@clawops/cli 1.0.0 → 1.2.0

package/dist/cli.js

@@ -1,17 +1,25 @@
 #!/usr/bin/env node
+import {
+  validateOpenclawConfig
+} from "./chunk-QJ6ERXHN.js";
+import "./chunk-ACYJBSLJ.js";
+import "./chunk-BRPU7AQC.js";
+import "./chunk-ZVOEQCNW.js";
+import "./chunk-4U3LTLWZ.js";
+import "./chunk-UDNZUSKA.js";
 import {
   getConfig,
   getConfigDir,
   requireConfig,
   setConfig
-} from "./chunk-ALSUDYA7.js";
+} from "./chunk-CX5SL5HP.js";
 import {
   ClawopsError,
   UsageError
-} from "./chunk-ZSE4QRKE.js";
+} from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand18, runMain } from "citty";
+import { defineCommand as defineCommand19, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -169,6 +177,7 @@ var init_default = defineCommand({
 // src/cli/commands/up.ts
 import { defineCommand as defineCommand2 } from "citty";
 import process3 from "process";
+import { readFileSync } from "fs";
 
 // src/output/table.ts
 function renderTable(headers, rows) {
@@ -199,10 +208,11 @@ var up_default = defineCommand2({
     "dry-run": { type: "boolean", description: "Preview without applying" },
     "no-wait": { type: "boolean", description: "Return immediately without waiting for healthy state" },
     "openclaw-version": { type: "string", description: "semver or 'stable'/'dev'" },
-    stack: { type: "string", description: "Target stack name" }
+    stack: { type: "string", description: "Target stack name" },
+    config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -213,7 +223,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-NRIDVS5F.js");
+      const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -233,6 +243,18 @@ var up_default = defineCommand2({
         spin2.succeed(`Host "${localOpts.host}" bootstrapped`);
         info(`Gateway URL: ${state.gatewayUrl}`);
         info(`SSH:         ${state.sshUser}@${state.sshHost}:${state.sshPort}`);
+        if (typeof args.config === "string") {
+          await applyLocalConfigOverlay({
+            configPath: args.config,
+            host: localOpts.host,
+            port: localOpts.sshPort,
+            user: localOpts.sshUser,
+            privateKeyPath: localOpts.sshKeyPath,
+            knownHostsPath: ctx.config.ssh.knownHostsPath,
+            signal: abortController.signal
+          });
+          info("Config overlay applied and gateway restarted.");
+        }
       } catch (err) {
         spin2.fail("Bootstrap failed");
         throw err;
@@ -293,6 +315,34 @@ var up_default = defineCommand2({
     }
   }
 });
+async function applyLocalConfigOverlay(opts) {
+  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
+  let overlay;
+  try {
+    overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
+  } catch (err) {
+    throw new UsageError(`Cannot read config overlay at ${opts.configPath}: ${err.message}`);
+  }
+  const resolved = resolveSecrets(overlay, []);
+  const session = await connect({
+    host: opts.host,
+    port: opts.port,
+    user: opts.user,
+    privateKeyPath: opts.privateKeyPath,
+    knownHostsPath: opts.knownHostsPath,
+    signal: opts.signal
+  });
+  try {
+    const remote = await readRemoteConfig(session, opts.signal);
+    const merged = deepMerge(remote, resolved);
+    await atomicWriteConfig(session, merged, opts.signal);
+    await restartGateway(session, opts.signal);
+  } finally {
+    session.close();
+  }
+}
 
 // src/cli/commands/down.ts
 import { defineCommand as defineCommand3 } from "citty";
@@ -308,7 +358,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -372,7 +422,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -397,7 +447,7 @@ var status_default = defineCommand4({
       process6.stdout.write("\n" + renderTable(["Field", "Value"], rows2) + "\n\n");
       return;
     }
-    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
     const outputs = Object.fromEntries(
@@ -444,8 +494,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { generatePlan } = await import("./generate-H3D7VQUP.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { generatePlan } = await import("./generate-WG5VONSE.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -485,6 +535,18 @@ var plan_default = defineCommand5({
     } else {
       process7.stdout.write(planJson + "\n");
     }
+    const { spec, metadata } = plan;
+    const sshCidrs = spec.network.allowedSshCidrs.join(", ") || "(none)";
+    const gatewayCidrs = spec.network.allowedGatewayCidrs.join(", ") || "(none)";
+    process7.stderr.write(
+      `
+Plan: ${metadata.name}  (${spec.provider}${spec.region ? ` / ${spec.region}` : ""})
+  Instance:  ${spec.instanceType}
+  OpenClaw:  ${spec.openclaw.version}
+  SSH CIDRs: ${sshCidrs}
+  Gateway:   ${gatewayCidrs}
+`
+    );
     if (plan.diff) {
       const { create, update, delete: del, totalChanges } = plan.diff;
       process7.stderr.write(
@@ -501,7 +563,7 @@ Changes: ${create.length} to create, ${update.length} to update, ${del.length} t
         process7.stderr.write(renderTable(["Op", "Resource Type", "Name"], rows) + "\n");
       }
     } else {
-      process7.stderr.write("(diff unavailable \u2014 preview could not run against this stack)\n");
+      process7.stderr.write("\n(diff unavailable \u2014 preview could not run against this stack)\n");
     }
   }
 });
@@ -509,7 +571,7 @@ Changes: ${create.length} to create, ${update.length} to update, ${del.length} t
 // src/cli/commands/apply.ts
 import { defineCommand as defineCommand6 } from "citty";
 import process8 from "process";
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { isAbsolute as isAbsolute2 } from "path";
 import { createInterface } from "readline/promises";
 var apply_default = defineCommand6({
@@ -523,7 +585,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-GTVALBAY.js");
+    const { applyPlan } = await import("./apply-KBF7OPWL.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -533,7 +595,7 @@ var apply_default = defineCommand6({
     }
     let raw;
     try {
-      raw = readFileSync(planPath, "utf-8");
+      raw = readFileSync2(planPath, "utf-8");
     } catch {
       throw new UsageError(`Cannot read plan file: ${planPath}`);
     }
@@ -592,7 +654,18 @@ ${validation.errors.join("\n")}`);
         onOutput: (line) => {
           spin.text = line.trim() || spin.text;
         },
-        signal: abortController.signal
+        signal: abortController.signal,
+        confirmDrift: args.yes ? void 0 : async () => {
+          spin.stop();
+          const rl = createInterface({ input: process8.stdin, output: process8.stdout });
+          const answer = await rl.question("Stack has drifted. Continue anyway? (y/N) ");
+          rl.close();
+          if (answer.trim().toLowerCase() !== "y") {
+            process8.stdout.write("Aborted.\n");
+            process8.exit(0);
+          }
+          spin.start();
+        }
       });
       spin.succeed(`Stack "${typedPlan.spec.stackName}" applied`);
       const summaryRows = Object.entries(result.changeSummary).filter(([, count]) => count > 0).map(([op, count]) => [op, String(count)]);
@@ -628,7 +701,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -695,8 +768,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -713,7 +786,7 @@ var ssh_default = defineCommand8({
         knownHostsPath: state.knownHostsPath
       };
     } else {
-      const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+      const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
       const stack = await ctx.getStack();
       const outputMap = await stack.outputs();
       const outputs = Object.fromEntries(
@@ -782,9 +855,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
-    const { acquireSession } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { acquireSession } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -850,9 +923,9 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
-    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -922,11 +995,11 @@ import { defineCommand as defineCommand11 } from "citty";
 import process13 from "process";
 var OPENCLAW_CONFIG = "/home/clawops/openclaw.json";
 var OPENCLAW_TMP = "/tmp/clawops-config.json.tmp";
-function dockerRunCmd(version) {
+function dockerRunCmd(image) {
   return [
     "docker stop openclaw 2>/dev/null || true",
     "docker rm   openclaw 2>/dev/null || true",
-    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG}:/app/config.json:ro ghcr.io/openclaw/openclaw:${version}`
+    `docker run -d --name openclaw --restart unless-stopped -p 18789:18789 -v ${OPENCLAW_CONFIG}:/app/config.json:ro ${image}`
   ].join(" && ");
 }
 function getPath(obj, dotKey) {
@@ -967,12 +1040,12 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
-    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, key, value] = args._ ?? [];
-    if (!action || !["get", "set", "unset"].includes(action)) {
-      failure("Usage: clawops config <get [key] | set key value | unset key>");
+    if (!action || !["get", "set", "unset", "validate"].includes(action)) {
+      failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
       process13.exit(2);
     }
     if (action === "set" && (!key || value === void 0)) {
@@ -1024,6 +1097,17 @@ var config_default = defineCommand11({
         }
         return;
       }
+      if (action === "validate") {
+        const issues = validateOpenclawConfig(cfg);
+        if (issues.length === 0) {
+          success("Config is valid.");
+        } else {
+          for (const issue of issues) warn(issue);
+          failure(`Config has ${issues.length} issue(s).`);
+          process13.exit(1);
+        }
+        return;
+      }
       if (action === "set") {
         let parsedValue = value;
         try {
@@ -1054,8 +1138,8 @@ var config_default = defineCommand11({
           `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo 'ghcr.io/openclaw/openclaw:stable'`,
           abortController.signal
         );
-        const version = imgResult.stdout.trim().split(":")[1] ?? "stable";
-        const restartResult = await session.exec(dockerRunCmd(version), abortController.signal);
+        const image = imgResult.stdout.trim();
+        const restartResult = await session.exec(dockerRunCmd(image), abortController.signal);
         if (restartResult.code !== 0) {
           failure(`Restart failed: ${restartResult.stderr}`);
           process13.exit(1);
@@ -1082,9 +1166,9 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
-    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, name] = args._ ?? [];
     if (!action || !["list", "restart", "logs"].includes(action)) {
       failure("Usage: clawops agents <list | restart [name] | logs <name>>");
@@ -1186,9 +1270,9 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
-    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
@@ -1299,8 +1383,8 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-T52JWL3P.js");
-    const { acquireSession, drainPool } = await import("./pool-D4JCUA2V.js");
+    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -1321,7 +1405,7 @@ var backup_default = defineCommand14({
         knownHostsPath: state.knownHostsPath
       };
     } else {
-      const { extractBaseOutputs } = await import("./outputs-6DAVEEAZ.js");
+      const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
       const stack = await ctx.getStack();
       const outputMap = await stack.outputs();
       const outputs = Object.fromEntries(
@@ -1514,8 +1598,11 @@ var doctor_default = defineCommand16({
     name: "doctor",
     description: "Check system prerequisites, config, SSH keys, and cloud credentials"
   },
-  async run() {
-    const { getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-ARJ2EO6L.js");
+  args: {
+    stack: { type: "string", description: "Stack name to include remote health checks" }
+  },
+  async run({ args }) {
+    const { getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
     process18.stdout.write("\nclawops doctor\n");
     process18.stdout.write("\nRuntime\n");
     const nodeVersion = process18.version;
@@ -1565,9 +1652,9 @@ var doctor_default = defineCommand16({
       info("Credential checks skipped \u2014 no config");
     } else {
       const { getProvider } = await import("./providers-2OABPW2E.js");
-      await import("./aws-A3323GNM.js");
-      await import("./gcp-OHWCTFLL.js");
-      await import("./azure-LNWBK2ZI.js");
+      await import("./aws-KQBWY43W.js");
+      await import("./gcp-SKURG3L6.js");
+      await import("./azure-4EJFVJZL.js");
       await import("./local-DXBEVZ5C.js");
       const checkedProviders = /* @__PURE__ */ new Set();
       for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
@@ -1596,6 +1683,98 @@ var doctor_default = defineCommand16({
         warn("No stacks configured \u2014 run `clawops init`");
       }
     }
+    if (args.stack) {
+      process18.stdout.write("\nRemote health\n");
+      if (!config) {
+        info("Remote health skipped \u2014 no config");
+      } else {
+        try {
+          const { buildContext } = await import("./context-VUAYRAJY.js");
+          const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+          const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+          const ctx = buildContext({ stack: args.stack });
+          const stack = await ctx.getStack();
+          const outputMap = await stack.outputs();
+          const outputs = Object.fromEntries(
+            Object.entries(outputMap).map(([k, v]) => [k, v.value])
+          );
+          const base = extractBaseOutputs(outputs);
+          const conn = ctx.adapter.getConnectionInfo({
+            ...base,
+            privateKeyPath: config.ssh.keyPath,
+            knownHostsPath: config.ssh.knownHostsPath
+          });
+          const ac = new AbortController();
+          process18.on("SIGINT", () => ac.abort());
+          process18.on("SIGTERM", () => ac.abort());
+          const { session, release } = await acquireSession({
+            host: conn.host,
+            port: conn.port,
+            user: conn.user,
+            privateKeyPath: conn.privateKeyPath,
+            knownHostsPath: conn.knownHostsPath,
+            signal: ac.signal
+          });
+          try {
+            const containerResult = await session.exec(
+              `docker inspect openclaw --format '{{.State.Status}}' 2>/dev/null || echo 'not found'`,
+              ac.signal
+            );
+            const containerStatus = containerResult.stdout.trim();
+            if (containerStatus === "running") {
+              success(`Container    running`);
+            } else {
+              failure(`Container    ${containerStatus || "unknown"}`);
+            }
+            const healthResult = await session.exec(
+              `docker inspect openclaw --format '{{.State.Health.Status}}' 2>/dev/null || echo 'none'`,
+              ac.signal
+            );
+            const healthStatus = healthResult.stdout.trim();
+            if (healthStatus === "healthy") {
+              success(`Healthcheck  healthy`);
+            } else if (healthStatus === "none" || healthStatus === "<no value>") {
+              info(`Healthcheck  no healthcheck configured`);
+            } else {
+              warn(`Healthcheck  ${healthStatus}`);
+            }
+            const diskResult = await session.exec(
+              `df -h /home/clawops 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
+              ac.signal
+            );
+            const diskUsage = diskResult.stdout.trim();
+            if (diskUsage) {
+              const pctMatch = diskUsage.match(/^(\d+)%/);
+              const pct = pctMatch ? parseInt(pctMatch[1], 10) : 0;
+              if (pct >= 90) {
+                failure(`Disk         ${diskUsage}`);
+              } else if (pct >= 75) {
+                warn(`Disk         ${diskUsage}`);
+              } else {
+                success(`Disk         ${diskUsage}`);
+              }
