Installer UX overhaul + EC2 Bedrock auth fixes - #5
Conversation
- Add simple mode (default): asks only agent type + profile, auto-configures everything else (region, instance size, security, VPC, terraform) - Add advanced mode: full interactive flow with all options - Simple mode confirmation offers "Change settings" to switch to advanced with current selections pre-applied - New oh-my-zsh style ASCII banner - Skip account confirmation prompt in simple mode - Security services use gum multi-select instead of individual toggles - Instance type in simple mode follows profile (builder=xlarge, others=medium) - Auto-reuse existing VPC in simple mode without prompting - Support --simple and --advanced CLI flags Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Extract ensure_terraform_available() — was duplicated in 3 places - Extract choose_pack() — was duplicated in simple + advanced modes - Extract check_pack_profile_compat() — was duplicated in simple + advanced - Stream terraform init output live (Installing.../Installed lines) - Fix simple mode instance type ignoring profile (pack min was overriding) - Skip account confirmation prompt in simple mode - Security services use gum multi-select in advanced mode - New oh-my-zsh style ASCII banner Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…TUI on SSM connect - Move bedrockDiscovery from deprecated models.bedrockDiscovery to plugins.entries.amazon-bedrock.config.discovery (per OpenClaw 2026.4.5) - Use bedrock_region variable instead of hardcoded us-east-1 - SSM Loki-Session document now auto-launches `loki tui` on connect, falls back to bash login shell if TUI unavailable - Update existing SSM documents instead of skipping if already present Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…nt plugin cache - Run terraform init/apply in background with tail -f streaming so Ctrl-C signals reach the parent trap instead of being blocked by pipe subshells - Add AWS_PROFILE and AWS_DEFAULT_REGION to systemd service template and .bashrc so OpenClaw detects AWS SDK auth on EC2 instances - Use persistent terraform plugin cache (~/.terraform.d/plugin-cache) to avoid re-downloading ~500MB of providers on reinstall - Match bedrock region to deploy region in OpenClaw pack install Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…l sessions The .bashrc exports weren't reaching openclaw tui because SSM sessions go through profile.d -> sudo -iu ec2-user (login shell). A dedicated /etc/profile.d/loki-aws.sh ensures the env vars are set for every login shell, enabling OpenClaw's AWS SDK auth detection on EC2 instances. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Addresses all issues found during EC2 OpenClaw setup: 1. Patch pi-coding-agent post-install (model-registry.js + agent-session.js) to accept AWS SDK auth without API key — EC2 instance roles use IMDS 2. Install dbus-tools package for openclaw gateway restart 3. Enable loginctl linger early in bootstrap (before pack install) 4. Set XDG_RUNTIME_DIR and DBUS_SESSION_BUS_ADDRESS in profile.d and .bashrc so systemctl --user works in SSM sessions The pi-coding-agent patches are applied via a Python script that's idempotent (checks for LOKI-PATCH marker). Patches will need reapplying after OpenClaw updates until upstream fixes auth-controller.ts to inject SDK auth into pi's authStorage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When bootstrap runs via CFN/Terraform user-data, no user is logged in. loginctl enable-linger starts the user manager asynchronously, so: - Wait up to 30s for /run/user/<uid>/systemd to appear - Export XDG_RUNTIME_DIR and DBUS_SESSION_BUS_ADDRESS from bootstrap - Pass both via --preserve-env to sudo -u ec2-user pack install steps This ensures systemctl --user daemon-reload/enable/start works during headless cloud-init execution. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The git clone in userdata.sh.tpl and CFN template was hardcoded to main, so feature branch fixes never reached the EC2 instance. Now: - install.sh auto-detects current git branch (REPO_BRANCH) - Passes repo_branch through Terraform/CFN deploy params - userdata clones the matching branch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the animate_spinner polling loop with live CloudFormation event streaming. Now shows each resource status as it happens (Creating, Complete, Failed) matching the terraform apply experience. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Preflight now shows which git branch the EC2 instance will clone during bootstrap. Deploy summary includes account ID and branch for confirmation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cdc869a840
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Stamped at release; fall back to git info at runtime | ||
| INSTALLER_COMMIT="${INSTALLER_COMMIT:-$(git -C "$SCRIPT_DIR" rev-parse --short HEAD 2>/dev/null || echo dev)}" | ||
| INSTALLER_DATE="${INSTALLER_DATE:-$(d=$(git -C "$SCRIPT_DIR" log -1 --format='%ci' 2>/dev/null | cut -d' ' -f1,2); echo "${d:-unknown}")}" | ||
| REPO_BRANCH="${REPO_BRANCH:-$(git -C "$SCRIPT_DIR" rev-parse --abbrev-ref HEAD 2>/dev/null || echo main)}" |
There was a problem hiding this comment.
