@clawops/cli 2.0.0 → 2.0.2

package/dist/preflight-MWWM5JT3.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_ALIAS,
+  INSTANCE_TYPE_MAP
+} from "./chunk-FEK7VJAY.js";
+import {
+  resolveSubscriptionId
+} from "./chunk-RHOWYIWT.js";
+
+// src/providers/azure/preflight.ts
+import process from "process";
+import { spawnSync } from "child_process";
+var ARM = "https://management.azure.com";
+var API_VERSION = "2021-04-01";
+var REQUIRED_PROVIDERS = [
+  { namespace: "Microsoft.Compute", why: "the virtual machine and its disk" },
+  { namespace: "Microsoft.Network", why: "the virtual network, NSG, public IP and NIC" },
+  { namespace: "Microsoft.Storage", why: "the azblob state backend" }
+];
+async function managementToken(signal) {
+  const tenantId = process.env["AZURE_TENANT_ID"];
+  const clientId = process.env["AZURE_CLIENT_ID"];
+  const clientSecret = process.env["AZURE_CLIENT_SECRET"];
+  if (tenantId && clientId && clientSecret) {
+    try {
+      const res = await fetch(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "client_credentials",
+          client_id: clientId,
+          client_secret: clientSecret,
+          scope: `${ARM}/.default`
+        }),
+        signal: signal ?? AbortSignal.timeout(1e4)
+      });
+      if (!res.ok) return void 0;
+      const body = await res.json();
+      return typeof body.access_token === "string" ? body.access_token : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  const result = spawnSync(
+    "az",
+    ["account", "get-access-token", "--resource", ARM, "--query", "accessToken", "-o", "tsv"],
+    { encoding: "utf-8", timeout: 2e4 }
+  );
+  if (result.status !== 0) return void 0;
+  const token = result.stdout.trim();
+  return token === "" ? void 0 : token;
+}
+async function registrationState(subscriptionId, namespace, token, signal) {
+  try {
+    const res = await fetch(
+      `${ARM}/subscriptions/${subscriptionId}/providers/${namespace}?api-version=${API_VERSION}`,
+      { headers: { authorization: `Bearer ${token}` }, signal }
+    );
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return typeof body.registrationState === "string" ? body.registrationState : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function register(subscriptionId, namespace, token, signal) {
+  const res = await fetch(
+    `${ARM}/subscriptions/${subscriptionId}/providers/${namespace}/register?api-version=${API_VERSION}`,
+    { method: "POST", headers: { authorization: `Bearer ${token}` }, signal }
+  );
+  if (!res.ok) {
+    throw new Error(`Could not register ${namespace}: HTTP ${res.status} ${await res.text()}`);
+  }
+}
+async function availableSizes(subscriptionId, location, token, signal) {
+  try {
+    const url = `${ARM}/subscriptions/${subscriptionId}/providers/Microsoft.Compute/skus?api-version=2021-07-01&$filter=${encodeURIComponent(`location eq '${location}'`)}`;
+    const res = await fetch(url, { headers: { authorization: `Bearer ${token}` }, signal });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    if (!Array.isArray(body.value)) return void 0;
+    return new Set(
+      body.value.filter((s) => s.resourceType === "virtualMachines").filter((s) => !Array.isArray(s.restrictions) || s.restrictions.length === 0).map((s) => s.name)
+    );
+  } catch {
+    return void 0;
+  }
+}
+function sizeCheck(location, available, requested = INSTANCE_TYPE_MAP[DEFAULT_ALIAS]) {
+  if (!available) {
+    return {
+      id: "vm-size-available",
+      label: `${requested} is available in ${location}`,
+      ok: false,
+      unknown: true,
+      detail: `clawops could not list the VM sizes this subscription is offered in ${location}. This says nothing about ${requested} \u2014 the usual cause is credentials without permission to read Microsoft.Compute/skus. A deploy can still succeed.`
