@clawops/cli 0.2.0

package/dist/cli.js

@@ -0,0 +1,1752 @@
+#!/usr/bin/env node
+import {
+  getConfig,
+  getConfigDir,
+  requireConfig,
+  setConfig
+} from "./chunk-ALSUDYA7.js";
+import {
+  ClawopsError,
+  UsageError
+} from "./chunk-ZSE4QRKE.js";
+
+// src/cli/index.ts
+import { defineCommand as defineCommand18, runMain } from "citty";
+
+// src/cli/commands/init.ts
+import { defineCommand } from "citty";
+import { generateKeyPairSync } from "crypto";
+import { writeFileSync, mkdirSync, existsSync } from "fs";
+import path from "path";
+import process2 from "process";
+
+// src/output/human.ts
+import chalk from "chalk";
+import ora from "ora";
+function success(msg) {
+  console.log(chalk.green("\u2713") + "  " + msg);
+}
+function failure(msg) {
+  console.error(chalk.red("\u2717") + "  " + msg);
+}
+function warn(msg) {
+  console.warn(chalk.yellow("\u26A0") + "  " + msg);
+}
+function info(msg) {
+  console.log(chalk.blue("\u2139") + "  " + msg);
+}
+function spinner(text) {
+  return ora(text).start();
+}
+
+// src/cli/commands/init.ts
+var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
+var PROVIDER_DEFAULTS = {
+  gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
+  aws: { region: "us-east-1", credEnv: "AWS_PROFILE", stateScheme: "s3://" },
+  azure: { region: "eastus", credEnv: "AZURE_CLIENT_ID", stateScheme: "azblob://" }
+};
+var init_default = defineCommand({
+  meta: {
+    name: "init",
+    description: "Initialise clawops: choose provider, configure state backend, generate SSH key"
+  },
+  args: {
+    provider: { type: "string", description: "Cloud provider (gcp|aws|azure|local)" },
+    state: { type: "string", description: "State backend URL (e.g. gs://my-bucket/clawops)" },
+    region: { type: "string", description: "Cloud region (defaults per provider)" },
+    stack: { type: "string", description: 'Stack name (default: "default")' },
+    "non-interactive": { type: "boolean", description: "Suppress all prompts; requires --provider" },
+    force: { type: "boolean", description: "Overwrite existing config without prompting" },
+    // local-specific
+    host: { type: "string", description: "[local] Hostname or IP of the target machine" },
+    "ssh-user": { type: "string", description: "[local] SSH login user (default: root)" },
+    "ssh-port": { type: "string", description: "[local] SSH port (default: 22)" },
+    "key-path": { type: "string", description: "[local] Path to an existing SSH private key" }
+  },
+  async run({ args }) {
+    const nonInteractive = Boolean(args["non-interactive"]);
+    const providerArg = typeof args.provider === "string" ? args.provider : null;
+    const stackName = typeof args.stack === "string" ? args.stack : "default";
+    const forceOverwrite = Boolean(args.force);
+    if (nonInteractive && !providerArg) {
+      throw new UsageError(
+        "--non-interactive requires --provider. Example: clawops init --provider gcp --non-interactive"
+      );
+    }
+    const provider = providerArg ?? "gcp";
+    if (!SUPPORTED_PROVIDERS.includes(provider)) {
+      throw new UsageError(
+        `Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`
+      );
+    }
+    const existing = getConfig();
+    if (existing && !forceOverwrite && !nonInteractive) {
+      failure(
+        `Config already exists at ${path.join(getConfigDir(), "config.json")}. Use --force to overwrite.`
+      );
+      process2.exit(1);
+    }
+    const configDir = getConfigDir();
+    mkdirSync(configDir, { recursive: true });
+    const keyPath = typeof args["key-path"] === "string" ? args["key-path"] : path.join(configDir, "id_ed25519");
+    const knownHostsPath = path.join(configDir, "known_hosts");
+    if (!existsSync(keyPath)) {
+      if (typeof args["key-path"] === "string") {
+        throw new UsageError(`SSH key not found at ${keyPath}`);
+      }
+      info("Generating SSH key pair...");
+      const { privateKey } = generateKeyPairSync("ed25519", {
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        publicKeyEncoding: { type: "spki", format: "pem" }
+      });
+      writeFileSync(keyPath, privateKey, { mode: 384 });
+      success(`SSH private key written to ${keyPath}`);
+    } else {
+      info(`Using existing SSH key at ${keyPath}`);
+    }
+    if (!existsSync(knownHostsPath)) {
+      writeFileSync(knownHostsPath, "", "utf-8");
+    }
+    let config;
+    if (provider === "local") {
+      const host = typeof args.host === "string" ? args.host : "";
+      if (!host) {
+        throw new UsageError("--host is required for the local provider");
+      }
+      const sshUser = typeof args["ssh-user"] === "string" ? args["ssh-user"] : "root";
+      const sshPort = typeof args["ssh-port"] === "string" ? parseInt(args["ssh-port"], 10) : 22;
+      config = {
+        version: 1,
+        defaults: { stack: stackName, provider },
+        stacks: {
+          [stackName]: {
+            provider,
+            stateUrl: "file://~/.clawops/state",
+            credentialsRef: { source: "file", envVars: [] },
+            localOpts: { host, sshUser, sshPort, sshKeyPath: keyPath }
+          }
+        },
+        ssh: { keyPath, knownHostsPath }
+      };
+    } else {
+      const defaults = PROVIDER_DEFAULTS[provider];
+      const region = typeof args.region === "string" ? args.region : defaults.region;
+      const stateUrl = typeof args.state === "string" ? args.state : `${defaults.stateScheme}CHANGEME/clawops`;
+      config = {
+        version: 1,
+        defaults: { stack: stackName, provider },
+        stacks: {
+          [stackName]: {
+            provider,
+            stateUrl,
+            region,
+            credentialsRef: { source: "env", envVars: [defaults.credEnv] }
+          }
+        },
+        ssh: { keyPath, knownHostsPath }
+      };
+      if (stateUrl.includes("CHANGEME")) {
+        process2.stdout.write("\n");
+        info(
+          `Update stateUrl in the config to a real state backend before running \`clawops up\`.
