devclaw

#!/usr/bin/env bash
# devclaw — Run OpenClaw in the Microsoft Cloud
# Usage: devclaw up        Deploy to Azure
#        devclaw down      Tear down all Azure resources
#        devclaw start     Start the agent
#        devclaw stop      Stop the agent (preserves state)
#        devclaw restart   Restart the agent
#        devclaw status    Check agent status
#        devclaw logs      Stream live logs
#        devclaw test      Run a quick test message
#        devclaw clone     (sandbox) Boot another OpenClaw from the existing image
#        devclaw login     Switch Azure account
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
# Respect an az config dir already scoped by the environment (e.g. VS Code's
# .azure-cli); only fall back to the repo-local .azure when nothing is set.
# Pinning az at a dir with no signed-in account is the #1 cause of false
# "resource not found" errors in status/teams.
export AZURE_CONFIG_DIR="${AZURE_CONFIG_DIR:-$ROOT/.azure}"

C='\033[36m'   # cyan
G='\033[32m'   # green
Y='\033[33m'   # yellow
R='\033[31m'   # red
D='\033[90m'   # dim
N='\033[0m'    # reset

COMMAND="${1:-status}"

check_prereqs() {
    local missing=0
    if ! command -v azd &>/dev/null; then
        echo -e "  ${R}Azure Developer CLI (azd) not found.${N}"
        echo -e "  ${D}Install: https://aka.ms/azd-install${N}"
        missing=1
    fi
    if ! command -v az &>/dev/null; then
        echo -e "  ${R}Azure CLI (az) not found.${N}"
        echo -e "  ${D}Install: https://aka.ms/install-azure-cli${N}"
        missing=1
    fi
    if [ $missing -eq 1 ]; then
        echo ""
        echo -e "  ${Y}Need an Azure account? https://azure.microsoft.com/free${N}"
        exit 1
    fi
}

get_app() {
    RG=$(azd env get-value AZURE_RESOURCE_GROUP 2>/dev/null || true)
    SUB=$(azd env get-value AZURE_SUBSCRIPTION_ID 2>/dev/null || true)
    if [ -z "$RG" ]; then
        echo -e "  ${R}No deployment found. Run 'devclaw up' first.${N}"
        exit 1
    fi
    if ! az account show >/dev/null 2>&1; then
        echo -e "  ${Y}Azure CLI is not logged in for this workspace profile.${N}"
        echo -e "  ${D}Run 'devclaw login' and retry.${N}"
        echo -e "  ${D}Profile: ${AZURE_CONFIG_DIR}${N}"
        exit 1
    fi
    if [ -n "$SUB" ] && ! az account set --subscription "$SUB" >/dev/null 2>&1; then
        echo -e "  ${Y}Azure CLI cannot access subscription ${SUB}.${N}"
        echo -e "  ${D}Run 'devclaw login' with an account that can access this subscription.${N}"
        exit 1
    fi
    APP=$(az containerapp list --resource-group "$RG" --query "[0].name" -o tsv 2>/dev/null || true)
    if [ -z "$APP" ]; then
        echo -e "  ${R}No container app found in $RG.${N}"
        exit 1
    fi
}

# True when this deployment uses the ACA Sandboxes host (USE_SANDBOX=true)
# instead of Azure Container Apps.
is_sandbox() {
    local v
    v=$(azd env get-value USE_SANDBOX 2>/dev/null || true)
    [ "$(printf '%s' "$v" | tr '[:upper:]' '[:lower:]')" = "true" ]
}