+    };
+  }
+  if (available.has(requested)) {
+    return {
+      id: "vm-size-available",
+      label: `${requested} is available in ${location}`,
+      ok: true
+    };
+  }
+  const alternatives = [...available].filter((n) => /^Standard_[A-Z]*[0-9]+[a-z]*(_v\d+)?$/.test(n)).filter((n) => /[^0-9]2[a-z]*(_v\d+)?$/.test(n)).sort().slice(0, 4);
+  return {
+    id: "vm-size-available",
+    label: `${requested} is available in ${location}`,
+    ok: false,
+    detail: `${requested} is not offered to this subscription in ${location}, so a deploy fails after the network, NSG, public IP and NIC have been created. ` + (alternatives.length > 0 ? `Available instead: ${alternatives.join(", ")} \u2014 pass one with \`clawops plan --instance-type <size>\`.` : "Try another region.")
+  };
+}
+async function azurePreflight(opts = {}) {
+  const checks = [];
+  const subscriptionId = resolveSubscriptionId();
+  checks.push({
+    id: "subscription-resolved",
+    label: "Azure subscription is set",
+    ok: Boolean(subscriptionId),
+    detail: subscriptionId ? `Deploying into ${subscriptionId}` : "No subscription resolved. Run `az login`, or set ARM_SUBSCRIPTION_ID."
+  });
+  if (!subscriptionId) return checks;
+  checks.push(stateBackendCheck(opts.bucket));
+  const token = await managementToken(opts.signal);
+  if (!token) {
+    checks.push({
+      id: "management-token",
+      label: "Azure management API reachable",
+      ok: false,
+      detail: "Could not get a management token, so the resource providers and VM sizes below were not checked. Run `az login`, or set AZURE_TENANT_ID + AZURE_CLIENT_ID + AZURE_CLIENT_SECRET for a service principal."
+    });
+    return checks;
+  }
+  if (opts.region) {
+    checks.push(
+      sizeCheck(
+        opts.region,
+        await availableSizes(subscriptionId, opts.region, token, opts.signal),
+        opts.instanceType
+      )
+    );
+  }
+  for (const provider of REQUIRED_PROVIDERS) {
+    const state = await registrationState(subscriptionId, provider.namespace, token, opts.signal);
+    const registered = state === "Registered";
+    checks.push({
+      id: `rp-${provider.namespace.split(".")[1]?.toLowerCase()}`,
+      label: `${provider.namespace} registered`,
+      ok: registered,
+      detail: registered ? void 0 : `${state ?? "unknown"} \u2014 needed for ${provider.why}. Nothing can be provisioned without it, and registration takes a couple of minutes.`,
+      ...registered ? {} : {
+        mutates: `Registers the ${provider.namespace} resource provider on subscription ${subscriptionId}`,
+        fix: () => register(subscriptionId, provider.namespace, token, opts.signal)
+      }
+    });
+  }
+  return checks;
+}
+function stateBackendCheck(container) {
+  const account = process.env["AZURE_STORAGE_ACCOUNT"];
+  const hasSecret = Boolean(
+    process.env["AZURE_STORAGE_KEY"] ?? process.env["AZURE_STORAGE_SAS_TOKEN"]
+  );
+  const ok = Boolean(account) && hasSecret;
+  const where = container ? `azblob://${container}` : "the azblob state backend";
+  return {
+    id: "state-backend-credentials",
+    label: "azblob state backend is configured",
+    ok,
+    detail: ok ? `${where} on storage account ${account}` : `${where} needs AZURE_STORAGE_ACCOUNT and one of AZURE_STORAGE_KEY or AZURE_STORAGE_SAS_TOKEN. Pulumi authenticates to blob storage with these and not with your \`az login\`, so every other check here can pass and the deploy still fail to open its own state.`
+  };
+}
+export {
+  REQUIRED_PROVIDERS,
+  availableSizes,
+  azurePreflight,
+  managementToken,
+  sizeCheck,
+  stateBackendCheck
+};

