@clawops/cli 1.7.9 → 2.0.1

package/dist/chunk-IVWP4QUJ.js

@@ -0,0 +1,901 @@
+#!/usr/bin/env node
+import {
+  inspectContainer
+} from "./chunk-3OLUJPCB.js";
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
+import {
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+import {
+  PUBLISH_INSPECT_CMD,
+  STATE_DIR_HOST_LINUX,
+  configPathForOS,
+  publishForRestart
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import {
+  chalk,
+  failure
+} from "./chunk-Q7NQY5HV.js";
+
+// src/cli/commands/monitor.ts
+import { defineCommand } from "citty";
+import process from "process";
+function formatUptime(startedAt) {
+  if (!startedAt) return "\u2014";
+  const ms = Date.now() - new Date(startedAt).getTime();
+  if (ms < 0 || isNaN(ms)) return "\u2014";
+  const totalSecs = Math.floor(ms / 1e3);
+  const mins = Math.floor(totalSecs / 60);
+  const hours = Math.floor(mins / 60);
+  const days = Math.floor(hours / 24);
+  if (days > 0) return `${days}d ${hours % 24}h ${mins % 60}m`;
+  if (hours > 0) return `${hours}h ${mins % 60}m`;
+  return `${mins}m ${totalSecs % 60}s`;
+}
+async function gatherSnapshot(session, signal, tailLines = 10) {
+  const DOCKER = "PATH=/usr/local/bin:/opt/homebrew/bin:$PATH docker";
+  const [inspectRaw, statsRaw, healthRaw, configRaw, diskRaw, logsRaw] = await Promise.all([
+    inspectContainer(
+      session,
+      "openclaw",
+      "{{.State.Status}}|{{.Config.Image}}|{{.State.StartedAt}}|{{.RestartCount}}",
+      signal,
+      DOCKER
+    ).then((r) => ({
+      // The dashboard shows a word per field; a refusal says so rather than borrowing
+      // "not found", which would claim the container is gone.
+      stdout: r.kind === "ok" ? r.value : r.kind === "missing" ? "not found|||0" : "unreachable|||0",
+      stderr: r.kind === "error" ? r.detail : "",
+      code: r.kind === "ok" ? 0 : 1
+    })),
+    execPrivileged(
+      session,
+      `${DOCKER} stats openclaw --no-stream --format '{{.MemUsage}}|{{.CPUPerc}}' 2>/dev/null || echo '\u2014|\u2014'`,
+      signal
+    ),
+    session.exec(probeCommand("live", GATEWAY_PORT), signal),
+    session.exec(
+      `cat ${configPathForOS("Linux")} 2>/dev/null || echo '{}'`,
+      signal
+    ),
+    session.exec(
+      // The state directory, not the service user's home: 2.0 keeps the SQLite database
+      // there, so that is the filesystem that fills up.
+      `df -h ${STATE_DIR_HOST_LINUX} 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
+      signal
+    ),
+    execPrivileged(
+      session,
+      `${DOCKER} logs openclaw -n ${tailLines} 2>&1 || echo '(no logs)'`,
+      signal
+    )
+  ]);
+  const inspectParts = inspectRaw.stdout.trim().split("|");
+  const status = inspectParts[0] ?? "not found";
+  const image = inspectParts[1] ?? "";
+  const startedAt = inspectParts[2] ?? "";
+  const restartCount = parseInt(inspectParts[3] ?? "0", 10) || 0;
+  const statsParts = statsRaw.stdout.trim().split("|");
+  const memUsage = statsParts[0] ?? "\u2014";
+  const cpuPct = statsParts[1] ?? "\u2014";
+  let version = "unknown";
+  let authMode = "unknown";
+  try {
+    const cfg = JSON.parse(configRaw.stdout.trim());
+    version = cfg.meta?.lastTouchedVersion ?? "unknown";
+    authMode = cfg.gateway?.auth?.mode ?? "unknown";
+  } catch {
+  }
+  return {
+    container: { status, image, startedAt, restartCount, memUsage, cpuPct },
+    gateway: {
+      // Judged on the payload: a status code cannot distinguish a healthy gateway from
+      // a path that fell through to the Control UI. See src/openclaw/health.ts.