# Resolve sandbox identifiers from the azd env; exits with guidance if missing.
get_sandbox() {
    RG=$(azd env get-value AZURE_RESOURCE_GROUP 2>/dev/null || true)
    GROUP=$(azd env get-value AZURE_SANDBOX_GROUP_NAME 2>/dev/null || true)
    SBX=$(azd env get-value AZURE_SANDBOX_ID 2>/dev/null || true)
    SBX_URL=$(azd env get-value SANDBOX_URL 2>/dev/null || true)
    if [ -z "$GROUP" ]; then
        echo -e "  ${R}No sandbox deployment found. Run 'devclaw up' first.${N}"
        exit 1
    fi
    if ! command -v aca >/dev/null 2>&1; then
        echo -e "  ${Y}aca CLI not found.${N} Install: ${D}https://aka.ms/aca-cli-install${N}"
        exit 1
    fi
}

check_prereqs

case "$COMMAND" in

login)
    ACCOUNT="${2:-}"
    echo ""
    if [ -n "$ACCOUNT" ]; then
        echo -e "  ${C}Switching to account: ${ACCOUNT}${N}"
    else
        echo -e "  ${C}Logging into Azure...${N}"
    fi
    echo -e "  ${D}Sign in with your account in the browser window that opens.${N}"
    az login ${ACCOUNT:+--login-hint "$ACCOUNT"} 2>/dev/null || az login
    azd auth login 2>/dev/null || true
    echo ""
    echo -e "  ${G}Logged in. Run 'devclaw up' to deploy.${N}"
    echo ""
    ;;

up)
    echo ""
    if is_sandbox; then
        echo -e "  ${C}Deploying OpenClaw to Azure (ACA Sandboxes host)...${N}"
        echo -e "  ${D}Provisions Azure OpenAI + a sandbox group with managed identity,${N}"
        echo -e "  ${D}then builds the image and boots a sandbox via the aca CLI.${N}"
        echo ""
        # Sandboxes aren't an azd-native service host, so there's no container
        # app for `azd deploy` to target — provision only. The postprovision
        # hook (sandbox.sh) builds the image and boots the sandbox.
        if ! azd provision; then
            echo ""
            echo -e "  ${R}Provisioning failed.${N} Common fixes:"
            echo ""
            echo -e "  ${Y}• \"NoRegisteredProviderFound\" / api-version on SandboxGroups?${N}"
            echo -e "    ACA Sandboxes is Early Access. Ensure it's enabled on your"
            echo -e "    subscription, or update the api-version literal in"
            echo -e "    ${C}  infra/sandbox.bicep${N}"
            echo ""
            echo -e "  ${Y}• \"InvalidTemplateDeployment\" on OpenAI model?${N}"
            echo -e "    Your region may not have the model SKU. Run:"
            echo -e "    ${C}  azd env set AZURE_OPENAI_LOCATION eastus2${N}"
            echo -e "    ${C}  devclaw up${N}"
            echo ""
            exit 1
        fi
        echo ""
        echo -e "  ${G}OpenClaw sandbox deployed!${N}"
        SBX_URL=$(azd env get-value SANDBOX_URL 2>/dev/null || true)
        [ -n "$SBX_URL" ] && echo -e "  ${D}URL: ${G}${SBX_URL}${N}"
        echo -e "  ${D}Run 'devclaw status' to check it.${N}"
        echo ""
        exit 0
    fi
    echo -e "  ${C}Deploying OpenClaw to Azure...${N}"
    echo -e "  ${D}This provisions Azure OpenAI + Container Apps with managed identity.${N}"
    echo ""
    if ! azd up; then
        echo ""
        echo -e "  ${R}Deployment failed.${N} Common fixes:"
        echo ""
        echo -e "  ${Y}• \"RequestDisallowedByPolicy\" on a storage account?${N}"
        echo -e "    Your subscription blocks shared-key storage. Run:"
        echo -e "    ${C}  azd env set SKIP_STORAGE true${N}"
        echo -e "    ${C}  devclaw up${N}"
        echo -e "    ${D}Trade-off: chat sessions won't persist across restarts.${N}"
        echo ""
        echo -e "  ${Y}• \"InvalidTemplateDeployment\" on OpenAI model?${N}"
        echo -e "    Your region may not have the model SKU. Run:"
        echo -e "    ${C}  azd env set AZURE_OPENAI_LOCATION eastus2${N}"
        echo -e "    ${C}  devclaw up${N}"
        echo ""
        exit 1
    fi
    echo ""
    echo -e "  ${G}OpenClaw deployed!${N}"
    echo -e "  ${D}Run 'devclaw test' to verify it's working.${N}"
    echo -e "  ${D}Run 'devclaw logs' to see live output.${N}"
    echo ""
    ;;

