@clawops/cli 1.2.0 → 1.3.0

package/dist/cli.js

@@ -1,12 +1,17 @@
 #!/usr/bin/env node
+import {
+  MCP_APPS,
+  buildMcpEntry,
+  writeAppConfigs
+} from "./chunk-OIGTOLB3.js";
 import {
   validateOpenclawConfig
-} from "./chunk-QJ6ERXHN.js";
-import "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+} from "./chunk-LVIIYY27.js";
+import "./chunk-JDN6PLH2.js";
 import "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
 import "./chunk-UDNZUSKA.js";
+import "./chunk-A2I76FTA.js";
 import {
   getConfig,
   getConfigDir,
@@ -19,7 +24,7 @@ import {
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand19, runMain } from "citty";
+import { defineCommand as defineCommand21, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -212,7 +217,7 @@ var up_default = defineCommand2({
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -223,7 +228,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+      const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -358,7 +363,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -422,7 +427,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -494,8 +499,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
-    const { generatePlan } = await import("./generate-WG5VONSE.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
+    const { generatePlan } = await import("./generate-U7PJ5LRG.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -585,7 +590,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-KBF7OPWL.js");
+    const { applyPlan } = await import("./apply-DLNE2JYZ.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -701,7 +706,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -768,7 +773,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
     let conn;
@@ -855,7 +860,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
@@ -923,7 +928,7 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
@@ -1040,7 +1045,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, key, value] = args._ ?? [];
@@ -1166,7 +1171,7 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, name] = args._ ?? [];
@@ -1270,7 +1275,7 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, versionArg] = args._ ?? [];
@@ -1383,7 +1388,7 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -1689,7 +1694,7 @@ var doctor_default = defineCommand16({
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-VUAYRAJY.js");
+          const { buildContext } = await import("./context-M2RMDHX6.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
           const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
           const ctx = buildContext({ stack: args.stack });
@@ -1782,13 +1787,11 @@ var doctor_default = defineCommand16({
 
 // src/cli/commands/mcp.ts
 import { defineCommand as defineCommand17 } from "citty";
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import path3 from "path";
-import os from "os";
-var mcp_default = defineCommand17({
+import process19 from "process";
+var serveCmd = defineCommand17({
   meta: {
-    name: "mcp",
-    description: "MCP server operations (serve | install)"
+    name: "serve",
+    description: "Start the clawops MCP server"
   },
   args: {
     http: { type: "string", description: "HTTP port for standalone mode" },
@@ -1796,25 +1799,10 @@ var mcp_default = defineCommand17({
     "read-only": { type: "boolean", description: "Only register read toolset" },
     "no-destructive": { type: "boolean", description: "Filter out destructive tools" },
     toolsets: { type: "string", description: "Comma-separated toolsets to enable" },
-    inspector: { type: "boolean", description: "Enable MCP inspector" },
-    claude: { type: "boolean", description: "Install for Claude Desktop" },
-    cursor: { type: "boolean", description: "Install for Cursor" },
-    vscode: { type: "boolean", description: "Install for VS Code" },
-    windsurf: { type: "boolean", description: "Install for Windsurf" },
-    zed: { type: "boolean", description: "Install for Zed" }
+    inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const installFlags = ["claude", "cursor", "vscode", "windsurf", "zed"];
-    const requestedClients = installFlags.filter((f) => Boolean(args[f]));
-    if (requestedClients.length > 0) {
-      for (const client of requestedClients) {
-        installMcp(client);
-        process.stderr.write(`Installed MCP config for: ${client}
-`);
-      }
-      return;
-    }
-    const { serveMcp } = await import("./server-QJRWK2RV.js");
+    const { serveMcp } = await import("./server-I62UES5V.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1825,60 +1813,80 @@ var mcp_default = defineCommand17({
     });
   }
 });
-var CLAWOPS_ENTRY = {
-  command: "clawops",
-  args: ["mcp", "serve"],
-  type: "stdio"
-};
-function getConfigPath(client) {
-  const home = os.homedir();
-  const isLinux = process.platform === "linux";
-  switch (client) {
-    case "claude":
-      return isLinux ? path3.join(home, ".config", "Claude", "claude_desktop_config.json") : path3.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-    case "cursor":
-      return path3.join(home, ".cursor", "mcp.json");
-    case "vscode":
-      return isLinux ? path3.join(home, ".config", "Code", "User", "mcp.json") : path3.join(home, "Library", "Application Support", "Code", "User", "mcp.json");
-    case "windsurf":
-      return path3.join(home, ".codeium", "windsurf", "mcp_config.json");
-    case "zed":
-      return path3.join(home, ".config", "zed", "settings.json");
-  }
-}
-function installMcp(client) {
-  const configPath = getConfigPath(client);
