@clawops/cli 1.2.1 → 1.3.0

package/README.md

@@ -1,6 +1,6 @@
 # clawops
 
-Deploy OpenClaw once. Operate it from your terminal or Claude Code.
+MCP-native infrastructure ops for OpenClaw — with read-only mode, destructive-action confirmation, and audit logs built in.
 
 **clawops** is a CLI and [MCP](https://modelcontextprotocol.io/) server for deploying and operating
 self-hosted [OpenClaw](https://github.com/openclaw/openclaw) instances. Provision on AWS, GCP,

package/dist/{apply-KBF7OPWL.js → apply-DLNE2JYZ.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-LU63NZD3.js";
+} from "./chunk-JCUZU5BH.js";
 import "./chunk-YTH4L2GN.js";
+import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+import "./chunk-JDN6PLH2.js";
 import "./chunk-UDNZUSKA.js";
+import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
 export {

package/dist/{bootstrap-UYCOEJQX.js → bootstrap-G4UZ2FKH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import {
-  writeLocalState
-} from "./chunk-BRPU7AQC.js";
 import {
   acquireSession
 } from "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
+import {
+  writeLocalState
+} from "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import {
   ProviderError

package/dist/chunk-6ZFIFDBJ.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+
+// src/plan/overlay-store.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from "fs";
+import path from "path";
+import os from "os";
+function overlayPath(stackName) {
+  return path.join(os.homedir(), ".clawops", "overlays", `${stackName}.json`);
+}
+function saveOverlay(stackName, overlay, secrets) {
+  const dir = path.join(os.homedir(), ".clawops", "overlays");
+  mkdirSync(dir, { recursive: true });
+  const data = { stackName, savedAt: (/* @__PURE__ */ new Date()).toISOString(), overlay, secrets };
+  writeFileSync(overlayPath(stackName), JSON.stringify(data, null, 2) + "\n", "utf-8");
+}
+function loadOverlay(stackName) {
+  const p = overlayPath(stackName);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function listOverlays() {
+  const dir = path.join(os.homedir(), ".clawops", "overlays");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
+    try {
+      return [JSON.parse(readFileSync(path.join(dir, f), "utf-8"))];
+    } catch {
+      return [];
+    }
+  });
+}
+
+export {
+  saveOverlay,
+  loadOverlay,
+  listOverlays
+};

package/dist/{chunk-BRPU7AQC.js → chunk-A2I76FTA.js}

@@ -30,8 +30,20 @@ function writeLocalState(stackName, state) {
   writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf-8");
   renameSync(tmp, dest);
 }
+function localStateToConnectionInfo(state) {
+  return {
+    host: state.sshHost,
+    port: state.sshPort,
+    user: state.sshUser,
+    privateKeyPath: state.privateKeyPath,
+    knownHostsPath: state.knownHostsPath
+  };
+}
 
 export {
+  stateDir,
+  statePath,
   readLocalState,
-  writeLocalState
+  writeLocalState,
+  localStateToConnectionInfo
 };

package/dist/{chunk-LU63NZD3.js → chunk-JCUZU5BH.js}

@@ -2,12 +2,15 @@
 import {
   validatePlan
 } from "./chunk-YTH4L2GN.js";
+import {
+  saveOverlay
+} from "./chunk-6ZFIFDBJ.js";
 import {
   resolveSecrets
 } from "./chunk-BOPSG2LI.js";
 import {
   buildContext
-} from "./chunk-ACYJBSLJ.js";
+} from "./chunk-JDN6PLH2.js";
 import {
   atomicWriteConfig,
   deepMerge,
@@ -106,6 +109,7 @@ async function applyConfigOverlay(plan, outputs, ctx, signal) {
     });
     await atomicWriteConfig(session, merged, signal);
     await restartGateway(session, signal);
+    saveOverlay(plan.spec.stackName, configOverlay, plan.spec.secrets ?? []);
   } finally {
     session.close();
   }