+      reachable: interpretProbe("live", healthRaw.stdout).ok,
+      version,
+      authMode
+    },
+    disk: diskRaw.stdout.trim() || "\u2014",
+    logLines: logsRaw.stdout.split("\n").filter((l) => l.trim().length > 0),
+    capturedAt: /* @__PURE__ */ new Date()
+  };
+}
+function renderSnapshot(snap, opts) {
+  const noColor = opts.noColor ?? false;
+  const g = noColor ? { green: (s) => s, red: (s) => s, yellow: (s) => s, dim: (s) => s, bold: (s) => s } : chalk;
+  const LINE = "\u2500".repeat(68);
+  const timeStr = snap.capturedAt.toLocaleTimeString();
+  const header = `clawops monitor \u2014 ${opts.stackName}`;
+  const padding = Math.max(1, 68 - header.length - `updated ${timeStr}`.length);
+  const gatewayStr = snap.gateway.reachable ? g.green("\u2713 healthy") : g.red("\u2717 unreachable");
+  const containerStr = snap.container.status === "running" ? g.green("\u2713 running") : snap.container.status === "not found" ? g.red("\u2717 not found") : g.yellow(`\u26A0 ${snap.container.status}`);
+  const uptime = formatUptime(snap.container.startedAt);
+  const shortImage = snap.container.image.replace("ghcr.io/openclaw/openclaw:", "") || "\u2014";
+  const lines = [
+    g.bold(header) + " ".repeat(padding) + g.dim(`updated ${timeStr}`),
+    LINE,
+    "",
+    `  Stack       ${g.bold(opts.stackName)}`,
+    `  Gateway     ${gatewayStr}   version ${g.bold(snap.gateway.version)}   auth ${snap.gateway.authMode}`,
+    `  Container   ${containerStr}   ${g.dim(snap.container.image)}`,
+    `  Image tag   ${shortImage}   uptime ${uptime}`,
+    `  Resources   CPU ${snap.container.cpuPct}   Memory ${snap.container.memUsage}`,
+    `  Restarts    ${snap.container.restartCount}   Disk ${snap.disk}`,
+    "",
+    LINE,
+    ""
+  ];
+  if (opts.showLogs) {
+    lines.push(`  Logs (last ${snap.logLines.length} lines)`);
+    for (const l of snap.logLines) {
+      lines.push("  " + g.dim(l));
+    }
+    lines.push("");
+    lines.push(LINE);
+    lines.push("");
+  }
+  const logToggle = opts.showLogs ? "hide logs" : "show logs";
+  const backHint = opts.menuMode ? "  [s] back" : "";
+  lines.push(g.dim(`  [r] refresh  [l] ${logToggle}  [q] quit${backHint}     interval: ${opts.intervalSec}s`));
+  return lines.join("\n");
+}
+async function probeEntries() {
+  const { buildContext } = await import("./context-7EVC6W45.js");
+  const { getConfig } = await import("./store-SDUR52Z5.js");
+  const config = getConfig();
+  if (!config) return [];
+  return Promise.all(
+    Object.entries(config.stacks).map(async ([name, stackCfg]) => {
+      const base = {
+        name,
+        provider: stackCfg.provider,
+        region: stackCfg.region ?? "\u2014",
+        deployed: false
+      };
+      try {
+        const ctx = buildContext({ stack: name });
+        if (ctx.adapter.name === "local") {
+          return { ...base, deployed: !!ctx.localState };
+        }
+        const stack = await ctx.getStack();
+        const outputMap = await stack.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        return { ...base, deployed: !!outputs["publicIp"] };
+      } catch {
+        return base;
+      }
+    })
+  );
+}
+function renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete) {
+  const g = noColor ? { green: (s) => s, red: (s) => s, dim: (s) => s, bold: (s) => s, yellow: (s) => s } : chalk;
+  const visible = showAll ? entries : entries.filter((e) => e.deployed);
+  const totalDeployed = entries.filter((e) => e.deployed).length;
+  const heading = showAll ? "clawops monitor \u2014 all stacks" : "clawops monitor \u2014 select a stack";
+  const countStr = showAll ? `(${totalDeployed} of ${entries.length} running)` : `(${totalDeployed} running \xB7 ${entries.length - totalDeployed} not deployed)`;
+  const lines = ["", `  ${g.bold(heading)}   ${g.dim(countStr)}`, ""];
+  if (visible.length === 0) {
+    if (showAll) {
+      lines.push("  No stacks configured. Run `clawops init` to set up.");
+    } else {
+      lines.push("  No deployed stacks found.");
+      lines.push("");
+      lines.push(g.dim("  [a] show all  [q] quit"));
+    }
+  } else {
+    for (let i = 0; i < visible.length; i++) {
+      const e = visible[i];
+      const cursor = i === selectedIdx ? "\u25B6" : " ";
+      const nameStr = i === selectedIdx ? g.bold(e.name.padEnd(24)) : e.name.padEnd(24);
+      const provStr = e.provider.padEnd(10);
+      const regStr = e.region.padEnd(14);
+      const statusStr = showAll ? e.deployed ? g.green("\u2713 running") : g.dim("\u2717 not deployed") : "";
+      lines.push(`  ${cursor}  ${nameStr}${provStr}${regStr}${statusStr}`);
+    }
+    lines.push("");
+    if (confirmDelete !== null) {