start)
    if is_sandbox; then
        get_sandbox
        echo ""
        echo -e "  ${C}Resuming OpenClaw sandbox...${N}"
        aca sandbox resume --id "$SBX" >/dev/null 2>&1 || true
        echo -e "  ${G}Sandbox resumed. State restored in place.${N}"
        echo -e "  ${D}Run 'devclaw logs' to see output.${N}"
        echo ""
        exit 0
    fi
    get_app
    echo ""
    echo -e "  ${C}Starting OpenClaw...${N}"
    az containerapp update --name "$APP" --resource-group "$RG" \
        --min-replicas 1 --max-replicas 1 --only-show-errors >/dev/null
    echo -e "  ${G}OpenClaw started. State restored from Azure Files.${N}"
    echo -e "  ${D}Run 'devclaw logs' to see output.${N}"
    echo ""
    ;;

stop)
    if is_sandbox; then
        get_sandbox
        echo ""
        echo -e "  ${C}Suspending OpenClaw sandbox...${N}"
        echo -e "  ${D}Memory + disk state preserved. Resume in sub-second.${N}"
        aca sandbox stop --id "$SBX" >/dev/null 2>&1 || true
        echo -e "  ${G}Sandbox suspended. No compute running.${N}"
        echo -e "  ${D}Run 'devclaw start' to resume.${N}"
        echo ""
        exit 0
    fi
    get_app
    echo ""
    echo -e "  ${C}Stopping OpenClaw...${N}"
    echo -e "  ${D}State is preserved on Azure Files. No data lost.${N}"
    az containerapp update --name "$APP" --resource-group "$RG" \
        --min-replicas 0 --max-replicas 0 --only-show-errors >/dev/null
    echo -e "  ${G}OpenClaw stopped. No compute running.${N}"
    echo -e "  ${D}Run 'devclaw start' to resume.${N}"
    echo ""
    ;;

restart)
    if is_sandbox; then
        get_sandbox
        echo ""
        echo -e "  ${C}Cycling the OpenClaw sandbox (suspend + resume)...${N}"
        aca sandbox stop --id "$SBX" >/dev/null 2>&1 || true
        aca sandbox resume --id "$SBX" >/dev/null 2>&1 || true
        echo -e "  ${G}Sandbox cycled.${N}"
        echo ""
        exit 0
    fi
    get_app
    echo ""
    echo -e "  ${C}Restarting OpenClaw...${N}"
    REVISION=$(az containerapp revision list --name "$APP" --resource-group "$RG" \
        --query "[?properties.active].name" -o tsv 2>/dev/null | head -1)
    if [ -n "$REVISION" ]; then
        az containerapp revision restart --name "$APP" --resource-group "$RG" \
            --revision "$REVISION" --only-show-errors >/dev/null
        echo -e "  ${G}OpenClaw restarted.${N}"
    else
        echo -e "  ${R}No active revision found. Run 'devclaw start' instead.${N}"
    fi
    echo ""
    ;;

