@clawops/cli 1.2.1 → 1.4.0

package/dist/cli.js

@@ -1,17 +1,24 @@
 #!/usr/bin/env node
-import {
-  validateOpenclawConfig
-} from "./chunk-QJ6ERXHN.js";
 import {
   MCP_APPS,
   buildMcpEntry,
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
-import "./chunk-ACYJBSLJ.js";
-import "./chunk-BRPU7AQC.js";
+import {
+  chalk,
+  failure,
+  info,
+  monitor_default,
+  spinner,
+  success,
+  validateOpenclawConfig,
+  warn
+} from "./chunk-JYQZJMD3.js";
+import "./chunk-T5EX55GP.js";
 import "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
-import "./chunk-UDNZUSKA.js";
+import "./chunk-ZFNPM2WG.js";
+import "./chunk-A2I76FTA.js";
 import {
   getConfig,
   getConfigDir,
@@ -24,7 +31,7 @@ import {
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand20, runMain } from "citty";
+import { defineCommand as defineCommand21, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -32,27 +39,6 @@ import { generateKeyPairSync } from "crypto";
 import { writeFileSync, mkdirSync, existsSync } from "fs";
 import path from "path";
 import process2 from "process";
-
-// src/output/human.ts
-import chalk from "chalk";
-import ora from "ora";
-function success(msg) {
-  console.log(chalk.green("\u2713") + "  " + msg);
-}
-function failure(msg) {
-  console.error(chalk.red("\u2717") + "  " + msg);
-}
-function warn(msg) {
-  console.warn(chalk.yellow("\u26A0") + "  " + msg);
-}
-function info(msg) {
-  console.log(chalk.blue("\u2139") + "  " + msg);
-}
-function spinner(text) {
-  return ora(text).start();
-}
-
-// src/cli/commands/init.ts
 var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
 var PROVIDER_DEFAULTS = {
   gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
@@ -217,7 +203,7 @@ var up_default = defineCommand2({
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -228,7 +214,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+      const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -323,7 +309,7 @@ var up_default = defineCommand2({
 async function applyLocalConfigOverlay(opts) {
   const { connect } = await import("./ssh-IQXNME3D.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -363,7 +349,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -427,7 +413,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -499,8 +485,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
-    const { generatePlan } = await import("./generate-PZPLG3ZM.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { generatePlan } = await import("./generate-Z7DBMANX.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -590,7 +576,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-KBF7OPWL.js");
+    const { applyPlan } = await import("./apply-5RREMN3L.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -706,7 +692,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -773,7 +759,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
     let conn;
@@ -860,7 +846,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
@@ -928,7 +914,7 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const ctx = buildContext(args);
@@ -1045,7 +1031,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, key, value] = args._ ?? [];
@@ -1171,7 +1157,7 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, name] = args._ ?? [];
@@ -1275,7 +1261,7 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const [action, versionArg] = args._ ?? [];
@@ -1388,7 +1374,7 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-VUAYRAJY.js");
+    const { buildContext } = await import("./context-PSGEX2D7.js");
     const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -1500,7 +1486,7 @@ var stacks_default = defineCommand15({
   args: {
     json: { type: "boolean", description: "Emit JSON (for list)" },
     yes: { type: "boolean", description: "Skip confirmation prompt on delete" },
-    force: { type: "boolean", description: "Allow deleting the default stack" }
+    force: { type: "boolean", description: "Skip safety checks (allow deleting default or still-deployed stacks)" }
   },
   async run({ args }) {
     const [action, name] = args._ ?? [];
@@ -1558,6 +1544,31 @@ var stacks_default = defineCommand15({
         `"${name}" is the default stack. Use --force to delete it (clawops will switch the default to another stack).`
       );
     }
+    let isDeployed = false;
+    if (!args.force) {
+      try {
+        const { buildContext } = await import("./context-PSGEX2D7.js");
+        const ctx = buildContext({ stack: name });
+        if (ctx.adapter.name === "local") {
+          isDeployed = !!ctx.localState;
+        } else {
+          const stack = await ctx.getStack();
+          const outputMap = await stack.outputs();
+          const outputs = Object.fromEntries(
+            Object.entries(outputMap).map(([k, v]) => [k, v.value])
+          );
+          isDeployed = !!outputs["publicIp"];
+        }
+      } catch {
+        warn(`Could not verify deployment status for "${name}" \u2014 proceeding anyway.`);
+      }
+    }
+    if (isDeployed) {
+      failure(
+        `Stack "${name}" is still deployed. Run \`clawops down --stack ${name}\` first to destroy cloud resources, or pass --force to remove from registry only.`
+      );
+      process17.exit(1);
+    }
     warn(
       `This removes "${name}" from clawops config only. Cloud resources are NOT destroyed. Run \`clawops destroy --stack ` + name + "` first if you want to remove cloud resources."