package/dist/{chunk-ACYJBSLJ.js → chunk-JDN6PLH2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readLocalState
-} from "./chunk-BRPU7AQC.js";
+} from "./chunk-A2I76FTA.js";
 import {
   getConfigDir,
   requireConfig

package/dist/{chunk-QJ6ERXHN.js → chunk-LVIIYY27.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-ACYJBSLJ.js";
+} from "./chunk-JDN6PLH2.js";
 import {
   acquireSession,
   drainPool

package/dist/{chunk-SSB6SGPQ.js → chunk-ZDPBBYYV.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YTH4L2GN.js";
 import {
   buildContext
-} from "./chunk-ACYJBSLJ.js";
+} from "./chunk-JDN6PLH2.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-SE3M4NJA.js");
+  const { version } = await import("./package-AFUTH62F.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/cli.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import {
-  validateOpenclawConfig
-} from "./chunk-QJ6ERXHN.js";
 import {
   MCP_APPS,
   buildMcpEntry,
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
-import "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+import {
+  validateOpenclawConfig
+} from "./chunk-LVIIYY27.js";
+import "./chunk-JDN6PLH2.js";
 import "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
 import "./chunk-UDNZUSKA.js";
+import "./chunk-A2I76FTA.js";
 import {
   getConfig,
   getConfigDir,
@@ -24,7 +24,7 @@ import {
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand20, runMain } from "citty";
+import { defineCommand as defineCommand21, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -217,7 +217,7 @@ var up_default = defineCommand2({
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -228,7 +228,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+      const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -363,7 +363,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -427,7 +427,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -499,8 +499,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
-    const { generatePlan } = await import("./generate-PZPLG3ZM.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
+    const { generatePlan } = await import("./generate-U7PJ5LRG.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -590,7 +590,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-KBF7OPWL.js");
+    const { applyPlan } = await import("./apply-DLNE2JYZ.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -706,7 +706,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -773,7 +773,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
     let conn;
@@ -860,7 +860,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
@@ -928,7 +928,7 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
@@ -1045,7 +1045,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, key, value] = args._ ?? [];
@@ -1171,7 +1171,7 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, name] = args._ ?? [];
@@ -1275,7 +1275,7 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, versionArg] = args._ ?? [];
@@ -1388,7 +1388,7 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-M2RMDHX6.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -1694,7 +1694,7 @@ var doctor_default = defineCommand16({
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-VUAYRAJY.js");
+          const { buildContext } = await import("./context-M2RMDHX6.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
           const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
           const ctx = buildContext({ stack: args.stack });
@@ -1802,7 +1802,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-4DNHLGEG.js");
+    const { serveMcp } = await import("./server-I62UES5V.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1876,12 +1876,6 @@ var mcp_default = defineCommand17({
   subCommands: {
     serve: serveCmd,
     install: installCmd
-  },
-  run() {
-    process19.stdout.write("Usage: clawops mcp <serve | install>\n\n");
-    process19.stdout.write("  serve    Start the MCP server (stdio or HTTP)\n");
-    process19.stdout.write("  install  Wire clawops into AI editors interactively\n\n");
-    process19.stdout.write("Run `clawops mcp <command> --help` for flags.\n");
   }
 });
 
