@clawops/cli 0.2.0

package/dist/server-TKDURITQ.js

@@ -0,0 +1,1349 @@
+#!/usr/bin/env node
+import {
+  acquireSession,
+  drainPool
+} from "./chunk-5XEZAU7V.js";
+import {
+  extractBaseOutputs
+} from "./chunk-LT24GUUO.js";
+import {
+  generatePlan
+} from "./chunk-ENQY5OW2.js";
+import {
+  applyPlan
+} from "./chunk-RZE35FQF.js";
+import {
+  buildContext
+} from "./chunk-PERSDQMT.js";
+import "./chunk-PRYLTCS4.js";
+import {
+  validatePlan
+} from "./chunk-YTH4L2GN.js";
+import {
+  getConfig,
+  getConfigDir
+} from "./chunk-ALSUDYA7.js";
+import {
+  StateError,
+  UsageError
+} from "./chunk-ZSE4QRKE.js";
+
+// src/mcp/server.ts
+import { createServer } from "http";
+import { randomUUID as randomUUID5 } from "crypto";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+// src/mcp/audit.ts
+import { appendFileSync, mkdirSync } from "fs";
+import { randomUUID } from "crypto";
+import path from "path";
+import process2 from "process";
+var _sessionId = null;
+function getSessionId() {
+  if (!_sessionId) _sessionId = randomUUID();
+  return _sessionId;
+}
+var SENSITIVE_KEYS = ["token", "secret", "password", "connectionstring", "authorization"];
+var EXEMPT_KEYS = ["keyname", "keypath", "privateKeyPath", "knownHostsPath"];
+var ARN_RE = /arn:aws:[a-z0-9\-*]+:[a-z0-9\-]*:[0-9]*:[^\s,'"]+/gi;
+function sanitize(args) {
+  const result = {};
+  for (const [k, v] of Object.entries(args)) {
+    const kl = k.toLowerCase();
+    const exempt = EXEMPT_KEYS.some((e) => kl === e.toLowerCase());
+    const sensitive = !exempt && SENSITIVE_KEYS.some((s) => kl.includes(s));
+    if (sensitive) {
+      result[k] = "[REDACTED]";
+    } else if (typeof v === "string") {
+      result[k] = v.replace(ARN_RE, "arn:aws:***:<region>:<account>:***");
+    } else if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+      result[k] = sanitize(v);
+    } else {
+      result[k] = v;
+    }
+  }
+  return result;
+}
+function auditLog(entry) {
+  const line = JSON.stringify(entry) + "\n";
+  process2.stderr.write(line);
+  try {
+    const logPath = getAuditLogPath();
+    mkdirSync(path.dirname(logPath), { recursive: true });
+    appendFileSync(logPath, line, { encoding: "utf-8" });
+  } catch {
+  }
+}
+function getAuditLogPath() {
+  const cfg = getConfig();
+  return cfg?.mcp?.auditLogPath ?? path.join(getConfigDir(), "mcp-audit.log");
+}
+function withAudit(toolName, handler) {
+  return async (input) => {
+    const start = Date.now();
+    try {
+      const result = await handler(input);
+      auditLog({
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        sessionId: getSessionId(),
+        tool: toolName,
+        args: sanitize(input),
+        durationMs: Date.now() - start,
+        result: "ok"
+      });
+      return result;
+    } catch (err) {
+      auditLog({
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        sessionId: getSessionId(),
+        tool: toolName,
+        args: sanitize(input),
+        durationMs: Date.now() - start,
+        result: "error"
+      });
+      throw err;
+    }
+  };
+}
+
+// src/mcp/tools/_generated.ts
+import { z } from "zod";
+var clawops_statusSchema = z.object({
+  stackName: z.string().optional()
+});
+var clawops_statusAnnotations = {
+  title: "Get Stack Status",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_logs_tailSchema = z.object({
+  stackName: z.string().optional(),
+  tailLines: z.number().int().default(100),
+  sinceMin: z.number().int().optional()
+});
+var clawops_logs_tailAnnotations = {
+  title: "Tail Gateway Logs",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_stacks_listSchema = z.object({});
+var clawops_stacks_listAnnotations = {
+  title: "List Stacks",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+  toolsets: ["admin", "read"]
+};
+var clawops_config_getSchema = z.object({
+  stackName: z.string().optional(),
+  key: z.string()
+});
+var clawops_config_getAnnotations = {
+  title: "Get OpenClaw Config Value",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_agents_listSchema = z.object({
+  stackName: z.string().optional()
+});
+var clawops_agents_listAnnotations = {
+  title: "List OpenClaw Agents",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_upSchema = z.object({
+  stackName: z.string().optional(),
+  provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
+  region: z.string().optional(),
+  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).default("small"),
+  openclawVersion: z.string().optional(),
+  dryRun: z.boolean().default(false)
+});
+var clawops_upAnnotations = {
+  title: "Provision and Deploy Stack",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_destroySchema = z.object({
+  stackName: z.string(),
+  yes: z.boolean().default(false)
+});
+var clawops_destroyAnnotations = {
+  title: "Destroy Stack (DESTRUCTIVE)",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_applySchema = z.object({
+  planPath: z.string(),
+  yes: z.boolean().default(false)
+});
+var clawops_applyAnnotations = {
+  title: "Apply Maker Plan",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_planSchema = z.object({
+  stackName: z.string().optional(),
+  provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
+  region: z.string().optional(),
+  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional(),
+  outPath: z.string().optional()
+});
+var clawops_planAnnotations = {
+  title: "Generate Deploy Plan",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_config_setSchema = z.object({
+  stackName: z.string().optional(),
+  key: z.string(),
+  value: z.string(),
+  restart: z.boolean().default(false)
+});
+var clawops_config_setAnnotations = {
+  title: "Set OpenClaw Config Value",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_agents_restartSchema = z.object({
+  stackName: z.string().optional(),
+  agentId: z.string()
+});
+var clawops_agents_restartAnnotations = {
+  title: "Restart OpenClaw Agent",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_gateway_restartSchema = z.object({
+  stackName: z.string().optional()
+});
+var clawops_gateway_restartAnnotations = {
+  title: "Restart Gateway Daemon",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_workflow_deploy_appSchema = z.object({
+  provider: z.enum(["aws", "gcp", "azure", "local"]),
+  region: z.string().optional(),
+  stackName: z.string().default("default"),
+  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).default("small")
+});
+var clawops_workflow_deploy_appAnnotations = {
+  title: "Deploy OpenClaw (End-to-End Workflow)",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["workflow"]
+};
+var clawops_workflow_recoverSchema = z.object({
+  stackName: z.string().optional()
+});
+var clawops_workflow_recoverAnnotations = {
+  title: "Recover/Diagnose Stack",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["workflow", "read"]
+};
+var clawops_task_statusSchema = z.object({
+  taskId: z.string()
+});
+var clawops_task_statusAnnotations = {
+  title: "Get Task Status",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+  toolsets: ["cli", "read"]
+};
+var TOOLSETS = {
+  cli: [
+    "clawops_status",
+    "clawops_logs_tail",
+    "clawops_config_get",
+    "clawops_agents_list",
+    "clawops_up",
+    "clawops_destroy",
+    "clawops_apply",
+    "clawops_plan",
+    "clawops_config_set",
+    "clawops_agents_restart",
+    "clawops_gateway_restart",
+    "clawops_task_status"
+  ],
+  workflow: [
+    "clawops_workflow_deploy_app",
+    "clawops_workflow_recover"
+  ],
+  read: [
+    "clawops_status",
+    "clawops_logs_tail",
+    "clawops_stacks_list",
+    "clawops_config_get",
+    "clawops_agents_list",
+    "clawops_plan",
+    "clawops_workflow_recover",
+    "clawops_task_status"
+  ],
+  admin: [
+    "clawops_stacks_list"
+  ]
+};
+
+// src/mcp/tools/cli/status.ts
+async function handleStatus(input, _server) {
+  const ctx = buildContext({ stack: input.stackName });
+  if (ctx.adapter.name === "local") {
+    const state = ctx.localState;
+    if (!state) {
+      return text(JSON.stringify({ stack: ctx.stackName, status: "not bootstrapped" }, null, 2));
+    }
+    return text(JSON.stringify({ stack: ctx.stackName, ...state }, null, 2));
+  }
+  const stack = await ctx.getStack();
+  const outputMap = await stack.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  if (!outputs["publicIp"]) {
+    return text(JSON.stringify({ stack: ctx.stackName, status: "not deployed" }, null, 2));
+  }
+  try {
+    const base = extractBaseOutputs(outputs);
+    return text(JSON.stringify({ stack: ctx.stackName, ...base }, null, 2));
+  } catch (err) {
+    if (err instanceof StateError) {
+      return text(JSON.stringify({ stack: ctx.stackName, status: "not deployed", detail: err.message }, null, 2));
+    }
+    throw err;
+  }
+}
+function text(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+
+// src/mcp/tools/_conn.ts
+async function resolveConn(ctx) {
+  if (ctx.adapter.name === "local") {
+    const state = ctx.localState;
+    if (!state) throw new StateError("Stack has no local state \u2014 run `clawops up` first.");
+    return {
+      host: state.sshHost,
+      port: state.sshPort,
+      user: state.sshUser,
+      privateKeyPath: state.privateKeyPath,
+      knownHostsPath: state.knownHostsPath
+    };
+  }
+  const { extractBaseOutputs: extractBaseOutputs2 } = await import("./outputs-6DAVEEAZ.js");
+  const stack = await ctx.getStack();
+  const outputMap = await stack.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  if (!outputs["publicIp"]) {
+    throw new StateError("Stack has no outputs \u2014 run `clawops up` first.");
+  }
+  const base = extractBaseOutputs2(outputs);
+  return ctx.adapter.getConnectionInfo({
+    ...base,
+    privateKeyPath: ctx.config.ssh.keyPath,
+    knownHostsPath: ctx.config.ssh.knownHostsPath
+  });
+}
+function errText(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function okText(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+
+// src/mcp/tools/cli/logs.ts
+var MAX_BYTES = 8 * 1024;
+async function handleLogsTail(input, _server) {
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const tailLines = input.tailLines ?? 100;
+    const sinceFlag = input.sinceMin ? `--since "${input.sinceMin} min ago"` : "";
+    const command = [
+      "journalctl -u openclaw",
+      `-n ${tailLines}`,
+      sinceFlag,
+      "2>/dev/null",
+      "|| docker logs openclaw",
+      `-n ${tailLines}`
+    ].filter(Boolean).join(" ");
+    const result = await session.exec(command);
+    if (result.code !== 0 && !result.stdout) {
+      return errText(`Failed to fetch logs: ${result.stderr}`);
+    }
+    let output = result.stdout;
+    if (Buffer.byteLength(output) > MAX_BYTES) {
+      output = output.slice(0, MAX_BYTES) + "\n\n[output truncated at 8KB]";