logs)
    if is_sandbox; then
        get_sandbox
        echo ""
        echo -e "  ${C}Opening an interactive shell in the sandbox (exit to return)...${N}"
        echo -e "  ${D}Inside, inspect the gateway with: openclaw gateway --help${N}"
        echo ""
        aca sandbox shell --id "$SBX" || \
            echo -e "  ${Y}Shell unavailable. Try: aca sandbox exec --id $SBX -c 'openclaw gateway status'${N}"
        exit 0
    fi
    get_app
    echo ""
    echo -e "  ${C}Streaming OpenClaw logs...${N}"
    echo -e "  ${D}Press Ctrl+C to stop.${N}"
    echo ""
    az containerapp logs show --name "$APP" --resource-group "$RG" --follow --tail 50 2>/dev/null || \
        echo -e "  ${Y}Log streaming unavailable (VNet-internal). Check Azure Portal > Container App > Log stream.${N}"
    ;;

test)
    if is_sandbox; then
        get_sandbox
        echo ""
        echo -e "  ${C}Testing OpenClaw sandbox...${N}"
        echo ""
        STATE=$(aca sandbox get --id "$SBX" -o json 2>/dev/null | grep -oE '"state"[^,]*' | head -1 | sed -E 's/.*:[[:space:]]*"?([A-Za-z]+).*/\1/')
        if [ "$STATE" = "Running" ]; then
            echo -e "  ${G}✅ Sandbox is running${N}"
        elif [ -n "$STATE" ]; then
            echo -e "  ${Y}Sandbox state: ${STATE}${N} ${D}(suspended sandboxes auto-resume on access)${N}"
        else
            echo -e "  ${R}❌ Could not read sandbox state${N}"
        fi
        echo -e "  Auth mode: ${C}managed-identity${N}"
        [ -n "$SBX_URL" ] && echo -e "  URL:       ${C}${SBX_URL}${N}"
        echo ""
        echo -e "  ${D}Send a test message from inside the sandbox:${N}"
        echo -e "  ${D}  aca sandbox exec --id $SBX -c 'openclaw agent -m \"Hello from the cloud!\"'${N}"
        echo ""
        exit 0
    fi
    get_app
    echo ""
    echo -e "  ${C}Testing OpenClaw agent...${N}"
    echo ""
    # Check revision status
    STATUS=$(az containerapp revision list --name "$APP" --resource-group "$RG" \
        --query "[?properties.active].properties.runningState" -o tsv 2>/dev/null | head -1)

    if [ "$STATUS" = "Running" ] || [ "$STATUS" = "RunningAtMaxScale" ]; then
        echo -e "  ${G}✅ Container is running${N}"
    elif [ "$STATUS" = "Activating" ]; then
        echo -e "  ${Y}⏳ Container is still activating — wait a moment and retry.${N}"
        echo ""
        exit 0
    else
        echo -e "  ${R}❌ Container state: ${STATUS:-unknown}${N}"
        echo -e "  ${D}Run 'devclaw logs' to check for errors.${N}"
        echo ""
        exit 1
    fi

    # Check auth mode
    AUTH=$(az containerapp show --name "$APP" --resource-group "$RG" \
        --query "properties.template.containers[0].env[?name=='AZURE_OPENAI_AUTH'].value" -o tsv 2>/dev/null)
    echo -e "  Auth mode: ${C}${AUTH:-unknown}${N}"

    # Check endpoint
    ENDPOINT=$(az containerapp show --name "$APP" --resource-group "$RG" \
        --query "properties.template.containers[0].env[?name=='OPENAI_BASE_URL'].value" -o tsv 2>/dev/null)
    echo -e "  Endpoint:  ${C}${ENDPOINT:-unknown}${N}"