     );
@@ -1657,9 +1668,9 @@ var doctor_default = defineCommand16({
       info("Credential checks skipped \u2014 no config");
     } else {
       const { getProvider } = await import("./providers-2OABPW2E.js");
-      await import("./aws-KQBWY43W.js");
-      await import("./gcp-SKURG3L6.js");
-      await import("./azure-4EJFVJZL.js");
+      await import("./aws-FRE2JVAZ.js");
+      await import("./gcp-BXDTC6EK.js");
+      await import("./azure-PVC3AQVC.js");
       await import("./local-DXBEVZ5C.js");
       const checkedProviders = /* @__PURE__ */ new Set();
       for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
@@ -1694,7 +1705,7 @@ var doctor_default = defineCommand16({
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-VUAYRAJY.js");
+          const { buildContext } = await import("./context-PSGEX2D7.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
           const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
           const ctx = buildContext({ stack: args.stack });
@@ -1802,7 +1813,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-4DNHLGEG.js");
+    const { serveMcp } = await import("./server-IWLZJ4EU.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1876,12 +1887,6 @@ var mcp_default = defineCommand17({
   subCommands: {
     serve: serveCmd,
     install: installCmd
-  },
-  run() {
-    process19.stdout.write("Usage: clawops mcp <serve | install>\n\n");
-    process19.stdout.write("  serve    Start the MCP server (stdio or HTTP)\n");
-    process19.stdout.write("  install  Wire clawops into AI editors interactively\n\n");
-    process19.stdout.write("Run `clawops mcp <command> --help` for flags.\n");
   }
 });
 
@@ -2148,10 +2153,10 @@ var setup_default = defineCommand18({
       }
     }
     const gatewayToken = randomBytes(24).toString("hex");
-    const secretsDir = path3.join(os.homedir(), ".clawops", "secrets");
-    mkdirSync3(secretsDir, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
-    const tokenPath = path3.join(secretsDir, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
+    const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
+    mkdirSync3(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const tokenPath = path3.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
     writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
       models: builtModelConfig,
@@ -2309,7 +2314,7 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-KBF7OPWL.js");
+        const { applyPlan } = await import("./apply-5RREMN3L.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2331,9 +2336,9 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-UYCOEJQX.js");
+  const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
   const { connect } = await import("./ssh-IQXNME3D.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-JQ77SRC2.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
   const existing = getConfig2();
@@ -2404,6 +2409,8 @@ async function runLocalDeploy(opts) {
       const merged = deepMerge(remote, resolved);
       await atomicWriteConfig(session, merged, opts.signal);
       await restartGateway(session, opts.signal);
+      const { saveOverlay } = await import("./overlay-store-ADZPD7EU.js");
+      saveOverlay(opts.stackName, opts.overlay, opts.secrets);
     } finally {
       session.close();
     }
@@ -2497,7 +2504,7 @@ function cliInstallUrl(provider) {
   return "https://learn.microsoft.com/en-us/cli/azure/install-azure-cli";
 }
 async function promptSecret(name, label, envDefault, inquirer) {
-  const secretsDir = path3.join(os.homedir(), ".clawops", "secrets");
+  const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
   const { secretSource } = await inquirer.prompt([{
     type: "list",
     name: "secretSource",
@@ -2515,12 +2522,12 @@ async function promptSecret(name, label, envDefault, inquirer) {
       message: `Paste your ${label}: (input is hidden)`,
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
-    mkdirSync3(secretsDir, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir], { stdio: "ignore" });
-    const secretPath = path3.join(secretsDir, name);