+  Example: clawops init --provider ${provider} --state ${defaults.stateScheme}your-bucket/clawops`
+        );
+      }
+      process2.stdout.write("\n");
+      success(`Provider: ${provider}  Region: ${region}  Stack: ${stackName}`);
+      setConfig(config);
+      success(`Config written to ${path.join(configDir, "config.json")}`);
+      return;
+    }
+    setConfig(config);
+    success(`Config written to ${path.join(configDir, "config.json")}`);
+    process2.stdout.write("\n");
+    success(`Provider: ${provider}  Stack: ${stackName}`);
+  }
+});
+
+// src/cli/commands/up.ts
+import { defineCommand as defineCommand2 } from "citty";
+import process3 from "process";
+
+// src/output/table.ts
+function renderTable(headers, rows) {
+  if (headers.length === 0) return "";
+  const widths = headers.map((h, i) => {
+    const cellMax = rows.reduce((max, row) => Math.max(max, (row[i] ?? "").length), 0);
+    return Math.max(h.length, cellMax);
+  });
+  const pad = (s, w) => s + " ".repeat(w - s.length);
+  const sep = "  ";
+  const header = headers.map((h, i) => pad(h, widths[i] ?? h.length)).join(sep);
+  const divider = widths.map((w) => "-".repeat(w)).join(sep);
+  const body = rows.map((row) => row.map((cell, i) => pad(cell, widths[i] ?? cell.length)).join(sep)).join("\n");
+  return [header, divider, ...body ? [body] : []].join("\n");
+}
+
+// src/cli/commands/up.ts
+var VALID_INSTANCE_TYPES = ["micro", "small", "medium", "large", "gpu"];
+var up_default = defineCommand2({
+  meta: {
+    name: "up",
+    description: "Provision and deploy an OpenClaw stack"
+  },
+  args: {
+    provider: { type: "string", description: "Cloud provider (gcp|aws|azure|local)" },
+    region: { type: "string", description: "Cloud region" },
+    "instance-type": { type: "string", description: "Instance size alias (micro|small|medium|large|gpu)" },
+    "dry-run": { type: "boolean", description: "Preview without applying" },
+    "no-wait": { type: "boolean", description: "Return immediately without waiting for healthy state" },
+    "openclaw-version": { type: "string", description: "semver or 'stable'/'dev'" },
+    stack: { type: "string", description: "Target stack name" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const ctx = buildContext(args);
+    const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
+    if (ctx.adapter.name === "local") {
+      const stackConfig = ctx.config.stacks[ctx.stackName];
+      if (!stackConfig?.localOpts) {
+        throw new UsageError(
+          `Stack "${ctx.stackName}" has no localOpts. Run \`clawops init --provider local --host <HOST>\` first.`
+        );
+      }
+      const { localOpts } = stackConfig;
+      const { localBootstrap } = await import("./bootstrap-NRIDVS5F.js");
+      const abortController = new AbortController();
+      process3.on("SIGINT", () => abortController.abort());
+      process3.on("SIGTERM", () => abortController.abort());
+      const spin2 = spinner(`Bootstrapping local host "${localOpts.host}"...`);
+      try {
+        const state = await localBootstrap({
+          host: localOpts.host,
+          port: localOpts.sshPort,
+          user: localOpts.sshUser,
+          privateKeyPath: localOpts.sshKeyPath,
+          knownHostsPath: ctx.config.ssh.knownHostsPath,
+          openclawVersion,
+          stackName: ctx.stackName,
+          noWait: Boolean(args["no-wait"]),
+          signal: abortController.signal
+        });
+        spin2.succeed(`Host "${localOpts.host}" bootstrapped`);
+        info(`Gateway URL: ${state.gatewayUrl}`);
+        info(`SSH:         ${state.sshUser}@${state.sshHost}:${state.sshPort}`);
+      } catch (err) {
+        spin2.fail("Bootstrap failed");
+        throw err;
+      }
+      return;
+    }
+    const instanceAlias = typeof args["instance-type"] === "string" ? args["instance-type"] : "small";
+    if (!VALID_INSTANCE_TYPES.includes(instanceAlias)) {
+      throw new UsageError(
+        `Invalid --instance-type: ${instanceAlias}. Valid values: ${VALID_INSTANCE_TYPES.join(", ")}`
+      );
+    }
+    const isDryRun = Boolean(args["dry-run"]);
+    const validation = await ctx.adapter.validateConfig();
+    if (!validation.ok) {
+      for (const e of validation.errors) failure(e);
+      process3.exit(3);
+    }
+    const stack = await ctx.getStack();
+    const region = typeof args.region === "string" ? args.region : ctx.adapter.defaultRegion();
+    const instanceType = ctx.adapter.normalizeInstanceType(
+      instanceAlias
+    );
+    await stack.setConfig("region", { value: region });
+    await stack.setConfig("instanceType", { value: instanceType });
+    await stack.setConfig("openclawVersion", { value: openclawVersion });
+    if (isDryRun) {
+      info("Previewing changes (--dry-run)...");
+      const preview = await stack.preview({ onOutput: (out) => process3.stdout.write(out) });
+      process3.stdout.write("\n");
+      if (preview.changeSummary) {
+        const rows = Object.entries(preview.changeSummary).filter(([, count]) => count > 0).map(([op, count]) => [op, String(count)]);
+        if (rows.length > 0) {
+          process3.stdout.write(renderTable(["Operation", "Count"], rows) + "\n");
+        }
+      }
+      success("Preview complete (no resources changed)");
+      return;
+    }
+    const spin = spinner(`Deploying stack "${ctx.stackName}"...`);
+    try {
+      const result = await stack.up({
+        onOutput: (out) => {
+          spin.text = out.trim() || spin.text;
+        }
+      });
+      spin.succeed(`Stack "${ctx.stackName}" deployed`);
+      const outputs = result.outputs;
+      if (outputs["publicIp"]) {
+        info(`Public IP:   ${outputs["publicIp"].value}`);
+      }
+      if (outputs["gatewayUrl"]) {
+        info(`Gateway URL: ${outputs["gatewayUrl"].value}`);
+      }
+    } catch (err) {
+      spin.fail("Deployment failed");
+      throw err;
+    }
+  }
+});
+
+// src/cli/commands/down.ts
+import { defineCommand as defineCommand3 } from "citty";
+import process4 from "process";
+var down_default = defineCommand3({
+  meta: {
+    name: "down",
+    description: "Destroy all provisioned resources for a stack"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    yes: { type: "boolean", description: "Skip confirmation prompt" },
+    "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const ctx = buildContext(args);
+    if (args["dry-run"]) {
+      info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
+      try {
+        const stack2 = await ctx.getStack();
+        const outputMap = await stack2.outputs();
+        const rows = Object.entries(outputMap).map(([k, v]) => [k, String(v.value ?? "")]);
+        if (rows.length > 0) {
+          process4.stdout.write("\nCurrent outputs that would be lost:\n");
+          process4.stdout.write(renderTable(["Output", "Value"], rows) + "\n");
+        }
+      } catch {
+      }
+      process4.stdout.write("\nPass --yes to proceed with destruction.\n");
+      return;
+    }
+    const confirmed = Boolean(args.yes);
+    if (!confirmed) {
+      failure(
+        `This will destroy all resources in stack "${ctx.stackName}". Pass --yes to confirm.`
+      );
+      process4.exit(1);
+    }
+    info(`Destroying stack "${ctx.stackName}"...`);
+    const stack = await ctx.getStack();
+    const spin = spinner("Running destroy...");
+    try {
+      await stack.destroy({ onOutput: (out) => {
