@clawops/cli 1.7.9 → 2.0.1

package/spec/openclaw-versions.yaml

@@ -1,37 +1,117 @@
 # OpenClaw Version Compatibility Matrix
 # Enforced by src/openclaw/versions.ts — `doctor`, `plan`, `up` and `apply` refuse
-# an OpenClaw version outside this range. Update via /openclaw-config skill.
+# an OpenClaw version outside `support`. Update via /openclaw-config skill.
 #
-# This is the clawops 1.x line: it supports the pre-2.0 OpenClaw runtime contract only.
-# OpenClaw 2026.8.1 ("OpenClaw 2.0") changed that contract — state moved into SQLite,
-# config moved to a writable path, and provider plugins became install-gated. Deploying
-# it from this line produces a crash-looping gateway (exit 78). Use clawops 2.x instead.
+# `support.min`, `support.max` and `support.recommended` are LIVE. Nothing reads
+# `runtime`, `quirks`, `incompatible` or `tested`; they are documentation and the
+# machine-readable source WO-38 will build the runtime contract from.
 
 version: 1
 
-# Minimum and maximum versions clawops supports
+# Which release line this checkout is. Flipping this to "2.x" is gated by a test
+# (tests/openclaw/line-interlock.test.ts) that fails until the runtime actually
+# implements the 2.0 contract — see `runtime` below.
+line: "2.x"
+
+# Minimum and maximum versions clawops supports.
+#
+# Flipped to the 2.x range by WO-40, once the runtime could actually honour it: the
+# config directory is mounted writable, provisioning writes gateway.mode, and
+# --allow-unconfigured is gone. tests/openclaw/line-interlock.test.ts holds those
+# together — setting `line: "2.x"` fails until each is true.
+#
+# The floor is 2026.9.2 rather than 2026.9.1 because the official Bedrock provider
+# plugin declares "requires plugin API >=2026.9.2" and refuses to install on 9.1.
 support:
-  min: "2026.4.5"
-  max: "2026.7.1-2"   # last release before the 2.0 runtime contract
-  recommended: "2026.7.1-2"
+  min: "2026.9.2"
+  max: ""              # no upper bound: this line tracks the 2.x runtime contract
+  recommended: "2026.9.2"
+
+# The 2.0 runtime contract, measured against ghcr.io/openclaw/openclaw:2026.9.1.
+# See docs/spikes/SP-10-openclaw-2.0-startup-contract.md for how each was observed.
+# WO-38 consumes this; today nothing reads it.
+runtime:
+  # 2026.9.2, not 2026.9.1: the official Bedrock provider plugin declares
+  # "requires plugin API >=2026.9.2" and refuses to install on 9.1. SP-10b §3.
+  targetMin: "2026.9.2"
+  image: "ghcr.io/openclaw/openclaw"
+  variants: [standard, slim, browser]   # `-slim`, `-browser` tag suffixes
+  # Mount the config DIRECTORY, never the file. OpenClaw writes config by atomic
+  # rename, and renaming over a bind-mounted file fails EBUSY regardless of :ro.
+  # Verified — `plugins install` cannot record a plugin against a file mount. SP-10b §4.
+  configDir: "/cfg"
+  configPath: "/cfg/config.json"        # via OPENCLAW_CONFIG_PATH
+  # The OpenClaw release spec/openclaw-2.0.config.schema.json was captured from.
+  # Validation compares the deployed version against this: a config key the schema
+  # does not know is an ERROR on an older-or-equal runtime and a WARNING on a newer
+  # one, because there it more likely means the schema is stale than the config wrong.
+  configSchemaCapturedFrom: "2026.9.2"
+  configMount: directory
+  gatewayPort: 18789
+  env:
+    configPath: OPENCLAW_CONFIG_PATH
+    token: OPENCLAW_GATEWAY_TOKEN
+    stateDir: OPENCLAW_STATE_DIR
+  startup:
+    # Verified: without gateway.mode the gateway exits 78 unless --allow-unconfigured
+    # is passed. Setting the mode is the supported answer; the flag exists to bypass a
+    # check for "suspicious or clobbered config", so clawops should not rely on it.
+    requiresGatewayMode: true
+    gatewayMode: "local"          # schema accepts local|remote
+    allowUnconfigured: false      # what 2.x should pass — i.e. do not pass it
+    exitCodeOnBlockedStart: 78
+  # Provider plugins are not all bundled. A configured-but-missing plugin is
+  # auto-installed from ClawHub on first boot, after which the gateway refuses to
+  # report ready and exits 1 ("startup convergence"); the next boot succeeds.
+  # The install lands in the container's writable layer, so it is lost — and refetched —
+  # on every container replacement, which is what clawops's restart path does.
+  plugins:
+    bundledSourceRoot: "/app/dist/extensions"
+    # Two different paths, and the difference matters. An explicit
+    # `openclaw plugins install` lands beside the config, so it persists with the
+    # config directory clawops already keeps as host state — no extra volume. The
+    # startup auto-install instead writes to the container's writable layer, which is
+    # lost on every container replacement. Pre-install; do not rely on auto-install.
+    installedPath: "<configDir>/extensions"
+    autoInstallPath: "/app/npm/projects"   # ephemeral — container layer
+    convergenceRestartRequired: true       # only when auto-installing at startup
+    # Reconcile configured providers against loaded plugins. `plugins doctor` is NOT
+    # usable for this: it never names a missing provider and exits 1 on duplicate-id
+    # warnings during normal operation. SP-10b §1-2.
+    verifyCommand: "openclaw plugins list --json"
+    verifyField: providerIds
+    providers:
+      amazon-bedrock:
+        bundled: false
+        package: "@openclaw/amazon-bedrock-provider"
+        install: "openclaw plugins install clawhub:@openclaw/amazon-bedrock-provider"
+        requiresEgress: true
+        # With no egress the gateway starts cleanly WITHOUT the provider — a healthy
+        # deployment missing the model backend it was configured for. clawops defaults
+        # to deny-all egress, so this is the default outcome, not an edge case.
+        silentlyAbsentWithoutEgress: true
+      ollama:    { bundled: true }
+      anthropic: { bundled: true }
+      openai:    { bundled: true }
 