    # Check identity
    MI=$(az containerapp show --name "$APP" --resource-group "$RG" \
        --query "identity.principalId" -o tsv 2>/dev/null)
    if [ -n "$MI" ]; then
        echo -e "  ${G}✅ Managed identity enabled${N} ${D}($MI)${N}"
    else
        echo -e "  ${R}❌ No managed identity${N}"
    fi

    echo ""
    echo -e "  ${D}To send a test message, open the Azure Portal Console:${N}"
    echo -e "  ${D}Portal > Container App > Console > /bin/bash${N}"
    echo -e "  ${D}Then run: openclaw agent --message \"Hello from the cloud!\"${N}"
    echo ""
    ;;

status)
    if is_sandbox; then
        get_sandbox
        echo ""
        echo -e "  ${C}devclaw${N}"
        echo -e "  ${C}--------${N}"
        STATE=$(aca sandbox get --id "$SBX" -o json 2>/dev/null | grep -oE '"state"[^,]*' | head -1 | sed -E 's/.*:[[:space:]]*"?([A-Za-z]+).*/\1/')
        SC="$Y"
        [ "$STATE" = "Running" ] && SC="$G"
        echo -e "  Host:       ACA Sandboxes"
        echo -e "  Group:      ${GROUP}"
        echo -e "  Sandbox:    ${SBX:-none}"
        echo -e "  Status:     ${SC}${STATE:-unknown}${N}"
        echo -e "  URL:        ${G}${SBX_URL:-none}${N}"
        echo -e "  Resource:   $RG"
        echo ""
        exit 0
    fi
    RG=$(azd env get-value AZURE_RESOURCE_GROUP 2>/dev/null || true)
    SUB=$(azd env get-value AZURE_SUBSCRIPTION_ID 2>/dev/null || true)
    if [ -z "$RG" ]; then
        echo -e "  ${R}No deployment found. Run 'devclaw up' first.${N}"
        exit 1
    fi

    APP=""
    SHOW_JSON=$(azd show -o json 2>/dev/null || true)
    if [ -n "$SHOW_JSON" ]; then
        RESOURCE_ID=$(printf '%s\n' "$SHOW_JSON" | grep -Eo '/subscriptions/[^\"]+/resourceGroups/[^\"]+/providers/Microsoft\.App/containerApps/[^\"]+' | head -1 || true)
        if [ -n "$RESOURCE_ID" ]; then
            APP="${RESOURCE_ID##*/}"
        fi
    fi

    # Fallback if azd show did not include resource IDs yet.
    if [ -z "$APP" ]; then
        HOST=$(azd env get-value HOST_FQDN 2>/dev/null || true)
        if [ -n "$HOST" ]; then
            APP="${HOST%%.*}"
        fi
    fi

    if [ -z "$APP" ]; then
        echo -e "  ${R}No container app found in $RG.${N}"
        echo -e "  ${D}Try 'devclaw deploy' or check 'azd show'.${N}"
        exit 1
    fi

    echo ""
    echo -e "  ${C}devclaw${N}"
    echo -e "  ${C}--------${N}"

    FQDN=$(azd env get-value HOST_FQDN 2>/dev/null || true)
    if [ -z "$FQDN" ] && [ -n "$SHOW_JSON" ]; then
        FQDN=$(printf '%s\n' "$SHOW_JSON" | sed -n 's#.*"ingressUrl"[[:space:]]*:[[:space:]]*"https\{0,1\}://\([^/\"]*\)/\{0,1\}".*#\1#p' | head -1)
    fi

    STATUS="unknown"
    if az account show >/dev/null 2>&1; then
        if [ -z "$SUB" ] || az account set --subscription "$SUB" >/dev/null 2>&1; then
            STATUS=$(az containerapp revision list --name "$APP" --resource-group "$RG" \
                --query "[?properties.active].properties.runningState" -o tsv 2>/dev/null | head -1)
            [ -z "$STATUS" ] && STATUS="unknown"
        fi
    fi