+      lines.push(`  ${g.yellow(`Delete "${confirmDelete}" from registry?`)} [y/n]`);
+    } else {
+      const sel = visible[selectedIdx];
+      const canDelete = showAll && sel !== void 0 && !sel.deployed;
+      const toggleLabel = showAll ? "[a] running only" : "[a] show all";
+      const deleteHint = canDelete ? "  [d] delete" : "";
+      lines.push(g.dim(`  [\u2191\u2193] navigate  [enter] select${deleteHint}  ${toggleLabel}  [q] quit`));
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+async function deleteFromRegistry(name) {
+  const { requireConfig, setConfig } = await import("./store-SDUR52Z5.js");
+  const config = requireConfig();
+  const newStacks = { ...config.stacks };
+  delete newStacks[name];
+  const updated = { ...config, stacks: newStacks };
+  if (name === config.defaults.stack) {
+    updated.defaults = { ...config.defaults, stack: Object.keys(newStacks)[0] };
+  }
+  setConfig(updated);
+}
+async function runStackMenu(ac, setKeyHandler, noColor) {
+  process.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
+  const entries = await probeEntries();
+  if (ac.signal.aborted) return null;
+  let selectedIdx = 0;
+  let showAll = false;
+  let confirmDelete = null;
+  function visible() {
+    return showAll ? entries : entries.filter((e) => e.deployed);
+  }
+  function redraw() {
+    process.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
+  }
+  redraw();
+  return new Promise((resolve) => {
+    if (ac.signal.aborted) {
+      resolve(null);
+      return;
+    }
+    ac.signal.addEventListener("abort", () => resolve(null), { once: true });
+    setKeyHandler((key) => {
+      if (confirmDelete !== null) {
+        if (key === "y" || key === "Y") {
+          const nameToDelete = confirmDelete;
+          confirmDelete = null;
+          void deleteFromRegistry(nameToDelete).then(() => {
+            const idx = entries.findIndex((e) => e.name === nameToDelete);
+            if (idx !== -1) entries.splice(idx, 1);
+            const vis2 = visible();
+            selectedIdx = Math.min(selectedIdx, Math.max(0, vis2.length - 1));
+            redraw();
+          }).catch(() => {
+            redraw();
+          });
+        } else {
+          confirmDelete = null;
+          redraw();
+        }
+        return;
+      }
+      if (key === "q" || key === "") {
+        resolve(null);
+        return;
+      }
+      const vis = visible();
+      if (key === "\x1B[A") {
+        if (vis.length > 0) selectedIdx = Math.max(0, selectedIdx - 1);
+        redraw();
+      } else if (key === "\x1B[B") {
+        if (vis.length > 0) selectedIdx = Math.min(vis.length - 1, selectedIdx + 1);
+        redraw();
+      } else if (key === "\r") {
+        const sel = vis[selectedIdx];
+        if (sel?.deployed) resolve(sel.name);
+      } else if (key === "a") {
+        showAll = !showAll;
+        selectedIdx = 0;
+        redraw();
+      } else if (key === "d" && showAll) {
+        const sel = vis[selectedIdx];
+        if (sel !== void 0 && !sel.deployed) {
+          confirmDelete = sel.name;
+          redraw();
+        }
+      }
+    });
+  });
+}
+async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMode) {
+  let showLogs = true;
+  let lastSnapshot = null;
+  let refreshTimer = null;
+  function scheduleRefresh() {
+    refreshTimer = setTimeout(() => void doRefresh(), opts.intervalSec * 1e3);
+  }
+  function cancelRefresh() {
+    if (refreshTimer !== null) {
+      clearTimeout(refreshTimer);
+      refreshTimer = null;
+    }
+  }
+  function redraw() {
+    if (!lastSnapshot) return;
+    const out = renderSnapshot(lastSnapshot, {
+      stackName,
+      intervalSec: opts.intervalSec,
+      showLogs,
+      noColor: opts.noColor,
+      menuMode
+    });
+    process.stdout.write("\x1B[2J\x1B[H" + out + "\n");
+  }
+  async function doRefresh() {
+    cancelRefresh();
+    if (ac.signal.aborted) return;
+    try {
+      lastSnapshot = await gatherSnapshot(session, ac.signal, opts.tailLines);
+      redraw();
+    } catch (err) {
+      if (!ac.signal.aborted) {
+        process.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
+      }
+    }
+    if (!ac.signal.aborted) scheduleRefresh();
+  }
+  return new Promise((resolve) => {
+    if (ac.signal.aborted) {
+      resolve("quit");
+      return;
+    }
+    ac.signal.addEventListener("abort", () => {
+      cancelRefresh();
+      resolve("quit");
+    }, { once: true });
+    setKeyHandler((key) => {
+      if (key === "q" || key === "") {
+        ac.abort();
+        cancelRefresh();
+        resolve("quit");
+      } else if (key === "s" && menuMode) {
+        cancelRefresh();
