v1.5.7

Rename VM Extensions → Cloud provider access; unify test output alignment

Full Changelog: v1.5.6...v1.5.7

v1.5.6

Add privateclaw info command for debugging

Full Changelog: v1.5.5...v1.5.6

v1.5.5

Fix waagent status capture; realign [4/5] output

Full Changelog: v1.5.4...v1.5.5

v1.5.4

Full Changelog: v1.5.3...v1.5.4

v1.5.3

Fix External Access Lockout: FAIL not WARN, AND logic for detection

Full Changelog: v1.5.2...v1.5.3

v1.5.2

Fix: Azure Guest Agent detection in privateclaw verify

The previous check queried IMDS for allowExtensionOperations, but IMDS doesn't expose that field — it always returned "unknown".

New detection method:

• Checks walinuxagent service status via systemctl is-active
• Checks Extensions.Enabled setting in /etc/waagent.conf

On prod CVMs where waagent is masked/disabled, step [5/5] now correctly shows PASS.
On staging CVMs where waagent is active, it shows the expected WARN.

Tested on a live staging CVM before release.

v1.5.1

Merge VM Extensions check into External Access Lockout step (5 checks total). Extensions enabled/unknown is WARN, not FAIL.

Full Changelog: v1.5.0...v1.5.1

v1.5.0

Changes

• Rename "Orchestrator Platform/VCEK Chain" to "Gateway Platform/VCEK Chain" in privateclaw verify output
• Reflects the new gateway-based inference architecture where tee-proxy runs on the dedicated gateway CVM instead of the orchestrator

Install

curl -fsSL https://github.com/lunal-dev/privateclaw-cli/releases/download/v1.5.0/install.sh | bash

v1.4.0

• Add step [6/6] Azure VM Extensions check (PASS on prod, WARN on staging)
• Previous: bearer token auth, TLS support, Confidential AI rebrand

v1.3.0 — Rebrand to Confidential AI + Gateway Bearer Token Auth

Changes

• Rebrand: All user-visible "Lunal" references changed to "Confidential AI"
• Bearer token auth: Step [4/5] now reads apiKey from openclaw config and sends it as Authorization: Bearer <token> header (required for gateway auth)
• TLS: Added -k flag for self-signed TLS on gateway (VCEK chain is the real trust anchor)
• Backward compatible: Falls back to legacy "lunal" provider name in openclaw.json

Breaking

• Provider name in openclaw.json should be "confidential" (not "lunal"). Old configs still work via fallback.