    SC="$Y"
    [ "$STATUS" = "Running" ] && SC="$G"
    [ "$STATUS" = "RunningAtMaxScale" ] && SC="$G"
    [ "$STATUS" = "ActivationFailed" ] && SC="$R"

    echo -e "  App:        $APP"
    echo -e "  Status:     ${SC}${STATUS:-unknown}${N}"
    echo -e "  FQDN:       ${FQDN:-none}"
    echo -e "  URL:        ${G}https://${FQDN}${N}"
    echo -e "  Resource:   $RG"
    echo ""
    ;;

down)
    echo ""
    echo -e "  ${R}This will permanently delete all OpenClaw Azure resources.${N}"
    if is_sandbox; then
        echo -e "  ${D}Resource group, sandbox group (all sandboxes + disk images), OpenAI, ACR — everything.${N}"
    else
        echo -e "  ${D}Resource group, VNet, OpenAI, container app, storage — everything.${N}"
    fi
    echo ""
    read -rp "  Are you sure? [y/N]: " CONFIRM
    if [[ ! "$CONFIRM" =~ ^[Yy] ]]; then
        echo -e "  ${D}Cancelled.${N}"
        echo ""
        exit 0
    fi
    # Clean up Entra app registrations before destroying Azure resources
    BOT_ID=$(azd env get-value BOT_APP_ID 2>/dev/null | grep -oP '^[0-9a-f-]+$' || echo "")
    AUTH_ID=$(azd env get-value EASYAUTH_APP_ID 2>/dev/null | grep -oP '^[0-9a-f-]+$' || echo "")
    [ -n "$BOT_ID" ] && echo -e "  ${D}Deleting bot app registration: $BOT_ID${N}" && az ad app delete --id "$BOT_ID" 2>/dev/null
    [ -n "$AUTH_ID" ] && echo -e "  ${D}Deleting Easy Auth app registration: $AUTH_ID${N}" && az ad app delete --id "$AUTH_ID" 2>/dev/null
    azd down --force --purge 2>/dev/null || azd down --force 2>/dev/null || true
    echo ""
    echo -e "  ${G}All resources deleted. Run 'devclaw up' to deploy fresh.${N}"
    echo ""
    ;;

deploy)
    echo ""
    if is_sandbox; then
        echo -e "  ${C}Rebuilding the image and re-booting the OpenClaw sandbox...${N}"
        echo ""
        bash "$ROOT/infra/hooks/sandbox.sh"
        echo ""
        echo -e "  ${G}Done! Run 'devclaw status' to verify.${N}"
        echo ""
        exit 0
    fi
    echo -e "  ${C}Rebuilding and deploying OpenClaw...${N}"
    echo ""
    azd deploy
    echo ""
    echo -e "  ${G}Deployed! Run 'devclaw test' to verify.${N}"
    echo ""
    ;;

clone)
    if ! is_sandbox; then
        echo ""
        echo -e "  ${Y}'devclaw clone' is only for the ACA Sandboxes host (USE_SANDBOX=true).${N}"
        echo ""
        exit 0
    fi
    echo ""
    echo -e "  ${C}Cloning OpenClaw — reusing the existing image (no rebuild)...${N}"
    echo -e "  ${D}Boots an additional, independent sandbox in seconds.${N}"
    echo ""
    SANDBOX_REUSE_DISK=true SANDBOX_CLONE=true bash "$ROOT/infra/hooks/sandbox.sh"
    echo ""
    ;;

exec-mode)
    MODE="${2:-}"
    CUR=$(azd env get-value EXECUTION_MODE 2>/dev/null || echo "inproc")
    if [ "$MODE" != "inproc" ] && [ "$MODE" != "sandbox" ]; then
        echo ""
        echo -e "  ${C}Execution mode${N} (current: ${G}${CUR:-inproc}${N})"
        echo -e "  ${D}inproc${N}  — run tools in the Gateway container (today's behavior)"
        echo -e "  ${D}sandbox${N} — offload untrusted tool execution to ephemeral ACA Sandboxes"
        echo -e "  ${D}Usage: devclaw exec-mode <inproc|sandbox> then 'devclaw up'${N}"
        echo ""
        exit 0
    fi
    azd env set EXECUTION_MODE "$MODE" >/dev/null
    echo ""
    echo -e "  ${G}EXECUTION_MODE=$MODE${N} saved. Run ${C}devclaw up${N} to apply."
    echo ""
    ;;