@@ -2148,10 +2142,10 @@ var setup_default = defineCommand18({
       }
     }
     const gatewayToken = randomBytes(24).toString("hex");
-    const secretsDir = path3.join(os.homedir(), ".clawops", "secrets");
-    mkdirSync3(secretsDir, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
-    const tokenPath = path3.join(secretsDir, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
+    const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
+    mkdirSync3(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const tokenPath = path3.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
     writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
       models: builtModelConfig,
@@ -2309,7 +2303,7 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-KBF7OPWL.js");
+        const { applyPlan } = await import("./apply-DLNE2JYZ.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2331,7 +2325,7 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+  const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
   const { connect } = await import("./ssh-IQXNME3D.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
@@ -2404,6 +2398,8 @@ async function runLocalDeploy(opts) {
       const merged = deepMerge(remote, resolved);
       await atomicWriteConfig(session, merged, opts.signal);
       await restartGateway(session, opts.signal);
+      const { saveOverlay } = await import("./overlay-store-ADZPD7EU.js");
+      saveOverlay(opts.stackName, opts.overlay, opts.secrets);
     } finally {
       session.close();
     }
@@ -2497,7 +2493,7 @@ function cliInstallUrl(provider) {
   return "https://learn.microsoft.com/en-us/cli/azure/install-azure-cli";
 }
 async function promptSecret(name, label, envDefault, inquirer) {
-  const secretsDir = path3.join(os.homedir(), ".clawops", "secrets");
+  const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
   const { secretSource } = await inquirer.prompt([{
     type: "list",
     name: "secretSource",
@@ -2515,12 +2511,12 @@ async function promptSecret(name, label, envDefault, inquirer) {
       message: `Paste your ${label}: (input is hidden)`,
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
-    mkdirSync3(secretsDir, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
-    const secretPath = path3.join(secretsDir, name);
-    writeFileSync3(secretPath, secretValue.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret saved to ${secretPath}  (chmod 600)`);
-    return { name, source: "file", ref: secretPath };
+    mkdirSync3(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const secretPath2 = path3.join(secretsDir2, name);
+    writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret saved to ${secretPath2}  (chmod 600)`);
+    return { name, source: "file", ref: secretPath2 };
   }
   if (secretSource === "env") {
     const { envVar } = await inquirer.prompt([{
@@ -2845,8 +2841,287 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 
-// src/cli/commands/help.ts
+// src/cli/commands/secret.ts
 import { defineCommand as defineCommand19 } from "citty";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync4, statSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import path4 from "path";
+import os2 from "os";
+import process21 from "process";
+var SECRETS_DIR = path4.join(os2.homedir(), ".clawops", "secrets");
+function secretsDir() {
+  return SECRETS_DIR;
+}
+function secretPath(name) {
+  return path4.join(secretsDir(), name);
+}
+function listSecretNames() {
+  if (!existsSync3(secretsDir())) return [];
+  return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
+}
+var listCmd = defineCommand19({
+  meta: { name: "list", description: "List all stored secrets and their status" },
+  args: {
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  run({ args }) {
+    const names = listSecretNames();
+    if (names.length === 0) {
+      info("No secrets stored in ~/.clawops/secrets/");
+      info("Run `clawops secret set <name>` to add one.");
+      return;
+    }
+    const rows = names.map((name) => {
+      const p = secretPath(name);
+      try {
+        const stat = statSync(p);
+        const content = readFileSync4(p, "utf-8").trim();
+        const status = content.length > 0 ? "ok" : "empty";
+        const modified = stat.mtime.toISOString().slice(0, 10);
+        return { name, status, source: "file", path: p, modified, resolvable: content.length > 0 };
+      } catch {
+        return { name, status: "unreadable", source: "file", path: p, modified: "\u2014", resolvable: false };
+      }
+    });
+    if (args.json) {
+      process21.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+      return;
+    }
+    const tableRows = rows.map((r) => [
+      r.name,