+        resolve("back");
+      } else if (key === "r") {
+        void doRefresh();
+      } else if (key === "l") {
+        showLogs = !showLogs;
+        redraw();
+      }
+    });
+    void doRefresh();
+  });
+}
+var monitor_default = defineCommand({
+  meta: {
+    name: "monitor",
+    description: "Live dashboard: gateway health, container status, resource usage, log tail"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name (omit to pick from a list)" },
+    interval: { type: "string", description: "Refresh interval in seconds (default: 10)" },
+    tail: { type: "string", description: "Log lines to show (default: 10)" },
+    "no-color": { type: "boolean", description: "Disable ANSI colors (auto-detected when not a TTY)" }
+  },
+  async run({ args }) {
+    const intervalSec = Math.max(2, parseInt(String(args.interval ?? "10"), 10) || 10);
+    const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
+    const isTTY = Boolean(process.stdout.isTTY);
+    const noColor = Boolean(args["no-color"]) || !isTTY;
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const ac = new AbortController();
+    process.on("SIGINT", () => ac.abort());
+    process.on("SIGTERM", () => ac.abort());
+    if (args.stack) {
+      const ctx = buildContext(args);
+      let conn;
+      if (ctx.adapter.name === "local") {
+        if (!ctx.localState) {
+          failure("Stack is not bootstrapped. Run `clawops up` first.");
+          process.exit(4);
+        }
+        const ls = ctx.localState;
+        conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
+      } else {
+        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+        const stack = await ctx.getStack();
+        const outputMap = await stack.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        if (!outputs["publicIp"]) {
+          failure("Stack has no outputs. Run `clawops up` first.");
+          process.exit(4);
+        }
+        const base = extractBaseOutputs(outputs);
+        conn = ctx.adapter.getConnectionInfo({
+          ...base,
+          privateKeyPath: ctx.config.ssh.keyPath,
+          knownHostsPath: ctx.config.ssh.knownHostsPath
+        });
+      }
+      if (!isTTY) {
+        const { session: session2, release: release2 } = await acquireSession({ ...conn, signal: ac.signal });
+        try {
+          const snap = await gatherSnapshot(session2, ac.signal, tailLines);
+          process.stdout.write(
+            renderSnapshot(snap, { stackName: ctx.stackName, intervalSec, showLogs: true, noColor }) + "\n"
+          );
+        } finally {
+          release2();
+          drainPool();
+        }
+        return;
+      }
+      const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.setEncoding("utf8");
+      process.stdout.write("\x1B[?25l");
+      let keyHandler2 = () => {
+      };
+      process.stdin.on("data", (key) => keyHandler2(key));
+      try {
+        await runDashboard(session, ctx.stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
+          keyHandler2 = fn;
+        }, false);
+      } finally {
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stdout.write("\x1B[?25h\n");
+        release();
+        drainPool();
+      }
+      return;
+    }
+    if (!isTTY) {
+      failure("Pass --stack <name> or run in a TTY for interactive stack selection.");
+      process.exit(2);
+    }
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    process.stdout.write("\x1B[?25l");
+    let keyHandler = () => {
+    };
+    process.stdin.on("data", (key) => keyHandler(key));
+    try {
+      while (!ac.signal.aborted) {
+        const stackName = await runStackMenu(ac, (fn) => {
+          keyHandler = fn;
+        }, noColor);
+        if (!stackName || ac.signal.aborted) break;
+        const ctx = buildContext({ stack: stackName });
+        let conn = null;
+        if (ctx.adapter.name === "local") {
+          if (!ctx.localState) continue;
+          const ls = ctx.localState;
+          conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
+        } else {
+          try {
+            const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+            const stack = await ctx.getStack();
+            const outputMap = await stack.outputs();
+            const outputs = Object.fromEntries(
+              Object.entries(outputMap).map(([k, v]) => [k, v.value])
+            );
+            if (!outputs["publicIp"]) continue;
+            const base = extractBaseOutputs(outputs);
+            conn = ctx.adapter.getConnectionInfo({
+              ...base,
+              privateKeyPath: ctx.config.ssh.keyPath,
+              knownHostsPath: ctx.config.ssh.knownHostsPath