-# Provider-specific quirks discovered through testing
 quirks:
-  - id: aws-bedrock-aws-profile
+  - id: openclaw-2-provider-plugin-install
     description: |
-      OpenClaw 2026.4.5+ ignores `auth: "aws-sdk"` in openclaw.json's Bedrock
-      provider config. Instead, AWS_PROFILE must be set in the systemd
-      EnvironmentFile so the AWS SDK resolves credentials via IMDS.
+      OpenClaw 2.0 does not bundle every model provider. A provider named in
+      models.providers whose plugin is missing is installed from ClawHub during
+      startup convergence; the gateway then exits 1 and requires one restart. With no
+      network egress the gateway starts successfully but without the provider.
     affected:
-      versions: ">=2026.4.5"
+      versions: ">=2026.8.1"
       providers: [aws]
       configs: [openclaw.models.providers.amazon-bedrock]
     workaround: |
-      AWS adapter MUST emit BOTH:
-      1. openclaw.json with `auth: "aws-sdk"` (for older versions, ignored by newer)
-      2. systemd EnvironmentFile with `AWS_PROFILE=default` (or the profile name)
-      Adapter should test the rendered systemd unit includes the EnvironmentFile.
-    discoveredFrom: aws-samples/sample-OpenClaw-on-AWS-with-Bedrock troubleshooting docs
+      Install the plugin at provisioning time, before the first gateway start:
+        openclaw plugins install clawhub:@openclaw/amazon-bedrock-provider
+      and/or persist /app/npm/projects so a container replacement does not refetch it.
+      Verify after deploy rather than trusting a healthy gateway: a missing provider
+      does not fail the health check.
+    discoveredFrom: docs/spikes/SP-10-openclaw-2.0-startup-contract.md
 
   - id: pnpm-pulumi-hoisting
     description: |
@@ -43,25 +123,34 @@ quirks:
       providers: ["*"]
     workaround: See docs/decisions/0003-pulumi-pnpm.md
 
-# Tested combinations — populated by CI matrix
+# Retired: `aws-bedrock-aws-profile` (AWS_PROFILE in the systemd EnvironmentFile).
+# It described a native/systemd install; clawops is Docker-only per ADR 0013, and on
+# 2.0 the Bedrock question is plugin installation, not credential resolution.
+
 tested:
   - openclawVersion: "2026.4.5"
     providers: [aws, gcp, local]
     nodeVersions: ["20.x", "22.x"]
     lastTestedAt: "2026-04-15"
+  - openclawVersion: "2026.9.1"
+    providers: []          # runtime contract characterised only; no deploy path yet
+    nodeVersions: ["24.x"]
+    lastTestedAt: "2026-09-06"
+    notes: "SP-10 — startup contract, plugin install behaviour, config schema capture."
 