+      r.resolvable ? chalk.green("ok") : chalk.red(r.status),
+      r.modified,
+      r.path
+    ]);
+    process21.stdout.write("\n" + renderTable(["Name", "Status", "Modified", "Path"], tableRows) + "\n\n");
+  }
+});
+var setCmd = defineCommand19({
+  meta: { name: "set", description: "Create or update a secret" },
+  args: {
+    value: { type: "string", description: "Secret value (skips interactive prompt)" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret set <name>");
+      process21.exit(2);
+    }
+    const inquirer = (await import("inquirer")).default;
+    let value;
+    if (args.value) {
+      value = args.value;
+    } else {
+      const { secretValue } = await inquirer.prompt([{
+        type: "password",
+        name: "secretValue",
+        message: `Value for secret "${name}": (input is hidden)`,
+        validate: (v) => typeof v === "string" && v.trim() !== "" || "Value cannot be empty"
+      }]);
+      value = secretValue;
+    }
+    mkdirSync4(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
+    info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
+  }
+});
+var deleteCmd = defineCommand19({
+  meta: { name: "delete", description: "Remove a stored secret" },
+  args: {
+    yes: { type: "boolean", description: "Skip confirmation prompt" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret delete <name>");
+      process21.exit(2);
+    }
+    const p = secretPath(name);
+    if (!existsSync3(p)) {
+      failure(`Secret "${name}" not found at ${p}`);
+      process21.exit(1);
+    }
+    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
+    const referencingStacks = listOverlays().filter((o) => o.secrets.some((s) => s.name === name)).map((o) => o.stackName);
+    if (referencingStacks.length > 0) {
+      warn(`Secret "${name}" is referenced by stack(s): ${referencingStacks.join(", ")}`);
+      warn("Deleting it will leave those stacks with an unresolvable $secret: ref.");
+    }
+    if (!args.yes) {
+      const inquirer = (await import("inquirer")).default;
+      const { confirmed } = await inquirer.prompt([{
+        type: "confirm",
+        name: "confirmed",
+        message: `Delete secret "${name}"?`,
+        default: false
+      }]);
+      if (!confirmed) {
+        info("Aborted.");
+        return;
+      }
+    }
+    unlinkSync(p);
+    success(`Secret "${name}" deleted.`);
+  }
+});
+var rotateCmd = defineCommand19({
+  meta: { name: "rotate", description: "Update a secret and re-apply config to a running stack" },
+  args: {
+    stack: { type: "string", description: "Stack name to re-apply (defaults to config default)" },
+    value: { type: "string", description: "New secret value (skips interactive prompt)" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret rotate <name> [--stack <name>]");
+      process21.exit(2);
+    }
+    const inquirer = (await import("inquirer")).default;
+    let value;
+    if (args.value) {
+      value = args.value;
+    } else {
+      const { secretValue } = await inquirer.prompt([{
+        type: "password",
+        name: "secretValue",
+        message: `New value for secret "${name}": (input is hidden)`,
+        validate: (v) => typeof v === "string" && v.trim() !== "" || "Value cannot be empty"
+      }]);
+      value = secretValue;
+    }
+    mkdirSync4(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" updated.`);
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const cfg = getConfig2();
+    const targetStack = args.stack ?? cfg?.defaults?.stack;
+    if (!targetStack) {
+      warn("No stack specified and no default stack in config \u2014 skipping re-apply.");
+      info("Run `clawops secret rotate <name> --stack <name>` to re-apply to a specific stack.");
+      return;
+    }
+    const { loadOverlay } = await import("./overlay-store-ADZPD7EU.js");
+    const stored = loadOverlay(targetStack);
+    if (!stored) {
+      warn(`No stored overlay for stack "${targetStack}" \u2014 cannot re-apply automatically.`);
+      info("Re-run `clawops setup` or `clawops apply` to propagate the new secret.");
+      return;
+    }
+    info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
+    try {
+      const { buildContext } = await import("./context-M2RMDHX6.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
+      const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
+      const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+      const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
+      const ctx = buildContext({ stack: targetStack });
+      let conn;
+      if (ctx.adapter.name === "local") {
+        if (!ctx.localState) throw new Error(`Stack "${targetStack}" has not been bootstrapped yet.`);