+    }
+    return okText(output || "(no log output)");
+  } finally {
+    release();
+    drainPool();
+  }
+}
+
+// src/mcp/tools/cli/stacks.ts
+async function handleStacksList(_input, _server) {
+  const config = getConfig();
+  if (!config) {
+    return { content: [{ type: "text", text: JSON.stringify({ stacks: [] }) }] };
+  }
+  const stacks = Object.entries(config.stacks).map(([name, cfg]) => ({
+    name,
+    provider: cfg.provider,
+    region: cfg.region,
+    stateUrl: cfg.stateUrl,
+    isDefault: name === config.defaults.stack
+  }));
+  return { content: [{ type: "text", text: JSON.stringify({ stacks }, null, 2) }] };
+}
+
+// src/mcp/tools/cli/config.ts
+var OPENCLAW_CONFIG = "/home/clawops/openclaw.json";
+var OPENCLAW_TMP = "/tmp/clawops-config.json.tmp";
+async function handleConfigGet(input, _server) {
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const result = await session.exec(`cat ${OPENCLAW_CONFIG}`);
+    let cfg;
+    try {
+      cfg = JSON.parse(result.stdout);
+    } catch {
+      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${result.stderr || result.stdout}`);
+    }
+    const value = input.key ? getPath(cfg, input.key) : cfg;
+    return okText(JSON.stringify(value, null, 2));
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleConfigSet(input, server) {
+  const elicit = await server.server.elicitInput({
+    message: `Set ${input.key} = ${input.value} on stack "${input.stackName ?? "default"}"?`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm config change" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Config change cancelled.");
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const readResult = await session.exec(`cat ${OPENCLAW_CONFIG}`);
+    let cfg;
+    try {
+      cfg = JSON.parse(readResult.stdout);
+    } catch {
+      return errText(`Cannot parse ${OPENCLAW_CONFIG}: ${readResult.stderr}`);
+    }
+    let parsedValue = input.value;
+    try {
+      parsedValue = JSON.parse(input.value);
+    } catch {
+    }
+    setPath(cfg, input.key, parsedValue);
+    const json = JSON.stringify(cfg, null, 2);
+    const b64 = Buffer.from(json, "utf-8").toString("base64");
+    const writeCmd = `echo '${b64}' | base64 -d > ${OPENCLAW_TMP} && mv ${OPENCLAW_TMP} ${OPENCLAW_CONFIG} && chown clawops:clawops ${OPENCLAW_CONFIG}`;
+    const writeResult = await session.exec(writeCmd);
+    if (writeResult.code !== 0) {
+      return errText(`Failed to write config: ${writeResult.stderr}`);
+    }
+    let note = "";
+    if (input.restart) {
+      const imgResult = await session.exec(
+        `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo 'ghcr.io/openclaw/openclaw:stable'`
+      );
+      const image = imgResult.stdout.trim();
+      const restartCmd = [
+        "docker stop openclaw 2>/dev/null || true",
+        "docker rm openclaw 2>/dev/null || true",
+        `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG}:/app/config.json:ro ${image}`
+      ].join(" && ");
+      await session.exec(restartCmd);
+      note = " (gateway restarted)";
+    }
+    return okText(`Config set: ${input.key}${note}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+function getPath(obj, dotKey) {
+  return dotKey.split(".").reduce((cur, k) => {
+    if (cur !== null && typeof cur === "object") return cur[k];
+    return void 0;
+  }, obj);
+}
+function setPath(obj, dotKey, value) {
+  const keys = dotKey.split(".");
+  let cur = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i];
+    if (typeof cur[k] !== "object" || cur[k] === null) cur[k] = {};
+    cur = cur[k];
+  }
+  cur[keys[keys.length - 1]] = value;
+}
+
+// src/mcp/tools/cli/agents.ts
+async function handleAgentsList(input, _server) {
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const result = await session.exec('docker exec openclaw openclaw-ctl agents list --json 2>&1 || echo "[]"');
+    return okText(result.stdout.trim());
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleAgentsRestart(input, server) {
+  const elicit = await server.server.elicitInput({
+    message: `Restart agent "${input.agentId}" on stack "${input.stackName ?? "default"}"?`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm restart" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Agent restart cancelled.");
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const result = await session.exec(
+      `docker exec openclaw openclaw-ctl agents restart ${input.agentId} 2>&1`
+    );
+    if (result.code !== 0) {
+      return errText(`Failed to restart agent: ${result.stderr || result.stdout}`);
+    }
+    return okText(`Agent "${input.agentId}" restarted.`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+
+// src/mcp/tools/cli/gateway.ts
+async function handleGatewayRestart(input, server) {
+  const elicit = await server.server.elicitInput({
+    message: `Restart the OpenClaw gateway on stack "${input.stackName ?? "default"}"? This will briefly interrupt connections.`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm restart" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Gateway restart cancelled.");
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const imgResult = await session.exec(
+      `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo 'ghcr.io/openclaw/openclaw:stable'`
+    );
+    const image = imgResult.stdout.trim();
+    const cmd = [
+      "docker stop openclaw 2>/dev/null || true",
+      "docker rm   openclaw 2>/dev/null || true",
+      `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 ${image}`
+    ].join(" && ");
+    const result = await session.exec(cmd);
+    if (result.code !== 0) {
+      return errText(`Gateway restart failed: ${result.stderr}`);
+    }
+    return okText("Gateway restarted successfully.");
+  } finally {
+    release();
+    drainPool();
+  }
+}
+
+// src/mcp/tools/cli/up.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/mcp/progress.ts
+var taskMap = /* @__PURE__ */ new Map();
+function startTask(id, description) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const record = { id, description, status: "running", startedAt: now, updatedAt: now };
+  taskMap.set(id, record);
+  return record;
+}
+function updateTask(id, status, result, error) {
+  const record = taskMap.get(id);
+  if (!record) return;
+  record.status = status;
+  record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (result !== void 0) record.result = result;
+  if (error !== void 0) record.error = error;
+}
+function getTask(id) {
+  return taskMap.get(id);
+}
+function makeProgressEmitter(server, progressToken) {
+  if (!progressToken) return () => {
+  };
+  return (message) => {
+    server.server.notification({
+      method: "notifications/progress",
+      params: { progressToken, progress: 0, message }
+    }).catch(() => {
+    });
+  };
+}
+
+// src/mcp/tools/_trim.ts
+import { writeFileSync, mkdirSync as mkdirSync2 } from "fs";
+import path2 from "path";
+var MAX_BYTES2 = 8 * 1024;
+function trimForMcp(output, stackName) {
+  try {
+    const dir = path2.join(getConfigDir(), "state");
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync(path2.join(dir, `${stackName}.last-run.json`), JSON.stringify({ output }), "utf-8");
+  } catch {
+  }
+  if (Buffer.byteLength(output) <= MAX_BYTES2) {
+    return { content: output, truncated: false };
+  }
+  const trimmed = output.slice(0, MAX_BYTES2);
+  return {
+    content: trimmed + `
+
+[Output truncated at 8KB. Full output available at clawops://stacks/${stackName}/last-run]`,
+    truncated: true
+  };
+}
+
+// src/mcp/tools/cli/up.ts
+var VALID_INSTANCE_TYPES = ["micro", "small", "medium", "large", "gpu"];
+async function handleUp(input, server) {
+  if (!input.dryRun) {
+    const elicit = await server.server.elicitInput({
+      message: `Deploy stack "${input.stackName ?? "default"}" (provider: ${input.provider ?? "from config"}, instance: ${input.instanceType})? This will provision cloud resources.`,
+      requestedSchema: {
+        type: "object",
+        properties: { confirmed: { type: "boolean", title: "Confirm deployment" } },
+        required: ["confirmed"]
+      }
+    });
+    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+      return okText("Deployment cancelled.");
+    }
+  }
+  const ctx = buildContext({ stack: input.stackName, provider: input.provider });
+  const openclawVersion = input.openclawVersion ?? "stable";
+  if (ctx.adapter.name === "local") {
+    const stackConfig = ctx.config.stacks[ctx.stackName];
+    if (!stackConfig?.localOpts) {
+      throw new UsageError(
+        `Stack "${ctx.stackName}" has no localOpts. Run \`clawops init --provider local --host <HOST>\` first.`
+      );
+    }
+    const { localOpts } = stackConfig;
+    const { localBootstrap } = await import("./bootstrap-NRIDVS5F.js");
+    const ac = new AbortController();
+    const state = await localBootstrap({
+      host: localOpts.host,
+      port: localOpts.sshPort,
+      user: localOpts.sshUser,
+      privateKeyPath: localOpts.sshKeyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath,
+      openclawVersion,
+      stackName: ctx.stackName,
+      noWait: false,
+      signal: ac.signal
+    });
+    return okText(JSON.stringify({ stack: ctx.stackName, ...state }, null, 2));
+  }
+  const instanceAlias = input.instanceType ?? "small";
+  if (!VALID_INSTANCE_TYPES.includes(instanceAlias)) {
+    throw new UsageError(`Invalid instanceType: ${instanceAlias}`);
+  }
+  const validation = await ctx.adapter.validateConfig();
+  if (!validation.ok) {
+    return errText(`Provider config invalid: ${validation.errors.join("; ")}`);
+  }
+  const taskId = randomUUID2();
+  const progressToken = void 0;
+  const emit = makeProgressEmitter(server, progressToken);
+  startTask(taskId, `clawops_up stack=${ctx.stackName}`);
+  const stack = await ctx.getStack();
+  const region = input.region ?? ctx.adapter.defaultRegion();
+  const instanceType = ctx.adapter.normalizeInstanceType(instanceAlias);
+  await stack.setConfig("region", { value: region });
+  await stack.setConfig("instanceType", { value: instanceType });
+  await stack.setConfig("openclawVersion", { value: openclawVersion });
+  if (input.dryRun) {
+    const lines = [];
+    await stack.preview({ onOutput: (o) => {
+      emit(o.trim());
+      lines.push(o);
+    } });
+    const output = lines.join("");
+    updateTask(taskId, "completed", output);
+    const { content } = trimForMcp(output, ctx.stackName);
+    return okText(content);
+  }
+  try {
+    const lines = [];
+    const result = await stack.up({
+      onOutput: (o) => {
+        emit(o.trim());
+        lines.push(o);
+      }
+    });
+    const summary = `Stack "${ctx.stackName}" deployed.
