@clawops/cli 2.0.0 → 2.0.1

package/spec/mcp-tools.yaml

@@ -291,10 +291,29 @@ tools:
         description: Defaults to provider configured for this stack
       region: { type: string, optional: true }
       instanceType:
-        type: enum
-        values: [micro, small, medium, large, gpu]
+        type: string
         optional: true
         default: small
+        description: |
+          A clawops size (micro|small|medium|large|gpu) or a provider-native machine type.
+          Not an enum: Azure offers SKU families per subscription, and an account offered
+          none of the five sizes clawops names would otherwise have no way to deploy.
+      sshCidr:
+        type: string
+        optional: true
+        description: |
+          CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for the caller's own
+          address. Omitted means none, and nothing will be able to connect — including
+          every clawops day-two command.
+      gatewayCidr:
+        type: string
+        optional: true
+        description: CIDR(s) allowed to reach the gateway port. Requires publishGateway=all.
+      publishGateway:
+        type: enum
+        values: [loopback, all]
+        optional: true
+        description: Which interface the gateway binds. 'all' serves plaintext HTTP.
       openclawVersion: { type: string, optional: true, description: "semver or 'stable'/'dev'" }
       dryRun: { type: boolean, optional: true, default: false }
     output:

package/spec/models.yaml

@@ -60,9 +60,20 @@ providers:
   - id: bedrock
     displayName: AWS Bedrock
     credentialSource: aws-profile
-    # No API key — uses EC2 instance role (AmazonBedrockFullAccess) via IMDS.
-    # The Pulumi program attaches AmazonBedrockFullAccess to the instance profile
-    # and passes AWS_PROFILE=default into the container via --env-file.
+    # Bedrock is a plugin provider, so OpenClaw does not resolve its transport on its own:
+    # without `api` the call routes through the OpenAI-compatible transport and fails with
+    # "requires an explicit base URL". Bundled providers do resolve it — `anthropic` selects
+    # anthropic-messages with nothing in the config — so this key is set here and nowhere
+    # else. See docs/spikes/SP-12-bedrock-config-shape.md.
+    api: bedrock-converse-stream
+    # No API key — credentials come from the EC2 instance role via IMDS, resolved by the AWS
+    # SDK chain at call time. The old `AWS_PROFILE=default` env-file mechanism is obsolete
+    # (SP-08); so is the `auth: "aws-sdk"` marker as a *requirement* — Bedrock was reached
+    # with it absent (SP-12 §4) — though clawops still writes it to document the auth route.
+    #
+    # modelId below is the FOUNDATION model id. Bedrock refuses these for on-demand
+    # inference; clawops resolves each to a regional inference profile at plan time, because
+    # the right profile depends on the deployment region and cannot be written down here.
     iamPolicy: AmazonBedrockFullAccess
     iamNote: >
       Credentials are provided by the EC2 instance role. clawops attaches