+        conn = localStateToConnectionInfo(ctx.localState);
+      } else {
+        const stack = await ctx.getStack();
+        const outputMap = await stack.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+        const base = extractBaseOutputs(outputs);
+        conn = ctx.adapter.getConnectionInfo({ ...base, privateKeyPath: ctx.config.ssh.keyPath, knownHostsPath: ctx.config.ssh.knownHostsPath });
+      }
+      const { session, release } = await acquireSession(conn);
+      try {
+        const remote = await readRemoteConfig(session);
+        const resolved = resolveSecrets(stored.overlay, stored.secrets);
+        const merged = deepMerge(remote, resolved);
+        await atomicWriteConfig(session, merged);
+        await restartGateway(session);
+      } finally {
+        release();
+        drainPool();
+      }
+      success(`Config overlay re-applied and gateway restarted on "${targetStack}".`);
+    } catch (err) {
+      failure(`Re-apply failed: ${err.message}`);
+      info("The secret file has been updated. Re-run `clawops setup` or `clawops apply` to propagate.");
+    }
+  }
+});
+var auditCmd = defineCommand19({
+  meta: { name: "audit", description: "Report missing secrets and unresolvable $secret: refs" },
+  args: {
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args }) {
+    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
+    const overlays = listOverlays();
+    const issues = [];
+    for (const name of listSecretNames()) {
+      const p = secretPath(name);
+      try {
+        const content = readFileSync4(p, "utf-8").trim();
+        if (content.length === 0) {
+          issues.push({ kind: "empty-secret", secret: name, detail: `File exists but is empty: ${p}` });
+        }
+      } catch {
+        issues.push({ kind: "unreadable-secret", secret: name, detail: `Cannot read: ${p}` });
+      }
+    }
+    for (const overlay of overlays) {
+      for (const s of overlay.secrets) {
+        if (s.source === "file") {
+          const ref = s.ref ?? secretPath(s.name);
+          if (!existsSync3(ref)) {
+            issues.push({ kind: "missing-file", stack: overlay.stackName, secret: s.name, detail: `File not found: ${ref}` });
+          }
+        } else if (s.source === "env") {
+          const envVar = s.ref ?? s.name;
+          if (!process21.env[envVar]) {
+            issues.push({ kind: "missing-env", stack: overlay.stackName, secret: s.name, detail: `Env var not set: ${envVar}` });
+          }
+        } else {
+          issues.push({ kind: "cloud-sm-unresolved", stack: overlay.stackName, secret: s.name, detail: `Source "${s.source}" is not auto-resolved \u2014 set manually` });
+        }
+      }
+    }
+    if (args.json) {
+      process21.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
+      return;
+    }
+    if (issues.length === 0) {
+      success("All secrets are resolvable. No issues found.");
+      return;
+    }
+    failure(`${issues.length} issue${issues.length === 1 ? "" : "s"} found:
+`);
+    for (const issue of issues) {
+      const prefix = issue.stack ? `[${issue.stack}] ` : "";
+      warn(`${prefix}${issue.secret}: ${issue.detail}`);
+    }
+    process21.stdout.write("\n");
+    info("Run `clawops secret set <name>` to update a missing or empty secret.");
+  }
+});
+var secret_default = defineCommand19({
+  meta: {
+    name: "secret",
+    description: "Manage clawops secrets (list | set | delete | rotate | audit)"
+  },
+  args: {},
+  subCommands: {
+    list: listCmd,
+    set: setCmd,
+    delete: deleteCmd,
+    rotate: rotateCmd,
+    audit: auditCmd
+  }
+});
+
+// src/cli/commands/help.ts
+import { defineCommand as defineCommand20 } from "citty";
 var COMMANDS = [
   ["setup", "Interactive first-run wizard \u2014 configure, deploy, and wire AI apps"],
   ["init", "Write config and generate SSH key pair (non-interactive)"],
@@ -2866,6 +3141,7 @@ var COMMANDS = [
   ["stacks", "List named stacks and their state"],
   ["doctor", "Check Node version, config, SSH key, provider credentials, and Pulumi home"],
   ["mcp", "MCP server operations (mcp serve | mcp install)"],
+  ["secret", "Manage secrets (secret list | set | delete | rotate | audit)"],
   ["help", "Show this help message"]
 ];
 var GLOBAL_FLAGS = [
@@ -2876,7 +3152,7 @@ var GLOBAL_FLAGS = [
   ["--dry-run", "Preview without applying (mutating commands)"],
   ["--yes", "Skip interactive confirmations (CI mode)"]
 ];
-var help_default = defineCommand19({
+var help_default = defineCommand20({
   meta: {
     name: "help",
     description: "Show available commands and global flags"
@@ -2916,25 +3192,25 @@ ${dim("Run `clawops <command> --help` for command-specific flags.")}
 });
 
