@clawops/cli 2.0.0 → 2.0.1

package/dist/chunk-MC5ATCXS.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+// src/transport/known-hosts.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function hostEntryFor(host, port) {
+  return port === 22 ? host : `[${host}]:${port}`;
+}
+function parseKnownHosts(content) {
+  const entries = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    let parts = line.split(/\s+/);
+    let marker;
+    if (parts[0]?.startsWith("@")) {
+      marker = parts[0];
+      parts = parts.slice(1);
+    }
+    const hostField = parts[0];
+    if (!hostField) continue;
+    const hosts = hostField.split(",");
+    if (parts.length >= 3) {
+      entries.push({ hosts, keyType: parts[1], base64Key: parts[2], ...marker ? { marker } : {} });
+    } else if (parts.length === 2 && /^[0-9a-f]+$/i.test(parts[1] ?? "")) {
+      entries.push({ hosts, hexKey: parts[1], ...marker ? { marker } : {} });
+    }
+  }
+  return entries;
+}
+function hashedHostMatches(token, hostEntry) {
+  const parts = token.split("|");
+  if (parts.length !== 4 || parts[1] !== "1") return false;
+  const salt = parts[2];
+  const expected = parts[3];
+  if (!salt || !expected) return false;
+  try {
+    const actual = createHmac("sha1", Buffer.from(salt, "base64")).update(hostEntry).digest("base64");
+    const a = Buffer.from(actual);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function patternToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+var isPattern = (host) => host.includes("*") || host.includes("?");
+function entryMatchesHost(entry, hostEntry) {
+  let matched = false;
+  for (const host of entry.hosts) {
+    if (host.startsWith("|1|")) {
+      if (hashedHostMatches(host, hostEntry)) matched = true;
+      continue;
+    }
+    const negated = host.startsWith("!");
+    const pattern = negated ? host.slice(1) : host;
+    const hit = isPattern(pattern) ? patternToRegExp(pattern).test(hostEntry) : pattern === hostEntry;
+    if (hit) {
+      if (negated) return false;
+      matched = true;
+    }
+  }
+  return matched;
+}
+function verifyAgainstKnownHosts(content, host, port, key) {
+  const hostEntry = hostEntryFor(host, port);
+  const base64Key = key.toString("base64");
+  const hexKey = key.toString("hex");
+  let sawHost = false;
+  for (const entry of parseKnownHosts(content)) {
+    if (!entryMatchesHost(entry, hostEntry)) continue;
+    if (entry.marker === "@cert-authority") continue;
+    sawHost = true;
+    const matches = entry.base64Key ? entry.base64Key === base64Key : entry.hexKey?.toLowerCase() === hexKey.toLowerCase();
+    if (matches) return entry.marker === "@revoked" ? "mismatch" : "match";
+  }
+  return sawHost ? "mismatch" : "unknown";
+}
+function withoutHost(content, host, port) {
+  const hostEntry = hostEntryFor(host, port);
+  const kept = [];
+  for (const raw of content.split("\n")) {
+    const [entry] = parseKnownHosts(raw);
+    if (entry && entryMatchesHost(entry, hostEntry)) continue;
+    kept.push(raw);
+  }
+  return kept.join("\n");
+}
+function formatKnownHostsLine(host, port, keyType, key) {
+  return `${hostEntryFor(host, port)} ${keyType} ${key.toString("base64")}
+`;
+}
+function keyTypeFromBlob(key) {
+  if (key.length < 4) return void 0;
+  const len = key.readUInt32BE(0);
+  if (len === 0 || len > 64 || key.length < 4 + len) return void 0;
+  const type = key.subarray(4, 4 + len).toString("utf-8");
+  return /^[\x20-\x7e]+$/.test(type) ? type : void 0;
+}
+
+export {
+  verifyAgainstKnownHosts,
+  withoutHost,
+  formatKnownHostsLine,
+  keyTypeFromBlob
+};

package/dist/chunk-N4WZLWJ4.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+// src/providers/aws/sizes.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "t3.micro",
+  small: "t3.small",
+  medium: "t3.medium",
+  large: "t3.large",
+  gpu: "g4dn.xlarge"
+};
+var DEFAULT_ALIAS = "small";
+
+export {
+  INSTANCE_TYPE_MAP,
+  DEFAULT_ALIAS
+};