+        spin.text = out.trim() || spin.text;
+      } });
+      spin.succeed(`Stack "${ctx.stackName}" destroyed`);
+      success("All resources have been removed.");
+    } catch (err) {
+      spin.fail("Destroy failed");
+      throw err;
+    }
+  }
+});
+
+// src/cli/commands/status.ts
+import { defineCommand as defineCommand4 } from "citty";
+import process6 from "process";
+
+// src/output/json.ts
+import process5 from "process";
+function printJson(output) {
+  process5.stdout.write(JSON.stringify(output, null, 2) + "\n");
+}
+function jsonOk(data) {
+  return { ok: true, data };
+}
+
+// src/cli/commands/status.ts
+var status_default = defineCommand4({
+  meta: {
+    name: "status",
+    description: "Show current stack status: outputs, region, provisioned time"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const ctx = buildContext(args);
+    if (ctx.adapter.name === "local") {
+      const state = ctx.localState;
+      if (Boolean(args.json)) {
+        if (state) {
+          printJson(jsonOk({ stack: ctx.stackName, ...state }));
+        } else {
+          printJson(jsonOk({ stack: ctx.stackName, status: "not bootstrapped" }));
+        }
+        return;
+      }
+      const rows2 = [["Stack", ctx.stackName]];
+      if (state) {
+        rows2.push(["Provider", "local"]);
+        rows2.push(["Host", state.sshHost]);
+        rows2.push(["SSH", `${state.sshUser}@${state.sshHost}:${state.sshPort}`]);
+        rows2.push(["Gateway URL", state.gatewayUrl]);
+        rows2.push(["Bootstrapped", state.provisionedAt]);
+      } else {
+        rows2.push(["Status", "not bootstrapped (run `clawops up`)"]);
+      }
+      process6.stdout.write("\n" + renderTable(["Field", "Value"], rows2) + "\n\n");
+      return;
+    }
+    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    if (Boolean(args.json)) {
+      printJson(jsonOk({ stack: ctx.stackName, ...outputs }));
+      return;
+    }
+    const rows = [];
+    try {
+      const base = extractBaseOutputs(outputs);
+      rows.push(["Stack", ctx.stackName]);
+      rows.push(["Provider", ctx.config.stacks[ctx.stackName]?.provider ?? "\u2014"]);
+      rows.push(["Region", base.region]);
+      rows.push(["Public IP", base.publicIp]);
+      rows.push(["Gateway URL", base.gatewayUrl]);
+      rows.push(["SSH", `${base.sshUser}@${base.sshHost}:${base.sshPort}`]);
+      rows.push(["Provisioned", base.provisionedAt]);
+    } catch {
+      rows.push(["Stack", ctx.stackName]);
+      rows.push(["Status", "not deployed (run `clawops up`)"]);
+    }
+    process6.stdout.write("\n" + renderTable(["Field", "Value"], rows) + "\n\n");
+  }
+});
+
+// src/cli/commands/plan.ts
+import { defineCommand as defineCommand5 } from "citty";
+import process7 from "process";
+import { writeFileSync as writeFileSync2 } from "fs";
+import { isAbsolute } from "path";
+var plan_default = defineCommand5({
+  meta: {
+    name: "plan",
+    description: "Generate a Maker deploy plan without applying it"
+  },
+  args: {
+    provider: { type: "string", description: "Cloud provider (aws|gcp|azure)" },
+    stack: { type: "string", description: "Target stack name" },
+    region: { type: "string", description: "Cloud region" },
+    "instance-type": { type: "string", description: "Instance size alias (micro|small|medium|large|gpu)" },
+    "openclaw-version": { type: "string", description: "semver or 'stable'/'dev'" },
+    out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { generatePlan } = await import("./generate-Y6O465VB.js");
+    const ctx = buildContext(args);
+    if (ctx.adapter.name === "local") {
+      throw new UsageError(
+        "plan/apply is not supported for the local provider. Use `clawops up` directly."
+      );
+    }
+    const provider = ctx.adapter.name;
+    const outPath = typeof args.out === "string" ? args.out : void 0;
+    if (outPath && !isAbsolute(outPath)) {
+      throw new UsageError("--out path must be absolute (R7). Use an absolute path like /tmp/plan.json.");
+    }
+    const abortController = new AbortController();
+    process7.on("SIGINT", () => abortController.abort());
+    process7.on("SIGTERM", () => abortController.abort());
+    const spin = spinner("Generating plan\u2026");
+    let plan;
+    try {
+      plan = await generatePlan(
+        {
+          stackName: ctx.stackName,
+          provider,
+          region: typeof args.region === "string" ? args.region : void 0,
+          instanceType: typeof args["instance-type"] === "string" ? args["instance-type"] : void 0,
+          openclawVersion: typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0
+        },
+        { signal: abortController.signal }
+      );
+      spin.succeed("Plan generated");
+    } catch (err) {
+      spin.fail("Plan generation failed");
+      throw err;
+    }
+    const planJson = JSON.stringify(plan, null, 2);
+    if (outPath) {
+      writeFileSync2(outPath, planJson + "\n", "utf-8");
+      success(`Plan written to ${outPath}`);
+    } else {
+      process7.stdout.write(planJson + "\n");
+    }
+    if (plan.diff) {
+      const { create, update, delete: del, totalChanges } = plan.diff;
+      process7.stderr.write(
+        `
+Changes: ${create.length} to create, ${update.length} to update, ${del.length} to delete (${totalChanges} total)
+`
+      );
+      const rows = [
+        ...create.map((r) => ["+", r.type, r.name ?? ""]),
+        ...update.map((r) => ["~", r.resource.type, r.resource.name ?? ""]),
+        ...del.map((r) => ["-", r.type, r.name ?? ""])
+      ];
+      if (rows.length > 0) {
+        process7.stderr.write(renderTable(["Op", "Resource Type", "Name"], rows) + "\n");
+      }
+    } else {
+      process7.stderr.write("(diff unavailable \u2014 preview could not run against this stack)\n");
+    }
+  }
+});
+
+// src/cli/commands/apply.ts
+import { defineCommand as defineCommand6 } from "citty";
+import process8 from "process";
+import { readFileSync } from "fs";
+import { isAbsolute as isAbsolute2 } from "path";
+import { createInterface } from "readline/promises";
+var apply_default = defineCommand6({
+  meta: {
+    name: "apply",
+    description: "Apply a Maker plan JSON produced by `clawops plan`"
+  },
+  args: {
+    yes: { type: "boolean", description: "Skip confirmation prompt" },
+    "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
+  },
+  async run({ args }) {
+    const { validatePlan } = await import("./validate-T5M5EHSJ.js");
+    const { applyPlan } = await import("./apply-GTVALBAY.js");
+    const planPath = args._?.[0];
+    if (!planPath) {
+      throw new UsageError("Usage: clawops apply <plan.json>");
+    }
+    if (!isAbsolute2(planPath)) {
+      throw new UsageError(`Plan path must be absolute (R7). Got: ${planPath}`);
+    }
+    let raw;
+    try {
+      raw = readFileSync(planPath, "utf-8");
+    } catch {
+      throw new UsageError(`Cannot read plan file: ${planPath}`);
+    }
+    let plan;
+    try {
+      plan = JSON.parse(raw);
+    } catch {
+      throw new UsageError(`Plan file is not valid JSON: ${planPath}`);
+    }
+    const validation = validatePlan(plan);
+    if (!validation.ok) {
+      throw new UsageError(`Invalid plan:
+${validation.errors.join("\n")}`);
+    }
+    const typedPlan = plan;
+    if (typedPlan.spec.provider === "local") {
+      throw new UsageError(
+        "plan/apply is not supported for the local provider. Use `clawops up` directly."