 // src/cli/error-handler.ts
-import process21 from "process";
+import process22 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process21.exit(err.exitCode);
+    process22.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process21.env["DEBUG"]) {
-      process21.stderr.write(err.stack ?? "\n");
+    if (process22.env["DEBUG"]) {
+      process22.stderr.write(err.stack ?? "\n");
     }
-    process21.exit(1);
+    process22.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process21.exit(1);
+  process22.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand20({
+var main = defineCommand21({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -2968,6 +3244,7 @@ var main = defineCommand20({
     doctor: doctor_default,
     mcp: mcp_default,
     setup: setup_default,
+    secret: secret_default,
     help: help_default
   }
 });

package/dist/{context-VUAYRAJY.js → context-M2RMDHX6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+} from "./chunk-JDN6PLH2.js";
+import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
 export {

package/dist/{generate-PZPLG3ZM.js → generate-U7PJ5LRG.js}

@@ -2,10 +2,10 @@
 import {
   generatePlan,
   planId
-} from "./chunk-SSB6SGPQ.js";
+} from "./chunk-ZDPBBYYV.js";
 import "./chunk-YTH4L2GN.js";
-import "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+import "./chunk-JDN6PLH2.js";
+import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
 export {

package/dist/overlay-store-ADZPD7EU.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  listOverlays,
+  loadOverlay,
+  saveOverlay
+} from "./chunk-6ZFIFDBJ.js";
+export {
+  listOverlays,
+  loadOverlay,
+  saveOverlay
+};

package/dist/{package-SE3M4NJA.js → package-AFUTH62F.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.2.1";
+var version = "1.3.0";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {

package/dist/{server-4DNHLGEG.js → server-I62UES5V.js}

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
+import {
+  extractBaseOutputs
+} from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-SSB6SGPQ.js";
+} from "./chunk-ZDPBBYYV.js";
 import {
   applyPlan
-} from "./chunk-LU63NZD3.js";
+} from "./chunk-JCUZU5BH.js";
 import {
   validatePlan
 } from "./chunk-YTH4L2GN.js";
+import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import {
-  extractBaseOutputs
-} from "./chunk-3QJBNAHW.js";
 import {
   errText,
   handleConfigGet,
@@ -20,17 +21,17 @@ import {
   handleConfigValidate,
   okText,
   resolveConn
-} from "./chunk-QJ6ERXHN.js";
+} from "./chunk-LVIIYY27.js";
 import {
   buildContext
-} from "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+} from "./chunk-JDN6PLH2.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
 import "./chunk-UDNZUSKA.js";
+import "./chunk-A2I76FTA.js";
 import {
   getConfig,
   getConfigDir
@@ -613,7 +614,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+    const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -1231,7 +1232,7 @@ If none of the above resolves the issue:
 
 // src/mcp/server.ts
 async function serveMcp(opts) {
-  const { version } = await import("./package-SE3M4NJA.js");
+  const { version } = await import("./package-AFUTH62F.js");
   const server = new McpServer({ name: "clawops", version });
   registerTools(server, opts);
   registerResources(server);

package/dist/state-PRBIIN7I.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import {
+  localStateToConnectionInfo,
+  readLocalState,
+  stateDir,
+  statePath,
+  writeLocalState
+} from "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  localStateToConnectionInfo,
+  readLocalState,
+  stateDir,
+  statePath,
+  writeLocalState
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {