@clawops/cli 2.0.0 → 2.0.2

package/dist/chunk-MC5ATCXS.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+// src/transport/known-hosts.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function hostEntryFor(host, port) {
+  return port === 22 ? host : `[${host}]:${port}`;
+}
+function parseKnownHosts(content) {
+  const entries = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    let parts = line.split(/\s+/);
+    let marker;
+    if (parts[0]?.startsWith("@")) {
+      marker = parts[0];
+      parts = parts.slice(1);
+    }
+    const hostField = parts[0];
+    if (!hostField) continue;
+    const hosts = hostField.split(",");
+    if (parts.length >= 3) {
+      entries.push({ hosts, keyType: parts[1], base64Key: parts[2], ...marker ? { marker } : {} });
+    } else if (parts.length === 2 && /^[0-9a-f]+$/i.test(parts[1] ?? "")) {
+      entries.push({ hosts, hexKey: parts[1], ...marker ? { marker } : {} });
+    }
+  }
+  return entries;
+}
+function hashedHostMatches(token, hostEntry) {
+  const parts = token.split("|");
+  if (parts.length !== 4 || parts[1] !== "1") return false;
+  const salt = parts[2];
+  const expected = parts[3];
+  if (!salt || !expected) return false;
+  try {
+    const actual = createHmac("sha1", Buffer.from(salt, "base64")).update(hostEntry).digest("base64");
+    const a = Buffer.from(actual);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function patternToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+var isPattern = (host) => host.includes("*") || host.includes("?");
+function entryMatchesHost(entry, hostEntry) {
+  let matched = false;
+  for (const host of entry.hosts) {
+    if (host.startsWith("|1|")) {
+      if (hashedHostMatches(host, hostEntry)) matched = true;
+      continue;
+    }
+    const negated = host.startsWith("!");
+    const pattern = negated ? host.slice(1) : host;
+    const hit = isPattern(pattern) ? patternToRegExp(pattern).test(hostEntry) : pattern === hostEntry;
+    if (hit) {
+      if (negated) return false;
+      matched = true;
+    }
+  }
+  return matched;
+}
+function verifyAgainstKnownHosts(content, host, port, key) {
+  const hostEntry = hostEntryFor(host, port);
+  const base64Key = key.toString("base64");
+  const hexKey = key.toString("hex");
+  let sawHost = false;
+  for (const entry of parseKnownHosts(content)) {
+    if (!entryMatchesHost(entry, hostEntry)) continue;
+    if (entry.marker === "@cert-authority") continue;
+    sawHost = true;
+    const matches = entry.base64Key ? entry.base64Key === base64Key : entry.hexKey?.toLowerCase() === hexKey.toLowerCase();
+    if (matches) return entry.marker === "@revoked" ? "mismatch" : "match";
+  }
+  return sawHost ? "mismatch" : "unknown";
+}
+function withoutHost(content, host, port) {
+  const hostEntry = hostEntryFor(host, port);
+  const kept = [];
+  for (const raw of content.split("\n")) {
+    const [entry] = parseKnownHosts(raw);
+    if (entry && entryMatchesHost(entry, hostEntry)) continue;
+    kept.push(raw);
+  }
+  return kept.join("\n");
+}
+function formatKnownHostsLine(host, port, keyType, key) {
+  return `${hostEntryFor(host, port)} ${keyType} ${key.toString("base64")}
+`;
+}
+function keyTypeFromBlob(key) {
+  if (key.length < 4) return void 0;
+  const len = key.readUInt32BE(0);
+  if (len === 0 || len > 64 || key.length < 4 + len) return void 0;
+  const type = key.subarray(4, 4 + len).toString("utf-8");
+  return /^[\x20-\x7e]+$/.test(type) ? type : void 0;
+}
+
+export {
+  verifyAgainstKnownHosts,
+  withoutHost,
+  formatKnownHostsLine,
+  keyTypeFromBlob
+};

package/dist/chunk-N4WZLWJ4.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+// src/providers/aws/sizes.ts
+var INSTANCE_TYPE_MAP = {
+  micro: "t3.micro",
+  small: "t3.small",
+  medium: "t3.medium",
+  large: "t3.large",
+  gpu: "g4dn.xlarge"
+};
+var DEFAULT_ALIAS = "small";
+
+export {
+  INSTANCE_TYPE_MAP,
+  DEFAULT_ALIAS
+};

package/dist/{chunk-SBLQH2TJ.js → chunk-NUL5F6YV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/openclaw/logs.ts
-var GATEWAY_LOGS_PROBE = "docker exec openclaw openclaw logs --limit 1 >/dev/null 2>&1 && echo ok || echo no";
+var GATEWAY_LOGS_PROBE = "docker exec openclaw openclaw logs --limit 1 >/dev/null";
 function gatewayLogsCommand(opts) {
   return [
     "docker exec openclaw openclaw logs",

package/dist/chunk-PSOSBJVO.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+// src/pulumi/cli.ts
+import path from "path";
+import process from "process";
+import { PulumiCommand } from "@pulumi/pulumi/automation/index.js";
+function pulumiCliRoot(configDir) {
+  return path.join(configDir, ".pulumi-cli");
+}
+function versionOf(cmd) {
+  return cmd.version ? `v${cmd.version.toString()}` : "unknown version";
+}
+async function pulumiCliStatus(configDir) {
+  const root = pulumiCliRoot(configDir);
+  try {
+    return { kind: "managed", version: versionOf(await PulumiCommand.get({ root })), root };
+  } catch {
+  }
+  try {
+    return { kind: "path", version: versionOf(await PulumiCommand.get()) };
+  } catch {
+    return { kind: "missing" };
+  }
+}
+async function ensurePulumiCli(opts) {
+  const root = pulumiCliRoot(opts.configDir);
+  const status = await pulumiCliStatus(opts.configDir);
+  if (status.kind === "managed") return await PulumiCommand.get({ root });
+  if (status.kind === "path") return await PulumiCommand.get();
+  const announce = opts.onInstall ?? defaultAnnounce;
+  announce({ root });
+  try {
+    return await PulumiCommand.install({ root });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `could not install the Pulumi CLI into ${root}: ${reason}
+Install it yourself and clawops will use it: https://www.pulumi.com/docs/install/`
+    );
+  }
+}
+function defaultAnnounce({ root }) {
+  process.stderr.write(`Pulumi CLI not found \u2014 installing it into ${root} (one time).
+`);
+}
+
+export {
+  pulumiCliRoot,
+  pulumiCliStatus,
+  ensurePulumiCli
+};

package/dist/{chunk-AX74VXTV.js → chunk-RATEIAFU.js}

@@ -1,42 +1,50 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-UFRO4H5W.js";
+} from "./chunk-ZMMRIWFS.js";
+import {
+  extractBaseOutputs
+} from "./chunk-3QJBNAHW.js";
 import {
   atomicWriteConfig,
   readRemoteConfig,
   restartGateway
-} from "./chunk-N44K3LHE.js";
-import {
-  extractBaseOutputs
-} from "./chunk-3QJBNAHW.js";
+} from "./chunk-2I7KCMXZ.js";
 import {
   generatePlan
-} from "./chunk-WHJMKDV7.js";
+} from "./chunk-SDZKCICH.js";
 import {
   validatePlan
-} from "./chunk-YR3O2I3S.js";
+} from "./chunk-BSLIYB5Q.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-3WYA2QDM.js";
+} from "./chunk-2Z7J3ERQ.js";
 import {
   buildContext
-} from "./chunk-LU2V3LXA.js";
+} from "./chunk-WTZ2CT35.js";
 import {
   formatUptime,
   gatherSnapshot,
   runDiagnostics
-} from "./chunk-GYV4KNW7.js";
+} from "./chunk-5TXCUOZV.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
-} from "./chunk-SBLQH2TJ.js";
+} from "./chunk-NUL5F6YV.js";
 import {
   execPrivileged
 } from "./chunk-NUDIHZEH.js";
+import {
+  STATE_DIR_HOST_LINUX,
+  gatewayRunCommand
+} from "./chunk-GIEVAGEK.js";
+import {
+  IMAGE_INSPECT_CMD,
+  imageForRestart
+} from "./chunk-VOEJYRIK.js";
 import {
   getConfig,
   getConfigDir
@@ -45,12 +53,6 @@ import {
   StateError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
-import {
-  IMAGE_INSPECT_CMD,
-  STATE_DIR_HOST_LINUX,
-  gatewayRunCommand,
-  imageForRestart
-} from "./chunk-6TIYVHPX.js";
 
 // src/mcp/server.ts
 import { createServer } from "http";
@@ -222,7 +224,10 @@ var clawops_upSchema = z.object({
   stackName: z.string().optional(),
   provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
   region: z.string().optional(),
-  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional().default("small"),
+  instanceType: z.string().optional().default("small"),
+  sshCidr: z.string().optional(),
+  gatewayCidr: z.string().optional(),
+  publishGateway: z.enum(["loopback", "all"]).optional(),
   openclawVersion: z.string().optional(),
   dryRun: z.boolean().optional().default(false)
 });
@@ -799,7 +804,6 @@ function makeProgressEmitter(server, progressToken) {
 }
 
 // src/mcp/tools/cli/up.ts
-var VALID_INSTANCE_TYPES = ["micro", "small", "medium", "large", "gpu"];
 async function handleUp(input, server) {
   if (!input.dryRun) {
     const elicit = await server.server.elicitInput({
@@ -824,7 +828,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-DMRPWJGN.js");
+    const { localBootstrap } = await import("./bootstrap-HNGKY6WW.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -839,10 +843,6 @@ async function handleUp(input, server) {
     });
     return okText(JSON.stringify({ stack: ctx.stackName, ...state }, null, 2));
   }
-  const instanceAlias = input.instanceType ?? "small";
-  if (!VALID_INSTANCE_TYPES.includes(instanceAlias)) {
-    throw new UsageError(`Invalid instanceType: ${instanceAlias}`);
-  }
   const validation = await ctx.adapter.validateConfig();
   if (!validation.ok) {
     return errText(`Provider config invalid: ${validation.errors.join("; ")}`);
@@ -851,38 +851,47 @@ async function handleUp(input, server) {
   const progressToken = void 0;
   const emit = makeProgressEmitter(server, progressToken);
   startTask(taskId, `clawops_up stack=${ctx.stackName}`);
-  const stack = await ctx.getStack();
-  const region = input.region ?? ctx.adapter.defaultRegion();
-  const instanceType = ctx.adapter.normalizeInstanceType(instanceAlias);
-  await stack.setConfig("region", { value: region });
-  await stack.setConfig("instanceType", { value: instanceType });
-  await stack.setConfig("openclawVersion", { value: openclawVersion });
-  if (input.dryRun) {
-    const lines = [];
-    await stack.preview({ onOutput: (o) => {
-      emit(o.trim());
-      lines.push(o);
-    } });
-    const output = lines.join("");
-    updateTask(taskId, "completed", output);
-    const { content } = trimForMcp(output, ctx.stackName);
-    return okText(content);
-  }
+  const { generatePlan: generatePlan2 } = await import("./generate-J6MIJGII.js");
+  const { applyPlan: applyPlan2 } = await import("./apply-WOUTUUQH.js");
+  const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
+  const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
+  const network = await resolveNetworkFlags(
+    {
+      ...input.sshCidr ? { sshCidr: input.sshCidr } : {},
+      ...input.gatewayCidr ? { gatewayCidr: input.gatewayCidr } : {},
+      ...input.publishGateway ? { publishGateway: input.publishGateway } : {}
+    },
+    { detectEgressIp: () => detectEgressIp("https://ifconfig.me/ip") }
+  );
   try {
+    const plan = await generatePlan2({
+      stackName: ctx.stackName,
+      provider: ctx.adapter.name,
+      ...input.region ? { region: input.region } : {},
+      ...input.instanceType ? { instanceType: input.instanceType } : {},
+      openclawVersion,
+      network
+    });
+    if (input.dryRun) {
+      const summary2 = JSON.stringify(plan.diff ?? { totalChanges: 0 }, null, 2);
+      updateTask(taskId, "completed", summary2);
+      const { content } = trimForMcp(summary2, ctx.stackName);
+      return okText(content);
+    }
     const lines = [];
-    const result = await stack.up({
+    const result = await applyPlan2(plan, {
       onOutput: (o) => {
         emit(o.trim());
         lines.push(o);
-      }
+      },
+      onProgress: (o) => emit(o)
     });
     const summary = `Stack "${ctx.stackName}" deployed.
-` + (result.outputs["publicIp"] ? `Public IP: ${result.outputs["publicIp"].value}
-` : "") + (result.outputs["gatewayUrl"] ? `Gateway URL: ${result.outputs["gatewayUrl"].value}
+` + (result.outputs["publicIp"] ? `Public IP: ${String(result.outputs["publicIp"])}
+` : "") + (result.outputs["gatewayUrl"] ? `Gateway URL: ${String(result.outputs["gatewayUrl"])}
 ` : "");
     updateTask(taskId, "completed", summary);
-    const fullOutput = lines.join("");
-    trimForMcp(fullOutput, ctx.stackName);
+    trimForMcp(lines.join(""), ctx.stackName);
     return okText(summary);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -1047,7 +1056,7 @@ async function handleTaskStatus(input, _server) {
 