+            } else {
+              warn("Disk         unable to determine disk usage");
+            }
+            const logrotateResult = await session.exec(
+              `test -f /etc/logrotate.d/openclaw && echo 'configured' || echo 'not configured'`,
+              ac.signal
+            );
+            const logrotate = logrotateResult.stdout.trim();
+            if (logrotate === "configured") {
+              success(`Log rotation configured`);
+            } else {
+              warn(`Log rotation not configured \u2014 logs may grow unbounded`);
+            }
+          } finally {
+            release();
+            drainPool();
+          }
+        } catch (err) {
+          failure(`Remote health checks failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+    }
     process18.stdout.write("\n");
     if (!nodeOk) process18.exit(1);
   }
@@ -1603,7 +1782,7 @@ var doctor_default = defineCommand16({
 
 // src/cli/commands/mcp.ts
 import { defineCommand as defineCommand17 } from "citty";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
 import path3 from "path";
 import os from "os";
 var mcp_default = defineCommand17({
@@ -1635,7 +1814,7 @@ var mcp_default = defineCommand17({
       }
       return;
     }
-    const { serveMcp } = await import("./server-YO4JFQND.js");
+    const { serveMcp } = await import("./server-QJRWK2RV.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1653,13 +1832,14 @@ var CLAWOPS_ENTRY = {
 };
 function getConfigPath(client) {
   const home = os.homedir();
+  const isLinux = process.platform === "linux";
   switch (client) {
     case "claude":
-      return path3.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return isLinux ? path3.join(home, ".config", "Claude", "claude_desktop_config.json") : path3.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
     case "cursor":
       return path3.join(home, ".cursor", "mcp.json");
     case "vscode":
-      return path3.join(home, "Library", "Application Support", "Code", "User", "mcp.json");
+      return isLinux ? path3.join(home, ".config", "Code", "User", "mcp.json") : path3.join(home, "Library", "Application Support", "Code", "User", "mcp.json");
     case "windsurf":
       return path3.join(home, ".codeium", "windsurf", "mcp_config.json");
     case "zed":
@@ -1675,7 +1855,7 @@ function installMcp(client) {
   let config = {};
   if (existsSync2(configPath)) {
     try {
-      config = JSON.parse(readFileSync2(configPath, "utf-8"));
+      config = JSON.parse(readFileSync3(configPath, "utf-8"));
     } catch {
     }
   }
@@ -1691,26 +1871,1042 @@ function installMcp(client) {
   writeFileSync3(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
 }
 
-// src/cli/error-handler.ts
+// src/cli/commands/setup.ts
+import { defineCommand as defineCommand18 } from "citty";
 import process19 from "process";
+import os2 from "os";
+import { randomBytes } from "crypto";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync3, mkdirSync as mkdirSync4 } from "fs";
+import { execSync, spawnSync, spawn as spawn2 } from "child_process";
+import path4 from "path";
+import { fileURLToPath } from "url";
+var setup_default = defineCommand18({
+  meta: {
+    name: "setup",
+    description: "Interactive wizard: configure and deploy an OpenClaw stack"
+  },
+  args: {
+    "dry-run": { type: "boolean", description: "Generate plan/config without applying" },
+    "output-dir": { type: "string", description: "Directory to write generated files (skips prompt)" }
+  },
+  async run({ args }) {
+    const inquirer = (await import("inquirer")).default;
+    const yaml = await import("./js-yaml-PTEEG4FO.js");
+    const catalogs = loadCatalogs(yaml);
+    const dryRun = Boolean(args["dry-run"]);
+    const ac = new AbortController();
+    process19.on("SIGINT", () => {
+      ac.abort();
+      process19.exit(130);
+    });
+    process19.on("SIGTERM", () => {
+      ac.abort();
+      process19.exit(143);
+    });
+    process19.stdout.write("\nWelcome to clawops setup. This wizard will help you deploy OpenClaw\n");
+    process19.stdout.write("and connect it to your AI tools. It takes about 2 minutes.\n\n");
+    const { deploymentType } = await inquirer.prompt([{
+      type: "list",
+      name: "deploymentType",
+      message: "Where would you like to run OpenClaw?",
+      choices: [
+        { name: "Cloud (AWS, GCP, or Azure) \u2014 deploy to paid cloud hosting", value: "cloud" },
+        { name: "Deploy to a local or existing server \u2014 connect over SSH (Linux or macOS)", value: "local" }
+      ]
+    }]);
+    let provider;
+    let localHost = "";
+    let localUser = os2.userInfo().username;
+    let localKeyPath = detectSshKey();
+    let localPort = 22;
+    let localSudoPassword = "";
+    if (deploymentType === "cloud") {
+      const answer = await inquirer.prompt([{
+        type: "list",
+        name: "provider",
+        message: "Which cloud service would you like to use?",
+        choices: [
+          { name: "Amazon Web Services (AWS)  \u2014 most popular, widest region coverage", value: "aws" },
+          { name: "Google Cloud (GCP)         \u2014 good pricing, strong in AI workloads", value: "gcp" },
+          { name: "Microsoft Azure            \u2014 best if your team already uses Microsoft", value: "azure" }
+        ]
+      }]);
+      provider = answer.provider;
+      process19.stdout.write("\n");
+      await ensureCloudAuth(provider, inquirer);
+    } else {
+      provider = "local";
+      info("We'll connect to your server over SSH to install and configure OpenClaw.\n");
+      if (!existsSync3(localKeyPath)) {
+        info(`No SSH key found at ${localKeyPath}.`);
+        const { genKey } = await inquirer.prompt([{
+          type: "confirm",
+          name: "genKey",
+          message: "Generate a new SSH key pair now? (recommended if you don't have one)",
+          default: true
+        }]);
+        if (genKey) {
+          localKeyPath = await generateSshKey();
+        }
+      }
+      const localAnswers = await inquirer.prompt([
+        {
+          type: "input",
+          name: "host",
+          message: "Server address: (IP address or hostname, e.g. 192.168.1.100 or myserver.example.com)",
+          validate: (v) => v.trim() !== "" || "Please enter a server address"
+        },
+        {
+          type: "number",
+          name: "port",
+          message: "SSH port: (almost always 22 \u2014 press Enter to accept)",
+          default: 22
+        },
+        {
+          type: "input",
+          name: "user",
+          message: 'SSH username: (e.g. "ubuntu" on AWS, "ec2-user" on Amazon Linux, or your local username for localhost)',
+          default: localUser
+        },
+        {
+          type: "input",
+          name: "keyPath",
+          message: `SSH private key file: (the key file on your computer used to log in \u2014 e.g. ~/.ssh/id_ed25519)`,
+          default: localKeyPath,
+          validate: (v) => existsSync3(v.trim()) || `File not found: ${v.trim()}`
+        }
+      ]);
+      localHost = localAnswers.host;
+      localPort = localAnswers.port;
+      localUser = localAnswers.user;
+      localKeyPath = localAnswers.keyPath;
+      await ensureAuthorizedKey(localKeyPath, localHost, inquirer);
+      const { sudoPass } = await inquirer.prompt([{
+        type: "password",
+        name: "sudoPass",
+        message: `Sudo password for ${localUser}@${localHost}: (press Enter to skip if passwordless sudo is configured)`
+      }]);
+      localSudoPassword = sudoPass;
+    }
+    process19.stdout.write("\n");
+    const stackAnswers = await inquirer.prompt([
+      {
+        type: "input",
+        name: "stackName",
+        message: 'Deployment name: (a short label for this install, e.g. "prod", "home", "team-dev")',
+        default: "prod",
+        validate: (v) => /^[a-z][a-z0-9-]{0,62}$/.test(v) || "Use lowercase letters, numbers, and hyphens only"
+      },