-  const dir = path3.dirname(configPath);
-  if (!existsSync2(dir)) {
-    mkdirSync3(dir, { recursive: true });
-  }
-  let config = {};
-  if (existsSync2(configPath)) {
-    try {
-      config = JSON.parse(readFileSync3(configPath, "utf-8"));
-    } catch {
+var installCmd = defineCommand17({
+  meta: {
+    name: "install",
+    description: "Interactively wire clawops into AI editors (Claude Desktop, Claude Code, Cursor, \u2026)"
+  },
+  args: {},
+  async run() {
+    const inquirer = (await import("inquirer")).default;
+    const { MCP_APPS: MCP_APPS2, buildMcpEntry: buildMcpEntry2, writeAppConfigs: writeAppConfigs2 } = await import("./mcp-apps-KY44ED3Y.js");
+    const mcpEntry = buildMcpEntry2();
+    if (!mcpEntry.resolved) {
+      info("clawops is not installed globally \u2014 AI apps may not be able to start the MCP server.");
+      info("Install it first:  npm install -g @clawops/cli");
+      info('The config will still be written now using "clawops" as the command name.\n');
+    }
+    info("Use \u2191\u2193 to move, Space to select/deselect, Enter to confirm.");
+    const choices = MCP_APPS2.map((app) => ({
+      name: app.isInstalled() ? app.name : `${app.name}  (not detected \u2014 config will be written anyway)`,
+      value: app.id,
+      checked: app.isInstalled()
+    }));
+    const { selectedIds } = await inquirer.prompt([{
+      type: "checkbox",
+      name: "selectedIds",
+      message: "Which AI editors should have access to clawops?",
+      choices,
+      pageSize: MCP_APPS2.length + 1
+    }]);
+    const selected = MCP_APPS2.filter((app) => selectedIds.includes(app.id));
+    if (selected.length === 0) {
+      info("No apps selected. Add this to an app's MCP config manually:");
+      process19.stdout.write(JSON.stringify({
+        mcpServers: { clawops: { command: mcpEntry.command, args: mcpEntry.args } }
+      }, null, 2) + "\n\n");
+      info("Config file locations:");
+      for (const app of MCP_APPS2) {
+        info(`  ${app.name.padEnd(18)} ${app.configPath()}`);
+      }
+      return;
+    }
+    const results = writeAppConfigs2(selected, { command: mcpEntry.command, args: mcpEntry.args });
+    for (const r of results) {
+      if (r.ok) {
+        success(`${r.app.name} configured  (${r.configPath})`);
+      } else {
+        failure(`Could not configure ${r.app.name}: ${r.error ?? "unknown error"}`);
+      }
+    }
+    const needsRestart = selected.filter((app) => app.id !== "claude-code");
+    if (needsRestart.length > 0) {
+      info(`Restart ${needsRestart.map((a) => a.name).join(", ")} to load the clawops tool.`);
     }
   }
-  if (client === "zed") {
-    const contextServers = config["context_servers"] ?? {};
-    contextServers["clawops"] = CLAWOPS_ENTRY;
-    config["context_servers"] = contextServers;
-  } else {
-    const mcpServers = config["mcpServers"] ?? {};
-    mcpServers["clawops"] = CLAWOPS_ENTRY;
-    config["mcpServers"] = mcpServers;
+});
+var mcp_default = defineCommand17({
+  meta: {
+    name: "mcp",
+    description: "MCP server operations"
+  },
+  args: {},
+  subCommands: {
+    serve: serveCmd,
+    install: installCmd
   }
-  writeFileSync3(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-}
+});
 
 // src/cli/commands/setup.ts
 import { defineCommand as defineCommand18 } from "citty";
-import process19 from "process";
-import os2 from "os";
+import process20 from "process";
+import os from "os";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync3, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync3 } from "fs";
 import { execSync, spawnSync, spawn as spawn2 } from "child_process";
-import path4 from "path";
+import path3 from "path";
 import { fileURLToPath } from "url";
 var setup_default = defineCommand18({
   meta: {
@@ -1895,16 +1903,16 @@ var setup_default = defineCommand18({
     const catalogs = loadCatalogs(yaml);
     const dryRun = Boolean(args["dry-run"]);
     const ac = new AbortController();
-    process19.on("SIGINT", () => {
+    process20.on("SIGINT", () => {
       ac.abort();
-      process19.exit(130);
+      process20.exit(130);
     });
-    process19.on("SIGTERM", () => {
+    process20.on("SIGTERM", () => {
       ac.abort();
-      process19.exit(143);
+      process20.exit(143);
     });
-    process19.stdout.write("\nWelcome to clawops setup. This wizard will help you deploy OpenClaw\n");
-    process19.stdout.write("and connect it to your AI tools. It takes about 2 minutes.\n\n");
+    process20.stdout.write("\nWelcome to clawops setup. This wizard will help you deploy OpenClaw\n");
+    process20.stdout.write("and connect it to your AI tools. It takes about 2 minutes.\n\n");
     const { deploymentType } = await inquirer.prompt([{
       type: "list",
       name: "deploymentType",
@@ -1916,7 +1924,7 @@ var setup_default = defineCommand18({
     }]);
     let provider;
     let localHost = "";
-    let localUser = os2.userInfo().username;
+    let localUser = os.userInfo().username;
     let localKeyPath = detectSshKey();
     let localPort = 22;
     let localSudoPassword = "";
@@ -1932,12 +1940,12 @@ var setup_default = defineCommand18({
         ]
       }]);
       provider = answer.provider;
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       await ensureCloudAuth(provider, inquirer);
     } else {
       provider = "local";
       info("We'll connect to your server over SSH to install and configure OpenClaw.\n");
-      if (!existsSync3(localKeyPath)) {
+      if (!existsSync2(localKeyPath)) {
         info(`No SSH key found at ${localKeyPath}.`);