+            });
+          } catch {
+            continue;
+          }
+        }
+        if (!conn) continue;
+        const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
+        try {
+          const result = await runDashboard(session, stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
+            keyHandler = fn;
+          }, true);
+          if (result === "quit") break;
+        } finally {
+          release();
+          drainPool();
+        }
+      }
+    } finally {
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdout.write("\x1B[?25h\n");
+    }
+  }
+});
+
+// src/diagnostics/index.ts
+import process2 from "process";
+import { accessSync, mkdirSync, readFileSync, constants } from "fs";
+import ssh2 from "ssh2";
+import path from "path";
+async function runDiagnostics(opts = {}, deps = {}) {
+  const { getConfig, getConfigDir } = await import("./store-SDUR52Z5.js");
+  const config = getConfig();
+  const sections = [];
+  sections.push({ title: "Runtime", checks: await runtimeChecks(getConfigDir()) });
+  sections.push({
+    title: "Config",
+    checks: [
+      config ? { name: "Config file", status: "pass", detail: path.join(getConfigDir(), "config.json") } : { name: "Config file", status: "warn", detail: "not found", remedy: "run `clawops init`" }
+    ]
+  });
+  sections.push({ title: "SSH", checks: sshChecks(config) });
+  sections.push({ title: "Credentials", checks: await credentialChecks(config, opts.provider) });
+  sections.push({ title: "OpenClaw", checks: await versionChecks() });
+  const account = await accountChecks(config, opts.stack, opts.provider, opts.instanceType);
+  if (account.length > 0) sections.push({ title: "Cloud account", checks: account });
+  if (opts.stack) {
+    const open = deps.openSession ?? defaultOpenSession;
+    let handle;
+    try {
+      handle = await open(opts.stack, opts.signal);
+    } catch (err) {
+      sections.push({
+        title: "Remote health",
+        checks: [{ name: "Connection", status: "fail", detail: messageOf(err) }]
+      });
+    }
+    if (handle) {
+      try {
+        sections.push({
+          title: "Remote health",
+          checks: await remoteChecks(handle.session, opts.signal)
+        });
+        sections.push({
+          title: "Hardening",
+          checks: await hardeningChecks(handle.conn, opts.stack, opts.signal)
+        });
+      } finally {
+        handle.release();
+        const { drainPool } = await import("./pool-PIIKJ4L2.js");
+        drainPool();
+      }
+    }
+  }
+  return summarise(sections);
+}
+function summarise(sections) {
+  const counts = { pass: 0, fail: 0, warn: 0, info: 0 };
+  for (const s of sections) for (const c of s.checks) counts[c.status]++;
+  return { sections, ok: counts.fail === 0, counts };
+}
+async function runtimeChecks(configDir) {
+  const checks = [];
+  const nodeMajor = parseInt(process2.version.slice(1).split(".")[0] ?? "0", 10);
+  checks.push(
+    nodeMajor >= 22 ? { name: "Node.js", status: "pass", detail: process2.version } : {
+      name: "Node.js",
+      status: "fail",
+      detail: `${process2.version} (requires >=22)`,
+      remedy: "install Node.js 22 or later"
+    }
+  );
+  const pulumiHome = path.join(configDir, ".pulumi");
+  try {
+    mkdirSync(pulumiHome, { recursive: true });
+    checks.push({ name: "Pulumi home", status: "pass", detail: pulumiHome });
+  } catch {
+    checks.push({ name: "Pulumi home", status: "fail", detail: `${pulumiHome} (not writable)` });
+  }
+  const { pulumiCliStatus } = await import("./cli-WLD3EBEM.js");
+  const cli = await pulumiCliStatus(configDir);
+  checks.push(
+    cli.kind === "managed" ? { name: "Pulumi CLI", status: "pass", detail: `${cli.version} (${cli.root})` } : cli.kind === "path" ? { name: "Pulumi CLI", status: "pass", detail: `${cli.version} (on PATH)` } : {
+      name: "Pulumi CLI",
+      status: "warn",
+      detail: "not installed",
+      remedy: `clawops installs it into ${path.join(configDir, ".pulumi-cli")} on first apply`
+    }
+  );
+  const { passphraseStatus, passphrasePath } = await import("./passphrase-MJBE45N7.js");
+  const passphrase = passphraseStatus(configDir);
+  checks.push(
+    passphrase === "environment" ? {
+      name: "State passphrase",
+      status: "pass",
+      detail: "PULUMI_CONFIG_PASSPHRASE set in the environment"
+    } : passphrase === "stored" ? {
+      name: "State passphrase",
+      status: "pass",
+      detail: passphrasePath(configDir),
+      remedy: "back this up \u2014 without it, an existing stack's secrets cannot be read"
+    } : {
+      name: "State passphrase",
+      status: "warn",
+      detail: "not created yet",