-# Known incompatible combinations
 incompatible:
   - openclawVersionRange: "<2026.4.5"
     reason: "Below clawops's declared minimum support. Earlier OpenClaw versions used different config paths and channel registration semantics."
   - openclawVersionRange: ">=2026.8.1"
     reason: |
-      OpenClaw 2.0 changed the container runtime contract. Verified against 2026.8.1:
-        - No gateway token on first boot => "Refusing to bind gateway to auto without
-          auth", exit 78, crash-loop under --restart unless-stopped.
+      OpenClaw 2.0 changed the container runtime contract. Verified on 2026.8.1 and
+      re-verified on 2026.9.1:
+        - Without gateway.mode the gateway exits 78 unless --allow-unconfigured is
+          passed; clawops writes no mode.
         - Sessions, transcripts and credentials moved into SQLite under the state
           directory, which this line does not mount => total state loss on restart.
-        - Provider plugins (Bedrock included) are install-gated; a configured but
-          uninstalled provider prevents startup entirely.
+        - Provider plugins are not all bundled. A configured provider whose plugin is
+          missing is fetched at startup, costing a convergence restart — or is silently
+          absent when egress is denied, which is clawops's default.
       Use clawops 2.x, which targets OpenClaw >= 2026.9.1.
     useInstead: "@clawops/cli@2"

package/spec/providers.schema.json

@@ -4,25 +4,46 @@
   "title": "ProviderAdapter",
   "description": "Contract every cloud provider adapter must satisfy. Source of truth for src/providers/types.ts (generated). Per R-meta-1.",
   "type": "object",
-  "required": ["name", "credentials", "regions", "instanceTypes", "stateBackend", "operations"],
+  "required": [
+    "name",
+    "credentials",
+    "regions",
+    "instanceTypes",
+    "stateBackend",
+    "operations"
+  ],
   "properties": {
     "name": {
       "type": "string",
-      "enum": ["aws", "gcp", "azure", "local"],
+      "enum": [
+        "aws",
+        "gcp",
+        "azure",
+        "local"
+      ],
       "description": "Lowercase provider id"
     },
     "credentials": {
       "type": "object",
       "description": "How this provider's credentials are sourced (R6: never in tool args)",
-      "required": ["source"],
+      "required": [
+        "source"
+      ],
       "properties": {
         "source": {
-          "enum": ["env", "cli-profile", "file", "instance-metadata"],
+          "enum": [
+            "env",
+            "cli-profile",
+            "file",
+            "instance-metadata"
+          ],
           "description": "Credential resolution mechanism"
         },
         "envVars": {
           "type": "array",
-          "items": { "type": "string" },
+          "items": {
+            "type": "string"
+          },
           "description": "Environment variables checked at startup (e.g., AWS_PROFILE)"
         },
         "profileName": {
@@ -37,7 +58,9 @@
     },
     "regions": {
       "type": "array",
-      "items": { "type": "string" },
+      "items": {
+        "type": "string"
+      },
       "minItems": 1,
       "description": "Region IDs supported by this adapter (e.g., us-east-1, us-central1, eastus)"
     },
@@ -47,28 +70,59 @@
       "description": "Mapping from clawops aliases to provider-native instance types",
       "items": {
         "type": "object",
-        "required": ["alias", "nativeId", "vcpu", "memoryGB", "arch"],
+        "required": [
+          "alias",
+          "nativeId",
+          "vcpu",
+          "memoryGB",
+          "arch"
+        ],
         "properties": {
           "alias": {
-            "enum": ["micro", "small", "medium", "large", "gpu"],
+            "enum": [
+              "micro",
+              "small",
+              "medium",
+              "large",
+              "gpu"
+            ],
             "description": "Normalized clawops alias"
           },
           "nativeId": {
             "type": "string",
             "description": "Provider-native instance type (e.g., t3.small, e2-small, Standard_B2s)"
           },
-          "vcpu": { "type": "number", "minimum": 1 },
-          "memoryGB": { "type": "number", "minimum": 0.5 },
-          "arch": { "enum": ["x86_64", "arm64"] }
+          "vcpu": {
+            "type": "number",
+            "minimum": 1
+          },
+          "memoryGB": {
+            "type": "number",
+            "minimum": 0.5
+          },
+          "arch": {
+            "enum": [
+              "x86_64",
+              "arm64"
+            ]
+          }
         }
       }
     },
     "stateBackend": {
       "type": "object",
-      "required": ["scheme", "urlPattern"],
+      "required": [
+        "scheme",
+        "urlPattern"
+      ],
       "properties": {
         "scheme": {
-          "enum": ["s3", "gs", "azblob", "file"],
+          "enum": [
+            "s3",
+            "gs",
+            "azblob",
+            "file"
+          ],
           "description": "Pulumi state backend URL scheme"
         },
         "urlPattern": {
@@ -79,41 +133,122 @@
     },
     "operations": {
       "type": "object",
-      "required": ["provision", "destroy", "describe"],
+      "required": [
+        "provision",
+        "destroy",
+        "describe"
+      ],
       "description": "Lifecycle operations every adapter must implement",
       "properties": {
-        "provision": { "$ref": "#/$defs/Operation" },
-        "destroy": { "$ref": "#/$defs/Operation" },
-        "describe": { "$ref": "#/$defs/Operation" },
-        "refresh": { "$ref": "#/$defs/Operation" }
+        "provision": {
+          "$ref": "#/$defs/Operation"
+        },
+        "destroy": {
+          "$ref": "#/$defs/Operation"
+        },
+        "describe": {
+          "$ref": "#/$defs/Operation"
+        },
+        "refresh": {
+          "$ref": "#/$defs/Operation"
+        }
       }
     },
     "supportedOpenclawVersions": {
       "type": "object",
       "properties": {
-        "min": { "type": "string", "description": "semver, e.g., 2026.4.5" },
-        "max": { "type": "string" },
-        "tested": { "type": "array", "items": { "type": "string" } }
+        "min": {
+          "type": "string",
+          "description": "semver, e.g., 2026.4.5"
+        },
+        "max": {
+          "type": "string"
+        },
+        "tested": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "preflight": {
+      "type": "object",
+      "description": "Account-level setup a provider needs before anything can be provisioned, and which clawops can detect and offer to fix. These are not infrastructure \u2014 enabling an API or creating a state bucket happens outside the Pulumi program, because the state backend must exist before Pulumi can run at all. Detected in `doctor`; the setup wizard PROMPTS before changing anything in someone's cloud account.",
+      "required": [
+        "checks"
+      ],
+      "properties": {
+        "checks": {
+          "type": "array",
+          "description": "What must be true before a first deploy.",
+          "items": {
+            "$ref": "#/$defs/PreflightCheck"
+          }
+        }
       }
     }
   },
   "$defs": {
     "Operation": {
       "type": "object",
-      "required": ["estimatedDurationSec", "idempotent", "destructive"],
+      "required": [
+        "estimatedDurationSec",
+        "idempotent",
+        "destructive"
+      ],
       "properties": {
         "estimatedDurationSec": {
           "type": "object",
           "properties": {
-            "min": { "type": "number" },
-            "max": { "type": "number" },
-            "median": { "type": "number" }
+            "min": {
+              "type": "number"
+            },
+            "max": {
+              "type": "number"
+            },
+            "median": {
+              "type": "number"
+            }
           },
           "description": "Used by R12 to pick streaming tier (sync / progress / Tasks)"
         },
-        "idempotent": { "type": "boolean" },
-        "destructive": { "type": "boolean" },
-        "supportsCancellation": { "type": "boolean", "default": true }
+        "idempotent": {
+          "type": "boolean"
+        },
+        "destructive": {
+          "type": "boolean"
+        },
+        "supportsCancellation": {
+          "type": "boolean",
+          "default": true
+        }
+      }
+    },
+    "PreflightCheck": {
+      "type": "object",
+      "required": [
+        "id",
+        "label",
+        "remediable"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "Stable kebab-case id, e.g. `compute-api-enabled`"
+        },
+        "label": {
+          "type": "string",
+          "description": "What is being checked, in the operator's terms"
+        },
+        "remediable": {
+          "type": "boolean",
+          "description": "Whether clawops can fix it after asking. False means it can only be reported \u2014 a missing permission or an unpaid billing account is not clawops's to resolve."
+        },
+        "mutates": {
+          "type": "string",
+          "description": "What the fix changes in the operator's account, shown in the prompt. Required when remediable is true: consent to 'fix it' is not consent to something unnamed."
+        }
       }
     }
   }