+` + (result.outputs["publicIp"] ? `Public IP: ${result.outputs["publicIp"].value}
+` : "") + (result.outputs["gatewayUrl"] ? `Gateway URL: ${result.outputs["gatewayUrl"].value}
+` : "");
+    updateTask(taskId, "completed", summary);
+    const fullOutput = lines.join("");
+    trimForMcp(fullOutput, ctx.stackName);
+    return okText(summary);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    updateTask(taskId, "failed", void 0, msg);
+    throw err;
+  }
+}
+
+// src/mcp/tools/cli/destroy.ts
+import { randomUUID as randomUUID3 } from "crypto";
+async function handleDestroy(input, server) {
+  if (!input.yes) {
+    const elicit = await server.server.elicitInput({
+      message: `DESTROY stack "${input.stackName}"? This permanently deletes all provisioned resources and cannot be undone.`,
+      requestedSchema: {
+        type: "object",
+        properties: { confirmed: { type: "boolean", title: "Confirm destruction (irreversible)" } },
+        required: ["confirmed"]
+      }
+    });
+    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+      return okText("Destruction cancelled.");
+    }
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  if (ctx.adapter.name === "local") {
+    return errText("Local provider stacks are destroyed with `clawops down --destroy` via SSH. Use clawops_up with the local provider instead.");
+  }
+  const taskId = randomUUID3();
+  const emit = makeProgressEmitter(server, void 0);
+  startTask(taskId, `clawops_destroy stack=${input.stackName}`);
+  try {
+    const stack = await ctx.getStack();
+    const lines = [];
+    await stack.destroy({ onOutput: (o) => {
+      emit(o.trim());
+      lines.push(o);
+    } });
+    const fullOutput = lines.join("");
+    updateTask(taskId, "completed", `Stack "${input.stackName}" destroyed.`);
+    const { content } = trimForMcp(fullOutput, input.stackName);
+    return okText(`Stack "${input.stackName}" destroyed.
+
+${content}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    updateTask(taskId, "failed", void 0, msg);
+    throw err;
+  }
+}
+
+// src/mcp/tools/cli/plan.ts
+import { writeFileSync as writeFileSync2 } from "fs";
+async function handlePlan(input, _server) {
+  const ctx = buildContext({
+    stack: input.stackName,
+    provider: input.provider
+  });
+  if (ctx.adapter.name === "local") {
+    return errText("plan/apply is not supported for the local provider. Use clawops_up directly.");
+  }
+  const provider = input.provider ?? ctx.adapter.name;
+  const stackName = ctx.stackName;
+  let plan;
+  try {
+    plan = await generatePlan({
+      stackName,
+      provider,
+      region: input.region,
+      instanceType: input.instanceType
+    });
+  } catch (err) {
+    return errText(`Plan generation failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const planJson = JSON.stringify(plan, null, 2);
+  if (input.outPath) {
+    try {
+      writeFileSync2(input.outPath, planJson + "\n", "utf-8");
+      return { content: [{ type: "text", text: `Plan written to ${input.outPath}` }] };
+    } catch (err) {
+      return errText(`Failed to write plan to ${input.outPath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const { content, truncated } = trimForMcp(planJson, stackName);
+  return {
+    content: [{ type: "text", text: truncated ? content : planJson }]
+  };
+}
+
+// src/mcp/tools/cli/apply.ts
+import { readFileSync } from "fs";
+import { randomUUID as randomUUID4 } from "crypto";
+async function handleApply(input, server) {
+  let plan;
+  try {
+    const raw = readFileSync(input.planPath, "utf-8");
+    plan = JSON.parse(raw);
+  } catch (err) {
+    return errText(`Cannot read plan file "${input.planPath}": ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const validation = validatePlan(plan);
+  if (!validation.ok) {
+    return errText(`Invalid plan:
+${validation.errors.join("\n")}`);
+  }
+  if (plan.spec.provider === "local") {
+    return errText("plan/apply is not supported for the local provider. Use clawops_up directly.");
+  }
+  if (!input.yes) {
+    const diffLine = plan.diff ? `${plan.diff.create.length} to create, ${plan.diff.update.length} to update, ${plan.diff.delete.length} to delete` : "diff unavailable";
+    const elicit = await server.server.elicitInput({
+      message: `Apply plan for stack "${plan.spec.stackName}" (${plan.spec.provider})?
+Changes: ${diffLine}.