         const { genKey } = await inquirer.prompt([{
           type: "confirm",
@@ -1973,7 +1981,7 @@ var setup_default = defineCommand18({
           name: "keyPath",
           message: `SSH private key file: (the key file on your computer used to log in \u2014 e.g. ~/.ssh/id_ed25519)`,
           default: localKeyPath,
-          validate: (v) => existsSync3(v.trim()) || `File not found: ${v.trim()}`
+          validate: (v) => existsSync2(v.trim()) || `File not found: ${v.trim()}`
         }
       ]);
       localHost = localAnswers.host;
@@ -1988,7 +1996,7 @@ var setup_default = defineCommand18({
       }]);
       localSudoPassword = sudoPass;
     }
-    process19.stdout.write("\n");
+    process20.stdout.write("\n");
     const stackAnswers = await inquirer.prompt([
       {
         type: "input",
@@ -2036,7 +2044,7 @@ var setup_default = defineCommand18({
         default: "latest"
       }
     ]);
-    process19.stdout.write("\n");
+    process20.stdout.write("\n");
     info("Choose the AI model that your OpenClaw agent will use.");
     info("You'll need an API key from your chosen provider (except Bedrock and Ollama).\n");
     const { modelProviderId } = await inquirer.prompt([{
@@ -2065,7 +2073,7 @@ var setup_default = defineCommand18({
       secrets.push(entry);
       modelConfig["apiKey"] = `$secret:${secretName}`;
     } else if (modelProvider.credentialSource === "aws-profile") {
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       info(modelProvider.iamNote ?? "Bedrock uses your AWS server's IAM role \u2014 no API key needed.");
       info("Make sure your EC2 instance has the AmazonBedrockFullAccess IAM policy attached.\n");
     } else if (modelProvider.id === "ollama") {
@@ -2082,7 +2090,7 @@ var setup_default = defineCommand18({
       ...selectedModel.modelId ? { modelId: selectedModel.modelId } : { model: selectedModel.id },
       ...modelConfig
     };
-    process19.stdout.write("\n");
+    process20.stdout.write("\n");
     info("Use \u2191\u2193 to move, Space to select/deselect, Enter to confirm.");
     const { selectedIntegrationIds } = await inquirer.prompt([{
       type: "checkbox",
@@ -2098,7 +2106,7 @@ var setup_default = defineCommand18({
     const channelsConfig = {};
     const infraRequired = [];
     for (const integ of catalogs.integrations.filter((i) => selectedIntegrationIds.includes(i.id))) {
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       info(`Setting up ${integ.displayName}:`);
       const channelConfig = {};
       for (const field of integ.fields) {
@@ -2134,11 +2142,11 @@ var setup_default = defineCommand18({
       }
     }
     const gatewayToken = randomBytes(24).toString("hex");
-    const secretsDir = path4.join(os2.homedir(), ".clawops", "secrets");
-    mkdirSync4(secretsDir, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
-    const tokenPath = path4.join(secretsDir, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
-    writeFileSync4(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
+    const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
+    mkdirSync3(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const tokenPath = path3.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
+    writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
       models: builtModelConfig,
       gateway: { auth: { mode: "token", token: gatewayToken } }
@@ -2148,17 +2156,17 @@ var setup_default = defineCommand18({
     }
     let outputPath;
     if (provider === "local") {
-      outputPath = path4.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
-      writeFileSync4(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
-      process19.stdout.write("\n");
+      outputPath = path3.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
+      writeFileSync3(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
+      process20.stdout.write("\n");
       success(`Config file saved to ${outputPath}`);
     } else {
       let sshPublicKey = "";
       try {
-        sshPublicKey = readFileSync4(stackAnswers.sshKeyPath ?? "", "utf-8").trim();
+        sshPublicKey = readFileSync3(stackAnswers.sshKeyPath ?? "", "utf-8").trim();
       } catch {
         failure(`Cannot read SSH public key at ${stackAnswers.sshKeyPath ?? ""}`);
-        process19.exit(1);
+        process20.exit(1);
       }
       const plan = {
         apiVersion: "clawops.dev/v1",
@@ -2187,12 +2195,12 @@ var setup_default = defineCommand18({
           ...stackAnswers.stateBucket ? { stateBucket: stackAnswers.stateBucket } : {}
         }
       };
-      outputPath = path4.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
-      writeFileSync4(outputPath, JSON.stringify(plan, null, 2), "utf-8");
-      process19.stdout.write("\n");
+      outputPath = path3.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
+      writeFileSync3(outputPath, JSON.stringify(plan, null, 2), "utf-8");
+      process20.stdout.write("\n");
       success(`Deployment plan saved to ${outputPath}`);
     }
-    process19.stdout.write("\n");
+    process20.stdout.write("\n");
     const mcpEntry = buildMcpEntry();
     if (!mcpEntry.resolved) {
       info("Note: clawops is not installed globally \u2014 AI apps will not be able to start");
@@ -2215,21 +2223,12 @@ var setup_default = defineCommand18({
     }]);
     const selectedApps = MCP_APPS.filter((app) => selectedAppIds.includes(app.id));
     if (selectedApps.length > 0) {
-      for (const app of selectedApps) {
-        const cfgPath = app.configPath();
-        try {