+      );
+    }
+    info(`Applying plan: ${planPath}`);
+    if (typedPlan.diff) {
+      const { create, update, delete: del } = typedPlan.diff;
+      process8.stdout.write(
+        `  ${create.length} to create, ${update.length} to update, ${del.length} to delete
+`
+      );
+      const rows = [
+        ...create.map((r) => ["+", r.type, r.name ?? ""]),
+        ...update.map((r) => ["~", r.resource.type, r.resource.name ?? ""]),
+        ...del.map((r) => ["-", r.type, r.name ?? ""])
+      ];
+      if (rows.length > 0) {
+        process8.stdout.write(renderTable(["Op", "Resource Type", "Name"], rows) + "\n");
+      }
+    }
+    if (args["dry-run"]) {
+      info("Dry run \u2014 plan is valid. Pass --yes (without --dry-run) to apply.");
+      return;
+    }
+    if (!args.yes) {
+      const rl = createInterface({ input: process8.stdin, output: process8.stdout });
+      const answer = await rl.question("Continue? (y/N) ");
+      rl.close();
+      if (answer.trim().toLowerCase() !== "y") {
+        process8.stdout.write("Aborted.\n");
+        process8.exit(0);
+      }
+    }
+    const abortController = new AbortController();
+    process8.on("SIGINT", () => abortController.abort());
+    process8.on("SIGTERM", () => abortController.abort());
+    const spin = spinner(`Applying plan for stack "${typedPlan.spec.stackName}"\u2026`);
+    try {
+      const result = await applyPlan(typedPlan, {
+        onOutput: (line) => {
+          spin.text = line.trim() || spin.text;
+        },
+        signal: abortController.signal
+      });
+      spin.succeed(`Stack "${typedPlan.spec.stackName}" applied`);
+      const summaryRows = Object.entries(result.changeSummary).filter(([, count]) => count > 0).map(([op, count]) => [op, String(count)]);
+      if (summaryRows.length > 0) {
+        process8.stdout.write(renderTable(["Operation", "Count"], summaryRows) + "\n");
+      }
+      if (result.outputs["gatewayUrl"]) {
+        info(`Gateway URL: ${result.outputs["gatewayUrl"]}`);
+      }
+      if (result.outputs["publicIp"]) {
+        info(`Public IP:   ${result.outputs["publicIp"]}`);
+      }
+      success(`Done in ${(result.durationMs / 1e3).toFixed(1)}s`);
+    } catch (err) {
+      spin.fail("Apply failed");
+      throw err;
+    }
+  }
+});
+
+// src/cli/commands/destroy.ts
+import { defineCommand as defineCommand7 } from "citty";
+import process9 from "process";
+import { createInterface as createInterface2 } from "readline/promises";
+var destroy_default = defineCommand7({
+  meta: {
+    name: "destroy",
+    description: "Destroy all resources in a stack (irreversible)"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    yes: { type: "boolean", description: "Skip confirmation prompt" },
+    "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const ctx = buildContext(args);
+    if (ctx.adapter.name === "local") {
+      throw new UsageError(
+        "Local provider stacks cannot be destroyed via `clawops destroy`. Use `clawops down --yes` to remove a local stack."
+      );
+    }
+    const stack = await ctx.getStack();
+    if (args["dry-run"]) {
+      info(`Dry run \u2014 would destroy stack "${ctx.stackName}" (${ctx.adapter.name})`);
+      try {
+        const outputMap = await stack.outputs();
+        const rows = Object.entries(outputMap).map(([k, v]) => [k, String(v.value ?? "")]);
+        if (rows.length > 0) {
+          process9.stdout.write("\nCurrent outputs that would be lost:\n");
+          process9.stdout.write(renderTable(["Output", "Value"], rows) + "\n");
+        }
+      } catch {
+      }
+      process9.stdout.write(`
+Pass --yes to proceed with destruction.
+`);
+      return;
+    }
+    if (!args.yes) {
+      const rl = createInterface2({ input: process9.stdin, output: process9.stdout });
+      const answer = await rl.question(
+        `Destroy stack "${ctx.stackName}"? This is irreversible. (y/N) `
+      );
+      rl.close();
+      if (answer.trim().toLowerCase() !== "y") {
+        process9.stdout.write("Aborted.\n");
+        process9.exit(0);
+      }
+    }
+    const abortController = new AbortController();
+    process9.on("SIGINT", () => abortController.abort());
+    process9.on("SIGTERM", () => abortController.abort());
+    const spin = spinner(`Destroying stack "${ctx.stackName}"\u2026`);
+    try {
+      await stack.destroy({
+        onOutput: (out) => {
+          spin.text = out.trim() || spin.text;
+        }
+      });
+      spin.succeed(`Stack "${ctx.stackName}" destroyed`);
+      success("All resources have been removed.");
+    } catch (err) {
+      spin.fail("Destroy failed");
+      throw err;
+    }
+  }
+});
+
+// src/cli/commands/ssh.ts
+import { defineCommand as defineCommand8 } from "citty";
+import process10 from "process";
+var ssh_default = defineCommand8({
+  meta: {
+    name: "ssh",
+    description: "Open an SSH session to the stack instance"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const ctx = buildContext(args);
+    let conn;
+    if (ctx.adapter.name === "local") {
+      const state = ctx.localState;
+      if (!state) {
+        failure("Stack has no state. Run `clawops up` first.");
+        process10.exit(4);
+      }
+      conn = {
+        host: state.sshHost,
+        port: state.sshPort,
+        user: state.sshUser,
+        privateKeyPath: state.privateKeyPath,
+        knownHostsPath: state.knownHostsPath
+      };
+    } else {
+      const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+      const stack = await ctx.getStack();
+      const outputMap = await stack.outputs();
+      const outputs = Object.fromEntries(
+        Object.entries(outputMap).map(([k, v]) => [k, v.value])
+      );
+      if (!outputs["publicIp"]) {
+        failure("Stack has no outputs. Run `clawops up` first.");
+        process10.exit(4);
+      }
+      const base = extractBaseOutputs(outputs);
+      conn = ctx.adapter.getConnectionInfo({
+        ...base,
+        privateKeyPath: ctx.config.ssh.keyPath,
+        knownHostsPath: ctx.config.ssh.knownHostsPath
+      });
+    }
+    const remoteCommand = typeof args.command === "string" ? args.command : null;
+    const abortController = new AbortController();
+    process10.on("SIGINT", () => abortController.abort());
+    process10.on("SIGTERM", () => abortController.abort());
+    const spin = spinner("Connecting...");
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    spin.stop();
+    try {
+      if (remoteCommand) {
+        const result = await session.exec(remoteCommand, abortController.signal);
+        process10.stdout.write(result.stdout);
+        if (result.stderr) process10.stderr.write(result.stderr);
+        process10.exit(result.code);
+      } else {
+        const shellStream = await session.stream("bash -l", abortController.signal);
+        shellStream.pipe(process10.stdout);
+        process10.stdin.pipe(shellStream);
+        await new Promise((resolve) => {
+          shellStream.on("end", resolve);
+          shellStream.on("close", resolve);
+          abortController.signal.addEventListener("abort", () => resolve(), { once: true });
+        });
+      }
+    } finally {
+      release();
+      drainPool();
+    }
+  }
+});
+
+// src/cli/commands/tunnel.ts
+import { defineCommand as defineCommand9 } from "citty";
+import { spawn } from "child_process";
+import process11 from "process";
+var tunnel_default = defineCommand9({
+  meta: {
+    name: "tunnel",
+    description: "Forward the OpenClaw gateway port to localhost"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    port: { type: "string", description: "Local port to listen on (default: same as gateway)" },
+    "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const { acquireSession } = await import("./pool-D4JCUA2V.js");
+    const ctx = buildContext(args);
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const gatewayUrl = new URL(base.gatewayUrl);
+    const remotePort = parseInt(gatewayUrl.port, 10) || 443;