package/dist/apply-F3KY2HTB.js

@@ -1,17 +0,0 @@
-#!/usr/bin/env node
-import {
-  applyPlan
-} from "./chunk-35WVQY3X.js";
-import "./chunk-6ZFIFDBJ.js";
-import "./chunk-BOPSG2LI.js";
-import "./chunk-6X45DDGH.js";
-import "./chunk-SEZMVVAS.js";
-import "./chunk-P5LKWRPL.js";
-import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
-import "./chunk-KGXPLI7W.js";
-export {
-  applyPlan
-};

package/dist/automation-RULUSJBW.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-import {
-  getConfigDir
-} from "./chunk-CX5SL5HP.js";
-import "./chunk-KGXPLI7W.js";
-
-// src/pulumi/automation.ts
-import path from "path";
-import { LocalWorkspace } from "@pulumi/pulumi/automation";
-async function getOrCreateStack(opts) {
-  const configDir = opts.configDir ?? getConfigDir();
-  return await LocalWorkspace.createOrSelectStack(
-    {
-      stackName: opts.stack,
-      projectName: "clawops",
-      program: opts.program
-    },
-    {
-      pulumiHome: path.join(configDir, ".pulumi"),
-      envVars: {
-        PULUMI_BACKEND_URL: opts.stateUrl,
-        PULUMI_SKIP_UPDATE_CHECK: "1"
-        // R6: cloud credentials inherited from process.env, never set here
-      }
-    }
-  );
-}
-export {
-  getOrCreateStack
-};