package/dist/{chunk-SBLQH2TJ.js → chunk-NUL5F6YV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/openclaw/logs.ts
-var GATEWAY_LOGS_PROBE = "docker exec openclaw openclaw logs --limit 1 >/dev/null 2>&1 && echo ok || echo no";
+var GATEWAY_LOGS_PROBE = "docker exec openclaw openclaw logs --limit 1 >/dev/null";
 function gatewayLogsCommand(opts) {
   return [
     "docker exec openclaw openclaw logs",

package/dist/chunk-RHOWYIWT.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+// src/providers/azure/cli-auth.ts
+import path from "path";
+import process from "process";
+import { readFileSync } from "fs";
+function azureConfigDir() {
+  const explicit = process.env["AZURE_CONFIG_DIR"];
+  if (explicit) return explicit;
+  const home = process.env["HOME"] ?? process.env["USERPROFILE"];
+  return home ? path.join(home, ".azure") : void 0;
+}
+function accountFromProfile(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body.replace(/^\uFEFF/, ""));
+  } catch {
+    return void 0;
+  }
+  const subscriptions = parsed?.subscriptions;
+  if (!Array.isArray(subscriptions)) return void 0;
+  const entries = subscriptions;
+  const chosen = entries.find((s) => s["isDefault"] === true) ?? entries[0];
+  if (!chosen) return void 0;
+  const id = typeof chosen["id"] === "string" ? chosen["id"] : void 0;
+  if (!id) return void 0;
+  const user = chosen["user"];
+  return {
+    subscriptionId: id,
+    name: typeof chosen["name"] === "string" ? chosen["name"] : id,
+    ...typeof user?.name === "string" ? { user: user.name } : {}
+  };
+}
+function azureCliAccount() {
+  const dir = azureConfigDir();
+  if (!dir) return void 0;
+  try {
+    return accountFromProfile(readFileSync(path.join(dir, "azureProfile.json"), "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function resolveSubscriptionId() {
+  return process.env["ARM_SUBSCRIPTION_ID"] ?? process.env["AZURE_SUBSCRIPTION_ID"] ?? azureCliAccount()?.subscriptionId;
+}
+
+export {
+  azureConfigDir,
+  accountFromProfile,
+  azureCliAccount,
+  resolveSubscriptionId
+};

package/dist/{chunk-WHJMKDV7.js → chunk-STLRHLLV.js}

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-YR3O2I3S.js";
+} from "./chunk-BSLIYB5Q.js";
 import {
-  buildContext
-} from "./chunk-LU2V3LXA.js";
+  buildContext,
+  loadAdapterModule
+} from "./chunk-5XT5IAJK.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
 import {
+  StateError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
 
@@ -19,12 +21,16 @@ function parseDiff(lines) {
   const create = [];
   const update = [];
   const del = [];
+  const seen = /* @__PURE__ */ new Set();
   for (const line of lines) {
     const m = PREVIEW_LINE_RE.exec(line.trimStart());
     if (!m) continue;
     const [, op, resourceType, name] = m;
+    const urn = `urn:pulumi:::clawops::${resourceType}::${name ?? ""}`;
+    if (seen.has(`${op}${urn}`)) continue;
+    seen.add(`${op}${urn}`);
     const ref = {
-      urn: `urn:pulumi:::clawops::${resourceType}::${name ?? ""}`,
+      urn,
       type: resourceType,
       ...name ? { name } : {}
     };
@@ -39,16 +45,33 @@ function parseDiff(lines) {
     totalChanges: create.length + update.length + del.length
   };
 }
+var INSTANCE_ALIASES = ["micro", "small", "medium", "large", "gpu"];
+function isInstanceAlias(value) {
+  return INSTANCE_ALIASES.includes(value);
+}
+async function resolveInstanceType(intent) {
+  const requested = intent.instanceType ?? "small";
+  if (!isInstanceAlias(requested)) {
+    process.stderr.write(
+      `[clawops] note: "${requested}" is not a clawops size (${INSTANCE_ALIASES.join(", ")}), so it is passed to ${intent.provider} as written.
+`
+    );
+    return requested;
+  }
+  const adapter = await loadAdapterModule(intent.provider);
+  return adapter.normalizeInstanceType(requested);
+}
+var parseDiffForTest = parseDiff;
 async function generatePlan(intent, _opts) {
   if (intent.provider === "local") {
     throw new UsageError(
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-3HUW57XH.js");
+  const { version } = await import("./package-5BCMEBTE.js");
   const config = getConfig();
-  const instanceType = intent.instanceType ?? "small";
-  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+  const instanceType = await resolveInstanceType(intent);
+  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
   const openclawVersion = await guardOpenclawVersion(
     intent.openclawVersion ?? await defaultOpenclawVersion()
   );
@@ -56,6 +79,13 @@ async function generatePlan(intent, _opts) {
     allowedSshCidrs: [],
     allowedGatewayCidrs: []
   };
+  const { resolvePublicKey } = await import("./ssh-key-DUO6OKOI.js");
+  const publicKey = config ? resolvePublicKey(expandHome(config.ssh.keyPath)) : void 0;
+  if (!publicKey) {
+    process.stderr.write(
+      "[clawops] warning: no SSH public key could be resolved" + (config ? ` from ${config.ssh.keyPath}` : " \u2014 no config file") + ". `clawops apply` will refuse this plan: the instance would have no way to admit anyone. Run `clawops doctor` to see why the key is unusable.\n"
+    );
+  }
   const stackName = intent.stackName;
   const region = intent.region ?? config?.stacks[stackName]?.region;
   const plan = {
@@ -74,15 +104,24 @@ async function generatePlan(intent, _opts) {
       instanceType,
       openclaw: { version: openclawVersion },
       network,
+      ...publicKey ? { ssh: { publicKey } } : {},
       ...intent.tags ? { tags: intent.tags } : {}
     }
   };
+  let stack;
   try {
     const ctx = buildContext({ stack: stackName, provider: intent.provider });
-    const stack = await ctx.getStack();
-    await stack.setConfig("instanceType", { value: instanceType });
-    if (region) await stack.setConfig("region", { value: region });
-    await stack.setConfig("openclawVersion", { value: openclawVersion });
+    stack = await ctx.getStack();
+  } catch (err) {
+    if (err instanceof UsageError) throw err;
+    throw new StateError(
+      `Cannot open the state backend for stack "${stackName}": ${messageOf(err)}
+A plan is only as good as the state it was computed against, so this is not a plan clawops will write. Check the stateUrl in ~/.clawops/config.json, and that the bucket or container exists and your credentials can read it.`
+    );
+  }
+  try {
+    const { writeStackConfig } = await import("./stack-config-R4SPSUQZ.js");
+    await writeStackConfig(stack, plan);
     const outputLines = [];
     const preview = await stack.preview({
       onOutput: (line) => outputLines.push(line)
@@ -98,6 +137,7 @@ async function generatePlan(intent, _opts) {
       plan.metadata.stackVersion = info.version;
     }
   } catch (err) {
+    if (err instanceof UsageError) throw err;
     process.stderr.write(
       `[clawops] Warning: preview failed, diff section omitted: ${err instanceof Error ? err.message : String(err)}
 `
@@ -108,7 +148,7 @@ async function generatePlan(intent, _opts) {
     throw new Error(`Generated plan failed schema validation:
 ${validation.errors.join("\n")}`);
   }
-  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-BOQRWX4F.js");
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-YVI3BJ55.js");
   const cfgCheck = await validatePlanConfig(plan);
   for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
 `);
@@ -133,8 +173,21 @@ Fix spec.openclaw.config before applying \u2014 the gateway reads it verbatim.`
 function planId() {
   return randomUUID().slice(0, 8);
 }
+function expandHome(p) {
+  return p.replace(/^~/, process.env["HOME"] ?? "~");
+}
+function messageOf(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  const lines = raw.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+  const explained = lines.find((l) => /(^|\s)error:/i.test(l));
+  if (explained) return explained.replace(/^.*?error:\s*/i, "");
+  return lines[0] ?? raw;
+}
 
 export {
+  INSTANCE_ALIASES,
+  isInstanceAlias,
+  parseDiffForTest,
   generatePlan,
   planId
 };

package/dist/chunk-V25QRZRB.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+// src/pulumi/passphrase.ts
+import path from "path";
+import process from "process";
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+var PASSPHRASE_FILE = "pulumi-passphrase";
+function passphrasePath(configDir) {
+  return path.join(configDir, "secrets", PASSPHRASE_FILE);
+}
+function passphraseInEnvironment() {
+  return Boolean(
+    process.env["PULUMI_CONFIG_PASSPHRASE"] ?? process.env["PULUMI_CONFIG_PASSPHRASE_FILE"]
+  );
+}
+function passphraseStatus(configDir) {
+  if (passphraseInEnvironment()) return "environment";
+  return existsSync(passphrasePath(configDir)) ? "stored" : "absent";
+}
+function ensurePassphrase(configDir) {
+  if (passphraseInEnvironment()) return void 0;
+  const file = passphrasePath(configDir);
+  if (existsSync(file)) {
+    const stored = readFileSync(file, "utf-8").trim();
+    if (stored !== "") return stored;
+  }
+  const dir = path.dirname(file);
+  mkdirSync(dir, { recursive: true });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  const generated = randomBytes(32).toString("base64url");
+  writeFileSync(file, generated + "\n", { encoding: "utf-8", mode: 384 });
+  return generated;
+}
+
+export {
+  PASSPHRASE_FILE,
+  passphrasePath,
+  passphraseInEnvironment,
+  passphraseStatus,
+  ensurePassphrase
+};