+      remedy: `clawops generates one at ${passphrasePath(configDir)} on first apply`
+    }
+  );
+  return checks;
+}
+function expandHome(p) {
+  return p.replace(/^~/, process2.env["HOME"] ?? "~");
+}
+function sshChecks(config) {
+  if (!config) return [{ name: "SSH", status: "info", detail: "skipped \u2014 no config" }];
+  const checks = [];
+  const keyPath = expandHome(config.ssh.keyPath);
+  try {
+    accessSync(keyPath, constants.R_OK);
+    const parsed = ssh2.utils.parseKey(readFileSync(keyPath));
+    checks.push(
+      parsed instanceof Error ? {
+        name: "SSH key",
+        status: "fail",
+        detail: `${keyPath} (${parsed.message.toLowerCase()})`,
+        remedy: `clawops connects with ssh2. Regenerate in OpenSSH format: ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops`
+      } : { name: "SSH key", status: "pass", detail: `${keyPath} (${parsed.type})` }
+    );
+  } catch {
+    checks.push({
+      name: "SSH key",
+      status: "fail",
+      detail: `${keyPath} (not found or not readable)`
+    });
+  }
+  const knownHostsPath = expandHome(config.ssh.knownHostsPath);
+  try {
+    accessSync(knownHostsPath, constants.F_OK);
+    checks.push({ name: "known_hosts", status: "pass", detail: knownHostsPath });
+  } catch {
+    checks.push({
+      name: "known_hosts",
+      status: "warn",
+      detail: `${knownHostsPath} (does not exist \u2014 will be created on first connect)`
+    });
+  }
+  return checks;
+}
+async function providerCredentialCheck(provider, why) {
+  if (provider === "local") {
+    return { name: "local", status: "pass", detail: "SSH-only, no cloud credentials required" };
+  }
+  const { getProvider } = await import("./providers-FW6H6OPF.js");
+  try {
+    const adapter = getProvider(provider);
+    const result = await adapter.validateConfig();
+    return result.ok ? { name: provider, status: "pass", detail: why } : { name: provider, status: "fail", detail: result.errors.join("; ") };
+  } catch (err) {
+    return { name: provider, status: "fail", detail: messageOf(err) };
+  }
+}
+async function credentialChecks(config, provider) {
+  if (provider) return [await providerCredentialCheck(provider, "requested with --provider")];
+  if (!config) return [{ name: "Credentials", status: "info", detail: "skipped \u2014 no config" }];
+  const { getProvider } = await import("./providers-FW6H6OPF.js");
+  const checks = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
+    const providerName = stackCfg.provider;
+    if (seen.has(providerName)) continue;
+    seen.add(providerName);
+    if (providerName === "local") {
+      checks.push({
+        name: providerName,
+        status: "pass",
+        detail: `stack "${stackName}" (SSH-only, no cloud credentials required)`
+      });
+      continue;
+    }
+    try {
+      const adapter = getProvider(providerName);
+      const result = await adapter.validateConfig();
+      if (result.ok) {
+        checks.push({ name: providerName, status: "pass", detail: `stack "${stackName}"` });
+      } else {
+        for (const err of result.errors) {
+          checks.push({ name: providerName, status: "fail", detail: `stack "${stackName}" \u2014 ${err}` });
+        }
+      }
+    } catch (err) {
+      checks.push({
+        name: providerName,
+        status: "fail",
+        detail: `stack "${stackName}" \u2014 ${messageOf(err)}`
+      });
+    }
+  }
+  if (seen.size === 0) {
+    checks.push({ name: "Stacks", status: "warn", detail: "none configured", remedy: "run `clawops init`" });
+  }
+  return checks;
+}
+async function versionChecks() {
+  try {
+    const yaml = await import("./js-yaml-PTEEG4FO.js");
+    const { loadVersionSpec, describeRange } = await import("./versions-W5LRQCAJ.js");
+    const support = loadVersionSpec(yaml).support;
+    const checks = [
+      {
+        name: "Supported range",
+        status: "pass",
+        detail: `${describeRange(support)} (recommended ${support.recommended})`
+      }
+    ];
+    if (!support.max) {
+      checks.push({
+        name: "Upper bound",
+        status: "warn",
+        detail: "none declared \u2014 this line would accept any OpenClaw release"
+      });
+    }
+    return checks;
+  } catch (e) {
+    return [{ name: "Version matrix", status: "fail", detail: messageOf(e) }];
+  }
+}
+async function remoteChecks(session, signal) {
+  const checks = [];
+  const { containerStatus } = await import("./docker-3PDO4TS7.js");
+  const container = await containerStatus(session, "openclaw", signal);
+  checks.push(
+    container.error ? {
+      // "not found" would be a claim about the deployment. This is a claim about clawops.