+      ...provider !== "local" ? [
+        {
+          type: "input",
+          name: "region",
+          message: `Server region: (the geographic area where your server will live \u2014 pick closest to your users)`,
+          default: defaultRegion(provider)
+        },
+        {
+          type: "list",
+          name: "instanceSize",
+          message: "Server size: (bigger = faster, but costs more per month)",
+          choices: instanceChoices(provider)
+        },
+        {
+          type: "input",
+          name: "stateBucket",
+          message: `${stateLabel(provider)} bucket name: (a storage bucket that tracks what's deployed \u2014 create one first if you haven't)`,
+          validate: (v) => v.trim() !== "" || "Required \u2014 create a bucket in your cloud console first"
+        },
+        {
+          type: "input",
+          name: "sshKeyPath",
+          message: "SSH public key file: (the .pub file that goes with your private key \u2014 used to access the new server)",
+          default: `${detectSshKey()}.pub`
+        },
+        {
+          type: "input",
+          name: "sshCidr",
+          message: "Restrict SSH access to: (your IP address for security, or 0.0.0.0/0 to allow access from anywhere)",
+          default: "0.0.0.0/0"
+        }
+      ] : [],
+      {
+        type: "input",
+        name: "openclawVersion",
+        message: 'OpenClaw version: ("latest" for the latest release, or a specific version like "2026.4")',
+        default: "latest"
+      }
+    ]);
+    process19.stdout.write("\n");
+    info("Choose the AI model that your OpenClaw agent will use.");
+    info("You'll need an API key from your chosen provider (except Bedrock and Ollama).\n");
+    const { modelProviderId } = await inquirer.prompt([{
+      type: "list",
+      name: "modelProviderId",
+      message: "Which AI provider do you want to use?",
+      choices: catalogs.models.map((p) => ({ name: p.displayName, value: p.id }))
+    }]);
+    const modelProvider = catalogs.models.find((p) => p.id === modelProviderId);
+    const modelConfig = {};
+    const secrets = [];
+    const { selectedModelId } = await inquirer.prompt([{
+      type: "list",
+      name: "selectedModelId",
+      message: `Which ${modelProvider.displayName} model should OpenClaw use?`,
+      choices: modelProvider.models.map((m) => ({
+        name: m.family ? `[${m.family}] ${m.displayName}` : m.displayName,
+        value: m.id
+      })),
+      default: modelProvider.defaultModel
+    }]);
+    const selectedModel = modelProvider.models.find((m) => m.id === selectedModelId);
+    if (modelProvider.credentialSource === "api-key") {
+      const secretName = `${modelProviderId.toUpperCase()}_API_KEY`;
+      const entry = await promptSecret(secretName, `${modelProvider.displayName} API key`, modelProvider.envDefault ?? "API_KEY", inquirer);
+      secrets.push(entry);
+      modelConfig["apiKey"] = `$secret:${secretName}`;
+    } else if (modelProvider.credentialSource === "aws-profile") {
+      process19.stdout.write("\n");
+      info(modelProvider.iamNote ?? "Bedrock uses your AWS server's IAM role \u2014 no API key needed.");
+      info("Make sure your EC2 instance has the AmazonBedrockFullAccess IAM policy attached.\n");
+    } else if (modelProvider.id === "ollama") {
+      const { baseUrl } = await inquirer.prompt([{
+        type: "input",
+        name: "baseUrl",
+        message: "Ollama address: (the URL where Ollama is running \u2014 usually http://localhost:11434)",
+        default: modelProvider.baseUrlDefault ?? "http://localhost:11434"
+      }]);
+      modelConfig["baseUrl"] = baseUrl;
+    }
+    const builtModelConfig = {
+      provider: modelProviderId,
+      ...selectedModel.modelId ? { modelId: selectedModel.modelId } : { model: selectedModel.id },
+      ...modelConfig
+    };
+    process19.stdout.write("\n");
+    info("Use \u2191\u2193 to move, Space to select/deselect, Enter to confirm.");
+    const { selectedIntegrationIds } = await inquirer.prompt([{
+      type: "checkbox",
+      name: "selectedIntegrationIds",
+      message: "Which chat integrations would you like to enable?",
+      choices: catalogs.integrations.map((integ) => ({
+        name: `${integ.displayName} \u2014 ${integ.description}`,
+        value: integ.id,
+        checked: false
+      })),
+      pageSize: catalogs.integrations.length + 1
+    }]);
+    const channelsConfig = {};
+    const infraRequired = [];
+    for (const integ of catalogs.integrations.filter((i) => selectedIntegrationIds.includes(i.id))) {
+      process19.stdout.write("\n");
+      info(`Setting up ${integ.displayName}:`);
+      const channelConfig = {};
+      for (const field of integ.fields) {
+        if (field.sensitive && field.envDefault) {
+          const entry = await promptSecret(field.envDefault, `${integ.displayName} ${field.label}`, field.envDefault, inquirer);
+          secrets.push(entry);
+          channelConfig[field.name] = `$secret:${field.envDefault}`;
+        } else {
+          const { value } = await inquirer.prompt([{
+            type: "input",
+            name: "value",
+            message: `${field.label}: ${field.description}`,
+            default: ""
+          }]);
+          channelConfig[field.name] = value;
+        }
+      }
+      channelsConfig[integ.channelKey] = channelConfig;
+      if (integ.infraRequired) infraRequired.push(integ);
+    }
+    let outDir = typeof args["output-dir"] === "string" ? args["output-dir"] : null;
+    if (outDir === null) {
+      if (provider !== "local") {
+        const { outputDir } = await inquirer.prompt([{
+          type: "input",
+          name: "outputDir",
+          message: "Where should the plan file be saved? (press Enter to save in the current folder)",
+          default: "."
+        }]);
+        outDir = outputDir;
+      } else {
+        outDir = ".";
+      }
+    }
+    const gatewayToken = randomBytes(24).toString("hex");
+    const secretsDir = path4.join(os2.homedir(), ".clawops", "secrets");
+    mkdirSync4(secretsDir, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
+    const tokenPath = path4.join(secretsDir, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
+    writeFileSync4(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
+    const openclawConfigOverlay = {
+      models: builtModelConfig,
+      gateway: { auth: { mode: "token", token: gatewayToken } }
+    };
+    if (Object.keys(channelsConfig).length > 0) {
+      openclawConfigOverlay["channels"] = channelsConfig;
+    }
+    let outputPath;
+    if (provider === "local") {
+      outputPath = path4.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
+      writeFileSync4(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
+      process19.stdout.write("\n");
+      success(`Config file saved to ${outputPath}`);
+    } else {
+      let sshPublicKey = "";
+      try {
+        sshPublicKey = readFileSync4(stackAnswers.sshKeyPath ?? "", "utf-8").trim();
+      } catch {
+        failure(`Cannot read SSH public key at ${stackAnswers.sshKeyPath ?? ""}`);
+        process19.exit(1);
+      }
+      const plan = {
+        apiVersion: "clawops.dev/v1",
+        kind: "DeployPlan",
+        metadata: {
+          name: stackAnswers.stackName,
+          generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          generator: "clawops-setup"
+        },
+        spec: {
+          provider,
+          region: stackAnswers.region,
+          stackName: stackAnswers.stackName,
+          instanceType: stackAnswers.instanceSize,
+          openclaw: {
+            version: stackAnswers.openclawVersion,
+            config: openclawConfigOverlay,
+            ...Object.keys(channelsConfig).length > 0 ? { channels: channelsConfig } : {}
+          },
+          secrets,
+          network: {
+            allowedSshCidrs: [stackAnswers.sshCidr ?? "0.0.0.0/0"],