teams)
    echo ""
    echo -e "  ${C}Microsoft Teams Setup (optional add-on)${N}"
    echo -e "  ${C}---------------------------------------${N}"
    echo ""

    if is_sandbox; then
        echo -e "  ${Y}The Teams add-on requires the Azure Container Apps host.${N}"
        echo -e "  ${D}It isn't available with the ACA Sandboxes host (USE_SANDBOX=true).${N}"
        echo -e "  ${D}Deploy without USE_SANDBOX to use Teams.${N}"
        echo ""
        exit 0
    fi

    get_app

    # Teams is opt-in. If the deployment was provisioned without
    # `ENABLE_TEAMS=true`, no Bot app registration / Azure Bot resource exists
    # yet. Set the flag and re-provision before continuing.
    BOT_APP_ID=$(azd env get-value BOT_APP_ID 2>/dev/null | grep -oP '^[0-9a-f-]+$' || echo "")
    if [ -z "$BOT_APP_ID" ]; then
        ENABLE_TEAMS_FLAG=$(azd env get-value ENABLE_TEAMS 2>/dev/null | tr -d '[:space:]' || echo "")
        echo -e "  ${Y}Teams is an optional add-on and isn't enabled for this deployment yet.${N}"
        echo -e "  ${D}Enabling Teams will create an Entra ID app registration + Azure Bot${N}"
        echo -e "  ${D}resource, then re-provision so the container app picks up the bot creds.${N}"
        echo ""
        read -rp "  Enable Teams now? [y/N]: " CONFIRM
        if [[ ! "$CONFIRM" =~ ^[Yy] ]]; then
            echo -e "  ${D}Cancelled.${N}"
            echo ""
            exit 0
        fi
        if [ "${ENABLE_TEAMS_FLAG,,}" != "true" ]; then
            azd env set ENABLE_TEAMS true
            echo -e "  ${G}ENABLE_TEAMS=true saved to azd env.${N}"
        fi
        echo -e "  ${C}Re-provisioning (creates bot app reg + Azure Bot + Teams channel)...${N}"
        echo ""
        azd provision
        BOT_APP_ID=$(azd env get-value BOT_APP_ID 2>/dev/null | grep -oP '^[0-9a-f-]+$' || echo "")
        if [ -z "$BOT_APP_ID" ]; then
            echo -e "  ${R}Provisioning didn't create a bot app registration.${N}"
            echo -e "  ${D}Check the preprovision hook output above for tenant policy errors.${N}"
            exit 1
        fi
        echo ""
        echo -e "  ${C}Redeploying app so MSTEAMS_* env vars take effect...${N}"
        azd deploy
        echo ""
    fi

    # Get bot resource name from resource group
    BOT_NAME=$(az resource list --resource-group "$RG" \
        --resource-type "Microsoft.BotService/botServices" \
        --query "[0].name" -o tsv 2>/dev/null)
    FQDN=$(az containerapp show --name "$APP" --resource-group "$RG" \
        --query "properties.configuration.ingress.fqdn" -o tsv 2>/dev/null)

    # The live bot lookup can come back empty if `az` is pointed at a config dir
    # with no signed-in account. The sideload package only needs BOT_APP_ID, so
    # don't hard-fail when we have it — warn, skip the (idempotent) channel
    # enable, and still build the zip.
    SKIP_CHANNEL=""
    if [ -z "$BOT_NAME" ]; then
        if [ -n "$BOT_APP_ID" ]; then
            echo -e "  ${Y}Couldn't read the live Azure Bot resource (az auth context).${N}"
            echo -e "  ${Y}BOT_APP_ID is set, so building the package anyway.${N}"
            SKIP_CHANNEL=1
        else
            echo -e "  ${R}No Azure Bot found in $RG even after provisioning.${N}"
            echo -e "  ${D}Check 'azd provision' output for errors.${N}"
            exit 1
        fi
    fi

    if [ -z "$SKIP_CHANNEL" ]; then
        echo -e "  Bot:      ${C}${BOT_NAME}${N}"
        echo -e "  Endpoint: ${C}https://${FQDN}/api/messages${N}"
        echo ""

