clawup 1.0.0

package/dist/tools/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../tools/webhooks.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;AAGH,0CAAgE;AAChE,uCAA2D;AAC3D,gDAAoE;AACpE,sDAAiE;AACjE,4DAA4B;AAO5B,kDAAkD;AAClD,MAAM,QAAQ,GAAG;IACf,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,eAAe;CACtB,CAAC;AAEF;;GAEG;AACH,SAAS,OAAO,CACd,IAAiB,EACjB,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;QACjC,IAAI,EAAE,mBAAmB;QACzB,GAAG,QAAQ;QACX,GAAG,eAAQ,IAAI,IAAI,EAAE;QACrB,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED;;GAEG;AACI,MAAM,iBAAiB,GAA6C,KAAK,EAC9E,OAAuB,EACvB,OAA6B,EAC7B,EAAE;IACF,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAE7B,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAEvC,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAA,2BAAe,GAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,2BAAe,GAAE,CAAC;IAE9B,wCAAwC;IACxC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,qBAAY,EAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,UAAU,wBAAwB,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,eAAe;IACf,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1F,IAAI,YAAY,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,kCAAkC,QAAQ,CAAC,SAAS,UAAU,oBAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oBAAoB;IACpB,MAAM,OAAO,GAAG,IAAA,8BAAe,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,sCAAsC,oBAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+BAA+B;IAC/B,MAAM,cAAc,GAAG,IAAA,wBAAS,EAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,YAAY,CAAC,CAC9C,CAAC;IAEF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,GAAG,CAAC,KAAK,CACV,2CAA2C;YAC3C,mEAAmE;YACnE,SAAS,oBAAE,CAAC,IAAI,CAAC,eAAe,CAAC,0BAA0B,CAC5D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,EAAE,CAAC,IAAI,CACL;QACE,qEAAqE;QACrE,uDAAuD;KACxD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,sBAAsB,CACvB,CAAC;IAEF,yCAAyC;IACzC,MAAM,OAAO,GAAwE,EAAE,CAAC;IAExF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,YAAY,CAAuB,CAAC;QAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QAED,EAAE,CAAC,IAAI,CACL;YACE,gBAAgB,oBAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE;YAC7C,EAAE;YACF,QAAQ;YACR,6DAA6D;YAC7D,wBAAwB;YACxB,sDAAsD;YACtD,uDAAuD;SACxD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,GAAG,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,GAAG,CACvC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,sBAAsB,KAAK,CAAC,WAAW,EAAE;YAClD,WAAW,EAAE,sCAAsC;YACnD,QAAQ,EAAE,CAAC,GAAW,EAAE,EAAE;gBACxB,IAAI,CAAC,GAAG;oBAAE,OAAO,4BAA4B,CAAC;YAChD,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,WAAW;YAC5B,MAAM,EAAE,MAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,kEAAkE;IAClE,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;IAC/E,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CACV,QAAQ,EACR,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,qBAAqB,EAAE,MAAM,EAAE,UAAU,CAAC,EACnE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,qCAAqC,CAAC,CAAC;IAEjF,6BAA6B;IAC7B,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACjF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAA,wBAAiB,EAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,cAAc,EAAE,CAAC;QAE3C,sCAAsC;QACtC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,KAAK,GACT,0DAA0D,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ;YAC/H,SAAS,eAAQ,2DAA2D;YAC5E,uCAAuC,eAAQ,0BAA0B,CAAC;QAE5E,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,2CAA2C,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;YAC/D,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,IAAI,CAAC,cAAc,OAAO,WAAW,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,IAAI,CAAC,cAAc,OAAO,cAAc,MAAM,SAAS,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;AACtC,CAAC,CAAC;AApLW,QAAA,iBAAiB,qBAoL5B"}

package/dist/types.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Re-export all types from @clawup/core for backward compatibility.
+ * External consumers importing "clawup/types" will get these.
+ */
+export { validateAgentDefinition, } from "@clawup/core";
+export type { AgentDefinition, ClawupManifest, IdentityManifest, IdentityResult, PluginConfigFile, PrereqResult, } from "@clawup/core";

package/dist/types.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAgentDefinition = void 0;
+/**
+ * Re-export all types from @clawup/core for backward compatibility.
+ * External consumers importing "clawup/types" will get these.