-          let existing = {};
-          if (existsSync3(cfgPath)) {
-            existing = JSON.parse(readFileSync4(cfgPath, "utf-8"));
-          }
-          const mcpServers = existing["mcpServers"] ?? {};
-          mcpServers["clawops"] = { command: mcpEntry.command, args: mcpEntry.args };
-          existing["mcpServers"] = mcpServers;
-          mkdirSync4(path4.dirname(cfgPath), { recursive: true });
-          writeFileSync4(cfgPath, JSON.stringify(existing, null, 2), "utf-8");
-          success(`${app.name} configured  (${cfgPath})`);
-        } catch (err) {
-          failure(`Could not configure ${app.name}: ${err.message}`);
+      const results = writeAppConfigs(selectedApps, { command: mcpEntry.command, args: mcpEntry.args });
+      for (const r of results) {
+        if (r.ok) {
+          success(`${r.app.name} configured  (${r.configPath})`);
+        } else {
+          failure(`Could not configure ${r.app.name}: ${r.error ?? "unknown error"}`);
           info("Add this to its MCP config manually:");
           printMcpSnippet();
         }
@@ -2247,7 +2246,7 @@ var setup_default = defineCommand18({
       }
     }
     if (infraRequired.length > 0) {
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       info("\u2500\u2500 Action required: webhook registration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
       info("These integrations need a webhook URL set up in their developer portal:");
       for (const integ of infraRequired) {
@@ -2258,7 +2257,7 @@ var setup_default = defineCommand18({
       }
     }
     if (modelProvider.id === "ollama" && selectedModel.pullSuffix !== void 0) {
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       info("\u2500\u2500 Action required: download the Ollama model \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
       info("After deployment, run this command on the server (or locally if Ollama is local):");
       info(`  ollama pull ${selectedModel.id}${selectedModel.pullSuffix}`);
@@ -2288,8 +2287,8 @@ var setup_default = defineCommand18({
         });
       } else {
         const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-        const knownHostsPath = path4.join(getConfigDir2(), "known_hosts");
-        process19.stdout.write("\n");
+        const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
+        process20.stdout.write("\n");
         info("To deploy later, run these two commands:");
         info(`  clawops init --provider local --host ${localHost} --port ${localPort} --user ${localUser} --key ${localKeyPath} --stack ${stackAnswers.stackName}`);
         info(`  clawops up --stack ${stackAnswers.stackName} --config ${outputPath}`);
@@ -2304,18 +2303,18 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-KBF7OPWL.js");
-        const plan = JSON.parse(readFileSync4(outputPath, "utf-8"));
+        const { applyPlan } = await import("./apply-DLNE2JYZ.js");
+        const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
-            onOutput: (line) => process19.stdout.write(line),
+            onOutput: (line) => process20.stdout.write(line),
             signal: ac.signal
           });
           success("Server provisioned and OpenClaw installed.");
           info(`Run: clawops doctor --stack ${stackAnswers.stackName}  to verify everything is healthy`);
         } catch (err) {
           failure(err instanceof Error ? err.message : String(err));
-          process19.exit(1);
+          process20.exit(1);
         }
       } else {
         info(`
@@ -2326,11 +2325,11 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+  const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
   const { connect } = await import("./ssh-IQXNME3D.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const knownHostsPath = path4.join(getConfigDir2(), "known_hosts");
+  const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
   const existing = getConfig2();
   const stackEntry = {
     provider: "local",
@@ -2399,6 +2398,8 @@ async function runLocalDeploy(opts) {
       const merged = deepMerge(remote, resolved);
       await atomicWriteConfig(session, merged, opts.signal);
       await restartGateway(session, opts.signal);
+      const { saveOverlay } = await import("./overlay-store-ADZPD7EU.js");
+      saveOverlay(opts.stackName, opts.overlay, opts.secrets);
     } finally {
       session.close();
     }
@@ -2409,9 +2410,9 @@ async function runLocalDeploy(opts) {
   }
   const { drainPool } = await import("./pool-FBFHATDG.js");
   drainPool();
-  const tokenPath = path4.join(os2.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
+  const tokenPath = path3.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
-  process19.stdout.write("\n");
+  process20.stdout.write("\n");
   success("All done! OpenClaw is running.");
   info(`Open dashboard: ${dashboardUrl}`);
   info(`  (or enter the token manually in the "Gateway Token" field: ${opts.gatewayToken})`);
@@ -2465,7 +2466,7 @@ ${cfg.loginHint}`);
     default: true
   }]);
   if (runNow) {
-    process19.stdout.write("\n");
+    process20.stdout.write("\n");
     const result = spawnSync(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
     if (result.error) {
       failure(`Could not launch ${cliName} \u2014 is it installed? (${result.error.message})`);
@@ -2475,10 +2476,10 @@ ${cfg.loginHint}`);
     }
     try {
       const identity = cfg.check();
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       success(`Authenticated: ${cfg.identity(identity)}`);
     } catch {
-      process19.stdout.write("\n");