+            allowedGatewayCidrs: [stackAnswers.sshCidr ?? "0.0.0.0/0"]
+          },
+          ssh: { publicKey: sshPublicKey },
+          ...stackAnswers.stateBucket ? { stateBucket: stackAnswers.stateBucket } : {}
+        }
+      };
+      outputPath = path4.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
+      writeFileSync4(outputPath, JSON.stringify(plan, null, 2), "utf-8");
+      process19.stdout.write("\n");
+      success(`Deployment plan saved to ${outputPath}`);
+    }
+    process19.stdout.write("\n");
+    const mcpEntry = buildMcpEntry();
+    if (!mcpEntry.resolved) {
+      info("Note: clawops is not installed globally \u2014 AI apps will not be able to start");
+      info("the MCP server until you install it:");
+      info("  npm install -g @clawops/cli");
+      info("The config will be written now; re-run setup after installing to update the path.\n");
+    }
+    info("Use \u2191\u2193 to move, Space to select/deselect, Enter to confirm.");
+    const appChoices = MCP_APPS.map((app) => ({
+      name: app.isInstalled() ? app.name : `${app.name}  (not detected \u2014 config will be written anyway)`,
+      value: app.id,
+      checked: app.isInstalled()
+    }));
+    const { selectedAppIds } = await inquirer.prompt([{
+      type: "checkbox",
+      name: "selectedAppIds",
+      message: "Connect clawops to your AI apps? (space to toggle, enter to skip)",
+      choices: appChoices,
+      pageSize: MCP_APPS.length + 1
+    }]);
+    const selectedApps = MCP_APPS.filter((app) => selectedAppIds.includes(app.id));
+    if (selectedApps.length > 0) {
+      for (const app of selectedApps) {
+        const cfgPath = app.configPath();
+        try {
+          let existing = {};
+          if (existsSync3(cfgPath)) {
+            existing = JSON.parse(readFileSync4(cfgPath, "utf-8"));
+          }
+          const mcpServers = existing["mcpServers"] ?? {};
+          mcpServers["clawops"] = { command: mcpEntry.command, args: mcpEntry.args };
+          existing["mcpServers"] = mcpServers;
+          mkdirSync4(path4.dirname(cfgPath), { recursive: true });
+          writeFileSync4(cfgPath, JSON.stringify(existing, null, 2), "utf-8");
+          success(`${app.name} configured  (${cfgPath})`);
+        } catch (err) {
+          failure(`Could not configure ${app.name}: ${err.message}`);
+          info("Add this to its MCP config manually:");
+          printMcpSnippet();
+        }
+      }
+      const needsRestart = selectedApps.filter((app) => app.id !== "claude-code");
+      if (needsRestart.length > 0) {
+        info(`Restart ${needsRestart.map((a) => a.name).join(", ")} to load the clawops tool.`);
+      }
+    } else {
+      info("To connect clawops to an AI app later, add this to its MCP config:");
+      printMcpSnippet();
+      info("Config paths:");
+      for (const app of MCP_APPS) {
+        info(`  ${app.name.padEnd(18)} ${app.configPath()}`);
+      }
+    }
+    if (infraRequired.length > 0) {
+      process19.stdout.write("\n");
+      info("\u2500\u2500 Action required: webhook registration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      info("These integrations need a webhook URL set up in their developer portal:");
+      for (const integ of infraRequired) {
+        info(`
+  ${integ.displayName}`);
+        if (integ.infraNote) info(`  ${integ.infraNote.trim()}`);
+        if (integ.setupUrl) info(`  Guide: ${integ.setupUrl}`);
+      }
+    }
+    if (modelProvider.id === "ollama" && selectedModel.pullSuffix !== void 0) {
+      process19.stdout.write("\n");
+      info("\u2500\u2500 Action required: download the Ollama model \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      info("After deployment, run this command on the server (or locally if Ollama is local):");
+      info(`  ollama pull ${selectedModel.id}${selectedModel.pullSuffix}`);
+    }
+    if (dryRun) return;
+    if (provider === "local") {
+      const { deployNow } = await inquirer.prompt([{
+        type: "confirm",
+        name: "deployNow",
+        message: "Initialize and deploy the server now? (connects over SSH \u2014 takes 2\u20135 min)",
+        default: true
+      }]);
+      if (deployNow) {
+        await runLocalDeploy({
+          stackName: stackAnswers.stackName,
+          host: localHost,
+          port: localPort,
+          user: localUser,
+          keyPath: localKeyPath,
+          sudoPassword: localSudoPassword || void 0,
+          openclawVersion: stackAnswers.openclawVersion,
+          overlay: openclawConfigOverlay,
+          secrets,
+          gatewayToken,
+          signal: ac.signal,
+          inquirer
+        });
+      } else {
+        const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
+        const knownHostsPath = path4.join(getConfigDir2(), "known_hosts");
+        process19.stdout.write("\n");
+        info("To deploy later, run these two commands:");
+        info(`  clawops init --provider local --host ${localHost} --port ${localPort} --user ${localUser} --key ${localKeyPath} --stack ${stackAnswers.stackName}`);
+        info(`  clawops up --stack ${stackAnswers.stackName} --config ${outputPath}`);
+        info(`
+(SSH host verification will be saved to ${knownHostsPath})`);
+      }
+    } else {
+      const { applyNow } = await inquirer.prompt([{
+        type: "confirm",
+        name: "applyNow",
+        message: "Provision the cloud server now? (creates the server and installs OpenClaw \u2014 takes 3\u20135 minutes)",
+        default: false
+      }]);
+      if (applyNow) {
+        const { applyPlan } = await import("./apply-KBF7OPWL.js");
+        const plan = JSON.parse(readFileSync4(outputPath, "utf-8"));
+        try {
+          await applyPlan(plan, {
+            onOutput: (line) => process19.stdout.write(line),
+            signal: ac.signal
+          });
+          success("Server provisioned and OpenClaw installed.");
+          info(`Run: clawops doctor --stack ${stackAnswers.stackName}  to verify everything is healthy`);
+        } catch (err) {
+          failure(err instanceof Error ? err.message : String(err));
+          process19.exit(1);
+        }
+      } else {
+        info(`
+To deploy later:  clawops apply ${outputPath}`);
+      }
+    }
+  }
+});
+async function runLocalDeploy(opts) {
+  const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
+  const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
+  const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
+  const knownHostsPath = path4.join(getConfigDir2(), "known_hosts");
+  const existing = getConfig2();
+  const stackEntry = {
+    provider: "local",
+    stateUrl: "file://~/.clawops/state",
+    credentialsRef: { source: "file", envVars: [] },
+    localOpts: { host: opts.host, sshUser: opts.user, sshPort: opts.port, sshKeyPath: opts.keyPath }
+  };
+  const newConfig = existing ? { ...existing, defaults: { stack: opts.stackName, provider: "local" }, stacks: { ...existing.stacks, [opts.stackName]: stackEntry } } : {
+    version: 1,
+    defaults: { stack: opts.stackName, provider: "local" },
+    stacks: { [opts.stackName]: stackEntry },
+    ssh: { keyPath: opts.keyPath, knownHostsPath }
+  };
+  setConfig2(newConfig);
+  success(`Deployment "${opts.stackName}" registered  (~/.clawops/config.json)`);
+  await checkDockerPreflight({ host: opts.host, port: opts.port, user: opts.user, keyPath: opts.keyPath, knownHostsPath, signal: opts.signal, inquirer: opts.inquirer });
+  const STAGES = [
+    [/apt-get update|dnf|yum|apk update/i, "Updating package lists..."],
+    [/apt-get install|dnf install|yum install|apk add/i, "Installing dependencies..."],
+    [/docker-ce|containerd|docker\.io|Install Docker/i, "Installing Docker..."],
+    [/Pulling from|docker pull|Pull complete|Already exists/i, "Pulling OpenClaw image..."],
+    [/systemctl|rc-update|docker run|ExecStart/i, "Starting OpenClaw service..."],
+    [/bootstrap complete/i, "Waiting for OpenClaw to start..."]