package/dist/preflight-TFD4N5ZU.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_ALIAS,
+  INSTANCE_TYPE_MAP
+} from "./chunk-N4WZLWJ4.js";
+
+// src/providers/aws/preflight.ts
+import process from "process";
+async function callerAccount(signal) {
+  try {
+    const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+    const client = new STSClient({});
+    const result = await client.send(new GetCallerIdentityCommand({}), { abortSignal: signal });
+    return result.Account ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function bucketExists(bucket, signal) {
+  try {
+    const { S3Client, HeadBucketCommand } = await import("@aws-sdk/client-s3");
+    const client = new S3Client({});
+    await client.send(new HeadBucketCommand({ Bucket: bucket }), { abortSignal: signal });
+    return { ok: true };
+  } catch (err) {
+    const status = err.$metadata?.httpStatusCode;
+    const detail = err instanceof Error ? err.message : String(err);
+    if (status === 404) return { ok: false, reason: "missing", detail };
+    if (status === 403) return { ok: false, reason: "denied", detail };
+    return { ok: false, reason: "unknown", detail };
+  }
+}
+async function createBucket(bucket, region, signal) {
+  const {
+    S3Client,
+    CreateBucketCommand,
+    PutBucketVersioningCommand,
+    PutPublicAccessBlockCommand
+  } = await import("@aws-sdk/client-s3");
+  const client = new S3Client({ region });
+  await client.send(
+    new CreateBucketCommand({
+      Bucket: bucket,
+      // us-east-1 is the one region that rejects an explicit LocationConstraint.
+      ...region === "us-east-1" ? {} : { CreateBucketConfiguration: { LocationConstraint: region } }
+    }),
+    { abortSignal: signal }
+  );
+  await client.send(
+    new PutBucketVersioningCommand({
+      Bucket: bucket,
+      VersioningConfiguration: { Status: "Enabled" }
+    }),
+    { abortSignal: signal }
+  );
+  await client.send(
+    new PutPublicAccessBlockCommand({
+      Bucket: bucket,
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        IgnorePublicAcls: true,
+        BlockPublicPolicy: true,
+        RestrictPublicBuckets: true
+      }
+    }),
+    { abortSignal: signal }
+  );
+}
+async function instanceTypeOffered(instanceType, region, signal) {
+  try {
+    const { EC2Client, DescribeInstanceTypeOfferingsCommand } = await import("@aws-sdk/client-ec2");
+    const client = new EC2Client({ region });
+    const result = await client.send(
+      new DescribeInstanceTypeOfferingsCommand({
+        LocationType: "region",
+        Filters: [
+          { Name: "instance-type", Values: [instanceType] },
+          { Name: "location", Values: [region] }
+        ]
+      }),
+      { abortSignal: signal }
+    );
+    return { offered: (result.InstanceTypeOfferings?.length ?? 0) > 0 };
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function awsPreflight(opts = {}) {
+  const checks = [];
+  const region = opts.region ?? process.env["AWS_REGION"] ?? "us-east-1";
+  const account = await callerAccount(opts.signal);
+  checks.push({
+    id: "account-resolved",
+    label: "AWS credentials resolve to an account",
+    ok: Boolean(account),
+    detail: account ? `Deploying into ${account} (${region})` : "No account resolved. Set AWS_PROFILE, or run `aws sso login --profile <name>`."
+  });
+  if (!account) return checks;
+  if (opts.bucket) {
+    const bucket = opts.bucket;
+    const result = await bucketExists(bucket, opts.signal);
+    checks.push(
+      result.ok ? { id: "state-bucket", label: `State bucket s3://${bucket} exists`, ok: true } : {
+        id: "state-bucket",
+        label: `State bucket s3://${bucket} exists`,
+        ok: false,
+        detail: result.reason === "denied" ? `s3://${bucket} exists but these credentials cannot read it, or the name belongs to another account. Bucket names are global.` : "Pulumi needs its state backend before it can run, so clawops cannot create this as part of a deploy.",
+        // Only offer to create what is genuinely absent: a 403 means the name is taken or
+        // the permission is missing, and creating it would fail either way.
+        ...result.reason === "missing" ? {
+          mutates: `Creates bucket s3://${bucket} in ${region}, with versioning on and public access blocked`,
+          fix: () => createBucket(bucket, region, opts.signal)
+        } : {}
+      }
+    );
+  }
+  const instanceType = opts.instanceType ?? INSTANCE_TYPE_MAP[DEFAULT_ALIAS];
+  const offering = await instanceTypeOffered(instanceType, region, opts.signal);
+  checks.push(
+    "error" in offering ? {
+      id: "instance-type-offered",
+      label: `${instanceType} is offered in ${region}`,
+      ok: false,
+      unknown: true,
+      detail: `clawops could not ask EC2 whether ${instanceType} is offered in ${region}: ${offering.error}. This says nothing about the instance type \u2014 the usual cause is credentials without ec2:DescribeInstanceTypeOfferings, which nothing else needs. A deploy can still succeed.`
+    } : {
+      id: "instance-type-offered",
+      label: `${instanceType} is offered in ${region}`,
+      ok: offering.offered,
+      detail: offering.offered ? void 0 : `${instanceType} is not offered in ${region}, so a deploy fails after the VPC, subnet, security group and address have been created. Pick another region, or pass --instance-type with a type this region has.`
+    }
+  );
+  return checks;
+}
+export {
+  awsPreflight,
+  bucketExists,
+  callerAccount,
+  createBucket,
+  instanceTypeOffered
+};