+      name: "Container",
+      status: "fail",
+      detail: `could not ask docker \u2014 ${container.error}`,
+      remedy: "the SSH user may have been added to the docker group after this session opened"
+    } : container.status === "running" ? { name: "Container", status: "pass", detail: "running" } : { name: "Container", status: "fail", detail: container.status }
+  );
+  const imageResult = await execPrivileged(
+    session,
+    `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo ''`,
+    signal
+  );
+  const image = imageResult.stdout.trim();
+  const deployedVersion = image.includes(":") ? image.slice(image.lastIndexOf(":") + 1) : "";
+  if (deployedVersion) {
+    checks.push(await deployedVersionCheck(image, deployedVersion));
+  }
+  const probe = await session.exec(probeCommand("started", GATEWAY_PORT), signal);
+  const verdict = interpretProbe("started", probe.stdout);
+  checks.push(
+    verdict.ok ? { name: "Gateway", status: "pass", detail: `answering on 127.0.0.1:${GATEWAY_PORT}` } : { name: "Gateway", status: "fail", detail: verdict.reason ?? "not answering" }
+  );
+  const pubResult = await execPrivileged(session, PUBLISH_INSPECT_CMD, signal);
+  checks.push(
+    publishForRestart(pubResult.stdout) === "all" ? {
+      name: "Published",
+      status: "warn",
+      detail: "0.0.0.0 \u2014 the gateway port is open on every interface, serving plaintext HTTP",
+      remedy: 'front it with TLS, or set network.publishGateway to "loopback" and use `clawops tunnel`'
+    } : { name: "Published", status: "pass", detail: "127.0.0.1 only (reach it with `clawops tunnel`)" }
+  );
+  const diskResult = await session.exec(
+    // The state directory: 2.0's SQLite lives there, not in the user's home.
+    `df -h ${STATE_DIR_HOST_LINUX} 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
+    signal
+  );
+  const diskUsage = diskResult.stdout.trim();
+  if (diskUsage) {
+    const pct = parseInt(diskUsage.match(/^(\d+)%/)?.[1] ?? "0", 10);
+    checks.push({
+      name: "Disk",
+      status: pct >= 90 ? "fail" : pct >= 75 ? "warn" : "pass",
+      detail: diskUsage
+    });
+  } else {
+    checks.push({ name: "Disk", status: "warn", detail: "unable to determine disk usage" });
+  }
+  const logrotateResult = await session.exec(
+    `test -f /etc/logrotate.d/openclaw && echo 'configured' || echo 'not configured'`,
+    signal
+  );
+  checks.push(
+    logrotateResult.stdout.trim() === "configured" ? { name: "Log rotation", status: "pass", detail: "configured" } : { name: "Log rotation", status: "warn", detail: "not configured \u2014 logs may grow unbounded" }
+  );
+  return checks;
+}
+async function deployedVersionCheck(image, deployedVersion) {
+  const yaml = await import("./js-yaml-PTEEG4FO.js");
+  const { loadVersionSpec, checkVersion, isMovingTag } = await import("./versions-W5LRQCAJ.js");
+  const support = loadVersionSpec(yaml).support;
+  if (isMovingTag(deployedVersion)) {
+    return {
+      name: "Deployed",
+      status: "warn",
+      detail: `${image} (moving tag)`,
+      remedy: "pin an explicit version \u2014 a moving tag resolves to whatever is newest"
+    };
+  }
+  const check = checkVersion(deployedVersion, support);
+  if (check.ok) return { name: "Deployed", status: "pass", detail: `OpenClaw ${deployedVersion}` };
+  return {
+    name: "Deployed",
+    status: "fail",
+    detail: `OpenClaw ${deployedVersion} is not supported by this clawops line`,
+    remedy: check.error.reason === "too-old" ? "this clawops line requires OpenClaw 2.0 or later \u2014 run `clawops migrate` to move an existing 1.x deployment across, which preserves its state and device identity" : "upgrade clawops, or pin an OpenClaw version this line supports"