+    const localPort = args.port ? parseInt(String(args.port), 10) : remotePort;
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    const abortController = new AbortController();
+    process11.on("SIGINT", () => abortController.abort());
+    process11.on("SIGTERM", () => abortController.abort());
+    const spin = spinner("Connecting...");
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    spin.stop();
+    try {
+      const handle = await session.tunnel(localPort, "localhost", remotePort, abortController.signal);
+      const localUrl = `http://localhost:${handle.localPort}`;
+      success(`Tunnel ready: ${localUrl}`);
+      process11.stdout.write("Press Ctrl+C to close.\n");
+      if (!args["no-open"]) {
+        openBrowser(localUrl);
+      }
+      await new Promise((resolve) => {
+        abortController.signal.addEventListener("abort", () => resolve(), { once: true });
+      });
+      handle.close();
+    } finally {
+      release();
+    }
+  }
+});
+function openBrowser(url) {
+  const [cmd, ...cmdArgs] = process11.platform === "darwin" ? ["open", url] : process11.platform === "win32" ? ["cmd", "/c", "start", url] : ["xdg-open", url];
+  spawn(cmd, cmdArgs, { detached: true, stdio: "ignore" }).unref();
+}
+
+// src/cli/commands/logs.ts
+import { defineCommand as defineCommand10 } from "citty";
+import process12 from "process";
+var logs_default = defineCommand10({
+  meta: {
+    name: "logs",
+    description: "Stream gateway logs from the remote instance"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    follow: { type: "boolean", alias: "f", description: "Follow log output" },
+    tail: { type: "string", description: "Number of lines to show from end (default: 100)" },
+    since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const ctx = buildContext(args);
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    if (!outputs["publicIp"]) {
+      failure("Stack has no outputs. Run `clawops up` first.");
+      process12.exit(4);
+    }
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    const tailLines = typeof args.tail === "string" ? parseInt(args.tail, 10) : 100;
+    const follow = Boolean(args.follow);
+    const sinceFlag = typeof args.since === "string" ? `--since "${args.since}"` : "";
+    const followFlag = follow ? "-f" : "";
+    const command = [
+      "journalctl -u openclaw",
+      `-n ${tailLines}`,
+      followFlag,
+      sinceFlag,
+      "2>/dev/null",
+      "|| docker logs openclaw",
+      `-n ${tailLines}`,
+      follow ? "-f" : ""
+    ].filter(Boolean).join(" ");
+    const abortController = new AbortController();
+    process12.on("SIGINT", () => abortController.abort());
+    process12.on("SIGTERM", () => abortController.abort());
+    const spin = spinner("Connecting...");
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    spin.stop();
+    try {
+      if (follow) {
+        const logStream = await session.stream(command, abortController.signal);
+        logStream.pipe(process12.stdout);
+        await new Promise((resolve) => {
+          logStream.on("end", resolve);
+          logStream.on("close", resolve);
+          abortController.signal.addEventListener("abort", () => resolve(), { once: true });
+        });
+      } else {
+        const result = await session.exec(command, abortController.signal);
+        process12.stdout.write(result.stdout);
+        if (result.stderr) process12.stderr.write(result.stderr);
+      }
+    } finally {
+      release();
+      if (!follow) drainPool();
+    }
+  }
+});
+
+// src/cli/commands/config.ts
+import { defineCommand as defineCommand11 } from "citty";
+import process13 from "process";
+var OPENCLAW_CONFIG = "/home/clawops/openclaw.json";
+var OPENCLAW_TMP = "/tmp/clawops-config.json.tmp";
+function dockerRunCmd(version) {
+  return [
+    "docker stop openclaw 2>/dev/null || true",
+    "docker rm   openclaw 2>/dev/null || true",
+    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG}:/app/config.json:ro ghcr.io/openclaw/openclaw:${version}`
+  ].join(" && ");
+}
+function getPath(obj, dotKey) {
+  return dotKey.split(".").reduce((cur, k) => {
+    if (cur !== null && typeof cur === "object") return cur[k];
+    return void 0;
+  }, obj);
+}
+function setPath(obj, dotKey, value) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) cur[k] = {};
+    cur = cur[k];
+  }
+  cur[keys[keys.length - 1]] = value;
+}
+function deletePath(obj, dotKey) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) return;
+    cur = cur[k];
+  }
+  delete cur[keys[keys.length - 1]];
+}
+var config_default = defineCommand11({
+  meta: {
+    name: "config",
+    description: "Manage OpenClaw gateway configuration (get | set | unset)"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    restart: { type: "boolean", description: "Restart gateway after set/unset" },
+    json: { type: "boolean", description: "Emit JSON (for get)" },
+    "dry-run": { type: "boolean", description: "Show what would change without writing" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const [action, key, value] = args._ ?? [];
+    if (!action || !["get", "set", "unset"].includes(action)) {
+      failure("Usage: clawops config <get [key] | set key value | unset key>");
+      process13.exit(2);
+    }
+    if (action === "set" && (!key || value === void 0)) {
+      failure("Usage: clawops config set <key> <value>");
+      process13.exit(2);
+    }
+    if (action === "unset" && !key) {
+      failure("Usage: clawops config unset <key>");
+      process13.exit(2);
+    }
+    const ctx = buildContext(args);
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    const abortController = new AbortController();
+    process13.on("SIGINT", () => abortController.abort());
+    process13.on("SIGTERM", () => abortController.abort());
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    try {
+      const readResult = await session.exec(`cat ${OPENCLAW_CONFIG}`, abortController.signal);
+      let cfg;
+      try {
+        cfg = JSON.parse(readResult.stdout);
+      } catch {
+        failure(`Cannot parse ${OPENCLAW_CONFIG}: ${readResult.stderr || readResult.stdout}`);
+        process13.exit(1);
+      }
+      if (action === "get") {
+        const result = key ? getPath(cfg, key) : cfg;
+        if (args.json) {
+          printJson(jsonOk(result));
+        } else {
+          process13.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        }
+        return;
+      }
+      if (action === "set") {
+        let parsedValue = value;
+        try {
+          parsedValue = JSON.parse(value);
+        } catch {
+        }
+        setPath(cfg, key, parsedValue);
+      } else {
+        deletePath(cfg, key);
+      }
+      if (args["dry-run"]) {
+        info(`Dry run \u2014 would write to ${OPENCLAW_CONFIG}:`);
+        process13.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
+        return;
+      }
+      const json = JSON.stringify(cfg, null, 2);
+      const b64 = Buffer.from(json, "utf-8").toString("base64");
+      const writeCmd = `echo '${b64}' | base64 -d > ${OPENCLAW_TMP} && mv ${OPENCLAW_TMP} ${OPENCLAW_CONFIG} && chown clawops:clawops ${OPENCLAW_CONFIG}`;
+      const writeResult = await session.exec(writeCmd, abortController.signal);
+      if (writeResult.code !== 0) {
+        failure(`Failed to write config: ${writeResult.stderr}`);
+        process13.exit(1);
+      }
+      success(`config ${action}: ${key ?? "(all)"}`);
+      if (args.restart) {
+        info("Restarting gateway...");
+        const imgResult = await session.exec(
+          `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo 'ghcr.io/openclaw/openclaw:stable'`,
+          abortController.signal
+        );
+        const version = imgResult.stdout.trim().split(":")[1] ?? "stable";
+        const restartResult = await session.exec(dockerRunCmd(version), abortController.signal);
+        if (restartResult.code !== 0) {
+          failure(`Restart failed: ${restartResult.stderr}`);