+      process20.stdout.write("\n");
       failure(`Still not authenticated \u2014 the sign-in may have been cancelled or failed.`);
       info("Re-run `clawops setup` after signing in, or continue and authenticate before running `clawops up`.\n");
     }
@@ -2492,7 +2493,7 @@ function cliInstallUrl(provider) {
   return "https://learn.microsoft.com/en-us/cli/azure/install-azure-cli";
 }
 async function promptSecret(name, label, envDefault, inquirer) {
-  const secretsDir = path4.join(os2.homedir(), ".clawops", "secrets");
+  const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
   const { secretSource } = await inquirer.prompt([{
     type: "list",
     name: "secretSource",
@@ -2510,12 +2511,12 @@ async function promptSecret(name, label, envDefault, inquirer) {
       message: `Paste your ${label}: (input is hidden)`,
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
-    mkdirSync4(secretsDir, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
-    const secretPath = path4.join(secretsDir, name);
-    writeFileSync4(secretPath, secretValue.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret saved to ${secretPath}  (chmod 600)`);
-    return { name, source: "file", ref: secretPath };
+    mkdirSync3(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const secretPath2 = path3.join(secretsDir2, name);
+    writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret saved to ${secretPath2}  (chmod 600)`);
+    return { name, source: "file", ref: secretPath2 };
   }
   if (secretSource === "env") {
     const { envVar } = await inquirer.prompt([{
@@ -2530,7 +2531,7 @@ async function promptSecret(name, label, envDefault, inquirer) {
     type: "input",
     name: "filePath",
     message: `File path: (full path to the file containing your ${label})`,
-    validate: (v) => existsSync3(v.trim()) || `File not found: ${v.trim()}`
+    validate: (v) => existsSync2(v.trim()) || `File not found: ${v.trim()}`
   }]);
   return { name, source: "file", ref: filePath };
 }
@@ -2663,7 +2664,7 @@ async function pollUntilDockerReady(label) {
   throw new Error("Docker daemon did not become ready within timeout.");
 }
 async function startDockerAndWait(inquirer) {
-  const isLinux = process19.platform === "linux";
+  const isLinux = process20.platform === "linux";
   const { choice } = await inquirer.prompt([{
     type: "list",
     name: "choice",
@@ -2727,12 +2728,12 @@ async function startDockerAndWait(inquirer) {
 var LOCALHOST_ALIASES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
 async function ensureAuthorizedKey(keyPath, host, inquirer) {
   const pubKeyPath = `${keyPath}.pub`;
-  if (!existsSync3(pubKeyPath)) return;
-  const pubKey = readFileSync4(pubKeyPath, "utf-8").trim();
+  if (!existsSync2(pubKeyPath)) return;
+  const pubKey = readFileSync3(pubKeyPath, "utf-8").trim();
   const isLocal = LOCALHOST_ALIASES.has(host.toLowerCase());
-  const authorizedKeysPath = path4.join(os2.homedir(), ".ssh", "authorized_keys");
+  const authorizedKeysPath = path3.join(os.homedir(), ".ssh", "authorized_keys");
   if (isLocal) {
-    const existing = existsSync3(authorizedKeysPath) ? readFileSync4(authorizedKeysPath, "utf-8") : "";
+    const existing = existsSync2(authorizedKeysPath) ? readFileSync3(authorizedKeysPath, "utf-8") : "";
     if (existing.includes(pubKey)) {
       success("SSH public key is already in authorized_keys.");
       return;
@@ -2745,9 +2746,9 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       default: true
     }]);
     if (addKey) {
-      mkdirSync4(path4.join(os2.homedir(), ".ssh"), { recursive: true });
+      mkdirSync3(path3.join(os.homedir(), ".ssh"), { recursive: true });
       const entry = existing.endsWith("\n") || existing === "" ? pubKey + "\n" : "\n" + pubKey + "\n";
-      writeFileSync4(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
+      writeFileSync3(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
       spawnSync("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
       success("Public key added to ~/.ssh/authorized_keys.");
     } else {
@@ -2755,15 +2756,15 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       info(`  ${pubKey}`);
     }
   } else {
-    process19.stdout.write("\n");
+    process20.stdout.write("\n");
     info("Make sure this public key is in ~/.ssh/authorized_keys on your server:");
     info(`  ${pubKey}`);
     info("(If you just created the server, paste the line above into the server's ~/.ssh/authorized_keys file.)\n");
   }
 }
 async function generateSshKey() {
-  const keyPath = path4.join(os2.homedir(), ".ssh", "id_ed25519");
-  mkdirSync4(path4.join(os2.homedir(), ".ssh"), { recursive: true });
+  const keyPath = path3.join(os.homedir(), ".ssh", "id_ed25519");
+  mkdirSync3(path3.join(os.homedir(), ".ssh"), { recursive: true });
   const result = spawnSync("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -2772,77 +2773,30 @@ async function generateSshKey() {
   }
   success(`SSH key pair generated: ${keyPath}`);
   info(`Public key (add this to your server's ~/.ssh/authorized_keys if needed):
-  ${readFileSync4(`${keyPath}.pub`, "utf-8").trim()}`);
+  ${readFileSync3(`${keyPath}.pub`, "utf-8").trim()}`);
   return keyPath;
 }
 function detectSshKey() {
   const candidates = ["id_ed25519", "id_ecdsa", "id_rsa", "id_dsa"];
   for (const name of candidates) {
-    const p = path4.join(os2.homedir(), ".ssh", name);
-    if (existsSync3(p)) return p;
+    const p = path3.join(os.homedir(), ".ssh", name);
+    if (existsSync2(p)) return p;
   }
-  return path4.join(os2.homedir(), ".ssh", "id_ed25519");
