@clawops/cli 2.1.2 → 2.2.0

package/dist/chunk-755X5OGS.js

@@ -0,0 +1,213 @@
+#!/usr/bin/env node
+import {
+  getConfig,
+  getConfigDir,
+  setConfig
+} from "./chunk-GFIR2IIJ.js";
+
+// src/config/init.ts
+import { spawnSync } from "child_process";
+import { writeFileSync, mkdirSync, existsSync } from "fs";
+import path from "path";
+
+// src/providers/state-bucket.ts
+function deriveStateBucket(provider, scope) {
+  if (provider === "azure") {
+    return { ok: true, name: "clawops-state" };
+  }
+  if (!scope.account) {
+    return {
+      ok: false,
+      needs: provider === "aws" ? "an AWS account id \u2014 set AWS_PROFILE, or run `aws sso login --profile <name>`" : "a GCP project \u2014 run `gcloud config set project <id>`, or set GOOGLE_CLOUD_PROJECT"
+    };
+  }
+  if (provider === "gcp") return { ok: true, name: `clawops-state-${scope.account}` };
+  if (!scope.region) return { ok: false, needs: "a region" };
+  return { ok: true, name: `clawops-state-${scope.account}-${scope.region}` };
+}
+function stateUrlFor(provider, bucket) {
+  const verdict = validateStateBucket(provider, bucket);
+  if (verdict !== true) throw new Error(`Not a usable ${provider} state backend name: ${verdict}`);
+  const scheme = provider === "aws" ? "s3://" : provider === "gcp" ? "gs://" : "azblob://";
+  return provider === "azure" ? `${scheme}${bucket}` : `${scheme}${bucket}/clawops`;
+}
+var IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function validateStateBucket(provider, name) {
+  const n = name.trim();
+  if (n === "") return "Required";
+  if (n !== name) return "No leading or trailing spaces";
+  if (n.length < 3) return `Too short \u2014 ${labelFor(provider)} names are at least 3 characters`;
+  const dotted = provider === "gcp" && n.includes(".");
+  const max = dotted ? 222 : 63;
+  if (n.length > max) return `Too long \u2014 ${labelFor(provider)} names are at most ${max} characters`;
+  if (dotted && n.split(".").some((part) => part.length > 63)) {
+    return "Each dot-separated part of a Cloud Storage name is at most 63 characters";
+  }
+  if (n !== n.toLowerCase()) return "Lowercase only";
+  if (provider === "azure") {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(n)) {
+      return "Letters, digits and single hyphens only, starting and ending with a letter or digit";
+    }
+    return true;
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/.test(n)) {
+    return "Letters, digits, dots, hyphens and underscores only, starting and ending with a letter or digit";
+  }
+  if (n.includes("..")) return "No consecutive dots";
+  if (IPV4.test(n)) return "Cannot be formatted as an IP address";
+  if (provider === "aws") {
+    if (n.startsWith("xn--")) return 'Cannot start with "xn--"';
+    if (n.startsWith("sthree-")) return 'Cannot start with "sthree-"';
+    if (n.endsWith("-s3alias")) return 'Cannot end with "-s3alias"';
+    if (n.endsWith("--ol-s3")) return 'Cannot end with "--ol-s3"';
+    if (n.includes("_")) return "Underscores are not allowed in S3 bucket names";
+    return true;
+  }
+  if (n.startsWith("goog")) return 'Cannot start with "goog"';
+  if (n.includes("google")) return 'Cannot contain "google"';
+  return true;
+}
+function labelFor(provider) {
+  if (provider === "aws") return "S3 bucket";
+  if (provider === "gcp") return "Cloud Storage bucket";
+  return "blob container";
+}
+async function resolveScopeAccount(provider, signal) {
+  if (provider === "azure") return void 0;
+  try {
+    if (provider === "aws") {
+      const { callerAccount } = await import("./preflight-TFD4N5ZU.js");
+      return await callerAccount(signal);
+    }
+    const { resolveProjectId } = await import("./preflight-IE2YWBAC.js");
+    return resolveProjectId();
+  } catch {
+    return void 0;
+  }
+}
+
+// src/config/init.ts
+var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
+var PROVIDER_DEFAULTS = {
+  gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
+  aws: { region: "us-east-1", credEnv: "AWS_PROFILE", stateScheme: "s3://" },
+  azure: { region: "eastus", credEnv: "AZURE_CLIENT_ID", stateScheme: "azblob://" }
+};
+async function initStack(opts) {
+  const provider = opts.provider;
+  if (!SUPPORTED_PROVIDERS.includes(provider)) {
+    return {
+      ok: false,
+      reason: `Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`
+    };
+  }
+  const stackName = opts.stackName ?? "default";
+  const existing = getConfig();
+  if (existing?.stacks[stackName] && !opts.force) {
+    return {
+      ok: false,
+      reason: `Stack "${stackName}" already exists in ${path.join(getConfigDir(), "config.json")} (${existing.stacks[stackName].stateUrl}). Pass force to overwrite its settings, or use a different stack name to add another one.`
+    };
+  }
+  const configDir = getConfigDir();
+  mkdirSync(configDir, { recursive: true });
+  const keyPath = opts.keyPath ?? path.join(configDir, "id_ed25519");
+  const knownHostsPath = path.join(configDir, "known_hosts");
+  let keyGenerated = false;
+  if (!existsSync(keyPath)) {
+    if (opts.keyPath) return { ok: false, reason: `SSH key not found at ${keyPath}` };
+    const gen = spawnSync(
+      "ssh-keygen",
+      ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops", "-q"],
+      { stdio: ["ignore", "pipe", "pipe"] }
+    );
+    if (gen.error || gen.status !== 0) {
+      const reason = gen.error?.message ?? gen.stderr?.toString().trim() ?? `exit ${gen.status}`;
+      return {
+        ok: false,
+        reason: `Could not generate an SSH key: ${reason}
+Generate one yourself and point clawops at it:
+  ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops
+  clawops init --key-path ${keyPath}`
+      };
+    }
+    keyGenerated = true;
+  }
+  if (!existsSync(knownHostsPath)) writeFileSync(knownHostsPath, "", "utf-8");
+  if (provider === "local") {
+    if (!opts.host) return { ok: false, reason: "host is required for the local provider" };
+    const config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
+      provider,
+      stateUrl: "file://~/.clawops/state",
+      credentialsRef: { source: "file", envVars: [] },
+      localOpts: {
+        host: opts.host,
+        sshUser: opts.sshUser ?? "root",
+        sshPort: opts.sshPort ?? 22,
+        sshKeyPath: keyPath
+      }
+    });
+    setConfig(config);
+    return {
+      ok: true,
+      configPath: path.join(configDir, "config.json"),
+      stackName,
+      provider,
+      stateUrl: "file://~/.clawops/state",
+      keyPath,
+      keyGenerated
+    };
+  }
+  const defaults = PROVIDER_DEFAULTS[provider];
+  const region = opts.region ?? defaults.region;
+  let stateUrl;
+  if (opts.stateUrl) {
+    stateUrl = opts.stateUrl;
+  } else {
+    const account = await resolveScopeAccount(provider);
+    const derived = deriveStateBucket(provider, { account, region });
+    if (!derived.ok) {
+      return {
+        ok: false,
+        reason: `Could not name a state backend for ${provider}: clawops needs ${derived.needs}. Authenticate first, or name the backend yourself, e.g. ${defaults.stateScheme}your-bucket/clawops`
+      };
+    }
+    stateUrl = stateUrlFor(provider, derived.name);