+          process13.exit(1);
+        }
+        success("Gateway restarted.");
+      }
+    } finally {
+      release();
+      drainPool();
+    }
+  }
+});
+
+// src/cli/commands/agents.ts
+import { defineCommand as defineCommand12 } from "citty";
+import process14 from "process";
+var agents_default = defineCommand12({
+  meta: {
+    name: "agents",
+    description: "Manage OpenClaw agents (list | restart [name] | logs <name>)"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    json: { type: "boolean", description: "Emit JSON (for list)" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const [action, name] = args._ ?? [];
+    if (!action || !["list", "restart", "logs"].includes(action)) {
+      failure("Usage: clawops agents <list | restart [name] | logs <name>>");
+      process14.exit(2);
+    }
+    if (action === "logs" && !name) {
+      failure("Usage: clawops agents logs <name>");
+      process14.exit(2);
+    }
+    const ctx = buildContext(args);
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    const abortController = new AbortController();
+    process14.on("SIGINT", () => abortController.abort());
+    process14.on("SIGTERM", () => abortController.abort());
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    try {
+      if (action === "list") {
+        const result = await session.exec(
+          "docker exec openclaw openclaw agents list --json 2>/dev/null || echo '[]'",
+          abortController.signal
+        );
+        let agents = [];
+        try {
+          agents = JSON.parse(result.stdout.trim());
+        } catch {
+          agents = [];
+        }
+        if (args.json) {
+          printJson(jsonOk(agents));
+        } else if (agents.length === 0) {
+          info("No agents running.");
+        } else {
+          process14.stdout.write(
+            "\n" + renderTable(
+              ["Name", "Status"],
+              agents.map((a) => [a.name ?? "\u2014", a.status ?? "\u2014"])
+            ) + "\n\n"
+          );
+        }
+      } else if (action === "restart") {
+        const cmd = name ? `docker exec openclaw openclaw agents restart ${name}` : "docker exec openclaw openclaw agents restart";
+        const result = await session.exec(cmd, abortController.signal);
+        if (result.code !== 0) {
+          failure(`Restart failed: ${result.stderr}`);
+          process14.exit(1);
+        }
+        success(name ? `Agent '${name}' restarted.` : "All agents restarted.");
+      } else {
+        const logStream = await session.stream(
+          `docker exec -t openclaw openclaw agents logs ${name} --follow`,
+          abortController.signal
+        );
+        logStream.pipe(process14.stdout);
+        await new Promise((resolve) => {
+          logStream.on("end", resolve);
+          logStream.on("close", resolve);
+          abortController.signal.addEventListener("abort", () => resolve(), { once: true });
+        });
+      }
+    } finally {
+      release();
+      if (action !== "logs") drainPool();
+    }
+  }
+});
+
+// src/cli/commands/gateway.ts
+import { defineCommand as defineCommand13 } from "citty";
+import process15 from "process";
+var OPENCLAW_CONFIG2 = "/home/clawops/openclaw.json";
+function dockerRunCmd2(version) {
+  return `docker stop openclaw 2>/dev/null || true && docker rm   openclaw 2>/dev/null || true && docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG2}:/app/config.json:ro ghcr.io/openclaw/openclaw:${version}`;
+}
+var gateway_default = defineCommand13({
+  meta: {
+    name: "gateway",
+    description: "Manage the OpenClaw gateway daemon (status | restart | update [version])"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    channel: { type: "string", description: "Channel for update: stable | dev | <version>" },
+    json: { type: "boolean", description: "Emit JSON (for status)" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const [action, versionArg] = args._ ?? [];
+    if (!action || !["status", "restart", "update"].includes(action)) {
+      failure("Usage: clawops gateway <status | restart | update [version]>");
+      process15.exit(2);
+    }
+    const ctx = buildContext(args);
+    const stack = await ctx.getStack();
+    const outputMap = await stack.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    const abortController = new AbortController();
+    process15.on("SIGINT", () => abortController.abort());
+    process15.on("SIGTERM", () => abortController.abort());
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    try {
+      if (action === "status") {
+        const statusCmd = `docker inspect openclaw --format '{"status":"{{.State.Status}}","started":"{{.State.StartedAt}}","image":"{{.Config.Image}}"}' 2>/dev/null || echo '{"status":"not running","started":"","image":""}'`;
+        const result = await session.exec(statusCmd, abortController.signal);
+        let status = { status: "unknown", started: "", image: "" };
+        try {
+          status = JSON.parse(result.stdout.trim());
+        } catch {
+        }
+        if (args.json) {
+          printJson(jsonOk(status));
+        } else {
+          process15.stdout.write(
+            "\n" + renderTable(
+              ["Field", "Value"],
+              [
+                ["Status", status.status],
+                ["Started", status.started],
+                ["Image", status.image]
+              ]
+            ) + "\n\n"
+          );
+        }
+      } else if (action === "restart") {
+        const imgResult = await session.exec(
+          `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo 'ghcr.io/openclaw/openclaw:stable'`,
+          abortController.signal
+        );
+        const version = imgResult.stdout.trim().split(":")[1] ?? "stable";
+        const spin = spinner("Restarting gateway...");
+        const result = await session.exec(dockerRunCmd2(version), abortController.signal);
+        spin.stop();
+        if (result.code !== 0) {
+          failure(`Restart failed: ${result.stderr}`);
+          process15.exit(1);
+        }
+        success(`Gateway restarted (${version}).`);
+      } else {
+        const version = versionArg ?? args.channel ?? "stable";
+        const spin = spinner(`Updating gateway to ${version}...`);
+        const pullResult = await session.exec(
+          `docker pull ghcr.io/openclaw/openclaw:${version}`,
+          abortController.signal
+        );
+        if (pullResult.code !== 0) {
+          spin.stop();
+          failure(`Pull failed: ${pullResult.stderr}`);
+          process15.exit(1);
+        }
+        const runResult = await session.exec(dockerRunCmd2(version), abortController.signal);
+        spin.stop();
+        if (runResult.code !== 0) {
+          failure(`Start failed: ${runResult.stderr}`);
+          process15.exit(1);
+        }
+        success(`Gateway updated to ${version}.`);
+      }
+    } finally {
+      release();
+      drainPool();
+    }
+  }
+});
+
+// src/cli/commands/backup.ts
+import { defineCommand as defineCommand14 } from "citty";
+import { createWriteStream, createReadStream } from "fs";
+import { pipeline } from "stream/promises";
+import process16 from "process";
+var backup_default = defineCommand14({
+  meta: {
+    name: "backup",
+    description: "Create or restore an OpenClaw backup (create | restore)"
+  },
+  args: {
+    action: { type: "positional", description: "Action: create | restore", required: true },
+    out: { type: "string", description: "[create] Local path to write the backup archive" },
+    file: { type: "string", description: "[restore] Local backup archive to restore from" },
+    stack: { type: "string", description: "Target stack name" },
+    yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const action = args.action;
+    if (action !== "create" && action !== "restore") {
+      throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
+    }
+    const ctx = buildContext(args);
+    let conn;
+    if (ctx.adapter.name === "local") {