+ */
+var core_1 = require("@clawup/core");
+Object.defineProperty(exports, "validateAgentDefinition", { enumerable: true, get: function () { return core_1.validateAgentDefinition; } });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../types.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,qCAEsB;AADpB,+GAAA,uBAAuB,OAAA"}

package/infra/Pulumi.yaml

@@ -0,0 +1,6 @@
+name: clawup
+description: Multi-agent OpenClaw deployment - PM, Engineer, and Tester
+runtime:
+  name: nodejs
+  options:
+    packagemanager: npm

package/infra/dist/components/cloud-init.js

@@ -0,0 +1,412 @@
+"use strict";
+/**
+ * Cloud-init script generator for OpenClaw agents
+ * Generates the user-data script for EC2 instance provisioning
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateCloudInit = generateCloudInit;
+exports.interpolateCloudInit = interpolateCloudInit;
+exports.compressCloudInit = compressCloudInit;
+const zlib = __importStar(require("zlib"));
+const config_generator_1 = require("./config-generator");
+const core_1 = require("@clawup/core");
+/**
+ * Generates a cloud-init bash script for OpenClaw deployment
+ */
+function generateCloudInit(config) {
+    const gatewayPort = config.gatewayPort ?? 18789;
+    const nodeVersion = config.nodeVersion ?? 22;
+    const nvmVersion = config.nvmVersion ?? "0.40.1";
+    const openclawVersion = config.openclawVersion ?? "latest";
+    const trustedProxies = config.trustedProxies ?? ["127.0.0.1"];
+    // Build PluginEntry[] for config-generator from PluginInstallConfig[]
+    const pluginEntries = (config.plugins ?? []).map((p) => ({
+        name: p.name,
+        enabled: true,
+        config: p.config ?? {},
+        secretEnvVars: p.secretEnvVars,
+    }));
+    // Extract braveApiKey from depSecrets for config-generator (special case)
+    const braveApiKey = config.depSecrets?.["BRAVE_API_KEY"];
+    const codingAgentName = config.codingAgent ?? "claude-code";
+    const codingAgentEntry = core_1.CODING_AGENT_REGISTRY[codingAgentName];
+    const configPatchScript = (0, config_generator_1.generateConfigPatchScript)({
+        gatewayPort,
+        gatewayToken: config.gatewayToken,
+        trustedProxies,
+        enableControlUi: true,
+        plugins: pluginEntries,
+        braveApiKey: braveApiKey,
+        backupModel: config.backupModel,
+        codingAgent: codingAgentName,
+    });
+    // Dynamic dep installation scripts (runs as root)
+    const depInstallScript = (config.deps ?? [])
+        .filter(d => d.installScript)
+        .map(d => d.installScript)
+        .join("\n");
+    // Dynamic dep post-install scripts (runs as ubuntu user)
+    const depPostInstallScript = (config.deps ?? [])
+        .filter(d => d.postInstallScript)
+        .map(d => `
+# Post-install: ${d.name}
+sudo -u ubuntu bash << 'DEP_POST_INSTALL'
+${d.postInstallScript}
+DEP_POST_INSTALL
+`)
+        .join("\n");
+    // Coding agent CLI installation script (registry-driven)
+    const codingClisInstallScript = codingAgentEntry
+        ? generateCodingAgentInstallScript(codingAgentEntry, config.model)
+        : "";
+    // Dynamic plugin install steps (only for installable plugins)
+    const installablePlugins = (config.plugins ?? []).filter((p) => p.installable !== false);
+    const pluginInstallScript = installablePlugins.length > 0
+        ? `
+# Install OpenClaw plugins
+echo "Installing plugins..."
+sudo -H -u ubuntu bash -c '
+export HOME=/home/ubuntu
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
+${installablePlugins.map((p) => `openclaw plugins install ${p.name} || echo "WARNING: ${p.name} plugin install failed. Install manually with: openclaw plugins install ${p.name}"`).join("\n")}
+'
+echo "Plugin installation complete"
+`
+        : "";
+    // Dynamic clawhub skill install steps
+    const clawhubSkillsScript = (config.clawhubSkills ?? []).length > 0
+        ? `
+# Install public skills from clawhub
+echo "Installing clawhub skills..."