package/spec/providers.schema.json

@@ -4,25 +4,46 @@
   "title": "ProviderAdapter",
   "description": "Contract every cloud provider adapter must satisfy. Source of truth for src/providers/types.ts (generated). Per R-meta-1.",
   "type": "object",
-  "required": ["name", "credentials", "regions", "instanceTypes", "stateBackend", "operations"],
+  "required": [
+    "name",
+    "credentials",
+    "regions",
+    "instanceTypes",
+    "stateBackend",
+    "operations"
+  ],
   "properties": {
     "name": {
       "type": "string",
-      "enum": ["aws", "gcp", "azure", "local"],
+      "enum": [
+        "aws",
+        "gcp",
+        "azure",
+        "local"
+      ],
       "description": "Lowercase provider id"
     },
     "credentials": {
       "type": "object",
       "description": "How this provider's credentials are sourced (R6: never in tool args)",
-      "required": ["source"],
+      "required": [
+        "source"
+      ],
       "properties": {
         "source": {
-          "enum": ["env", "cli-profile", "file", "instance-metadata"],
+          "enum": [
+            "env",
+            "cli-profile",
+            "file",
+            "instance-metadata"
+          ],
           "description": "Credential resolution mechanism"
         },
         "envVars": {
           "type": "array",
-          "items": { "type": "string" },
+          "items": {
+            "type": "string"
+          },
           "description": "Environment variables checked at startup (e.g., AWS_PROFILE)"
         },
         "profileName": {
@@ -37,7 +58,9 @@
     },
     "regions": {
       "type": "array",
-      "items": { "type": "string" },
+      "items": {
+        "type": "string"
+      },
       "minItems": 1,
       "description": "Region IDs supported by this adapter (e.g., us-east-1, us-central1, eastus)"
     },
@@ -47,28 +70,59 @@
       "description": "Mapping from clawops aliases to provider-native instance types",
       "items": {
         "type": "object",
-        "required": ["alias", "nativeId", "vcpu", "memoryGB", "arch"],
+        "required": [
+          "alias",
+          "nativeId",
+          "vcpu",
+          "memoryGB",
+          "arch"
+        ],
         "properties": {
           "alias": {
-            "enum": ["micro", "small", "medium", "large", "gpu"],
+            "enum": [
+              "micro",
+              "small",
+              "medium",
+              "large",
+              "gpu"
+            ],
             "description": "Normalized clawops alias"
           },
           "nativeId": {
             "type": "string",
             "description": "Provider-native instance type (e.g., t3.small, e2-small, Standard_B2s)"
           },
-          "vcpu": { "type": "number", "minimum": 1 },
-          "memoryGB": { "type": "number", "minimum": 0.5 },
-          "arch": { "enum": ["x86_64", "arm64"] }
+          "vcpu": {
+            "type": "number",
+            "minimum": 1
+          },
+          "memoryGB": {
+            "type": "number",
+            "minimum": 0.5
+          },
+          "arch": {
+            "enum": [
+              "x86_64",
+              "arm64"
+            ]
+          }
         }
       }
     },
     "stateBackend": {
       "type": "object",
-      "required": ["scheme", "urlPattern"],
+      "required": [
+        "scheme",
+        "urlPattern"
+      ],
       "properties": {
         "scheme": {
-          "enum": ["s3", "gs", "azblob", "file"],
+          "enum": [
+            "s3",
+            "gs",
+            "azblob",
+            "file"
+          ],
           "description": "Pulumi state backend URL scheme"
         },
         "urlPattern": {
@@ -79,41 +133,122 @@
     },
     "operations": {
       "type": "object",
-      "required": ["provision", "destroy", "describe"],
+      "required": [
+        "provision",
+        "destroy",
+        "describe"
+      ],
       "description": "Lifecycle operations every adapter must implement",
       "properties": {
-        "provision": { "$ref": "#/$defs/Operation" },
-        "destroy": { "$ref": "#/$defs/Operation" },
-        "describe": { "$ref": "#/$defs/Operation" },
-        "refresh": { "$ref": "#/$defs/Operation" }
+        "provision": {
+          "$ref": "#/$defs/Operation"
+        },
+        "destroy": {
+          "$ref": "#/$defs/Operation"
+        },
+        "describe": {
+          "$ref": "#/$defs/Operation"
+        },
+        "refresh": {
+          "$ref": "#/$defs/Operation"
+        }
       }
     },
     "supportedOpenclawVersions": {
       "type": "object",
       "properties": {
-        "min": { "type": "string", "description": "semver, e.g., 2026.4.5" },
-        "max": { "type": "string" },
-        "tested": { "type": "array", "items": { "type": "string" } }
+        "min": {
+          "type": "string",
+          "description": "semver, e.g., 2026.4.5"
+        },
+        "max": {
+          "type": "string"
+        },
+        "tested": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "preflight": {
+      "type": "object",
+      "description": "Account-level setup a provider needs before anything can be provisioned, and which clawops can detect and offer to fix. These are not infrastructure \u2014 enabling an API or creating a state bucket happens outside the Pulumi program, because the state backend must exist before Pulumi can run at all. Detected in `doctor`; the setup wizard PROMPTS before changing anything in someone's cloud account.",
+      "required": [
+        "checks"
+      ],
+      "properties": {
+        "checks": {
+          "type": "array",
+          "description": "What must be true before a first deploy.",
+          "items": {
+            "$ref": "#/$defs/PreflightCheck"
+          }
+        }
       }
     }
   },
   "$defs": {
     "Operation": {
       "type": "object",
-      "required": ["estimatedDurationSec", "idempotent", "destructive"],
+      "required": [
+        "estimatedDurationSec",
+        "idempotent",
+        "destructive"
+      ],
       "properties": {
         "estimatedDurationSec": {
           "type": "object",
           "properties": {
-            "min": { "type": "number" },
-            "max": { "type": "number" },
-            "median": { "type": "number" }
+            "min": {
+              "type": "number"
+            },
+            "max": {
+              "type": "number"
+            },
+            "median": {
+              "type": "number"
+            }
           },
           "description": "Used by R12 to pick streaming tier (sync / progress / Tasks)"
         },
-        "idempotent": { "type": "boolean" },
-        "destructive": { "type": "boolean" },
-        "supportsCancellation": { "type": "boolean", "default": true }
+        "idempotent": {
+          "type": "boolean"
+        },
+        "destructive": {
+          "type": "boolean"
+        },
+        "supportsCancellation": {
+          "type": "boolean",
+          "default": true
+        }
+      }
+    },
+    "PreflightCheck": {
+      "type": "object",
+      "required": [
+        "id",
+        "label",
+        "remediable"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "Stable kebab-case id, e.g. `compute-api-enabled`"
+        },
+        "label": {
+          "type": "string",
+          "description": "What is being checked, in the operator's terms"
+        },
+        "remediable": {
+          "type": "boolean",
+          "description": "Whether clawops can fix it after asking. False means it can only be reported \u2014 a missing permission or an unpaid billing account is not clawops's to resolve."
+        },
+        "mutates": {
+          "type": "string",
+          "description": "What the fix changes in the operator's account, shown in the prompt. Required when remediable is true: consent to 'fix it' is not consent to something unnamed."
+        }
       }
     }
   }