+  ];
+  const spin = spinner(`Connecting to ${opts.host}...`);
+  let state;
+  try {
+    state = await localBootstrap({
+      host: opts.host,
+      port: opts.port,
+      user: opts.user,
+      privateKeyPath: opts.keyPath,
+      knownHostsPath,
+      openclawVersion: opts.openclawVersion,
+      stackName: opts.stackName,
+      sudoPassword: opts.sudoPassword,
+      noWait: false,
+      onOutput: (line) => {
+        for (const [pattern, label] of STAGES) {
+          if (pattern.test(line)) {
+            spin.text = label;
+            break;
+          }
+        }
+      },
+      signal: opts.signal
+    });
+    spin.succeed(`OpenClaw installed on ${opts.host}`);
+  } catch (err) {
+    spin.fail("Installation failed");
+    throw err;
+  }
+  const spin2 = spinner("Applying your configuration...");
+  try {
+    const session = await connect({
+      host: opts.host,
+      port: opts.port,
+      user: opts.user,
+      privateKeyPath: opts.keyPath,
+      knownHostsPath,
+      signal: opts.signal
+    });
+    try {
+      const remote = await readRemoteConfig(session, opts.signal);
+      const resolved = resolveSecrets(opts.overlay, opts.secrets);
+      const merged = deepMerge(remote, resolved);
+      await atomicWriteConfig(session, merged, opts.signal);
+      await restartGateway(session, opts.signal);
+    } finally {
+      session.close();
+    }
+    spin2.succeed("Configuration applied");
+  } catch (err) {
+    spin2.fail("Configuration failed");
+    throw err;
+  }
+  const { drainPool } = await import("./pool-FBFHATDG.js");
+  drainPool();
+  const tokenPath = path4.join(os2.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
+  const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
+  process19.stdout.write("\n");
+  success("All done! OpenClaw is running.");
+  info(`Open dashboard: ${dashboardUrl}`);
+  info(`  (or enter the token manually in the "Gateway Token" field: ${opts.gatewayToken})`);
+  info(`SSH access:     ${state.sshUser}@${state.sshHost}:${state.sshPort}`);
+  info(`Token saved to  ${tokenPath}`);
+  info(`
+Run  clawops doctor --stack ${opts.stackName}  to check everything is healthy`);
+}
+var CLOUD_AUTH = {
+  aws: {
+    check: () => execSync("aws sts get-caller-identity --query Account --output text", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim(),
+    identity: (out) => `AWS account ${out}`,
+    loginCmd: ["aws", "configure"],
+    loginHint: "This will walk you through entering your Access Key ID and Secret."
+  },
+  gcp: {
+    check: () => {
+      const acct = execSync("gcloud config get-value account 2>/dev/null", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+      if (!acct || acct === "(unset)") throw new Error("not authenticated");
+      return acct;
+    },
+    identity: (out) => `GCP account ${out}`,
+    loginCmd: ["gcloud", "auth", "login"],
+    loginHint: "This will open a browser window to sign in to your Google account."
+  },
+  azure: {
+    check: () => execSync("az account show --query user.name --output tsv", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim(),
+    identity: (out) => `Azure user ${out}`,
+    loginCmd: ["az", "login"],
+    loginHint: "This will open a browser window to sign in to your Azure account."
+  }
+};
+async function ensureCloudAuth(provider, inquirer) {
+  const cfg = CLOUD_AUTH[provider];
+  try {
+    const identity = cfg.check();
+    success(`Authenticated: ${cfg.identity(identity)}`);
+    return;
+  } catch {
+  }
+  const cliName = cfg.loginCmd[0];
+  failure(`Not signed in to ${provider.toUpperCase()}. You need to authenticate before deploying.`);
+  info(`
+To authenticate, run:
+  ${cfg.loginCmd.join(" ")}
+${cfg.loginHint}`);
+  const { runNow } = await inquirer.prompt([{
+    type: "confirm",
+    name: "runNow",
+    message: `Run \`${cfg.loginCmd.join(" ")}\` now?`,
+    default: true
+  }]);
+  if (runNow) {
+    process19.stdout.write("\n");
+    const result = spawnSync(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
+    if (result.error) {
+      failure(`Could not launch ${cliName} \u2014 is it installed? (${result.error.message})`);
+      info(`Install guide: ${cliInstallUrl(provider)}`);
+      info("Re-run `clawops setup` after installing and signing in.\n");
+      return;
+    }
+    try {
+      const identity = cfg.check();
+      process19.stdout.write("\n");
+      success(`Authenticated: ${cfg.identity(identity)}`);
+    } catch {
+      process19.stdout.write("\n");
+      failure(`Still not authenticated \u2014 the sign-in may have been cancelled or failed.`);
+      info("Re-run `clawops setup` after signing in, or continue and authenticate before running `clawops up`.\n");
+    }
+  } else {
+    info("You can authenticate later, but `clawops up` will fail until you do.\n");
+  }
+}
+function cliInstallUrl(provider) {
+  if (provider === "aws") return "https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html";
+  if (provider === "gcp") return "https://cloud.google.com/sdk/docs/install";
+  return "https://learn.microsoft.com/en-us/cli/azure/install-azure-cli";
+}
+async function promptSecret(name, label, envDefault, inquirer) {
+  const secretsDir = path4.join(os2.homedir(), ".clawops", "secrets");
+  const { secretSource } = await inquirer.prompt([{
+    type: "list",
+    name: "secretSource",
+    message: `Where is your ${label}?`,
+    choices: [
+      { name: `Paste it here \u2014 saved to ~/.clawops/secrets/${name}`, value: "paste" },
+      { name: `In an environment variable  (e.g. ${envDefault})`, value: "env" },
+      { name: "In a file on this computer", value: "file" }
+    ]
+  }]);
+  if (secretSource === "paste") {
+    const { secretValue } = await inquirer.prompt([{
+      type: "password",
+      name: "secretValue",
+      message: `Paste your ${label}: (input is hidden)`,
+      validate: (v) => v.trim() !== "" || "Value cannot be empty"
+    }]);
+    mkdirSync4(secretsDir, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
+    const secretPath = path4.join(secretsDir, name);
+    writeFileSync4(secretPath, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret saved to ${secretPath}  (chmod 600)`);
+    return { name, source: "file", ref: secretPath };
+  }
+  if (secretSource === "env") {
+    const { envVar } = await inquirer.prompt([{
+      type: "input",
+      name: "envVar",
+      message: `Environment variable name: (the variable that holds your ${label})`,
+      default: envDefault
+    }]);
+    return { name, source: "env", ref: envVar };
+  }
+  const { filePath } = await inquirer.prompt([{
+    type: "input",
+    name: "filePath",
+    message: `File path: (full path to the file containing your ${label})`,
+    validate: (v) => existsSync3(v.trim()) || `File not found: ${v.trim()}`
+  }]);
+  return { name, source: "file", ref: filePath };
+}
+var DOCKER_PREFLIGHT_TIMEOUT_MS = 1e4;
+var DOCKER_CHECK_CMD = [
+  'export PATH="/usr/local/bin:/opt/homebrew/bin:/Applications/Docker.app/Contents/Resources/bin:$PATH"',
+  "if ! command -v docker >/dev/null 2>&1; then echo NOT_INSTALLED; exit 0; fi",
+  "if docker version >/dev/null 2>&1; then echo OK; exit 0; fi",
+  'if DOCKER_HOST="unix://${HOME}/.docker/run/docker.sock" docker version >/dev/null 2>&1; then echo OK; exit 0; fi',
+  'if DOCKER_HOST="unix://${HOME}/.colima/default/docker.sock" docker version >/dev/null 2>&1; then echo OK; exit 0; fi',
+  "echo NOT_RUNNING"
+].join("; ");
+async function checkDockerPreflight(opts) {
+  const { acquireSession } = await import("./pool-FBFHATDG.js");