+      const state = ctx.localState;
+      if (!state) {
+        failure("Stack has no state. Run `clawops up` first.");
+        process16.exit(4);
+      }
+      conn = {
+        host: state.sshHost,
+        port: state.sshPort,
+        user: state.sshUser,
+        privateKeyPath: state.privateKeyPath,
+        knownHostsPath: state.knownHostsPath
+      };
+    } else {
+      const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+      const stack = await ctx.getStack();
+      const outputMap = await stack.outputs();
+      const outputs = Object.fromEntries(
+        Object.entries(outputMap).map(([k, v]) => [k, v.value])
+      );
+      if (!outputs["publicIp"]) {
+        failure("Stack has no outputs. Run `clawops up` first.");
+        process16.exit(4);
+      }
+      const base = extractBaseOutputs(outputs);
+      conn = ctx.adapter.getConnectionInfo({
+        ...base,
+        privateKeyPath: ctx.config.ssh.keyPath,
+        knownHostsPath: ctx.config.ssh.knownHostsPath
+      });
+    }
+    const abortController = new AbortController();
+    process16.on("SIGINT", () => abortController.abort());
+    process16.on("SIGTERM", () => abortController.abort());
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: abortController.signal
+    });
+    try {
+      if (action === "create") {
+        const outPath = typeof args.out === "string" ? args.out : `openclaw-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.tar.gz`;
+        info(`Writing backup to ${outPath}...`);
+        const spin = spinner("Creating backup on remote host...");
+        const backupStream = await session.stream(
+          "docker exec openclaw openclaw-ctl backup create --stdout",
+          abortController.signal
+        );
+        spin.stop();
+        const fileStream = createWriteStream(outPath);
+        await pipeline(backupStream, fileStream);
+        success(`Backup saved to ${outPath}`);
+      } else {
+        const filePath = typeof args.file === "string" ? args.file : null;
+        if (!filePath) {
+          throw new UsageError("--file is required for backup restore");
+        }
+        if (!args.yes) {
+          const { createInterface: createInterface3 } = await import("readline/promises");
+          const rl = createInterface3({ input: process16.stdin, output: process16.stdout });
+          try {
+            const answer = await rl.question(
+              `Restore backup from "${filePath}" to stack "${ctx.stackName}"? This will overwrite existing data. (y/N) `
+            );
+            if (answer.trim().toLowerCase() !== "y") {
+              info("Restore cancelled.");
+              return;
+            }
+          } finally {
+            rl.close();
+          }
+        }
+        info(`Restoring from ${filePath}...`);
+        const spin = spinner("Transferring and restoring backup...");
+        const restoreStream = await session.stream(
+          "docker exec -i openclaw openclaw-ctl backup restore --stdin",
+          abortController.signal
+        );
+        const fileStream = createReadStream(filePath);
+        await pipeline(fileStream, restoreStream);
+        spin.stop();
+        success("Backup restored successfully");
+      }
+    } finally {
+      release();
+      drainPool();
+    }
+  }
+});
+
+// src/cli/commands/stacks.ts
+import { defineCommand as defineCommand15 } from "citty";
+import process17 from "process";
+var stacks_default = defineCommand15({
+  meta: {
+    name: "stacks",
+    description: "Manage clawops stacks (list | delete <name>)"
+  },
+  args: {
+    json: { type: "boolean", description: "Emit JSON (for list)" },
+    yes: { type: "boolean", description: "Skip confirmation prompt on delete" },
+    force: { type: "boolean", description: "Allow deleting the default stack" }
+  },
+  async run({ args }) {
+    const [action, name] = args._ ?? [];
+    if (!action || !["list", "delete"].includes(action)) {
+      failure("Usage: clawops stacks <list | delete <name>>");
+      process17.exit(2);
+    }
+    if (action === "list") {
+      const config2 = requireConfig();
+      const defaultStack = config2.defaults.stack;
+      const rows = Object.entries(config2.stacks).map(([n, s]) => [
+        n === defaultStack ? `${n} *` : n,
+        s.provider,
+        s.region ?? "\u2014",
+        s.stateUrl
+      ]);
+      if (args.json) {
+        const data = Object.entries(config2.stacks).map(([n, s]) => ({
+          name: n,
+          provider: s.provider,
+          region: s.region ?? null,
+          stateUrl: s.stateUrl,
+          isDefault: n === defaultStack
+        }));
+        printJson(jsonOk({ stacks: data, default: defaultStack }));
+      } else if (rows.length === 0) {
+        info("No stacks configured.");
+      } else {
+        process17.stdout.write(
+          "\n" + renderTable(
+            ["Name", "Provider", "Region", "State URL"],
+            rows
+          ) + "\n\n"
+        );
+        info("* = default stack");
+      }
+      return;
+    }
+    if (!name) {
+      failure("Usage: clawops stacks delete <name>");
+      process17.exit(2);
+    }
+    const config = requireConfig();
+    if (!(name in config.stacks)) {
+      throw new UsageError(`Stack "${name}" not found in config.`);
+    }
+    const stackNames = Object.keys(config.stacks);
+    if (stackNames.length === 1) {
+      throw new UsageError(
+        `Cannot delete the only remaining stack "${name}". Add another stack first or run \`clawops destroy\` to tear down resources.`
+      );
+    }
+    if (name === config.defaults.stack && !args.force) {
+      throw new UsageError(
+        `"${name}" is the default stack. Use --force to delete it (clawops will switch the default to another stack).`
+      );
+    }
+    warn(
+      `This removes "${name}" from clawops config only. Cloud resources are NOT destroyed. Run \`clawops destroy --stack ` + name + "` first if you want to remove cloud resources."
+    );
+    if (!args.yes) {
+      const confirmed = await confirm(`Delete stack "${name}" from config?`);
+      if (!confirmed) {
+        info("Aborted.");
+        return;
+      }
+    }
+    const updated = { ...config };
+    const newStacks = { ...config.stacks };
+    delete newStacks[name];
+    updated.stacks = newStacks;
+    if (name === config.defaults.stack) {
+      updated.defaults = { ...config.defaults, stack: Object.keys(newStacks)[0] };
+    }
+    setConfig(updated);
+    success(`Stack "${name}" removed from config.`);
+    if (name === config.defaults.stack) {
+      info(`Default stack switched to "${updated.defaults.stack}".`);
+    }
+  }
+});
+async function confirm(message) {
+  const { createInterface: createInterface3 } = await import("readline/promises");
+  const rl = createInterface3({ input: process17.stdin, output: process17.stdout });
+  try {
+    const answer = await rl.question(`${message} (y/N) `);
+    return answer.trim().toLowerCase() === "y";
+  } finally {
+    rl.close();
+  }
+}
+
+// src/cli/commands/doctor.ts
+import { defineCommand as defineCommand16 } from "citty";
+import process18 from "process";
+import { accessSync, mkdirSync as mkdirSync2, constants } from "fs";
+import path2 from "path";
+var doctor_default = defineCommand16({
+  meta: {
+    name: "doctor",
+    description: "Check system prerequisites, config, SSH keys, and cloud credentials"
+  },
+  async run() {
+    const { getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-ARJ2EO6L.js");
+    process18.stdout.write("\nclawops doctor\n");
+    process18.stdout.write("\nRuntime\n");
+    const nodeVersion = process18.version;
+    const nodeMajor = parseInt(nodeVersion.slice(1).split(".")[0] ?? "0", 10);
+    const nodeOk = nodeMajor >= 22;
+    if (nodeOk) {
+      success(`Node.js ${nodeVersion}`);
+    } else {
+      failure(`Node.js ${nodeVersion}  (requires >=22)`);
+    }
+    const configDir = getConfigDir2();
+    const pulumiHome = path2.join(configDir, ".pulumi");
