@clawops/cli 2.1.3 → 2.2.0

package/dist/chunk-PCSX6Y3U.js

@@ -0,0 +1,297 @@
+#!/usr/bin/env node
+import {
+  execPrivileged,
+  execPrivilegedWithInput,
+  streamPrivileged
+} from "./chunk-WPZIJONN.js";
+import {
+  CONTAINER_UID,
+  stateDirForOS
+} from "./chunk-N5ZYUTZS.js";
+
+// src/openclaw/backup-flows.ts
+import { createReadStream, createWriteStream, statSync } from "fs";
+import { pipeline } from "stream/promises";
+
+// src/openclaw/restore.ts
+var SUPPORTED_MANIFEST_SCHEMA = 1;
+function locateRestoredState(manifestJson, bundleRoot) {
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestJson);
+  } catch {
+    return { ok: false, reason: "The restored archive has no readable manifest.json." };
+  }
+  if (manifest.schemaVersion !== SUPPORTED_MANIFEST_SCHEMA) {
+    return {
+      ok: false,
+      reason: `This archive declares manifest schemaVersion ${String(manifest.schemaVersion)}, and clawops has only been tested against ${SUPPORTED_MANIFEST_SCHEMA}. Its layout may have changed, so clawops will not move it into place. The archive is expanded and can be adopted by hand.`
+    };
+  }
+  const archiveRoot = typeof manifest.archiveRoot === "string" ? manifest.archiveRoot : "";
+  const stateDir = typeof manifest.paths?.stateDir === "string" ? manifest.paths.stateDir : "";
+  if (!archiveRoot || !stateDir) {
+    return { ok: false, reason: "The manifest names no archiveRoot or stateDir, so clawops cannot tell which directory to adopt." };
+  }
+  return {
+    ok: true,
+    stateDirInArchive: stateDir,
+    statePath: `${bundleRoot}/${archiveRoot}/payload/posix/${stateDir.replace(/^\/+/, "")}`
+  };
+}
+async function move(exec, from, to) {
+  const r = await exec(`mv ${shellArg(from)} ${shellArg(to)}`);
+  if (r.code === 0) return null;
+  return (r.stderr || r.stdout).trim().split("\n").slice(-1)[0] || `mv exited ${r.code}`;
+}
+async function activateRestored(opts) {
+  const { stateDir, staging, exec, restart, waitHealthy } = opts;
+  const stamp = new Date(opts.now?.() ?? Date.now()).toISOString().replace(/[:.]/g, "-");
+  const parent = stateDir.replace(/\/+$/, "").replace(/\/[^/]+$/, "") || "/";
+  const preserved = `${stateDir}.pre-restore-${stamp}`;
+  const holding = `${parent}/.clawops-restored-${stamp}`;
+  const exists = await exec(`test -d ${shellArg(staging)} && echo yes || echo no`);
+  if (exists.stdout.trim() !== "yes") {
+    return { ok: false, reason: `The restored archive is not at ${staging}.`, rolledBack: false };
+  }
+  const outFirst = await move(exec, staging, holding);
+  if (outFirst) {
+    return { ok: false, reason: `Could not move the restored state clear of the live directory: ${outFirst}`, rolledBack: false };
+  }
+  const asideErr = await move(exec, stateDir, preserved);
+  if (asideErr) {
+    await move(exec, holding, staging);
+    return { ok: false, reason: `Could not set the current state aside: ${asideErr}`, rolledBack: false };
+  }
+  const inErr = await move(exec, holding, stateDir);
+  if (inErr) {
+    await move(exec, preserved, stateDir);
+    return { ok: false, reason: `Could not move the restored state into place: ${inErr}`, rolledBack: true };
+  }
+  try {
+    await restart();
+    await waitHealthy();
+    return { ok: true, preserved };
+  } catch (err) {
+    const keptFailed = `${stateDir}.failed-restore-${stamp}`;
+    const reason = err instanceof Error ? err.message : String(err);
+    const parkErr = await move(exec, stateDir, keptFailed);
+    if (parkErr) {
+      return {
+        ok: false,
+        rolledBack: false,
+        preserved,
+        reason: `The gateway did not come up (${reason}), and the restored state could not be moved aside to roll back (${parkErr}). The previous state is at ${preserved}.`
+      };
+    }
+    const backErr = await move(exec, preserved, stateDir);
+    if (backErr) {
+      return {
+        ok: false,
+        rolledBack: false,
+        keptFailed,