        # Enable Teams channel (check first, create if missing)
        echo -e "  ${C}Checking Teams channel...${N}"
        if az bot msteams show --name "$BOT_NAME" --resource-group "$RG" -o none 2>/dev/null; then
            echo -e "  ${G}Teams channel already enabled${N}"
        else
            echo -e "  ${C}Creating Teams channel...${N}"
            az bot msteams create --name "$BOT_NAME" --resource-group "$RG" -o none 2>/dev/null
            echo -e "  ${G}Teams channel enabled${N}"
        fi
    fi

    # Build Teams app manifest
    TEAMS_DIR="$ROOT/teams"
    echo -e "  ${C}Building Teams app package...${N}"
    mkdir -p "$TEAMS_DIR/package"

    # Generate manifest with real App ID
    if [ -n "$BOT_APP_ID" ]; then
        sed "s/APP_ID_PLACEHOLDER/$BOT_APP_ID/g" "$TEAMS_DIR/manifest.json" > "$TEAMS_DIR/package/manifest.json"
    else
        cp "$TEAMS_DIR/manifest.json" "$TEAMS_DIR/package/manifest.json"
        echo -e "  ${Y}Warning: BOT_APP_ID not found — manifest may need manual App ID${N}"
    fi

    # Check icons exist
    [ ! -f "$TEAMS_DIR/package/color.png" ] && echo -e "  ${Y}Warning: teams/package/color.png missing — add a 192x192 PNG icon${N}"
    [ ! -f "$TEAMS_DIR/package/outline.png" ] && echo -e "  ${Y}Warning: teams/package/outline.png missing — add a 32x32 PNG icon${N}"

    # Create ZIP
    if command -v zip &>/dev/null; then
        (cd "$TEAMS_DIR/package" && zip -q ../openclaw-teams-app.zip manifest.json color.png outline.png 2>/dev/null)
        echo -e "  ${G}Package: teams/openclaw-teams-app.zip${N}"
    else
        echo -e "  ${Y}Install 'zip' to auto-create, or manually zip:${N}"
        echo -e "  ${D}  teams/package/manifest.json + color.png + outline.png${N}"
    fi

    echo ""
    echo -e "  ${C}Install in Teams:${N}"
    echo -e "  ${D}  Teams > Apps > Manage your apps > Upload a custom app${N}"
    echo -e "  ${D}  Select: teams/openclaw-teams-app.zip${N}"
    echo -e "  ${D}  Add > DM the bot to test${N}"
    echo ""
    ;;

*)
    echo ""
    echo -e "  ${C}devclaw — OpenClaw in the Microsoft Cloud${N}"
    echo ""
    echo "  Getting started:"
    echo "    devclaw up         Deploy OpenClaw to Azure"
    echo "    devclaw test       Verify it's working"
    echo ""
    echo "  Channels:"
    echo "    devclaw teams      Add Microsoft Teams integration (optional add-on)"
    echo ""
    echo "  Control:"
    echo "    devclaw start      Start the agent"
    echo "    devclaw stop       Stop the agent (state preserved)"
    echo "    devclaw restart    Restart the agent"
    echo "    devclaw status     Check agent status"
    echo "    devclaw logs       Stream live logs"
    echo "    devclaw deploy     Rebuild and deploy after code changes"
    echo ""
    echo "  Cleanup:"
    echo "    devclaw down       Delete all Azure resources"
    echo ""
    echo "  Account:"
    echo "    devclaw login      Switch Azure account"
    echo ""
    ;;
esac