 // src/mcp/tools/cli/monitor.ts
 async function handleMonitor(input, _server) {
-  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-EX4ZTA5P.js");
+  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-PIIKJ4L2.js");
   const ctx = buildContext({ stack: input.stackName });
   const tailLines = input.tailLines ?? 5;
   let conn;
@@ -1523,7 +1532,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-3HUW57XH.js");
+  const { version } = await import("./package-3A6BOALU.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);

package/dist/chunk-RHOWYIWT.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+// src/providers/azure/cli-auth.ts
+import path from "path";
+import process from "process";
+import { readFileSync } from "fs";
+function azureConfigDir() {
+  const explicit = process.env["AZURE_CONFIG_DIR"];
+  if (explicit) return explicit;
+  const home = process.env["HOME"] ?? process.env["USERPROFILE"];
+  return home ? path.join(home, ".azure") : void 0;
+}
+function accountFromProfile(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body.replace(/^\uFEFF/, ""));
+  } catch {
+    return void 0;
+  }
+  const subscriptions = parsed?.subscriptions;
+  if (!Array.isArray(subscriptions)) return void 0;
+  const entries = subscriptions;
+  const chosen = entries.find((s) => s["isDefault"] === true) ?? entries[0];
+  if (!chosen) return void 0;
+  const id = typeof chosen["id"] === "string" ? chosen["id"] : void 0;
+  if (!id) return void 0;
+  const user = chosen["user"];
+  return {
+    subscriptionId: id,
+    name: typeof chosen["name"] === "string" ? chosen["name"] : id,
+    ...typeof user?.name === "string" ? { user: user.name } : {}
+  };
+}
+function azureCliAccount() {
+  const dir = azureConfigDir();
+  if (!dir) return void 0;
+  try {
+    return accountFromProfile(readFileSync(path.join(dir, "azureProfile.json"), "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function resolveSubscriptionId() {
+  return process.env["ARM_SUBSCRIPTION_ID"] ?? process.env["AZURE_SUBSCRIPTION_ID"] ?? azureCliAccount()?.subscriptionId;
+}
+
+export {
+  azureConfigDir,
+  accountFromProfile,
+  azureCliAccount,
+  resolveSubscriptionId
+};

package/dist/{chunk-WHJMKDV7.js → chunk-SDZKCICH.js}

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-YR3O2I3S.js";
+} from "./chunk-BSLIYB5Q.js";
 import {
-  buildContext
-} from "./chunk-LU2V3LXA.js";
+  buildContext,
+  loadAdapterModule
+} from "./chunk-WTZ2CT35.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
 import {
+  StateError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
 