+        reason: `The gateway did not come up (${reason}), and the previous state could not be put back (${backErr}). It is at ${preserved}; the restored state is at ${keptFailed}.`
+      };
+    }
+    await restart().catch(() => void 0);
+    return {
+      ok: false,
+      rolledBack: true,
+      keptFailed,
+      reason: `The gateway did not come up with the restored state (${reason}). The previous state has been put back.`
+    };
+  }
+}
+async function hasRoomFor(exec, dir, bytes) {
+  const r = await exec(`df -Pk ${shellArg(dir)} | tail -1 | awk '{print $4}'`);
+  const availableKb = Number.parseInt(r.stdout.trim(), 10);
+  if (!Number.isFinite(availableKb)) return { ok: true };
+  const availableBytes = availableKb * 1024;
+  return availableBytes >= bytes ? { ok: true } : { ok: false, availableBytes, neededBytes: bytes };
+}
+function shellArg(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/openclaw/backup-flows.ts
+function defaultBackupFilename(now = /* @__PURE__ */ new Date()) {
+  return `openclaw-backup-${now.toISOString().replace(/[:.]/g, "-")}.tar.gz`;
+}
+var ARCHIVE_IS_A_CREDENTIAL = [
+  "Saved with mode 0600. The archive contains the state database \u2014 OAuth tokens,",
+  "secrets and device credentials, unencrypted. Treat it as a credential."
+];
+var PLUGINS_NOT_CARRIED = [
+  "Provider plugins are not carried in the archive; re-run `clawops apply` to",
+  "reinstall them, or the gateway starts without its model providers."
+];
+function nothingChanged(stagingOnHost) {
+  return `The expanded archive is at ${stagingOnHost}; nothing has been changed.`;
+}
+function mib(bytes) {
+  return `${Math.round(bytes / 1024 / 1024)} MiB`;
+}
+async function createBackup(session, opts) {
+  const { outPath, signal } = opts;
+  opts.onPhase?.("creating");
+  const remoteArchive = "/tmp/clawops-backup.tar.gz";
+  const createResult = await execPrivileged(
+    session,
+    `docker exec openclaw sh -lc 'rm -f ${remoteArchive} && openclaw backup create --output ${remoteArchive} --verify --json'`,
+    signal
+  );
+  if (createResult.code !== 0) {
+    return { ok: false, reason: `Backup failed on the remote host: ${createResult.stderr.slice(0, 300)}` };
+  }
+  const backupStream = await streamPrivileged(session, `docker exec openclaw cat ${remoteArchive}`, signal);
+  opts.onPhase?.("downloading");
+  const fileStream = createWriteStream(outPath, { mode: 384 });
+  await pipeline(backupStream, fileStream);
+  await execPrivileged(session, `docker exec openclaw rm -f ${remoteArchive}`, signal);
+  return { ok: true, path: outPath };
+}
+async function stageRestore(session, opts) {
+  const { file, signal } = opts;
+  const remoteArchive = "/tmp/clawops-restore.tar.gz";
+  const stamp = (opts.now ?? Date.now)();
+  const stagingInContainer = `/tmp/clawops-restored-${stamp}`;
+  const hostExec = (command) => execPrivileged(session, command, signal);
+  const osProbe = await session.exec("uname -s", signal);
+  const stateDir = stateDirForOS(osProbe.stdout.trim() === "Darwin" ? "Darwin" : "Linux");
+  const stateParent = stateDir.replace(/\/+$/, "").replace(/\/[^/]+$/, "") || "/";
+  const stagingOnHost = `${stateParent}/.clawops-restored-${stamp}`;
+  const archiveBytes = statSync(file).size;
+  const room = await hasRoomFor(hostExec, stateDir, archiveBytes * 3);
+  if (!room.ok) {
+    return {
+      ok: false,
+      kind: "refused",
+      reason: `Not enough free space on the host to expand this archive: ${mib(room.availableBytes)} available where the state lives, and the restore needs about ${mib(room.neededBytes)}. Free some space and run this again; nothing has been changed.`
+    };
+  }
+  opts.onPhase?.("uploading");
+  const uploadResult = await execPrivilegedWithInput(
+    session,
+    `docker exec -i openclaw sh -c 'cat > ${remoteArchive}'`,
+    createReadStream(file),
+    signal
+  );
+  if (uploadResult.code !== 0) {
+    return { ok: false, kind: "failed", reason: `Could not upload the archive: ${uploadResult.stderr.slice(0, 300)}` };
+  }
+  opts.onPhase?.("restoring");
+  const restore = await execPrivileged(