+  };
+}
+async function hardeningChecks(conn, stack, signal) {
+  try {
+    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-72JMRT4E.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const provider = buildContext({ stack }).adapter.name;
+    const modules = resolveModules(MODULE_CATALOG, void 0, provider);
+    const checks = [];
+    await withRemoteExec(conn, signal, async (exec) => {
+      for (const mod of modules) {
+        const result = await mod.check(exec);
+        if (result.status === "applied") {
+          checks.push({ name: mod.label, status: "pass", detail: "applied" });
+        } else if (result.status === "drifted") {
+          checks.push({ name: mod.label, status: "warn", detail: `drifted \u2014 ${result.detail}` });
+        } else if (result.status === "missing") {
+          checks.push({ name: mod.label, status: "info", detail: "not applied", remedy: "run `clawops harden`" });
+        }
+      }
+    });
+    return checks;
+  } catch (err) {
+    return [{ name: "Hardening checks", status: "fail", detail: messageOf(err) }];
+  }
+}
+async function defaultOpenSession(stack, signal) {
+  const { getConfig } = await import("./store-SDUR52Z5.js");
+  const { buildContext } = await import("./context-7EVC6W45.js");
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+  const config = getConfig();
+  if (!config) throw new Error("no config \u2014 run `clawops init`");
+  const ctx = buildContext({ stack });
+  const stackObj = await ctx.getStack();
+  const outputMap = await stackObj.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  const base = extractBaseOutputs(outputs);
+  const conn = ctx.adapter.getConnectionInfo({
+    ...base,
+    privateKeyPath: config.ssh.keyPath,
+    knownHostsPath: config.ssh.knownHostsPath
+  });
+  const { session, release } = await acquireSession({
+    host: conn.host,
+    port: conn.port,
+    user: conn.user,
+    privateKeyPath: conn.privateKeyPath,
+    knownHostsPath: conn.knownHostsPath,
+    signal
+  });
+  return { session, release, conn };
+}
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function accountChecks(config, stack, provider, instanceType) {
+  if (!config && !provider) return [];
+  const stackName = stack ?? config?.defaults?.stack;
+  const fromStack = stackName ? config?.stacks[stackName] : void 0;
+  const stackCfg = provider && fromStack?.provider !== provider ? Object.values(config?.stacks ?? {}).find((s) => s.provider === provider) : fromStack;
+  const providerName = provider ?? stackCfg?.provider;
+  if (!providerName || providerName === "local") return [];
+  try {
+    const { getProvider } = await import("./providers-FW6H6OPF.js");
+    const adapter = getProvider(providerName);
+    if (!adapter.preflight) return [];
+    const bucket = stackCfg ? bucketFromStateUrl(stackCfg.stateUrl) : void 0;
+    const results = await adapter.preflight({ region: stackCfg?.region, bucket, instanceType });
+    return results.map((r) => ({
+      name: r.label,
+      // A question clawops could not ask is not an answer about the account. Failing the
+      // report over a denied read permission would be as wrong as passing it.
+      status: r.unknown ? "warn" : r.ok ? "pass" : "fail",
+      detail: r.detail,
+      remedy: r.mutates ? `clawops setup can fix this: ${r.mutates}` : void 0
+    }));
+  } catch (err) {
+    return [{ name: "Account preflight", status: "warn", detail: messageOf(err) }];
+  }
+}
+function bucketFromStateUrl(stateUrl) {
+  if (!stateUrl) return void 0;
+  const match = /^[a-z0-9]+:\/\/([^/]+)/.exec(stateUrl);
+  return match?.[1];
+}
+
+export {
+  runDiagnostics,
+  formatUptime,
+  gatherSnapshot,
+  monitor_default
+};