REPO_BRANCH is derived with git rev-parse --abbrev-ref HEAD, which returns the literal HEAD when the installer runs from a detached checkout (for example, a tag or pinned commit). That value is propagated into userdata (git clone -b "${repo_branch}" ...), and -b HEAD fails because HEAD is not a remote branch name, so bootstrap aborts. Add a fallback when the resolved value is HEAD (for example, default to main or resolve origin/HEAD).
Useful? React with 👍 / 👎.
| --region "$DEPLOY_REGION" >/dev/null 2>&1 || true | ||
| aws ssm update-document-default-version \ | ||
| --name "$SSM_DOC_NAME" \ | ||
| --document-version '$LATEST' \ |
There was a problem hiding this comment.
aws ssm update-document-default-version expects a numeric version for --document-version (the CLI option constraint is ^[1-9][0-9]*$), so passing '$LATEST' makes this call fail. Because the failure is swallowed with || true, existing Loki-Session documents keep their old default version, and the newly uploaded session profile (including loki tui) is never activated for users who already had the document. Capture the version from update-document and pass that number instead.
Useful? React with 👍 / 👎.
| case "$PROFILE_NAME" in | ||
| builder) INSTANCE_TYPE="t4g.xlarge" ;; | ||
| account_assistant) INSTANCE_TYPE="t4g.medium" ;; | ||
| personal_assistant) INSTANCE_TYPE="t4g.medium" ;; |
There was a problem hiding this comment.
Simple mode hard-codes instance type from profile and skips the pack minimum-size override used in advanced mode. This under-provisions packs whose registry requirements are larger (for example, openclaw requires t4g.xlarge and claude-code requires t4g.large), so selecting those packs with account_assistant or personal_assistant forces t4g.medium, which can cause bootstrap/runtime failures. Apply the same registry-based minimum-size guard here.
Useful? React with 👍 / 👎.
…pdate - REPO_BRANCH falls back to "main" when git returns "HEAD" (detached checkout from tags, CI, or shallow clones) - SSM update-document-default-version now uses the numeric version returned by update-document instead of '$LATEST' which is rejected Addresses PR #5 review feedback items 1 and 2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…pdate - REPO_BRANCH falls back to "main" when git returns "HEAD" (detached checkout from tags, CI, or shallow clones) - SSM update-document-default-version now uses the numeric version returned by update-document instead of '$LATEST' which is rejected Addresses PR #5 review feedback items 1 and 2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- #2: Add --allowed-o-auth-flows-user-pool-client to enable OAuth/managed login - #3: Password generation guarantees uppercase, lowercase, digit, and symbol - #4: Defer Cognito resource creation until after user confirms deployment (prevents orphaned resources on cancel/change-settings) - #5: Check for existing domain on pool before creating new one (reuse) - #1: Write WEBUI config to SSM Parameter Store so instance can read during bootstrap (fixes auth enforcement gap)
1 participant
Summary
ensure_terraform_available(),choose_pack(),check_pack_profile_compat()— reduced duplication across simple/advanced flowswaitin foreground so signals are delivered immediately~/.terraform.d/plugin-cacheavoids re-downloading ~500MB of providers on reinstallopenclaw tuion connectTest plan
bash install.sh --debug-in-repofrominstaller-ux-overhaulbranch — verify EC2 clones correct branchopenclaw tuiworks on fresh EC2 instance without manual patchesopenclaw gateway restartworks (D-Bus + systemd)🤖 Generated with Claude Code