+    try {
+      mkdirSync2(pulumiHome, { recursive: true });
+      success(`Pulumi home  ${pulumiHome}`);
+    } catch {
+      failure(`Pulumi home  ${pulumiHome}  (not writable)`);
+    }
+    process18.stdout.write("\nConfig\n");
+    const config = getConfig2();
+    if (!config) {
+      warn("No config file found \u2014 run `clawops init` to create one");
+    } else {
+      success(`Config file  ${path2.join(configDir, "config.json")}`);
+    }
+    process18.stdout.write("\nSSH\n");
+    if (!config) {
+      info("SSH checks skipped \u2014 no config");
+    } else {
+      const keyPath = config.ssh.keyPath.replace(/^~/, process18.env["HOME"] ?? "~");
+      try {
+        accessSync(keyPath, constants.R_OK);
+        success(`SSH key      ${keyPath}`);
+      } catch {
+        failure(`SSH key      ${keyPath}  (not found or not readable)`);
+      }
+      const knownHostsPath = config.ssh.knownHostsPath.replace(/^~/, process18.env["HOME"] ?? "~");
+      try {
+        accessSync(knownHostsPath, constants.F_OK);
+        success(`known_hosts  ${knownHostsPath}`);
+      } catch {
+        warn(`known_hosts  ${knownHostsPath}  (does not exist \u2014 will be created on first connect)`);
+      }
+    }
+    process18.stdout.write("\nCredentials\n");
+    if (!config) {
+      info("Credential checks skipped \u2014 no config");
+    } else {
+      const { getProvider } = await import("./providers-2OABPW2E.js");
+      await import("./aws-A3323GNM.js");
+      await import("./gcp-OHWCTFLL.js");
+      await import("./azure-LNWBK2ZI.js");
+      await import("./local-DXBEVZ5C.js");
+      const checkedProviders = /* @__PURE__ */ new Set();
+      for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
+        const providerName = stackCfg.provider;
+        if (checkedProviders.has(providerName)) continue;
+        checkedProviders.add(providerName);
+        if (providerName === "local") {
+          success(`local  stack "${stackName}"  (SSH-only, no cloud credentials required)`);
+          continue;
+        }
+        try {
+          const adapter = getProvider(providerName);
+          const result = await adapter.validateConfig();
+          if (result.ok) {
+            success(`${providerName}  stack "${stackName}"`);
+          } else {
+            for (const err of result.errors) {
+              failure(`${providerName}  stack "${stackName}"  \u2014 ${err}`);
+            }
+          }
+        } catch (err) {
+          failure(`${providerName}  stack "${stackName}"  \u2014 ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (checkedProviders.size === 0) {
+        warn("No stacks configured \u2014 run `clawops init`");
+      }
+    }
+    process18.stdout.write("\n");
+    if (!nodeOk) process18.exit(1);
+  }
+});
+
+// src/cli/commands/mcp.ts
+import { defineCommand as defineCommand17 } from "citty";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import path3 from "path";
+import os from "os";
+var mcp_default = defineCommand17({
+  meta: {
+    name: "mcp",
+    description: "MCP server operations (serve | install)"
+  },
+  args: {
+    http: { type: "string", description: "HTTP port for standalone mode" },
+    bind: { type: "string", description: "Bind address for HTTP mode" },
+    "read-only": { type: "boolean", description: "Only register read toolset" },
+    "no-destructive": { type: "boolean", description: "Filter out destructive tools" },
+    toolsets: { type: "string", description: "Comma-separated toolsets to enable" },
+    inspector: { type: "boolean", description: "Enable MCP inspector" },
+    claude: { type: "boolean", description: "Install for Claude Desktop" },
+    cursor: { type: "boolean", description: "Install for Cursor" },
+    vscode: { type: "boolean", description: "Install for VS Code" },
+    windsurf: { type: "boolean", description: "Install for Windsurf" },
+    zed: { type: "boolean", description: "Install for Zed" }
+  },
+  async run({ args }) {
+    const installFlags = ["claude", "cursor", "vscode", "windsurf", "zed"];
+    const requestedClients = installFlags.filter((f) => Boolean(args[f]));
+    if (requestedClients.length > 0) {
+      for (const client of requestedClients) {
+        installMcp(client);
+        process.stderr.write(`Installed MCP config for: ${client}
+`);
+      }
+      return;
+    }
+    const { serveMcp } = await import("./server-TKDURITQ.js");
+    await serveMcp({
+      port: args.http ? Number(args.http) : void 0,
+      bind: args.bind,
+      readOnly: Boolean(args["read-only"]),
+      noDestructive: Boolean(args["no-destructive"]),
+      toolsets: args.toolsets ? args.toolsets.split(",").map((s) => s.trim()) : void 0,
+      inspector: Boolean(args.inspector)
+    });
+  }
+});
+var CLAWOPS_ENTRY = {
+  command: "clawops",
+  args: ["mcp", "serve"],
+  type: "stdio"
+};
+function getConfigPath(client) {
+  const home = os.homedir();
+  switch (client) {
+    case "claude":
+      return path3.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    case "cursor":
+      return path3.join(home, ".cursor", "mcp.json");
+    case "vscode":
+      return path3.join(home, "Library", "Application Support", "Code", "User", "mcp.json");
+    case "windsurf":
+      return path3.join(home, ".codeium", "windsurf", "mcp_config.json");
+    case "zed":
+      return path3.join(home, ".config", "zed", "settings.json");
+  }
+}
+function installMcp(client) {
+  const configPath = getConfigPath(client);
+  const dir = path3.dirname(configPath);
+  if (!existsSync2(dir)) {
+    mkdirSync3(dir, { recursive: true });
+  }
+  let config = {};
+  if (existsSync2(configPath)) {
+    try {
+      config = JSON.parse(readFileSync2(configPath, "utf-8"));
+    } catch {
+    }
+  }
+  if (client === "zed") {
+    const contextServers = config["context_servers"] ?? {};
+    contextServers["clawops"] = CLAWOPS_ENTRY;
+    config["context_servers"] = contextServers;
+  } else {
+    const mcpServers = config["mcpServers"] ?? {};
+    mcpServers["clawops"] = CLAWOPS_ENTRY;
+    config["mcpServers"] = mcpServers;
+  }
+  writeFileSync3(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+
+// src/cli/error-handler.ts
+import process19 from "process";
+function handleError(err) {
+  if (err instanceof ClawopsError) {
+    failure(err.message);
+    process19.exit(err.exitCode);
+  }
+  if (err instanceof Error) {
+    failure(`Unexpected error: ${err.message}`);
+    if (process19.env["DEBUG"]) {
+      process19.stderr.write(err.stack ?? "\n");
+    }
+    process19.exit(1);
+  }
+  failure(`Unknown error: ${String(err)}`);
+  process19.exit(1);
+}
+
+// src/cli/index.ts
+var main = defineCommand18({
+  meta: {
+    name: "clawops",
+    description: "Deploy and manage self-hosted OpenClaw instances across clouds",
+    version: "0.2.0"
+  },
+  args: {
+    stack: { type: "string", description: "Target named stack (default from config)" },
+    provider: { type: "string", description: "Override provider (aws|gcp|azure|local)" },
+    json: { type: "boolean", description: "Emit JSON to stdout" },
+    quiet: { type: "boolean", description: "Suppress non-error output" },
+    profile: { type: "string", description: "Auth profile from ~/.clawops/config.json" },
+    "dry-run": { type: "boolean", description: "Preview without applying (mutating commands)" },
+    yes: { type: "boolean", description: "Skip interactive confirmations (CI mode)" }
+  },
+  subCommands: {
+    init: init_default,
+    up: up_default,
+    down: down_default,
+    status: status_default,
+    plan: plan_default,
+    apply: apply_default,
+    destroy: destroy_default,
+    ssh: ssh_default,
+    tunnel: tunnel_default,
+    logs: logs_default,
+    config: config_default,
+    agents: agents_default,
+    gateway: gateway_default,
+    backup: backup_default,
+    stacks: stacks_default,
+    doctor: doctor_default,
+    mcp: mcp_default
+  }
+});
+try {
+  await runMain(main);
+} catch (err) {
+  handleError(err);
+}