+sudo -H -u ubuntu bash -c '
+export HOME=/home/ubuntu
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
+${(config.clawhubSkills ?? []).map((slug) => `clawhub install ${slug} || echo "WARNING: clawhub skill ${slug} install failed."`).join("\n")}
+'
+echo "Clawhub skills installation complete"
+`
+        : "";
+    // Generate workspace files injection script
+    const workspaceFilesScript = generateWorkspaceFilesScript(config.workspaceFiles);
+    // Generate additional env vars
+    const additionalEnvVars = config.envVars
+        ? Object.entries(config.envVars)
+            .map(([key, value]) => `echo 'export ${key}="${value}"' >> /home/ubuntu/.bashrc`)
+            .join("\n")
+        : "";
+    // Generate post-setup commands
+    const postSetupScript = config.postSetupCommands
+        ? config.postSetupCommands.join("\n")
+        : "";
+    // Create ubuntu user section (for Hetzner)
+    const createUserSection = config.createUbuntuUser
+        ? `
+# Create ubuntu user (Hetzner uses root by default)
+useradd -m -s /bin/bash -G docker ubuntu || true
+`
+        : "";
+    // Tailscale installation section
+    const tailscaleSection = config.skipTailscale
+        ? ""
+        : `
+# Install and configure Tailscale
+echo "Installing Tailscale..."
+curl -fsSL https://tailscale.com/install.sh | sh
+tailscale up --authkey="\${TAILSCALE_AUTH_KEY}" --ssh${config.tailscaleHostname ? ` --hostname=${config.tailscaleHostname}` : ""} || echo "WARNING: Tailscale setup failed. Run 'sudo tailscale up' manually."
+`;
+    // Tailscale proxy section: funnel (public access for webhooks) or serve (Tailscale-only HTTPS)
+    const tailscaleProxySection = config.skipTailscale
+        ? ""
+        : config.enableFunnel
+            ? `
+# Enable Tailscale Funnel for webhook endpoint (public HTTPS)
+echo "Enabling Tailscale Funnel for webhook endpoint..."
+if tailscale funnel --bg ${gatewayPort}; then
+  echo "Tailscale Funnel enabled — webhook endpoint is publicly accessible"
+else
+  echo "WARNING: tailscale funnel failed — falling back to tailscale serve (webhooks will NOT work until Funnel is enabled in Tailscale admin)"
+  tailscale serve --bg ${gatewayPort} || echo "WARNING: tailscale serve also failed. Enable HTTPS in your Tailscale admin console."
+fi
+`
+            : `
+# Enable Tailscale HTTPS proxy (requires HTTPS to be enabled in Tailscale admin console)
+echo "Enabling Tailscale HTTPS proxy..."
+tailscale serve --bg ${gatewayPort} || echo "WARNING: tailscale serve failed. Enable HTTPS in your Tailscale admin console first."
+`;
+    // Collect all secret env vars that need to be passed to the config-patch python script
+    const pluginSecretEnvVarExports = [];
+    for (const plugin of config.plugins ?? []) {
+        for (const envVar of Object.values(plugin.secretEnvVars ?? {})) {
+            pluginSecretEnvVarExports.push(`  ${envVar}="\${${envVar}:-}"`);
+        }
+    }
+    const pluginSecretEnvLine = pluginSecretEnvVarExports.length > 0
+        ? ` \\\n${pluginSecretEnvVarExports.join(" \\\n")}`
+        : "";
+    return `#!/bin/bash
+set -e
+
+export DEBIAN_FRONTEND=noninteractive
+
+# ============================================
+# OpenClaw Agent Provisioning Script
+# Generated by clawup Pulumi component
+# ============================================
+
+# Configuration
+ANTHROPIC_API_KEY="\${ANTHROPIC_API_KEY}"
+TAILSCALE_AUTH_KEY="\${TAILSCALE_AUTH_KEY}"
+GATEWAY_TOKEN="\${GATEWAY_TOKEN}"
+GATEWAY_PORT="${gatewayPort}"
+NODE_VERSION="${nodeVersion}"
+NVM_VERSION="${nvmVersion}"
+OPENCLAW_VERSION="${openclawVersion}"
+
+echo "Starting OpenClaw agent provisioning..."
+
+# System updates
+echo "Updating system packages..."
+apt-get update
+apt-get upgrade -y
+apt-get install -y unzip
+
+# Install Docker
+echo "Installing Docker..."
+curl -fsSL https://get.docker.com | sh
+systemctl enable docker
+systemctl start docker
+${createUserSection}
+usermod -aG docker ubuntu
+${depInstallScript}
+
+# Install NVM and Node.js for ubuntu user
+echo "Installing Node.js $NODE_VERSION via NVM..."