+This will provision cloud resources and may incur costs.`,
+      requestedSchema: {
+        type: "object",
+        properties: { confirmed: { type: "boolean", title: "Confirm plan apply" } },
+        required: ["confirmed"]
+      }
+    });
+    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+      return okText("Apply cancelled.");
+    }
+  }
+  const taskId = randomUUID4();
+  const emit = makeProgressEmitter(server, void 0);
+  startTask(taskId, `clawops_apply stack=${plan.spec.stackName}`);
+  try {
+    const result = await applyPlan(plan, {
+      onOutput: (line) => emit(line.trim())
+    });
+    const summaryLines = [`Stack "${plan.spec.stackName}" applied.`];
+    const changed = Object.entries(result.changeSummary).filter(([, n]) => n > 0);
+    if (changed.length > 0) {
+      summaryLines.push(changed.map(([op, n]) => `  ${op}: ${n}`).join("\n"));
+    }
+    if (result.outputs["gatewayUrl"]) summaryLines.push(`Gateway URL: ${result.outputs["gatewayUrl"]}`);
+    if (result.outputs["publicIp"]) summaryLines.push(`Public IP:   ${result.outputs["publicIp"]}`);
+    summaryLines.push(`Duration: ${(result.durationMs / 1e3).toFixed(1)}s`);
+    const summary = summaryLines.join("\n");
+    updateTask(taskId, "completed", summary);
+    const { content } = trimForMcp(summary, plan.spec.stackName);
+    return okText(content);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    updateTask(taskId, "failed", void 0, msg);
+    throw err;
+  }
+}
+
+// src/mcp/tools/cli/task.ts
+async function handleTaskStatus(input, _server) {
+  const record = getTask(input.taskId);
+  if (!record) {
+    return {
+      content: [{ type: "text", text: JSON.stringify({ taskId: input.taskId, status: "not_found" }) }],
+      isError: true
+    };
+  }
+  return { content: [{ type: "text", text: JSON.stringify(record, null, 2) }] };
+}
+
+// src/mcp/tools/workflow/deploy_app.ts
+async function handleWorkflowDeployApp(input, server) {
+  const parts = [`## Deployment Workflow \u2014 ${input.provider} / ${input.stackName}
+`];
+  if (input.provider === "local") {
+    return handleUp(
+      { stackName: input.stackName, provider: input.provider, region: input.region, instanceType: input.instanceType, dryRun: false },
+      server
+    );
+  }
+  const provider = input.provider;
+  parts.push("### Step 1: Plan");
+  let plan;
+  try {
+    plan = await generatePlan({
+      stackName: input.stackName,
+      provider,
+      region: input.region,
+      instanceType: input.instanceType
+    });
+    const diffSummary = plan.diff ? `${plan.diff.create.length} to create, ${plan.diff.update.length} to update, ${plan.diff.delete.length} to delete` : "diff unavailable";
+    parts.push(`Plan generated. Changes: ${diffSummary}.`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    parts.push(`Plan generation failed: ${msg}
+Falling back to direct deployment.`);
+    return handleUp(
+      { stackName: input.stackName, provider: input.provider, region: input.region, instanceType: input.instanceType, dryRun: false },
+      server
+    );
+  }
+  const diffLine = plan.diff ? `${plan.diff.create.length} to create, ${plan.diff.update.length} to update, ${plan.diff.delete.length} to delete` : "? changes";
+  const elicit = await server.server.elicitInput({
+    message: `Deploy OpenClaw on ${provider} (stack: "${input.stackName}", instance: ${input.instanceType}${input.region ? `, region: ${input.region}` : ""})?
+Changes: ${diffLine}. This will provision cloud resources and may incur costs.`,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: "Confirm end-to-end deployment" } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return okText("Deployment workflow cancelled.");
+  }
+  parts.push("### Step 2: Apply");
+  const emit = makeProgressEmitter(server, void 0);
+  try {
+    const result = await applyPlan(plan, { onOutput: (line) => emit(line.trim()) });
+    const changed = Object.entries(result.changeSummary).filter(([, n]) => n > 0);
+    const applySummary = changed.length > 0 ? changed.map(([op, n]) => `  ${op}: ${n}`).join("\n") : "No changes.";
+    parts.push(applySummary);
+    if (result.outputs["gatewayUrl"]) parts.push(`Gateway URL: ${result.outputs["gatewayUrl"]}`);
+    if (result.outputs["publicIp"]) parts.push(`Public IP:   ${result.outputs["publicIp"]}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    parts.push(`Apply failed: ${msg}`);
+    return { content: [{ type: "text", text: parts.join("\n\n") }], isError: true };
+  }
+  parts.push("### Step 3: Status");
+  try {
+    const statusResult = await handleStatus({ stackName: input.stackName }, server);
+    const statusText = statusResult.content.filter((c) => c.type === "text").map((c) => c.text).join("");
+    parts.push(statusText);
+  } catch {
+    parts.push("Status check skipped (stack may still be starting up).");
+  }
+  return { content: [{ type: "text", text: parts.join("\n\n") }] };
+}
+
+// src/mcp/tools/workflow/recover.ts
+async function handleWorkflowRecover(input, server) {
+  const parts = [`## Diagnostic Report \u2014 stack: ${input.stackName ?? "default"}
+`];
+  try {
+    const statusResult = await handleStatus({ stackName: input.stackName }, server);
+    const statusText = statusResult.content.filter((c) => c.type === "text").map((c) => c.text).join("");
+    parts.push(`### Status
+\`\`\`json
+${statusText}
+\`\`\``);
+  } catch (err) {
+    parts.push(`### Status
+Error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const logsResult = await handleLogsTail({ stackName: input.stackName, tailLines: 50 }, server);
+    const logsText = logsResult.content.filter((c) => c.type === "text").map((c) => c.text).join("");
+    parts.push(`### Recent Logs (last 50 lines)
+\`\`\`
+${logsText}
+\`\`\``);
+  } catch (err) {
+    parts.push(`### Recent Logs
+Error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  parts.push(
+    `### Next Steps