+  return path3.join(os.homedir(), ".ssh", "id_ed25519");
 }
-function buildMcpEntry() {
-  try {
-    const bin = execSync("which clawops", {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (bin) return { command: bin, args: ["mcp", "serve", "--read-only"], resolved: true };
-  } catch {
-  }
-  return { command: "clawops", args: ["mcp", "serve", "--read-only"], resolved: false };
-}
-var MCP_APPS = [
-  {
-    id: "claude-desktop",
-    name: "Claude Desktop",
-    configPath: () => process19.platform === "darwin" ? path4.join(os2.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json") : path4.join(os2.homedir(), ".config", "Claude", "claude_desktop_config.json"),
-    isInstalled: () => existsSync3(
-      process19.platform === "darwin" ? path4.join(os2.homedir(), "Library", "Application Support", "Claude") : path4.join(os2.homedir(), ".config", "Claude")
-    )
-  },
-  {
-    id: "claude-code",
-    name: "Claude Code",
-    configPath: () => path4.join(os2.homedir(), ".claude.json"),
-    isInstalled: () => {
-      if (existsSync3(path4.join(os2.homedir(), ".claude.json"))) return true;
-      try {
-        execSync("claude --version", { stdio: "ignore" });
-        return true;
-      } catch {
-        return false;
-      }
-    }
-  },
-  {
-    id: "cursor",
-    name: "Cursor",
-    configPath: () => path4.join(os2.homedir(), ".cursor", "mcp.json"),
-    isInstalled: () => existsSync3(path4.join(os2.homedir(), ".cursor"))
-  },
-  {
-    id: "windsurf",
-    name: "Windsurf",
-    configPath: () => path4.join(os2.homedir(), ".codeium", "windsurf", "mcp_config.json"),
-    isInstalled: () => existsSync3(path4.join(os2.homedir(), ".codeium", "windsurf"))
-  }
-];
 function printMcpSnippet() {
-  process19.stdout.write("\n");
-  process19.stdout.write(JSON.stringify({
+  process20.stdout.write("\n");
+  process20.stdout.write(JSON.stringify({
     mcpServers: {
       clawops: { command: "clawops", args: ["mcp", "serve", "--read-only"] }
     }
   }, null, 2) + "\n\n");
 }
 function loadCatalogs(yaml) {
-  const specDir = path4.join(path4.dirname(fileURLToPath(import.meta.url)), "../../../spec");
+  const specDir = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "../../../spec");
   try {
-    const modelsRaw = yaml.load(readFileSync4(path4.join(specDir, "models.yaml"), "utf-8"));
-    const integrationsRaw = yaml.load(readFileSync4(path4.join(specDir, "integrations.yaml"), "utf-8"));
+    const modelsRaw = yaml.load(readFileSync3(path3.join(specDir, "models.yaml"), "utf-8"));
+    const integrationsRaw = yaml.load(readFileSync3(path3.join(specDir, "integrations.yaml"), "utf-8"));
     return {
       models: modelsRaw.providers,
       integrations: integrationsRaw.integrations
@@ -2887,26 +2841,376 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 
+// src/cli/commands/secret.ts
+import { defineCommand as defineCommand19 } from "citty";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync4, statSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import path4 from "path";
+import os2 from "os";
+import process21 from "process";
+var SECRETS_DIR = path4.join(os2.homedir(), ".clawops", "secrets");
+function secretsDir() {
+  return SECRETS_DIR;
+}
+function secretPath(name) {
+  return path4.join(secretsDir(), name);
+}
+function listSecretNames() {
+  if (!existsSync3(secretsDir())) return [];
+  return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
+}
+var listCmd = defineCommand19({
+  meta: { name: "list", description: "List all stored secrets and their status" },
+  args: {
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  run({ args }) {
+    const names = listSecretNames();
+    if (names.length === 0) {
+      info("No secrets stored in ~/.clawops/secrets/");
+      info("Run `clawops secret set <name>` to add one.");
+      return;
+    }
+    const rows = names.map((name) => {
+      const p = secretPath(name);
+      try {
+        const stat = statSync(p);
+        const content = readFileSync4(p, "utf-8").trim();
+        const status = content.length > 0 ? "ok" : "empty";
+        const modified = stat.mtime.toISOString().slice(0, 10);
+        return { name, status, source: "file", path: p, modified, resolvable: content.length > 0 };
+      } catch {
+        return { name, status: "unreadable", source: "file", path: p, modified: "\u2014", resolvable: false };
+      }
+    });
+    if (args.json) {
+      process21.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+      return;
+    }
+    const tableRows = rows.map((r) => [
+      r.name,
+      r.resolvable ? chalk.green("ok") : chalk.red(r.status),
+      r.modified,
+      r.path
+    ]);
+    process21.stdout.write("\n" + renderTable(["Name", "Status", "Modified", "Path"], tableRows) + "\n\n");
+  }
+});
+var setCmd = defineCommand19({
+  meta: { name: "set", description: "Create or update a secret" },
+  args: {
+    value: { type: "string", description: "Secret value (skips interactive prompt)" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret set <name>");
+      process21.exit(2);
+    }
+    const inquirer = (await import("inquirer")).default;
+    let value;
+    if (args.value) {
+      value = args.value;
+    } else {
+      const { secretValue } = await inquirer.prompt([{
+        type: "password",
+        name: "secretValue",
+        message: `Value for secret "${name}": (input is hidden)`,
+        validate: (v) => typeof v === "string" && v.trim() !== "" || "Value cannot be empty"
+      }]);
+      value = secretValue;
+    }