package/dist/chunk-VOEJYRIK.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import {
+  err,
+  ok
+} from "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/run-flags.ts
+var CONFIG_MOUNT_PATH = "/app/config.json";
+var GATEWAY_PORT = 18789;
+var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
+var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
+var PORT_PIN = `--port ${GATEWAY_PORT}`;
+var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
+var IMAGE_INSPECT_CMD = `docker inspect openclaw --format '{{.Config.Image}}'`;
+function imageForRestart(inspectStdout) {
+  const image = inspectStdout.trim();
+  if (!image || image.includes("Error") || !image.includes(":")) {
+    return err(
+      "No running OpenClaw container found, so there is no image version to reuse. Deploy one with `clawops up --openclaw-version <version>`. clawops does not fall back to `latest` or `stable` here: both now point at OpenClaw 2.0, which this release line does not support."
+    );
+  }
+  return ok(image);
+}
+function versionOf(image) {
+  return image.split(":")[1] ?? "unknown";
+}
+
+export {
+  GATEWAY_PORT,
+  IMAGE_INSPECT_CMD,
+  imageForRestart,
+  versionOf
+};

package/dist/{providers-2OABPW2E.js → chunk-VUFMZEIM.js}

@@ -17,8 +17,9 @@ function getProvider(name) {
 function listProviders() {
   return Array.from(registry.keys());
 }
+
 export {
+  registerProvider,
   getProvider,
-  listProviders,
-  registerProvider
+  listProviders
 };

package/dist/chunk-W3OLNNJW.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+// src/pulumi/cli.ts
+import path from "path";
+import process from "process";
+import { PulumiCommand } from "@pulumi/pulumi/automation";
+function pulumiCliRoot(configDir) {
+  return path.join(configDir, ".pulumi-cli");
+}
+function versionOf(cmd) {
+  return cmd.version ? `v${cmd.version.toString()}` : "unknown version";
+}
+async function pulumiCliStatus(configDir) {
+  const root = pulumiCliRoot(configDir);
+  try {
+    return { kind: "managed", version: versionOf(await PulumiCommand.get({ root })), root };
+  } catch {
+  }
+  try {
+    return { kind: "path", version: versionOf(await PulumiCommand.get()) };
+  } catch {
+    return { kind: "missing" };
+  }
+}
+async function ensurePulumiCli(opts) {
+  const root = pulumiCliRoot(opts.configDir);
+  const status = await pulumiCliStatus(opts.configDir);
+  if (status.kind === "managed") return await PulumiCommand.get({ root });
+  if (status.kind === "path") return await PulumiCommand.get();
+  const announce = opts.onInstall ?? defaultAnnounce;
+  announce({ root });
+  try {
+    return await PulumiCommand.install({ root });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `could not install the Pulumi CLI into ${root}: ${reason}
+Install it yourself and clawops will use it: https://www.pulumi.com/docs/install/`
+    );
+  }
+}
+function defaultAnnounce({ root }) {
+  process.stderr.write(`Pulumi CLI not found \u2014 installing it into ${root} (one time).
+`);
+}
+
+export {
+  pulumiCliRoot,
+  pulumiCliStatus,
+  ensurePulumiCli
+};

package/dist/cli-WLD3EBEM.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  ensurePulumiCli,
+  pulumiCliRoot,
+  pulumiCliStatus
+} from "./chunk-W3OLNNJW.js";
+export {
+  ensurePulumiCli,
+  pulumiCliRoot,
+  pulumiCliStatus
+};

package/dist/cli-auth-GD5SK7JU.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import {
+  accountFromProfile,
+  azureCliAccount,
+  azureConfigDir,
+  resolveSubscriptionId
+} from "./chunk-RHOWYIWT.js";
+export {
+  accountFromProfile,
+  azureCliAccount,
+  azureConfigDir,
+  resolveSubscriptionId
+};