package/dist/providers-FW6H6OPF.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  getProvider,
+  listProviders,
+  registerProvider
+} from "./chunk-VUFMZEIM.js";
+export {
+  getProvider,
+  listProviders,
+  registerProvider
+};

package/dist/ready-KDNRBNSU.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import {
+  containerStatus,
+  looksLikeStillBooting
+} from "./chunk-3OLUJPCB.js";
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
+import {
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/ready.ts
+async function bootstrapTail(session, lines = 12, signal) {
+  const command = `(tail -n ${lines} /var/log/cloud-init-output.log 2>/dev/null || journalctl -u google-startup-scripts --no-pager 2>/dev/null | tail -n ${lines}) | tail -n ${lines}`;
+  try {
+    const result = await execPrivileged(session, command, signal);
+    const text = result.stdout.trim();
+    return text === "" ? void 0 : text;
+  } catch {
+    return void 0;
+  }
+}
+async function waitForGateway(session, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e5;
+  const intervalMs = opts.intervalMs ?? 1e4;
+  const port = opts.port ?? GATEWAY_PORT;
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const started = now();
+  const deadline = started + timeoutMs;
+  let lastContainerStatus = "unknown";
+  let lastReason = "not probed yet";
+  let announcedAt = 0;
+  for (; ; ) {
+    if (opts.signal?.aborted) throw new Error("Waiting for the gateway was aborted");
+    const container = await containerStatus(session, "openclaw", opts.signal);
+    lastContainerStatus = container.status;
+    if (container.error) {
+      if (!looksLikeStillBooting(container.error)) {
+        throw new Error(
+          `Could not ask the host about the openclaw container: ${container.error}. This is not the container being absent \u2014 clawops was unable to look.`
+        );
+      }
+      lastContainerStatus = "docker not installed yet";
+    }
+    if (lastContainerStatus === "running") {
+      const probe = await session.exec(probeCommand("started", port), opts.signal);
+      const verdict = interpretProbe("started", probe.stdout);
+      if (verdict.ok) return { waitedMs: now() - started, lastContainerStatus };
+      lastReason = verdict.reason ?? "the gateway did not report itself started";
+    } else {
+      lastReason = container.error ? `docker could not be asked yet: ${container.error}` : `the container is ${lastContainerStatus}`;
+    }
+    const elapsed = now() - started;
+    if (elapsed - announcedAt >= 3e4 || announcedAt === 0) {
+      announcedAt = elapsed;
+      opts.onProgress?.(
+        `Waiting for OpenClaw to start \u2014 ${lastReason}. A first deploy pulls a ~3GB image (${Math.round(elapsed / 1e3)}s so far).`
+      );
+    }
+    if (now() + intervalMs >= deadline) {
+      const tail = await bootstrapTail(session, 12, opts.signal);
+      throw new Error(
+        `The OpenClaw gateway did not answer within ${Math.round(timeoutMs / 1e3)}s. Container: ${lastContainerStatus}. Last check: ${lastReason}.` + (tail ? `
+
+The last of the host's bootstrap log:
+${tail}` : " The instance is up \u2014 `clawops logs --stack <name>` shows what it is doing.")
+      );
+    }
+    await sleep(intervalMs, opts.signal);
+  }
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new Error("Waiting for the gateway was aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+export {
+  bootstrapTail,
+  waitForGateway
+};