+    session,
+    `docker exec openclaw openclaw backup restore ${remoteArchive} --target ${stagingInContainer} --json`,
+    signal
+  );
+  await execPrivileged(session, `docker exec openclaw rm -f ${remoteArchive}`, signal);
+  if (restore.code !== 0) {
+    return { ok: false, kind: "failed", reason: `Restore failed: ${(restore.stderr || restore.stdout).slice(0, 400)}` };
+  }
+  const copyOut = await hostExec(`docker cp openclaw:${stagingInContainer} ${stagingOnHost}`);
+  await execPrivileged(session, `docker exec openclaw rm -rf ${stagingInContainer}`, signal);
+  if (copyOut.code !== 0) {
+    return {
+      ok: false,
+      kind: "failed",
+      reason: `The archive was restored inside the container but could not be copied to the host: ${(copyOut.stderr || copyOut.stdout).slice(0, 300)}`
+    };
+  }
+  let report = {};
+  let unparsedReport;
+  try {
+    report = JSON.parse(restore.stdout.trim());
+  } catch {
+    unparsedReport = restore.stdout;
+  }
+  const manifestRead = await hostExec(`cat ${stagingOnHost}/*/manifest.json`);
+  const located = locateRestoredState(manifestRead.stdout, stagingOnHost);
+  if (!located.ok) {
+    return {
+      ok: false,
+      kind: "unadoptable",
+      reason: located.reason,
+      stagingOnHost,
+      ...unparsedReport !== void 0 ? { unparsedReport } : {}
+    };
+  }
+  return {
+    ok: true,
+    stateDir,
+    stagingOnHost,
+    statePath: located.statePath,
+    stateDirInArchive: located.stateDirInArchive,
+    ...report.entryCount !== void 0 ? { entryCount: report.entryCount } : {},
+    warnings: report.warnings ?? [],
+    ...unparsedReport !== void 0 ? { unparsedReport } : {}
+  };
+}
+async function activateStaged(session, staged, opts = {}) {
+  const { signal } = opts;
+  const hostExec = (command) => execPrivileged(session, command, signal);
+  const { restartGateway } = await import("./remote-config-OZYBMBSK.js");
+  const { waitForGateway } = await import("./ready-IJEUBFVX.js");
+  opts.onPhase?.("activating");
+  const chown = await hostExec(`chown -R ${CONTAINER_UID}:${CONTAINER_UID} ${staged.statePath}`);
+  if (chown.code !== 0) {
+    opts.onPhase?.("done");
+    return {
+      ok: false,
+      reason: `Could not give the restored state to the gateway's user: ${(chown.stderr || chown.stdout).slice(0, 200)}`,
+      stagingOnHost: staged.stagingOnHost
+    };
+  }
+  const outcome = await activateRestored({
+    stateDir: staged.stateDir,
+    staging: staged.statePath,
+    exec: hostExec,
+    restart: async () => {
+      opts.onPhase?.("restarting");
+      await restartGateway(session, signal);
+    },
+    waitHealthy: async () => {
+      opts.onPhase?.("waiting");
+      await waitForGateway(session, { ...signal ? { signal } : {}, timeoutMs: 18e4 });
+    }
+  });
+  opts.onPhase?.("done");
+  if (!outcome.ok) {
+    return {
+      ok: false,
+      reason: outcome.reason,
+      ...outcome.keptFailed ? { keptFailed: outcome.keptFailed } : {},
+      ...outcome.preserved ? { preserved: outcome.preserved } : {}
+    };
+  }
+  await hostExec(`rm -rf ${staged.stagingOnHost}`);
+  return { ok: true, preserved: outcome.preserved };
+}
+function activationFailureDetail(outcome) {
+  const lines = [];
+  if (outcome.stagingOnHost) lines.push(nothingChanged(outcome.stagingOnHost));
+  if (outcome.keptFailed) lines.push(`The restored state was kept at ${outcome.keptFailed}.`);
+  if (outcome.preserved) lines.push(`The previous state is at ${outcome.preserved}.`);
+  return lines;
+}
+function activatedLines(preserved) {
+  return [
+    `The state it replaced is at ${preserved}.`,
+    "Remove that directory once you are satisfied; clawops will not.",
+    ...PLUGINS_NOT_CARRIED
+  ];
+}
+var ACTIVATED = "The restored state is live and the gateway is answering.";
+
+export {
+  defaultBackupFilename,
+  ARCHIVE_IS_A_CREDENTIAL,
+  PLUGINS_NOT_CARRIED,
+  nothingChanged,
+  createBackup,
+  stageRestore,
+  activateStaged,
+  activationFailureDetail,
+  activatedLines,
+  ACTIVATED
+};