+  const { ProviderError } = await import("./errors-OK47MQFD.js");
+  const spin = spinner("Checking Docker on target host...");
+  const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
+  const execSignal = opts.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
+  const { session, release } = await acquireSession({
+    host: opts.host,
+    port: opts.port,
+    user: opts.user,
+    privateKeyPath: opts.keyPath,
+    knownHostsPath: opts.knownHostsPath,
+    signal: opts.signal
+  });
+  let out = "";
+  try {
+    const result = await session.exec(DOCKER_CHECK_CMD, execSignal);
+    out = result.stdout.trim();
+  } catch {
+    spin.warn("Docker check timed out \u2014 proceeding anyway. Bootstrap will verify.");
+    return;
+  } finally {
+    release();
+  }
+  if (out === "OK") {
+    spin.succeed("Docker is installed and running.");
+    return;
+  }
+  if (out === "NOT_RUNNING") {
+    if (!LOCALHOST_ALIASES.has(opts.host.toLowerCase())) {
+      await startRemoteDocker(opts, spin);
+      return;
+    }
+    spin.warn("Docker is installed but not running.");
+    await startDockerAndWait(opts.inquirer);
+    return;
+  }
+  spin.fail("Docker not found on the target host.");
+  info("Install Docker with one of:");
+  info("  Docker Desktop (GUI):  https://www.docker.com/products/docker-desktop/");
+  info("  Homebrew:              brew install --cask docker");
+  info("  Colima (FOSS):         brew install colima docker && colima start");
+  info("Then re-run: clawops setup");
+  throw new ProviderError("Docker is not installed on the target host.");
+}
+var DOCKER_POLL_MS = 3e3;
+var DOCKER_TIMEOUT_MS = 9e4;
+async function startRemoteDocker(opts, spin) {
+  const { acquireSession } = await import("./pool-FBFHATDG.js");
+  const { ProviderError } = await import("./errors-OK47MQFD.js");
+  spin.text = "Starting Docker on the remote server...";
+  const { session, release } = await acquireSession({
+    host: opts.host,
+    port: opts.port,
+    user: opts.user,
+    privateKeyPath: opts.keyPath,
+    knownHostsPath: opts.knownHostsPath,
+    signal: opts.signal
+  });
+  try {
+    const startResult = await session.exec(
+      "sudo systemctl start docker 2>/dev/null || sudo service docker start 2>/dev/null",
+      opts.signal
+    );
+    if (startResult.code !== 0) {
+      spin.fail("Could not start Docker on the remote server.");
+      throw new ProviderError(
+        "Start Docker manually (sudo systemctl start docker) and re-run: clawops setup"
+      );
+    }
+    const deadline = Date.now() + DOCKER_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, DOCKER_POLL_MS));
+      spin.text = `Waiting for Docker to start on ${opts.host}...`;
+      const check = await session.exec(
+        "docker version >/dev/null 2>&1 && echo OK || echo NOT_RUNNING",
+        opts.signal
+      );
+      if (check.stdout.trim() === "OK") {
+        spin.succeed("Docker started on the remote server.");
+        return;
+      }
+    }
+    spin.fail("Docker did not start within 90s on the remote server.");
+    throw new ProviderError(
+      "Docker did not become ready. Start it manually and re-run: clawops setup"
+    );
+  } finally {
+    release();
+  }
+}
+function dockerIsReachable() {
+  try {
+    execSync(
+      'docker version >/dev/null 2>&1 || DOCKER_HOST="unix://$HOME/.docker/run/docker.sock" docker version >/dev/null 2>&1 || DOCKER_HOST="unix://$HOME/.colima/default/docker.sock" docker version >/dev/null 2>&1',
+      { stdio: "ignore" }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function pollUntilDockerReady(label) {
+  const spin = spinner(label);
+  const deadline = Date.now() + DOCKER_TIMEOUT_MS;
+  let elapsed = 0;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, DOCKER_POLL_MS));
+    elapsed += DOCKER_POLL_MS;
+    spin.text = `${label} (${Math.round(elapsed / 1e3)}s)`;
+    if (dockerIsReachable()) {
+      spin.succeed("Docker is running.");
+      return;
+    }
+  }
+  spin.fail("Docker did not start within 90s.");
+  info("Check Docker Desktop for errors, then re-run: clawops setup");
+  throw new Error("Docker daemon did not become ready within timeout.");
+}
+async function startDockerAndWait(inquirer) {
+  const isLinux = process19.platform === "linux";
+  const { choice } = await inquirer.prompt([{
+    type: "list",
+    name: "choice",
+    message: "How would you like to start Docker?",
+    choices: [
+      ...isLinux ? [{ name: "Start daemon directly  (sudo dockerd)", value: "dockerd" }] : [],
+      ...isLinux ? [{ name: "systemctl             (sudo systemctl start docker)", value: "systemctl" }] : [],
+      ...!isLinux ? [{ name: "Docker Desktop        (open -a Docker)", value: "desktop" }] : [],
+      { name: "Colima               (colima start)", value: "colima" },
+      { name: "Skip \u2014 I'll start it myself and re-run clawops setup", value: "skip" }
+    ]
+  }]);
+  if (choice === "skip") {
+    info("Re-run `clawops setup` once Docker is running.");
+    throw new Error("Docker not running \u2014 user chose to exit.");
+  }
+  if (choice === "dockerd") {
+    info("Starting dockerd in the background (you may be prompted for your password)...");
+    const child = spawn2("sudo", ["dockerd"], { detached: true, stdio: "ignore" });
+    child.unref();
+    await pollUntilDockerReady("Waiting for Docker daemon...");
+  } else if (choice === "systemctl") {
+    const spin = spinner("Running: sudo systemctl start docker...");
+    const res = spawnSync("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
+    if (res.status !== 0) {
+      spin.fail("systemctl start docker failed.");
+      throw new Error("systemctl start docker failed");
+    }
+    spin.succeed("Docker service started.");
+    await pollUntilDockerReady("Waiting for Docker daemon to be reachable...");
+  } else if (choice === "desktop") {
+    const backendRunning = spawnSync("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
+    if (backendRunning) {
+      const killSpin = spinner("Docker Desktop is stuck \u2014 force-restarting...");
+      for (const pat of ["com.docker.backend", "com.docker.virtualization", "com.docker.build", "Docker Desktop"]) {
+        spawnSync("pkill", ["-9", "-f", pat], { stdio: "ignore" });
+      }
+      await new Promise((r) => setTimeout(r, 2e3));
+      killSpin.succeed("Old Docker processes cleared.");
+    }
+    const openSpin = spinner("Launching Docker Desktop...");
+    let opened = spawnSync("open", ["-a", "Docker"], { stdio: "ignore" });
+    if (opened.status !== 0) opened = spawnSync("open", ["/Applications/Docker.app"], { stdio: "ignore" });
+    if (opened.status !== 0) {
+      openSpin.fail("Could not open Docker Desktop \u2014 is it installed in /Applications?");
+      throw new Error("Failed to open Docker Desktop");
+    }
+    openSpin.succeed("Docker Desktop launched.");
+    await pollUntilDockerReady("Waiting for Docker engine to start...");
+  } else if (choice === "colima") {
+    const spin = spinner("Running: colima start...");
+    const res = spawnSync("colima", ["start"], { stdio: "pipe" });
+    if (res.status !== 0) {
+      spin.fail("colima start failed \u2014 is Colima installed? (brew install colima docker)");
+      throw new Error("colima start failed");
+    }
+    spin.succeed("Colima started.");
+    await pollUntilDockerReady("Waiting for Docker daemon to be reachable...");
+  }
+}
+var LOCALHOST_ALIASES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+async function ensureAuthorizedKey(keyPath, host, inquirer) {
+  const pubKeyPath = `${keyPath}.pub`;