package/dist/{remote-config-Z6IIZR3D.js → remote-config-3HZLUWEA.js}

@@ -8,9 +8,10 @@ import {
   deepMerge,
   readRemoteConfig,
   restartGateway
-} from "./chunk-N44K3LHE.js";
+} from "./chunk-2I7KCMXZ.js";
 import "./chunk-NUDIHZEH.js";
-import "./chunk-6TIYVHPX.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 export {
   OPENCLAW_CONFIG,

package/dist/{runtime-LZ7NA53V.js → runtime-X3KW5TCP.js}

@@ -5,7 +5,6 @@ import {
   CONFIG_MOUNT_PATH,
   CONTAINER_UID,
   ENV_FILE_PATH,
-  GATEWAY_PORT,
   PUBLISH_INSPECT_CMD,
   SECURITY_FLAGS,
   STATE_DIR_CONTAINER,
@@ -18,7 +17,10 @@ import {
   publishForRestart,
   publishedGatewayPort,
   stateDirForOS
-} from "./chunk-6TIYVHPX.js";
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 export {
   ADD_HOST_FLAG,

package/dist/server-RWM2JI3D.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import {
+  MCP_HTTP_PORT,
+  authRequirement,
+  bearerFrom,
+  isLoopbackBind,
+  serveMcp
+} from "./chunk-RATEIAFU.js";
+import "./chunk-ZMMRIWFS.js";
+import "./chunk-BOPSG2LI.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-2I7KCMXZ.js";
+import "./chunk-HSPHXG6W.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-SDZKCICH.js";
+import "./chunk-BSLIYB5Q.js";
+import "./chunk-2Z7J3ERQ.js";
+import "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import "./chunk-WTZ2CT35.js";
+import "./chunk-5TXCUOZV.js";
+import "./chunk-NUL5F6YV.js";
+import "./chunk-3OLUJPCB.js";
+import "./chunk-NUDIHZEH.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-LT4XMO5D.js";
+import "./chunk-LEVIW2PV.js";
+import "./chunk-GIEVAGEK.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+import "./chunk-Q7NQY5HV.js";
+import "./chunk-N4WZLWJ4.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
+export {
+  MCP_HTTP_PORT,
+  authRequirement,
+  bearerFrom,
+  isLoopbackBind,
+  serveMcp
+};

package/dist/ssh-VAI5DU5M.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  connect,
+  describeConnectError
+} from "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  connect,
+  describeConnectError
+};

package/dist/ssh-key-DUO6OKOI.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import {
+  resolvePublicKey
+} from "./chunk-AEEMRFZV.js";
+export {
+  resolvePublicKey
+};

package/dist/stack-config-R4SPSUQZ.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  writeStackConfig
+} from "./chunk-HSPHXG6W.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  writeStackConfig
+};

package/dist/{validate-BOQRWX4F.js → validate-YVI3BJ55.js}

@@ -4,7 +4,7 @@ import {
   validatePlan,
   validatePlanConfig,
   validatePlanNetwork
-} from "./chunk-YR3O2I3S.js";
+} from "./chunk-BSLIYB5Q.js";
 import "./chunk-JW5A7E3X.js";
 export {
   assertValidPlan,