package/dist/chunk-POYS3EVQ.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+
+// src/errors/pulumi.ts
+function pulumiCause(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  const lines = raw.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+  const explained = lines.find((l) => /(^|\s)error:/i.test(l));
+  if (explained) return explained.replace(/^.*?error:\s*/i, "");
+  return lines[0] ?? raw;
+}
+
+export {
+  pulumiCause
+};

package/dist/chunk-SX75L2T3.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import {
+  pulumiCause
+} from "./chunk-POYS3EVQ.js";
+import {
+  StateError
+} from "./chunk-KGXPLI7W.js";
+
+// src/transport/conn.ts
+async function resolveConn(ctx) {
+  if (ctx.adapter.name === "local") {
+    const state = ctx.localState;
+    if (!state) throw new StateError("Stack has no local state \u2014 run `clawops up` first.");
+    return {
+      host: state.sshHost,
+      port: state.sshPort,
+      user: state.sshUser,
+      privateKeyPath: state.privateKeyPath,
+      knownHostsPath: state.knownHostsPath
+    };
+  }
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  let outputs;
+  try {
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    outputs = Object.fromEntries(Object.entries(outputMap).map(([k, v]) => [k, v.value]));
+  } catch (err) {
+    throw new StateError(
+      `Could not read the state of stack "${ctx.stackName}": ${pulumiCause(err)}. Check that the credentials for its state backend are in this process's environment (for an MCP server, the env block of its client config).`
+    );
+  }
+  if (!outputs["publicIp"]) {
+    throw new StateError("Stack has no outputs \u2014 run `clawops up` first.");
+  }
+  const base = extractBaseOutputs(outputs);
+  return ctx.adapter.getConnectionInfo({
+    ...base,
+    privateKeyPath: ctx.config.ssh.keyPath,
+    knownHostsPath: ctx.config.ssh.knownHostsPath
+  });
+}
+
+export {
+  resolveConn
+};