@@ -19,12 +21,16 @@ function parseDiff(lines) {
   const create = [];
   const update = [];
   const del = [];
+  const seen = /* @__PURE__ */ new Set();
   for (const line of lines) {
     const m = PREVIEW_LINE_RE.exec(line.trimStart());
     if (!m) continue;
     const [, op, resourceType, name] = m;
+    const urn = `urn:pulumi:::clawops::${resourceType}::${name ?? ""}`;
+    if (seen.has(`${op}${urn}`)) continue;
+    seen.add(`${op}${urn}`);
     const ref = {
-      urn: `urn:pulumi:::clawops::${resourceType}::${name ?? ""}`,
+      urn,
       type: resourceType,
       ...name ? { name } : {}
     };
@@ -39,16 +45,33 @@ function parseDiff(lines) {
     totalChanges: create.length + update.length + del.length
   };
 }
+var INSTANCE_ALIASES = ["micro", "small", "medium", "large", "gpu"];
+function isInstanceAlias(value) {
+  return INSTANCE_ALIASES.includes(value);
+}
+async function resolveInstanceType(intent) {
+  const requested = intent.instanceType ?? "small";
+  if (!isInstanceAlias(requested)) {
+    process.stderr.write(
+      `[clawops] note: "${requested}" is not a clawops size (${INSTANCE_ALIASES.join(", ")}), so it is passed to ${intent.provider} as written.
+`
+    );
+    return requested;
+  }
+  const adapter = await loadAdapterModule(intent.provider);
+  return adapter.normalizeInstanceType(requested);
+}
+var parseDiffForTest = parseDiff;
 async function generatePlan(intent, _opts) {
   if (intent.provider === "local") {
     throw new UsageError(
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-3HUW57XH.js");
+  const { version } = await import("./package-3A6BOALU.js");
   const config = getConfig();
-  const instanceType = intent.instanceType ?? "small";
-  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+  const instanceType = await resolveInstanceType(intent);
+  const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
   const openclawVersion = await guardOpenclawVersion(
     intent.openclawVersion ?? await defaultOpenclawVersion()
   );
@@ -56,6 +79,13 @@ async function generatePlan(intent, _opts) {
     allowedSshCidrs: [],
     allowedGatewayCidrs: []
   };
+  const { resolvePublicKey } = await import("./ssh-key-DUO6OKOI.js");
+  const publicKey = config ? resolvePublicKey(expandHome(config.ssh.keyPath)) : void 0;
+  if (!publicKey) {
+    process.stderr.write(
+      "[clawops] warning: no SSH public key could be resolved" + (config ? ` from ${config.ssh.keyPath}` : " \u2014 no config file") + ". `clawops apply` will refuse this plan: the instance would have no way to admit anyone. Run `clawops doctor` to see why the key is unusable.\n"
+    );
+  }
   const stackName = intent.stackName;
   const region = intent.region ?? config?.stacks[stackName]?.region;
   const plan = {
@@ -74,15 +104,24 @@ async function generatePlan(intent, _opts) {
       instanceType,
       openclaw: { version: openclawVersion },
       network,
+      ...publicKey ? { ssh: { publicKey } } : {},
       ...intent.tags ? { tags: intent.tags } : {}
     }
   };
+  let stack;
   try {
     const ctx = buildContext({ stack: stackName, provider: intent.provider });
-    const stack = await ctx.getStack();
-    await stack.setConfig("instanceType", { value: instanceType });
-    if (region) await stack.setConfig("region", { value: region });
-    await stack.setConfig("openclawVersion", { value: openclawVersion });
+    stack = await ctx.getStack();
+  } catch (err) {
+    if (err instanceof UsageError) throw err;
+    throw new StateError(
+      `Cannot open the state backend for stack "${stackName}": ${messageOf(err)}
+A plan is only as good as the state it was computed against, so this is not a plan clawops will write. Check the stateUrl in ~/.clawops/config.json, and that the bucket or container exists and your credentials can read it.`
+    );
+  }
+  try {
+    const { writeStackConfig } = await import("./stack-config-R4SPSUQZ.js");
+    await writeStackConfig(stack, plan);
     const outputLines = [];
     const preview = await stack.preview({
       onOutput: (line) => outputLines.push(line)
@@ -98,6 +137,7 @@ async function generatePlan(intent, _opts) {
       plan.metadata.stackVersion = info.version;
     }
   } catch (err) {
+    if (err instanceof UsageError) throw err;
     process.stderr.write(
       `[clawops] Warning: preview failed, diff section omitted: ${err instanceof Error ? err.message : String(err)}
 `
@@ -108,7 +148,7 @@ async function generatePlan(intent, _opts) {
     throw new Error(`Generated plan failed schema validation:
 ${validation.errors.join("\n")}`);
   }
-  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-BOQRWX4F.js");
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-YVI3BJ55.js");
   const cfgCheck = await validatePlanConfig(plan);
   for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
 `);
@@ -133,8 +173,21 @@ Fix spec.openclaw.config before applying \u2014 the gateway reads it verbatim.`
 function planId() {
   return randomUUID().slice(0, 8);
 }
+function expandHome(p) {
+  return p.replace(/^~/, process.env["HOME"] ?? "~");
+}
+function messageOf(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  const lines = raw.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+  const explained = lines.find((l) => /(^|\s)error:/i.test(l));
+  if (explained) return explained.replace(/^.*?error:\s*/i, "");
+  return lines[0] ?? raw;
+}
 