+sudo -u ubuntu bash << 'UBUNTU_SCRIPT'
+set -e
+cd ~
+
+# Install NVM
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v${nvmVersion}/install.sh | bash
+
+# Load NVM
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
+# Install Node.js
+nvm install ${nodeVersion}
+nvm use ${nodeVersion}
+nvm alias default ${nodeVersion}
+
+# Install OpenClaw
+npm install -g openclaw@${openclawVersion}
+
+# Add NVM to bashrc if not already there
+if ! grep -q 'NVM_DIR' ~/.bashrc; then
+  echo 'export NVM_DIR="$HOME/.nvm"' >> ~/.bashrc
+  echo '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"' >> ~/.bashrc
+fi
+UBUNTU_SCRIPT
+
+# Set environment variables for ubuntu user
+# Auto-detect credential type and export the correct variable
+if [[ "\${ANTHROPIC_API_KEY}" =~ ^sk-ant-oat ]]; then
+  # OAuth token from Claude Pro/Max subscription
+  echo 'export CLAUDE_CODE_OAUTH_TOKEN="\${ANTHROPIC_API_KEY}"' >> /home/ubuntu/.bashrc
+  echo "Detected OAuth token, exporting as CLAUDE_CODE_OAUTH_TOKEN"
+else
+  # API key from Anthropic Console
+  echo 'export ANTHROPIC_API_KEY="\${ANTHROPIC_API_KEY}"' >> /home/ubuntu/.bashrc
+  echo "Detected API key, exporting as ANTHROPIC_API_KEY"
+fi
+${(config.plugins ?? [])
+        .flatMap((p) => Object.values(p.secretEnvVars ?? {}))
+        .map((envVar) => `\\\${${envVar}:+echo 'export ${envVar}="\\\${${envVar}}"' >> /home/ubuntu/.bashrc}`)
+        .join("\n")}
+${(config.deps ?? [])
+        .flatMap(d => Object.values(d.secrets).map(s => s.envVar))
+        .map(envVar => `\\\${${envVar}:+echo 'export ${envVar}="\\\${${envVar}}"' >> /home/ubuntu/.bashrc}`)
+        .join("\n")}
+${additionalEnvVars}
+${tailscaleSection}${depPostInstallScript}
+${codingClisInstallScript}
+
+# Enable systemd linger for ubuntu user (required for user services to run at boot)
+loginctl enable-linger ubuntu
+
+# Start user's systemd instance (required for user services during cloud-init)
+systemctl start user@1000.service
+
+# Run OpenClaw onboarding as ubuntu user (skip daemon install, do it separately)
+echo "Running OpenClaw onboarding..."
+sudo -H -u ubuntu ANTHROPIC_API_KEY="\${ANTHROPIC_API_KEY}" GATEWAY_PORT="$GATEWAY_PORT" bash -c '
+export HOME=/home/ubuntu
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
+openclaw onboard --non-interactive --accept-risk \\
+  --mode local \\
+  --auth-choice apiKey \\
+  --gateway-port $GATEWAY_PORT \\
+  --gateway-bind loopback \\
+  --skip-daemon \\
+  --skip-skills || echo "WARNING: OpenClaw onboarding failed. Run openclaw onboard manually."
+'
+${workspaceFilesScript}
+${pluginInstallScript}
+${clawhubSkillsScript}
+# Install daemon service with XDG_RUNTIME_DIR set
+echo "Installing OpenClaw daemon..."
+sudo -H -u ubuntu XDG_RUNTIME_DIR=/run/user/1000 bash -c '
+export HOME=/home/ubuntu
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
+openclaw daemon install || echo "WARNING: Daemon install failed. Run openclaw daemon install manually."
+'
+
+# Configure gateway for Tailscale Serve
+echo "Configuring OpenClaw gateway..."
+sudo -H -u ubuntu \\
+  GATEWAY_TOKEN="\${GATEWAY_TOKEN}" \\
+  ANTHROPIC_API_KEY="\${ANTHROPIC_API_KEY}" \\
+  BRAVE_API_KEY="${braveApiKey ?? ""}" \\
+  AGENT_NAME="${config.envVars?.AGENT_NAME ?? ""}" \\
+  AGENT_EMOJI="${config.envVars?.AGENT_EMOJI ?? ""}"${pluginSecretEnvLine} \\
+  python3 << 'PYTHON_SCRIPT'
+${configPatchScript}
+PYTHON_SCRIPT
+${tailscaleProxySection}
+# Run openclaw doctor to fix any missing config
+echo "Running openclaw doctor..."