package/dist/{chunk-2Z7J3ERQ.js → chunk-TYNMOYVM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   connect
-} from "./chunk-E4NJSJ54.js";
+} from "./chunk-4PY6PN4G.js";
 import {
   NetworkError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-2I7KCMXZ.js → chunk-UAJJEDCJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   execPrivileged
-} from "./chunk-NUDIHZEH.js";
+} from "./chunk-WPZIJONN.js";
 import {
   CONTAINER_UID,
   PUBLISH_INSPECT_CMD,
@@ -9,7 +9,7 @@ import {
   gatewayRunCommand,
   publishForRestart,
   stateDirForOS
-} from "./chunk-GIEVAGEK.js";
+} from "./chunk-N5ZYUTZS.js";
 import {
   GATEWAY_PORT,
   IMAGE_INSPECT_CMD,

package/dist/{chunk-NUDIHZEH.js → chunk-WPZIJONN.js}

@@ -13,8 +13,19 @@ function looksLikePermissionDenied(result) {
   return text.includes("permission denied") || text.includes("docker.sock") || text.includes("operation not permitted");
 }
 var sudoNeeded = /* @__PURE__ */ new WeakMap();
+var dockerSudoNeeded = /* @__PURE__ */ new WeakMap();
 function resetPrivilegeCache(session) {
   sudoNeeded.delete(session);
+  dockerSudoNeeded.delete(session);
+}
+async function dockerNeedsSudo(session, signal) {
+  const key = session;
+  const known = dockerSudoNeeded.get(key);
+  if (known !== void 0) return known;
+  const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
+  const needed = looksLikePermissionDenied(probe);
+  dockerSudoNeeded.set(key, needed);
+  return needed;
 }
 async function execPrivileged(session, cmd, signal) {
   const key = session;
@@ -29,20 +40,11 @@ async function execPrivileged(session, cmd, signal) {
   return escalated;
 }
 async function streamPrivileged(session, cmd, signal) {
-  const key = session;
-  if (sudoNeeded.get(key) === void 0) {
-    const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
-    sudoNeeded.set(key, looksLikePermissionDenied(probe));
-  }
-  return session.stream(sudoNeeded.get(key) ? sudoWrap(cmd) : cmd, signal);
+  return session.stream(await dockerNeedsSudo(session, signal) ? sudoWrap(cmd) : cmd, signal);
 }
 async function execPrivilegedWithInput(session, cmd, input, signal) {
-  const key = session;
-  if (sudoNeeded.get(key) === void 0) {
-    const probe = await session.exec('docker version --format "{{.Server.Version}}"', signal);
-    sudoNeeded.set(key, looksLikePermissionDenied(probe));
-  }
-  return session.execWithInput(sudoNeeded.get(key) ? sudoWrap(cmd) : cmd, input, signal);
+  const escalate = await dockerNeedsSudo(session, signal);
+  return session.execWithInput(escalate ? sudoWrap(cmd) : cmd, input, signal);
 }
 
 export {

package/dist/{chunk-CHNSL3TC.js → chunk-YPVWF7IA.js}

@@ -7,7 +7,7 @@ import {
   CONTAINER_UID,
   STATE_DIR_HOST_LINUX,
   gatewayRunCommand
-} from "./chunk-GIEVAGEK.js";
+} from "./chunk-N5ZYUTZS.js";
 import {
   GATEWAY_PORT
 } from "./chunk-VOEJYRIK.js";

package/dist/{chunk-3OLUJPCB.js → chunk-Z3XLWZWF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   execPrivileged
-} from "./chunk-NUDIHZEH.js";
+} from "./chunk-WPZIJONN.js";
 
 // src/openclaw/docker.ts
 function looksLikeStillBooting(detail) {