package/dist/apply-AM5HERE7.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-import {
-  applyPlan
-} from "./chunk-UFRO4H5W.js";
-import "./chunk-N44K3LHE.js";
-import "./chunk-YR3O2I3S.js";
-import "./chunk-6ZFIFDBJ.js";
-import "./chunk-BOPSG2LI.js";
-import "./chunk-LU2V3LXA.js";
-import "./chunk-NUDIHZEH.js";
-import "./chunk-JW5A7E3X.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
-import "./chunk-KGXPLI7W.js";
-import "./chunk-6TIYVHPX.js";
-import "./chunk-EI7CQQ7D.js";
-export {
-  applyPlan
-};

package/dist/automation-RULUSJBW.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-import {
-  getConfigDir
-} from "./chunk-CX5SL5HP.js";
-import "./chunk-KGXPLI7W.js";
-
-// src/pulumi/automation.ts
-import path from "path";
-import { LocalWorkspace } from "@pulumi/pulumi/automation";
-async function getOrCreateStack(opts) {
-  const configDir = opts.configDir ?? getConfigDir();
-  return await LocalWorkspace.createOrSelectStack(
-    {
-      stackName: opts.stack,
-      projectName: "clawops",
-      program: opts.program
-    },
-    {
-      pulumiHome: path.join(configDir, ".pulumi"),
-      envVars: {
-        PULUMI_BACKEND_URL: opts.stateUrl,
-        PULUMI_SKIP_UPDATE_CHECK: "1"
-        // R6: cloud credentials inherited from process.env, never set here
-      }
-    }
-  );
-}
-export {
-  getOrCreateStack
-};