+- If gateway is not running: try \`clawops_gateway_restart\`
+- If bootstrap failed: run \`clawops_up\` again (idempotent)
+- If stack is not deployed: run \`clawops_workflow_deploy_app\`
+- For Pulumi drift: run \`clawops refresh\` from the CLI`
+  );
+  return { content: [{ type: "text", text: parts.join("\n\n") }] };
+}
+
+// src/mcp/tools/registry.ts
+function makeEntry(schema, annotations, handler) {
+  return { schema, annotations, handler };
+}
+var TOOL_REGISTRY = {
+  clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus),
+  clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail),
+  clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList),
+  clawops_config_get: makeEntry(clawops_config_getSchema, clawops_config_getAnnotations, handleConfigGet),
+  clawops_agents_list: makeEntry(clawops_agents_listSchema, clawops_agents_listAnnotations, handleAgentsList),
+  clawops_up: makeEntry(clawops_upSchema, clawops_upAnnotations, handleUp),
+  clawops_destroy: makeEntry(clawops_destroySchema, clawops_destroyAnnotations, handleDestroy),
+  clawops_apply: makeEntry(clawops_applySchema, clawops_applyAnnotations, handleApply),
+  clawops_plan: makeEntry(clawops_planSchema, clawops_planAnnotations, handlePlan),
+  clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet),
+  clawops_agents_restart: makeEntry(clawops_agents_restartSchema, clawops_agents_restartAnnotations, handleAgentsRestart),
+  clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart),
+  clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp),
+  clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover),
+  clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus)
+};
+function resolveEnabledTools(opts) {
+  let names;
+  if (opts.readOnly) {
+    names = [...TOOLSETS.read];
+  } else if (opts.toolsets && opts.toolsets.length > 0) {
+    names = opts.toolsets.flatMap((ts) => TOOLSETS[ts] ?? []);
+  } else {
+    names = [
+      ...TOOLSETS.cli,
+      ...TOOLSETS.workflow,
+      ...TOOLSETS.admin
+    ];
+  }
+  if (opts.noDestructive) {
+    names = names.filter((n) => {
+      const entry = TOOL_REGISTRY[n];
+      return entry ? !entry.annotations.destructiveHint : true;
+    });
+  }
+  return [...new Set(names)];
+}
+function registerTools(server, opts) {
+  const enabled = resolveEnabledTools(opts);
+  for (const toolName of enabled) {
+    const entry = TOOL_REGISTRY[toolName];
+    if (!entry) continue;
+    const { schema, annotations, handler } = entry;
+    const { title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint } = annotations;
+    const audited = withAudit(toolName, (input) => handler(input, server));
+    server.registerTool(
+      toolName,
+      {
+        title,
+        inputSchema: schema,
+        annotations: { title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint }
+      },
+      audited
+    );
+  }
+}
+
+// src/mcp/resources.ts
+import { readFileSync as readFileSync2 } from "fs";
+import path3 from "path";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+function registerResources(server) {
+  server.registerResource(
+    "current-context",
+    "clawops://current-context",
+    { description: "Active stack name, provider, and region" },
+    async () => {
+      const config = getConfig();
+      const stackName = config?.defaults.stack ?? "unknown";
+      const stack = config?.stacks[stackName];
+      const data = {
+        stackName,
+        provider: stack?.provider ?? config?.defaults.provider ?? "unknown",
+        region: stack?.region ?? "unknown"
+      };
+      return {
+        contents: [{
+          uri: "clawops://current-context",
+          mimeType: "application/json",
+          text: JSON.stringify(data, null, 2)
+        }]
+      };
+    }
+  );
+  server.registerResource(
+    "stacks",
+    "clawops://stacks",
+    { description: "All configured stacks" },
+    async () => {
+      const config = getConfig();
+      const stacks = config ? Object.entries(config.stacks).map(([name, cfg]) => ({
+        name,
+        provider: cfg.provider,
+        region: cfg.region,
+        isDefault: name === config.defaults.stack
+      })) : [];
+      return {
+        contents: [{
+          uri: "clawops://stacks",
+          mimeType: "application/json",
+          text: JSON.stringify({ stacks }, null, 2)
+        }]
+      };
+    }
+  );
+  server.registerResource(
+    "stack-last-run",
+    new ResourceTemplate("clawops://stacks/{name}/last-run", { list: void 0 }),
+    { description: "Full Pulumi output from the last up/destroy run for a stack" },
+    async (uri, { name }) => {
+      const stackName = Array.isArray(name) ? name[0] : name;
+      const filePath = path3.join(getConfigDir(), "state", `${stackName}.last-run.json`);
+      let text2;
+      try {
+        const raw = readFileSync2(filePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        text2 = parsed.output ?? "(no output recorded)";
+      } catch {
+        text2 = `No last-run output found for stack "${stackName}".`;
+      }
+      return {
+        contents: [{
+          uri: uri.href,
+          mimeType: "text/plain",
+          text: text2
+        }]
+      };
+    }
+  );
+}
+
+// src/mcp/prompts.ts
+import { z as z2 } from "zod";
+function registerPrompts(server) {
+  server.registerPrompt(
+    "deploy-to-aws",
+    {
+      description: "Step-by-step guide to deploy OpenClaw on AWS",
+      argsSchema: {
+        region: z2.string().optional().describe("AWS region (e.g. us-east-1)"),
+        instanceType: z2.string().optional().describe("EC2 instance type (e.g. t3.medium)")
+      }
+    },
+    ({ region, instanceType }) => {
+      const r = region ?? "us-east-1";
+      const it = instanceType ?? "t3.medium";
+      return {
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: `# Deploy OpenClaw on AWS
+
+Follow these steps to provision an OpenClaw instance on AWS in region **${r}** using instance type **${it}**.