+    mkdirSync4(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
+    info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
+  }
+});
+var deleteCmd = defineCommand19({
+  meta: { name: "delete", description: "Remove a stored secret" },
+  args: {
+    yes: { type: "boolean", description: "Skip confirmation prompt" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret delete <name>");
+      process21.exit(2);
+    }
+    const p = secretPath(name);
+    if (!existsSync3(p)) {
+      failure(`Secret "${name}" not found at ${p}`);
+      process21.exit(1);
+    }
+    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
+    const referencingStacks = listOverlays().filter((o) => o.secrets.some((s) => s.name === name)).map((o) => o.stackName);
+    if (referencingStacks.length > 0) {
+      warn(`Secret "${name}" is referenced by stack(s): ${referencingStacks.join(", ")}`);
+      warn("Deleting it will leave those stacks with an unresolvable $secret: ref.");
+    }
+    if (!args.yes) {
+      const inquirer = (await import("inquirer")).default;
+      const { confirmed } = await inquirer.prompt([{
+        type: "confirm",
+        name: "confirmed",
+        message: `Delete secret "${name}"?`,
+        default: false
+      }]);
+      if (!confirmed) {
+        info("Aborted.");
+        return;
+      }
+    }
+    unlinkSync(p);
+    success(`Secret "${name}" deleted.`);
+  }
+});
+var rotateCmd = defineCommand19({
+  meta: { name: "rotate", description: "Update a secret and re-apply config to a running stack" },
+  args: {
+    stack: { type: "string", description: "Stack name to re-apply (defaults to config default)" },
+    value: { type: "string", description: "New secret value (skips interactive prompt)" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret rotate <name> [--stack <name>]");
+      process21.exit(2);
+    }
+    const inquirer = (await import("inquirer")).default;
+    let value;
+    if (args.value) {
+      value = args.value;
+    } else {
+      const { secretValue } = await inquirer.prompt([{
+        type: "password",
+        name: "secretValue",
+        message: `New value for secret "${name}": (input is hidden)`,
+        validate: (v) => typeof v === "string" && v.trim() !== "" || "Value cannot be empty"
+      }]);
+      value = secretValue;
+    }
+    mkdirSync4(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" updated.`);
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const cfg = getConfig2();
+    const targetStack = args.stack ?? cfg?.defaults?.stack;
+    if (!targetStack) {
+      warn("No stack specified and no default stack in config \u2014 skipping re-apply.");
+      info("Run `clawops secret rotate <name> --stack <name>` to re-apply to a specific stack.");
+      return;
+    }
+    const { loadOverlay } = await import("./overlay-store-ADZPD7EU.js");
+    const stored = loadOverlay(targetStack);
+    if (!stored) {
+      warn(`No stored overlay for stack "${targetStack}" \u2014 cannot re-apply automatically.`);
+      info("Re-run `clawops setup` or `clawops apply` to propagate the new secret.");
+      return;
+    }
+    info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
+    try {
+      const { buildContext } = await import("./context-M2RMDHX6.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
+      const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
+      const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+      const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
+      const ctx = buildContext({ stack: targetStack });
+      let conn;
+      if (ctx.adapter.name === "local") {
+        if (!ctx.localState) throw new Error(`Stack "${targetStack}" has not been bootstrapped yet.`);
+        conn = localStateToConnectionInfo(ctx.localState);
+      } else {
+        const stack = await ctx.getStack();
+        const outputMap = await stack.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+        const base = extractBaseOutputs(outputs);
+        conn = ctx.adapter.getConnectionInfo({ ...base, privateKeyPath: ctx.config.ssh.keyPath, knownHostsPath: ctx.config.ssh.knownHostsPath });
+      }
+      const { session, release } = await acquireSession(conn);
+      try {
+        const remote = await readRemoteConfig(session);
+        const resolved = resolveSecrets(stored.overlay, stored.secrets);
+        const merged = deepMerge(remote, resolved);
+        await atomicWriteConfig(session, merged);
+        await restartGateway(session);
+      } finally {
+        release();
+        drainPool();
+      }
+      success(`Config overlay re-applied and gateway restarted on "${targetStack}".`);
+    } catch (err) {
+      failure(`Re-apply failed: ${err.message}`);
+      info("The secret file has been updated. Re-run `clawops setup` or `clawops apply` to propagate.");
+    }
+  }
+});
+var auditCmd = defineCommand19({
+  meta: { name: "audit", description: "Report missing secrets and unresolvable $secret: refs" },
+  args: {
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args }) {
+    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
+    const overlays = listOverlays();
+    const issues = [];
+    for (const name of listSecretNames()) {
+      const p = secretPath(name);
+      try {
+        const content = readFileSync4(p, "utf-8").trim();
+        if (content.length === 0) {
+          issues.push({ kind: "empty-secret", secret: name, detail: `File exists but is empty: ${p}` });
+        }
+      } catch {
+        issues.push({ kind: "unreadable-secret", secret: name, detail: `Cannot read: ${p}` });