+  if (!existsSync3(pubKeyPath)) return;
+  const pubKey = readFileSync4(pubKeyPath, "utf-8").trim();
+  const isLocal = LOCALHOST_ALIASES.has(host.toLowerCase());
+  const authorizedKeysPath = path4.join(os2.homedir(), ".ssh", "authorized_keys");
+  if (isLocal) {
+    const existing = existsSync3(authorizedKeysPath) ? readFileSync4(authorizedKeysPath, "utf-8") : "";
+    if (existing.includes(pubKey)) {
+      success("SSH public key is already in authorized_keys.");
+      return;
+    }
+    info("\nConnecting to localhost requires your public key to be in ~/.ssh/authorized_keys.");
+    const { addKey } = await inquirer.prompt([{
+      type: "confirm",
+      name: "addKey",
+      message: "Add your public key to ~/.ssh/authorized_keys now? (required for SSH to work)",
+      default: true
+    }]);
+    if (addKey) {
+      mkdirSync4(path4.join(os2.homedir(), ".ssh"), { recursive: true });
+      const entry = existing.endsWith("\n") || existing === "" ? pubKey + "\n" : "\n" + pubKey + "\n";
+      writeFileSync4(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
+      spawnSync("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
+      success("Public key added to ~/.ssh/authorized_keys.");
+    } else {
+      info("SSH will likely fail. Add this line to ~/.ssh/authorized_keys manually:");
+      info(`  ${pubKey}`);
+    }
+  } else {
+    process19.stdout.write("\n");
+    info("Make sure this public key is in ~/.ssh/authorized_keys on your server:");
+    info(`  ${pubKey}`);
+    info("(If you just created the server, paste the line above into the server's ~/.ssh/authorized_keys file.)\n");
+  }
+}
+async function generateSshKey() {
+  const keyPath = path4.join(os2.homedir(), ".ssh", "id_ed25519");
+  mkdirSync4(path4.join(os2.homedir(), ".ssh"), { recursive: true });
+  const result = spawnSync("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.status !== 0) {
+    throw new Error(`ssh-keygen failed: ${result.stderr?.toString().trim()}`);
+  }
+  success(`SSH key pair generated: ${keyPath}`);
+  info(`Public key (add this to your server's ~/.ssh/authorized_keys if needed):
+  ${readFileSync4(`${keyPath}.pub`, "utf-8").trim()}`);
+  return keyPath;
+}
+function detectSshKey() {
+  const candidates = ["id_ed25519", "id_ecdsa", "id_rsa", "id_dsa"];
+  for (const name of candidates) {
+    const p = path4.join(os2.homedir(), ".ssh", name);
+    if (existsSync3(p)) return p;
+  }
+  return path4.join(os2.homedir(), ".ssh", "id_ed25519");
+}
+function buildMcpEntry() {
+  try {
+    const bin = execSync("which clawops", {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (bin) return { command: bin, args: ["mcp", "serve", "--read-only"], resolved: true };
+  } catch {
+  }
+  return { command: "clawops", args: ["mcp", "serve", "--read-only"], resolved: false };
+}
+var MCP_APPS = [
+  {
+    id: "claude-desktop",
+    name: "Claude Desktop",
+    configPath: () => process19.platform === "darwin" ? path4.join(os2.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json") : path4.join(os2.homedir(), ".config", "Claude", "claude_desktop_config.json"),
+    isInstalled: () => existsSync3(
+      process19.platform === "darwin" ? path4.join(os2.homedir(), "Library", "Application Support", "Claude") : path4.join(os2.homedir(), ".config", "Claude")
+    )
+  },
+  {
+    id: "claude-code",
+    name: "Claude Code",
+    configPath: () => path4.join(os2.homedir(), ".claude.json"),
+    isInstalled: () => {
+      if (existsSync3(path4.join(os2.homedir(), ".claude.json"))) return true;
+      try {
+        execSync("claude --version", { stdio: "ignore" });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  },
+  {
+    id: "cursor",
+    name: "Cursor",
+    configPath: () => path4.join(os2.homedir(), ".cursor", "mcp.json"),
+    isInstalled: () => existsSync3(path4.join(os2.homedir(), ".cursor"))
+  },
+  {
+    id: "windsurf",
+    name: "Windsurf",
+    configPath: () => path4.join(os2.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+    isInstalled: () => existsSync3(path4.join(os2.homedir(), ".codeium", "windsurf"))
+  }
+];
+function printMcpSnippet() {
+  process19.stdout.write("\n");
+  process19.stdout.write(JSON.stringify({
+    mcpServers: {
+      clawops: { command: "clawops", args: ["mcp", "serve", "--read-only"] }
+    }
+  }, null, 2) + "\n\n");
+}
+function loadCatalogs(yaml) {
+  const specDir = path4.join(path4.dirname(fileURLToPath(import.meta.url)), "../../../spec");
+  try {
+    const modelsRaw = yaml.load(readFileSync4(path4.join(specDir, "models.yaml"), "utf-8"));
+    const integrationsRaw = yaml.load(readFileSync4(path4.join(specDir, "integrations.yaml"), "utf-8"));
+    return {
+      models: modelsRaw.providers,
+      integrations: integrationsRaw.integrations
+    };
+  } catch (err) {
+    throw new Error(`Cannot load wizard catalogs from spec/: ${err.message}`);
+  }
+}
+function defaultRegion(provider) {
+  if (provider === "aws") return "us-east-1";
+  if (provider === "gcp") return "us-central1";
+  if (provider === "azure") return "eastus";
+  return "";
+}
+function stateLabel(provider) {
+  if (provider === "aws") return "S3";
+  if (provider === "gcp") return "GCS";
+  if (provider === "azure") return "Azure Blob Storage";
+  return "State";
+}
+function instanceChoices(provider) {
+  const table = {
+    aws: [
+      { name: "micro  \u2014 1 CPU, 1 GB RAM  (~$8/mo)   \u2014 light personal use", value: "micro" },
+      { name: "small  \u2014 2 CPU, 2 GB RAM  (~$17/mo)  \u2014 recommended for most users", value: "small" },
+      { name: "medium \u2014 2 CPU, 4 GB RAM  (~$33/mo)  \u2014 teams or heavy usage", value: "medium" },
+      { name: "large  \u2014 2 CPU, 8 GB RAM  (~$67/mo)  \u2014 high traffic or multiple agents", value: "large" }
+    ],
+    gcp: [
+      { name: "micro  \u2014 2 CPU, 1 GB RAM  (~$7/mo)   \u2014 light personal use", value: "micro" },
+      { name: "small  \u2014 2 CPU, 8 GB RAM  (~$49/mo)  \u2014 recommended for most users", value: "small" },
+      { name: "medium \u2014 4 CPU, 16 GB RAM (~$97/mo)  \u2014 teams or heavy usage", value: "medium" },
+      { name: "large  \u2014 8 CPU, 32 GB RAM (~$194/mo) \u2014 high traffic or multiple agents", value: "large" }
+    ],
+    azure: [
+      { name: "micro  \u2014 1 CPU, 1 GB RAM  (~$8/mo)   \u2014 light personal use", value: "micro" },
+      { name: "small  \u2014 2 CPU, 4 GB RAM  (~$35/mo)  \u2014 recommended for most users", value: "small" },
+      { name: "medium \u2014 4 CPU, 8 GB RAM  (~$70/mo)  \u2014 teams or heavy usage", value: "medium" },
+      { name: "large  \u2014 8 CPU, 16 GB RAM (~$140/mo) \u2014 high traffic or multiple agents", value: "large" }
+    ]
+  };
+  return table[provider] ?? [];
+}
+
+// src/cli/error-handler.ts
+import process20 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process19.exit(err.exitCode);
+    process20.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process19.env["DEBUG"]) {
-      process19.stderr.write(err.stack ?? "\n");
+    if (process20.env["DEBUG"]) {
+      process20.stderr.write(err.stack ?? "\n");
     }
-    process19.exit(1);
+    process20.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process19.exit(1);
+  process20.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand18({
+var main = defineCommand19({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -1742,7 +2938,8 @@ var main = defineCommand18({
     backup: backup_default,
     stacks: stacks_default,
     doctor: doctor_default,
-    mcp: mcp_default
+    mcp: mcp_default,
+    setup: setup_default
   }
 });
 try {