package/dist/aws-AMON7DA7.js

@@ -1,265 +0,0 @@
-#!/usr/bin/env node
-import {
-  makeStartupScript
-} from "./chunk-CKSPROD5.js";
-import {
-  GATEWAY_PORT
-} from "./chunk-6TIYVHPX.js";
-import "./chunk-EI7CQQ7D.js";
-
-// src/providers/aws/index.ts
-import process2 from "process";
-
-// src/providers/aws/program.ts
-var SSH_PORT = 22;
-var awsProgram = async () => {
-  const [pulumi, aws, { resolveIngressCidrs, resolveGatewayIngressCidrs, resolveGatewayPort, detectEgressIp }] = await Promise.all([
-    import("@pulumi/pulumi"),
-    import("@pulumi/aws"),
-    import("./firewall-T3NTPZJD.js")
-  ]);
-  const cfg = new pulumi.Config();
-  const instanceType = cfg.get("instanceType") ?? "t3.small";
-  const region = cfg.get("region") ?? "us-east-1";
-  const openclawVersion = cfg.get("openclawVersion") ?? "latest";
-  const publishGateway = cfg.get("publishGateway") === "all" ? "all" : "loopback";
-  const gatewayPort = resolveGatewayPort(cfg.get("gatewayPort"), GATEWAY_PORT);
-  const accessMode = cfg.get("accessMode") ?? "restricted";
-  const allowedCidrs = cfg.get("allowedCidrs") ?? "";
-  const sshCidrs = cfg.get("sshCidrs") ?? "";
-  const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
-  const bedrockEnabled = cfg.get("bedrockEnabled") === "true";
-  const pinnedAmiId = cfg.get("amiId");
-  const sshPublicKey = cfg.get("sshPublicKey");
-  if (!sshPublicKey) {
-    throw new Error(
-      'Stack config "sshPublicKey" is required for the AWS adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
-    );
-  }
-  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
-  if (accessMode === "open") {
-    process.stderr.write(
-      "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
-    );
-  }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
-  const gatewayIngressCidrs = resolveGatewayIngressCidrs(
-    publishGateway,
-    accessMode,
-    allowedCidrs,
-    gatewayCidrs,
-    egressResult
-  );
-  const vpc = new aws.ec2.Vpc("clawops-vpc", {
-    cidrBlock: "10.0.0.0/16",
-    enableDnsHostnames: true,
-    enableDnsSupport: true,
-    tags: { Name: "clawops" }
-  });
-  const igw = new aws.ec2.InternetGateway("clawops-igw", {
-    tags: { Name: "clawops" }
-  });
-  new aws.ec2.InternetGatewayAttachment("clawops-igw-attach", {
-    vpcId: vpc.id,
-    internetGatewayId: igw.id
-  });
-  const subnet = new aws.ec2.Subnet("clawops-subnet", {
-    vpcId: vpc.id,
-    cidrBlock: "10.0.1.0/24",
-    mapPublicIpOnLaunch: false,
-    availabilityZone: pulumi.interpolate`${region}a`,
-    tags: { Name: "clawops" }
-  });
-  const routeTable = new aws.ec2.RouteTable("clawops-rt", {
-    vpcId: vpc.id,
-    tags: { Name: "clawops" }
-  });
-  new aws.ec2.Route("clawops-route", {
-    routeTableId: routeTable.id,
-    destinationCidrBlock: "0.0.0.0/0",
-    gatewayId: igw.id
-  });
-  new aws.ec2.RouteTableAssociation("clawops-rta", {
-    subnetId: subnet.id,
-    routeTableId: routeTable.id
-  });
-  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
-    vpcId: vpc.id,
-    description: "clawops managed security group",
-    tags: { Name: "clawops" }
-  });
-  sshIngressCidrs.forEach((cidr, i) => {
-    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-ssh-${i}`, {
-      securityGroupId: sg.id,
-      ipProtocol: "tcp",
-      fromPort: SSH_PORT,
-      toPort: SSH_PORT,
-      cidrIpv4: cidr,
-      tags: { Name: `clawops-ssh-${i}` }
-    });
-  });
-  gatewayIngressCidrs.forEach((cidr, i) => {
-    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-gw-${i}`, {
-      securityGroupId: sg.id,
-      ipProtocol: "tcp",
-      fromPort: gatewayPort,
-      toPort: gatewayPort,
-      cidrIpv4: cidr,
-      tags: { Name: `clawops-gateway-${i}` }
-    });
-  });
-  new aws.vpc.SecurityGroupEgressRule("clawops-sg-egress", {
-    securityGroupId: sg.id,
-    ipProtocol: "-1",
-    cidrIpv4: "0.0.0.0/0",
-    tags: { Name: "clawops-egress" }
-  });
-  const role = new aws.iam.Role("clawops-role", {
-    assumeRolePolicy: JSON.stringify({
-      Version: "2012-10-17",
-      Statement: [{
-        Effect: "Allow",
-        Principal: { Service: "ec2.amazonaws.com" },
-        Action: "sts:AssumeRole"
-      }]