+      }
+    }
+    for (const overlay of overlays) {
+      for (const s of overlay.secrets) {
+        if (s.source === "file") {
+          const ref = s.ref ?? secretPath(s.name);
+          if (!existsSync3(ref)) {
+            issues.push({ kind: "missing-file", stack: overlay.stackName, secret: s.name, detail: `File not found: ${ref}` });
+          }
+        } else if (s.source === "env") {
+          const envVar = s.ref ?? s.name;
+          if (!process21.env[envVar]) {
+            issues.push({ kind: "missing-env", stack: overlay.stackName, secret: s.name, detail: `Env var not set: ${envVar}` });
+          }
+        } else {
+          issues.push({ kind: "cloud-sm-unresolved", stack: overlay.stackName, secret: s.name, detail: `Source "${s.source}" is not auto-resolved \u2014 set manually` });
+        }
+      }
+    }
+    if (args.json) {
+      process21.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
+      return;
+    }
+    if (issues.length === 0) {
+      success("All secrets are resolvable. No issues found.");
+      return;
+    }
+    failure(`${issues.length} issue${issues.length === 1 ? "" : "s"} found:
+`);
+    for (const issue of issues) {
+      const prefix = issue.stack ? `[${issue.stack}] ` : "";
+      warn(`${prefix}${issue.secret}: ${issue.detail}`);
+    }
+    process21.stdout.write("\n");
+    info("Run `clawops secret set <name>` to update a missing or empty secret.");
+  }
+});
+var secret_default = defineCommand19({
+  meta: {
+    name: "secret",
+    description: "Manage clawops secrets (list | set | delete | rotate | audit)"
+  },
+  args: {},
+  subCommands: {
+    list: listCmd,
+    set: setCmd,
+    delete: deleteCmd,
+    rotate: rotateCmd,
+    audit: auditCmd
+  }
+});
+
+// src/cli/commands/help.ts
+import { defineCommand as defineCommand20 } from "citty";
+var COMMANDS = [
+  ["setup", "Interactive first-run wizard \u2014 configure, deploy, and wire AI apps"],
+  ["init", "Write config and generate SSH key pair (non-interactive)"],
+  ["up", "Provision or update a stack"],
+  ["down", "Destroy a local-provider stack (requires --yes)"],
+  ["destroy", "Destroy a cloud-provider stack with confirmation prompt (requires --yes)"],
+  ["status", "Show stack outputs: IP, gateway URL, region, provisioned time"],
+  ["plan", "Generate a deploy-plan JSON artifact (dry-run safe)"],
+  ["apply", "Apply a previously reviewed plan file"],
+  ["ssh", "Interactive SSH session or run a remote command (--command)"],
+  ["logs", "Stream OpenClaw logs (-f, --tail N, --since 5m)"],
+  ["tunnel", "Port-forward gateway UI to localhost over SSH"],
+  ["config", "Get / set / validate remote OpenClaw config values"],
+  ["agents", "List or restart OpenClaw agents"],
+  ["gateway", "Restart the OpenClaw gateway service"],
+  ["backup", "Create or restore an OpenClaw state backup"],
+  ["stacks", "List named stacks and their state"],
+  ["doctor", "Check Node version, config, SSH key, provider credentials, and Pulumi home"],
+  ["mcp", "MCP server operations (mcp serve | mcp install)"],
+  ["secret", "Manage secrets (secret list | set | delete | rotate | audit)"],
+  ["help", "Show this help message"]
+];
+var GLOBAL_FLAGS = [
+  ["--stack <name>", "Target named stack (overrides config default)"],
+  ["--provider <name>", "Override provider  (aws | gcp | azure | local)"],
+  ["--json", "Emit JSON to stdout"],
+  ["--quiet", "Suppress non-error output"],
+  ["--dry-run", "Preview without applying (mutating commands)"],
+  ["--yes", "Skip interactive confirmations (CI mode)"]
+];
+var help_default = defineCommand20({
+  meta: {
+    name: "help",
+    description: "Show available commands and global flags"
+  },
+  args: {},
+  run() {
+    const bold = chalk.bold;
+    const dim = chalk.dim;
+    const cyan = chalk.cyan;
+    const cmdWidth = Math.max(...COMMANDS.map(([c]) => c.length));
+    const flagWidth = Math.max(...GLOBAL_FLAGS.map(([f]) => f.length));
+    process.stdout.write(`
+${bold("clawops")} \u2014 Deploy and manage self-hosted OpenClaw instances
+
+`);
+    process.stdout.write(`${bold("Usage:")}  clawops <command> [flags]
+
+`);
+    process.stdout.write(`${bold("Commands:")}
+`);
+    for (const [cmd, desc] of COMMANDS) {
+      process.stdout.write(`  ${cyan(cmd.padEnd(cmdWidth))}  ${desc}
+`);
+    }
+    process.stdout.write(`
+${bold("Global flags:")}
+`);
+    for (const [flag, desc] of GLOBAL_FLAGS) {
+      process.stdout.write(`  ${flag.padEnd(flagWidth)}  ${dim(desc)}
+`);
+    }
+    process.stdout.write(`
+${dim("Run `clawops <command> --help` for command-specific flags.")}
+
+`);
+  }
+});
+
 // src/cli/error-handler.ts
-import process20 from "process";
+import process22 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process20.exit(err.exitCode);
+    process22.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process20.env["DEBUG"]) {
-      process20.stderr.write(err.stack ?? "\n");
+    if (process22.env["DEBUG"]) {
+      process22.stderr.write(err.stack ?? "\n");
     }
-    process20.exit(1);
+    process22.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process20.exit(1);
+  process22.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand19({
+var main = defineCommand21({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -2939,7 +3243,9 @@ var main = defineCommand19({
     stacks: stacks_default,
     doctor: doctor_default,
     mcp: mcp_default,
-    setup: setup_default
+    setup: setup_default,
+    secret: secret_default,
+    help: help_default
   }
 });
 try {