+sudo -H -u ubuntu bash -c '
+export HOME=/home/ubuntu
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+openclaw doctor --fix --non-interactive || echo "WARNING: openclaw doctor failed"
+'
+
+${postSetupScript}
+echo "============================================"
+echo "OpenClaw agent setup complete!"
+echo "============================================"
+`;
+}
+/**
+ * Generates bash script to inject workspace files
+ */
+function generateWorkspaceFilesScript(workspaceFiles) {
+    if (!workspaceFiles || Object.keys(workspaceFiles).length === 0) {
+        return "";
+    }
+    const lines = [
+        "",
+        "# Inject workspace files",
+        'echo "Injecting workspace files..."',
+        "mkdir -p /home/ubuntu/.openclaw/workspace",
+    ];
+    for (const [filePath, content] of Object.entries(workspaceFiles)) {
+        // Validate path to prevent directory traversal
+        const normalized = filePath.replace(/\\/g, "/");
+        if (normalized.includes("..") ||
+            normalized.startsWith("/") ||
+            normalized.includes("\0")) {
+            throw new Error(`Invalid workspace file path: "${filePath}". Paths must be relative and cannot contain "..".`);
+        }
+        const fullPath = `/home/ubuntu/.openclaw/workspace/${filePath}`;
+        const dirPath = fullPath.substring(0, fullPath.lastIndexOf("/"));
+        // Gzip + base64 encode to stay within Hetzner's 32KB user_data limit
+        const compressed = zlib.gzipSync(Buffer.from(content, "utf-8")).toString("base64");
+        lines.push(`mkdir -p "${dirPath}"`);
+        lines.push(`echo "${compressed}" | base64 -d | gunzip > "${fullPath}"`);
+    }
+    lines.push('chown -R ubuntu:ubuntu /home/ubuntu/.openclaw/workspace');
+    lines.push('echo "Workspace files injected successfully"');
+    return lines.join("\n");
+}
+/**
+ * Interpolates environment variables in the cloud-init script.
+ * Call this with actual values before passing to EC2 user data.
+ *
+ * Base secrets (anthropic, tailscale, gateway, slack, github, brave) are always handled.
+ * Plugin secrets are passed via the additionalSecrets map.
+ */
+function interpolateCloudInit(script, values) {
+    let result = script
+        .replace(/\${ANTHROPIC_API_KEY}/g, values.anthropicApiKey)
+        .replace(/\${TAILSCALE_AUTH_KEY}/g, values.tailscaleAuthKey)
+        .replace(/\${GATEWAY_TOKEN}/g, values.gatewayToken);
+    // Plugin and dep secret env vars (includes Slack tokens, Linear keys, GitHub token, etc.)
+    if (values.additionalSecrets) {
+        for (const [envVar, value] of Object.entries(values.additionalSecrets)) {
+            const escaped = value.replace(/\$/g, "$$$$");
+            result = result.replace(new RegExp(`\\$\\{${envVar}:-\\}`, "g"), escaped);
+            result = result.replace(new RegExp(`\\$\\{${envVar}\\}`, "g"), escaped);
+        }
+    }
+    return result;
+}
+/**
+ * Wraps a cloud-init script in a gzip+base64 self-extracting bootstrap.
+ * Hetzner limits user_data to 32KB; this typically achieves 60-70% compression.
+ */
+function compressCloudInit(script) {
+    const compressed = zlib.gzipSync(Buffer.from(script, "utf-8")).toString("base64");
+    return `#!/bin/bash
+base64 -d <<'COMPRESSED_PAYLOAD' | gunzip | bash
+${compressed}
+COMPRESSED_PAYLOAD
+`;
+}
+/**
+ * Generates bash script to install a coding agent CLI and configure its default model.
+ * Uses the registry entry's installScript and configureModelScript.
+ */
+function generateCodingAgentInstallScript(entry, model) {
+    // Strip provider prefix (e.g. "anthropic/claude-opus-4-6" -> "claude-opus-4-6")
+    const strippedModel = model?.replace(/^[^/]+\//, "") ?? "claude-opus-4-6";
+    // Replace ${MODEL} placeholder in configureModelScript
+    const configScript = entry.configureModelScript.replace(/\$\{MODEL\}/g, strippedModel);
+    return `
+${entry.installScript}
+
+${configScript}
+`;
+}
+//# sourceMappingURL=cloud-init.js.map