-    }),
-    tags: { Name: "clawops" }
-  });
-  new aws.iam.RolePolicyAttachment("clawops-ssm", {
-    role: role.name,
-    policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
-  });
-  if (bedrockEnabled) {
-    new aws.iam.RolePolicy("clawops-bedrock-invoke", {
-      role: role.name,
-      policy: JSON.stringify({
-        Version: "2012-10-17",
-        Statement: [{
-          Effect: "Allow",
-          Action: [
-            "bedrock:InvokeModel",
-            "bedrock:InvokeModelWithResponseStream"
-          ],
-          Resource: "*"
-        }]
-      })
-    });
-  }
-  const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
-    role: role.name
-  });
-  const keyPair = new aws.ec2.KeyPair("clawops-keypair", {
-    publicKey: sshPublicKey,
-    tags: { Name: "clawops" }
-  });
-  const amiId = pinnedAmiId ?? (await aws.ec2.getAmi({
-    mostRecent: true,
-    owners: ["099720109477"],
-    // Canonical
-    filters: [
-      { name: "name", values: ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] },
-      { name: "virtualization-type", values: ["hvm"] }
-    ]
-  })).id;
-  process.stderr.write(`[clawops] Using AMI: ${amiId}
-`);
-  const instance = new aws.ec2.Instance("clawops-instance", {
-    ami: amiId,
-    instanceType,
-    subnetId: subnet.id,
-    vpcSecurityGroupIds: [sg.id],
-    iamInstanceProfile: instanceProfile.name,
-    keyName: keyPair.keyName,
-    userData: makeStartupScript({ openclawVersion, os: "ubuntu", bedrockEnabled, publishGateway, gatewayPort }),
-    // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
-    // and obtain the instance role credentials (required for Bedrock access).
-    metadataOptions: {
-      httpTokens: "required",
-      httpPutResponseHopLimit: 2
-    },
-    tags: { Name: "clawops" }
-  });
-  const eip = new aws.ec2.Eip("clawops-eip", {
-    domain: "vpc",
-    tags: { Name: "clawops" }
-  });
-  new aws.ec2.EipAssociation("clawops-eip-assoc", {
-    instanceId: instance.id,
-    allocationId: eip.id
-  });
-  return {
-    instanceId: instance.id,
-    publicIp: eip.publicIp,
-    gatewayUrl: pulumi.interpolate`https://${eip.publicIp}:${gatewayPort}`,
-    sshHost: eip.publicIp,
-    sshPort: SSH_PORT,
-    sshUser: "ubuntu",
-    region,
-    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-};
-
-// src/providers/aws/index.ts
-var INSTANCE_TYPE_MAP = {
-  micro: "t3.micro",
-  small: "t3.small",
-  medium: "t3.medium",
-  large: "t3.large",
-  gpu: "g4dn.xlarge"
-};
-var awsAdapter = {
-  name: "aws",
-  get program() {
-    return awsProgram;
-  },
-  getConnectionInfo(outputs) {
-    return {
-      host: String(outputs["sshHost"] ?? ""),
-      port: Number(outputs["sshPort"] ?? 22),
-      user: String(outputs["sshUser"] ?? "ubuntu"),
-      privateKeyPath: String(outputs["privateKeyPath"] ?? ""),
-      knownHostsPath: String(outputs["knownHostsPath"] ?? "")
-    };
-  },
-  normalizeInstanceType(alias) {
-    const mapped = INSTANCE_TYPE_MAP[alias];
-    if (!mapped) throw new Error(`Unknown instance alias: ${alias}`);
-    return mapped;
-  },
-  defaultRegion() {
-    return "us-east-1";
-  },
-  stateBackendUrl(bucket) {
-    return `s3://${bucket}`;
-  },
-  async validateConfig() {
-    const errors = [];
-    const hasProfile = Boolean(process2.env["AWS_PROFILE"]);
-    const hasKeyId = Boolean(process2.env["AWS_ACCESS_KEY_ID"]);
-    const hasOidc = Boolean(process2.env["AWS_ROLE_ARN"] && process2.env["AWS_WEB_IDENTITY_TOKEN_FILE"]);
-    if (!hasProfile && !hasKeyId && !hasOidc) {
-      const onAws = await checkImds();
-      if (!onAws) {
-        errors.push(
-          "No AWS credentials found. Set AWS_PROFILE, AWS_ACCESS_KEY_ID, or AWS_ROLE_ARN + AWS_WEB_IDENTITY_TOKEN_FILE, or run on an EC2 instance with an IAM instance role."
-        );
-      }
-    }
-    return { ok: errors.length === 0, errors };
-  }
-};
-async function checkImds() {
-  try {
-    const res = await fetch(
-      "http://169.254.169.254/latest/meta-data/instance-id",
-      { signal: AbortSignal.timeout(1e3) }
-    );
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-var aws_default = awsAdapter;
-export {
-  aws_default as default
-};