+
+## Prerequisites
+
+1. AWS CLI configured: \`aws configure\` or set \`AWS_PROFILE\`.
+2. clawops installed: \`npm install -g clawops\`.
+3. SSH key pair available locally.
+
+## Steps
+
+### 1. Initialise a stack
+\`\`\`
+clawops init --provider aws --region ${r} --stack my-stack
+\`\`\`
+
+### 2. Preview the deployment (dry run)
+\`\`\`
+clawops up --stack my-stack --dry-run
+\`\`\`
+Review the resource plan \u2014 it will show EC2 instance, security groups, and IAM role.
+
+### 3. Deploy
+Use the MCP tool \`clawops_up\` or the CLI:
+\`\`\`
+clawops up --stack my-stack
+\`\`\`
+Or via MCP:
+\`\`\`
+clawops_up({ stackName: "my-stack", provider: "aws", region: "${r}", instanceType: "${it}" })
+\`\`\`
+
+### 4. Verify
+\`\`\`
+clawops status --stack my-stack
+\`\`\`
+Confirm \`status: running\` and note the public IP.
+
+### 5. Connect
+The stack outputs a \`gatewayUrl\` \u2014 open it in your browser to reach the OpenClaw gateway.
+
+## Troubleshooting
+
+- Use \`clawops_workflow_recover\` to collect diagnostic information.
+- Logs: \`clawops logs --stack my-stack --tail 100\`
+- If deployment fails mid-way, re-run \`clawops up\` \u2014 Pulumi is idempotent.
+`
+            }
+          }
+        ]
+      };
+    }
+  );
+  server.registerPrompt(
+    "recover-failed-stack",
+    {
+      description: "Diagnostic playbook for a failed or unhealthy clawops stack",
+      argsSchema: {
+        stackName: z2.string().optional().describe("Stack name to diagnose")
+      }
+    },
+    ({ stackName }) => {
+      const s = stackName ?? "default";
+      return {
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: `# Recover Failed Stack: ${s}
+
+## Step 1 \u2014 Gather diagnostics
+Run the recovery workflow:
+\`\`\`
+clawops_workflow_recover({ stackName: "${s}" })
+\`\`\`
+This returns current status + last 50 log lines.
+
+## Step 2 \u2014 Common failure modes
+
+### Gateway not responding
+\`\`\`
+clawops_gateway_restart({ stackName: "${s}" })
+\`\`\`
+
+### Agents not running
+\`\`\`
+clawops_agents_list({ stackName: "${s}" })
+clawops_agents_restart({ stackName: "${s}" })
+\`\`\`
+
+### Bootstrap failed or incomplete
+Re-run (Pulumi is idempotent):
+\`\`\`
+clawops_up({ stackName: "${s}", provider: "aws" })
+\`\`\`
+
+### Pulumi state drift
+From the CLI:
+\`\`\`
+clawops refresh --stack ${s}
+\`\`\`
+
+### Stack never deployed
+\`\`\`
+clawops_workflow_deploy_app({ stackName: "${s}", provider: "aws" })
+\`\`\`
+
+## Step 3 \u2014 Review last run output
+
+Read the full Pulumi output:
+\`\`\`
+clawops://stacks/${s}/last-run
+\`\`\`
+
+## Step 4 \u2014 Escalation
+
+If none of the above resolves the issue:
+1. Check AWS/GCP/Azure console for resource state.
+2. Look for IAM permission errors in logs.
+3. Verify SSH key is present and matches the deployed instance.
+`
+            }
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/mcp/server.ts
+async function serveMcp(opts) {
+  const { version } = await import("./package-YZFYSSQM.js");
+  const server = new McpServer({ name: "clawops", version });
+  registerTools(server, opts);
+  registerResources(server);
+  registerPrompts(server);
+  if (opts.port) {
+    const bind = opts.bind ?? "127.0.0.1";
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID5() });
+    const httpServer = createServer((req, res) => {
+      void transport.handleRequest(req, res);
+    });
+    await new Promise((resolve, reject) => {
+      httpServer.once("error", reject);
+      httpServer.listen(opts.port, bind, resolve);
+    });
+    process.stderr.write(`[clawops] MCP HTTP server listening on ${bind}:${opts.port}
+`);
+    await server.connect(transport);
+    await new Promise((resolve) => httpServer.once("close", resolve));
+  } else {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    await new Promise((resolve) => {
+      server.server.onclose = resolve;
+    });
+  }
+}
+export {
+  serveMcp
+};