+  }
+  setConfig(
+    merge(existing, stackName, provider, keyPath, knownHostsPath, {
+      provider,
+      stateUrl,
+      region,
+      credentialsRef: { source: "env", envVars: [defaults.credEnv] }
+    })
+  );
+  return {
+    ok: true,
+    configPath: path.join(configDir, "config.json"),
+    stackName,
+    provider,
+    stateUrl,
+    region,
+    keyPath,
+    keyGenerated
+  };
+}
+function merge(existing, stackName, provider, keyPath, knownHostsPath, stack) {
+  return {
+    ...existing ?? {},
+    version: 1,
+    defaults: { stack: stackName, provider },
+    stacks: { ...existing?.stacks ?? {}, [stackName]: stack },
+    ssh: { keyPath, knownHostsPath }
+  };
+}
+
+export {
+  deriveStateBucket,
+  validateStateBucket,
+  resolveScopeAccount,
+  SUPPORTED_PROVIDERS,
+  PROVIDER_DEFAULTS,
+  initStack
+};

package/dist/{chunk-QDNFADJI.js → chunk-AVERNLUY.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
+import {
+  getProvider
+} from "./chunk-VUFMZEIM.js";
 import {
   readLocalState
-} from "./chunk-ELU3XQEA.js";
+} from "./chunk-RDUKRIRC.js";
 import {
   getConfigDir,
   requireConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
-import {
-  getProvider
-} from "./chunk-VUFMZEIM.js";
 
 // src/cli/context.ts
 function buildContext(args) {
@@ -41,7 +41,7 @@ function buildContext(args) {
           `Stack "${stackName}" not found in config. Run \`clawops init\` or use \`--stack\` to specify a different stack.`
         );
       }
-      const { getOrCreateStack } = await import("./automation-MKCJ46I6.js");
+      const { getOrCreateStack } = await import("./automation-NBYQ6MFZ.js");
       stackCache = await getOrCreateStack({
         stack: stackName,
         stateUrl: stackConfig.stateUrl,

package/dist/{chunk-R3DTA35B.js → chunk-AX65JMDZ.js}

@@ -2,31 +2,31 @@
 import {
   resolveSecrets
 } from "./chunk-BOPSG2LI.js";
-import {
-  saveOverlay
-} from "./chunk-6ZFIFDBJ.js";
 import {
   atomicWriteConfig,
   deepMerge,
   readRemoteConfig,
   restartGateway
-} from "./chunk-2I7KCMXZ.js";
-import {
-  writeStackConfig
-} from "./chunk-3Z5TDXCJ.js";
+} from "./chunk-UAJJEDCJ.js";
 import {
   validatePlan
-} from "./chunk-XFN3YDZE.js";
+} from "./chunk-PASAVVNS.js";
+import {
+  writeStackConfig
+} from "./chunk-55UMO37O.js";
 import {
   buildContext
-} from "./chunk-QDNFADJI.js";
+} from "./chunk-AVERNLUY.js";
+import {
+  saveOverlay
+} from "./chunk-6ZFIFDBJ.js";
 import {
   GATEWAY_PORT
 } from "./chunk-VOEJYRIK.js";
 import {
   getConfig,
   setConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -54,7 +54,7 @@ ${validation.errors.join("\n")}`
   });
   const stack = await ctx.getStack();
   const { guardPrivateOnlyApply } = await import("./private-only-DIA26I2E.js");
-  const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+  const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
   await guardPrivateOnlyApply(plan, ctx, opts?.probeTailnet ?? ((conn2) => probeSsh(conn2, opts?.signal)));
   await writeStackConfig(stack, plan);
   if (plan.metadata.stackVersion !== void 0) {
@@ -84,7 +84,7 @@ The diff you reviewed may no longer reflect what will be applied.
       changeSummary[op] = count;
     }
   }
-  const { waitForSsh } = await import("./wait-WO72TRRQ.js");
+  const { waitForSsh } = await import("./wait-DOUNNJNN.js");
   const conn = await connectionInfoFor(ctx, outputs);
   if (opts?.skipReadiness) {
     return { outputs, changeSummary, durationMs: Date.now() - start };
@@ -93,7 +93,7 @@ The diff you reviewed may no longer reflect what will be applied.