package/dist/wait-WO72TRRQ.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import {
+  connect
+} from "./chunk-E4NJSJ54.js";
+import "./chunk-MC5ATCXS.js";
+import {
+  NetworkError
+} from "./chunk-KGXPLI7W.js";
+
+// src/transport/wait.ts
+var TRANSIENT = [
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ECONNRESET",
+  "EPIPE",
+  "ENOTFOUND",
+  "Timed out while waiting for handshake",
+  "Connection closed by server",
+  "Connection lost before handshake",
+  "All configured authentication methods failed"
+];
+function isTransient(message) {
+  return TRANSIENT.some((t) => message.includes(t));
+}
+async function waitForSsh(conn, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 3e5;
+  const intervalMs = opts.intervalMs ?? 5e3;
+  const connect2 = opts.connect ?? connect;
+  const sleep = opts.sleep ?? defaultSleep;
+  const deadline = Date.now() + timeoutMs;
+  let attempts = 0;
+  let lastError = "no attempt completed";
+  for (; ; ) {
+    if (opts.signal?.aborted) throw new NetworkError("Waiting for SSH was aborted");
+    attempts++;
+    try {
+      const session = await connect2({ ...conn, signal: opts.signal });
+      if (attempts > 1) opts.onProgress?.(`SSH is up after ${attempts} attempts.`);
+      return session;
+    } catch (err) {
+      lastError = err instanceof Error ? err.message : String(err);
+      if (!isTransient(lastError)) {
+        throw new NetworkError(
+          `SSH to ${conn.host}:${conn.port} failed for a reason waiting will not fix: ${lastError}`
+        );
+      }
+      if (attempts === 1) {
+        opts.onProgress?.(
+          `Waiting for ${conn.host}:${conn.port} to accept SSH \u2014 a new instance takes a minute.`
+        );
+      }
+    }
+    if (Date.now() + intervalMs >= deadline) {
+      throw new NetworkError(
+        `${conn.host}:${conn.port} did not accept SSH within ${Math.round(timeoutMs / 1e3)}s (${attempts} attempts, last error: ${lastError}). The instance may still be booting, or the firewall may not admit this machine \u2014 check \`clawops doctor --stack <name>\`.`
+      );
+    }
+    await sleep(intervalMs, opts.signal);
+  }
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new NetworkError("Waiting for SSH was aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+export {
+  isTransient,
+  waitForSsh
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -33,18 +33,24 @@
     "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
     "test:changed": "vitest --changed",
     "test:integration": "vitest run --config vitest.integration.config.ts",
+    "test:cloud": "bash scripts/e2e/cloud.sh",
     "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
     "lint": "eslint --max-warnings=0 src tests scripts",
     "gen:schemas": "tsx scripts/gen-schemas.ts",
     "changeset": "changeset",
     "release": "pnpm build && changeset publish",
-    "test:mutation": "node scripts/dev/mutation-check.mjs"
+    "test:mutation": "node scripts/dev/mutation-check.mjs",
+    "graph": "node scripts/dev/graph.mjs",
+    "verify:pack": "node scripts/dev/verify-pack.mjs"
   },
   "dependencies": {
+    "@aws-sdk/client-bedrock": "^3.1063.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.1063.0",
     "@aws-sdk/client-ec2": "^3.1063.0",
     "@aws-sdk/client-guardduty": "^3.1063.0",
     "@aws-sdk/client-iam": "^3.1063.0",
+    "@aws-sdk/client-s3": "3.1132.0",
+    "@aws-sdk/client-sts": "3.1132.0",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@pulumi/aws": "^6.0.0",
     "@pulumi/azure-native": "^2.0.0",
@@ -58,6 +64,7 @@
     "chalk": "^5.0.0",
     "citty": "^0.1.0",
     "conf": "^12.0.0",
+    "google-auth-library": "^11.0.2",
     "inquirer": "^9.0.0",
     "ora": "^8.0.0",
     "ssh2": "^1.0.0",
@@ -82,7 +89,8 @@
   },
   "pnpm": {
     "overrides": {
-      "@pulumi/pulumi": "^3.0.0"
+      "@pulumi/pulumi": "^3.0.0",
+      "@smithy/types": "4.14.3"
     },
     "onlyBuiltDependencies": [
       "@pulumi/command",