 export {
+  INSTANCE_ALIASES,
+  isInstanceAlias,
+  parseDiffForTest,
   generatePlan,
   planId
 };

package/dist/chunk-V25QRZRB.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+// src/pulumi/passphrase.ts
+import path from "path";
+import process from "process";
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+var PASSPHRASE_FILE = "pulumi-passphrase";
+function passphrasePath(configDir) {
+  return path.join(configDir, "secrets", PASSPHRASE_FILE);
+}
+function passphraseInEnvironment() {
+  return Boolean(
+    process.env["PULUMI_CONFIG_PASSPHRASE"] ?? process.env["PULUMI_CONFIG_PASSPHRASE_FILE"]
+  );
+}
+function passphraseStatus(configDir) {
+  if (passphraseInEnvironment()) return "environment";
+  return existsSync(passphrasePath(configDir)) ? "stored" : "absent";
+}
+function ensurePassphrase(configDir) {
+  if (passphraseInEnvironment()) return void 0;
+  const file = passphrasePath(configDir);
+  if (existsSync(file)) {
+    const stored = readFileSync(file, "utf-8").trim();
+    if (stored !== "") return stored;
+  }
+  const dir = path.dirname(file);
+  mkdirSync(dir, { recursive: true });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  const generated = randomBytes(32).toString("base64url");
+  writeFileSync(file, generated + "\n", { encoding: "utf-8", mode: 384 });
+  return generated;
+}
+
+export {
+  PASSPHRASE_FILE,
+  passphrasePath,
+  passphraseInEnvironment,
+  passphraseStatus,
+  ensurePassphrase
+};

package/dist/chunk-VOEJYRIK.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import {
+  err,
+  ok
+} from "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/run-flags.ts
+var CONFIG_MOUNT_PATH = "/app/config.json";
+var GATEWAY_PORT = 18789;
+var CONFIG_PATH_ENV = `-e OPENCLAW_CONFIG_PATH=${CONFIG_MOUNT_PATH}`;
+var ADD_HOST_FLAG = "--add-host=host.docker.internal:host-gateway";
+var PORT_PIN = `--port ${GATEWAY_PORT}`;
+var COMMON_RUN_FLAGS = `${CONFIG_PATH_ENV} ${ADD_HOST_FLAG}`;
+var IMAGE_INSPECT_CMD = `docker inspect openclaw --format '{{.Config.Image}}'`;
+function imageForRestart(inspectStdout) {
+  const image = inspectStdout.trim();
+  if (!image || image.includes("Error") || !image.includes(":")) {
+    return err(
+      "No running OpenClaw container found, so there is no image version to reuse. Deploy one with `clawops up --openclaw-version <version>`. clawops does not fall back to `latest` or `stable` here: both now point at OpenClaw 2.0, which this release line does not support."
+    );
+  }
+  return ok(image);
+}
+function versionOf(image) {
+  return image.split(":")[1] ?? "unknown";
+}
+
+export {
+  GATEWAY_PORT,
+  IMAGE_INSPECT_CMD,
+  imageForRestart,
+  versionOf
+};