     signal: opts?.signal,
     onProgress: (line) => reportProgress(opts, line)
   });
-  const { waitForGateway } = await import("./ready-KDNRBNSU.js");
+  const { waitForGateway } = await import("./ready-IJEUBFVX.js");
   try {
     await waitForGateway(readySession, {
       signal: opts?.signal,
@@ -129,7 +129,7 @@ function expandHome(p) {
   return p.replace(/^~/, process.env["HOME"] ?? "~");
 }
 async function applyConfigOverlay(plan, outputs, ctx, signal) {
-  const { connect } = await import("./ssh-VAI5DU5M.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
   const session = await connect({ ...await connectionInfoFor(ctx, outputs), signal });
   try {
     const remote = await readRemoteConfig(session, signal);
@@ -158,7 +158,7 @@ async function applyConfigOverlay(plan, outputs, ctx, signal) {
 async function installProviderPlugins(session, cfg, openclawVersion, signal) {
   const [{ requiredPlugins, installCommand }, { STATE_DIR_HOST_LINUX }, yaml, { readFileSync }, { join }, { resolveSpecDir }] = await Promise.all([
     import("./plugins-DTST3OER.js"),
-    import("./runtime-X3KW5TCP.js"),
+    import("./runtime-VW53TU2W.js"),
     import("./js-yaml-PTEEG4FO.js"),
     import("fs"),
     import("path"),
@@ -169,7 +169,7 @@ async function installProviderPlugins(session, cfg, openclawVersion, signal) {
   );
   const needed = requiredPlugins(cfg, catalog);
   if (needed.length === 0) return;
-  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const { execPrivileged } = await import("./privileged-5Y6O4H7Z.js");
   const image = `ghcr.io/openclaw/openclaw:${openclawVersion}`;
   for (const plugin of needed) {
     const result = await execPrivileged(
@@ -187,7 +187,7 @@ async function installProviderPlugins(session, cfg, openclawVersion, signal) {
 }
 async function verifyProviders(session, cfg, signal) {
   const { missingProviders } = await import("./plugins-DTST3OER.js");
-  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const { execPrivileged } = await import("./privileged-5Y6O4H7Z.js");
   const result = await execPrivileged(
     session,
     "docker exec openclaw openclaw plugins list --json",
@@ -213,10 +213,10 @@ async function loadChannelCatalog() {
   return yaml.load(readFileSync(join(resolveSpecDir(), "integrations.yaml"), "utf-8"));
 }
 async function installChannelPlugins(session, cfg, openclawVersion, signal) {
-  const [{ requiredChannelPlugins, channelInstallCommand }, { STATE_DIR_HOST_LINUX }] = await Promise.all([import("./channels-KBUR42IU.js"), import("./runtime-X3KW5TCP.js")]);
+  const [{ requiredChannelPlugins, channelInstallCommand }, { STATE_DIR_HOST_LINUX }] = await Promise.all([import("./channels-KBUR42IU.js"), import("./runtime-VW53TU2W.js")]);
   const needed = requiredChannelPlugins(cfg, await loadChannelCatalog());
   if (needed.length === 0) return;
-  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const { execPrivileged } = await import("./privileged-5Y6O4H7Z.js");
   const image = `ghcr.io/openclaw/openclaw:${openclawVersion}`;
   for (const plugin of needed) {
     const result = await execPrivileged(
@@ -234,7 +234,7 @@ async function installChannelPlugins(session, cfg, openclawVersion, signal) {
 }
 async function verifyChannels(session, cfg, signal) {
   const { missingChannels, CHANNELS_LIST_CMD } = await import("./channels-KBUR42IU.js");
-  const { execPrivileged } = await import("./privileged-JFA6LLTV.js");
+  const { execPrivileged } = await import("./privileged-5Y6O4H7Z.js");
   const result = await execPrivileged(session, CHANNELS_LIST_CMD, signal);
   if (result.code !== 0) return;
   const missing = missingChannels(cfg, result.stdout, await loadChannelCatalog());