-    writeFileSync3(secretPath, secretValue.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret saved to ${secretPath}  (chmod 600)`);
-    return { name, source: "file", ref: secretPath };
+    mkdirSync3(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const secretPath2 = path3.join(secretsDir2, name);
+    writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret saved to ${secretPath2}  (chmod 600)`);
+    return { name, source: "file", ref: secretPath2 };
   }
   if (secretSource === "env") {
     const { envVar } = await inquirer.prompt([{
@@ -2845,8 +2852,287 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 
-// src/cli/commands/help.ts
+// src/cli/commands/secret.ts
 import { defineCommand as defineCommand19 } from "citty";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync4, statSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import path4 from "path";
+import os2 from "os";
+import process21 from "process";
+var SECRETS_DIR = path4.join(os2.homedir(), ".clawops", "secrets");
+function secretsDir() {
+  return SECRETS_DIR;
+}
+function secretPath(name) {
+  return path4.join(secretsDir(), name);
+}
+function listSecretNames() {
+  if (!existsSync3(secretsDir())) return [];
+  return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
+}
+var listCmd = defineCommand19({
+  meta: { name: "list", description: "List all stored secrets and their status" },
+  args: {
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  run({ args }) {
+    const names = listSecretNames();
+    if (names.length === 0) {
+      info("No secrets stored in ~/.clawops/secrets/");
+      info("Run `clawops secret set <name>` to add one.");
+      return;
+    }
+    const rows = names.map((name) => {
+      const p = secretPath(name);
+      try {
+        const stat = statSync(p);
+        const content = readFileSync4(p, "utf-8").trim();
+        const status = content.length > 0 ? "ok" : "empty";
+        const modified = stat.mtime.toISOString().slice(0, 10);
+        return { name, status, source: "file", path: p, modified, resolvable: content.length > 0 };
+      } catch {
+        return { name, status: "unreadable", source: "file", path: p, modified: "\u2014", resolvable: false };
+      }
+    });
+    if (args.json) {
+      process21.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+      return;
+    }
+    const tableRows = rows.map((r) => [
+      r.name,
+      r.resolvable ? chalk.green("ok") : chalk.red(r.status),
+      r.modified,
+      r.path
+    ]);
+    process21.stdout.write("\n" + renderTable(["Name", "Status", "Modified", "Path"], tableRows) + "\n\n");
+  }
+});
+var setCmd = defineCommand19({
+  meta: { name: "set", description: "Create or update a secret" },
+  args: {
+    value: { type: "string", description: "Secret value (skips interactive prompt)" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret set <name>");
+      process21.exit(2);
+    }
+    const inquirer = (await import("inquirer")).default;
+    let value;
+    if (args.value) {
+      value = args.value;
+    } else {
+      const { secretValue } = await inquirer.prompt([{
+        type: "password",
+        name: "secretValue",
+        message: `Value for secret "${name}": (input is hidden)`,
+        validate: (v) => typeof v === "string" && v.trim() !== "" || "Value cannot be empty"
+      }]);
+      value = secretValue;
+    }
+    mkdirSync4(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
+    info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
+  }
+});
+var deleteCmd = defineCommand19({
+  meta: { name: "delete", description: "Remove a stored secret" },
+  args: {
+    yes: { type: "boolean", description: "Skip confirmation prompt" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret delete <name>");
+      process21.exit(2);
+    }
+    const p = secretPath(name);
+    if (!existsSync3(p)) {
+      failure(`Secret "${name}" not found at ${p}`);
+      process21.exit(1);
+    }
+    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
+    const referencingStacks = listOverlays().filter((o) => o.secrets.some((s) => s.name === name)).map((o) => o.stackName);
+    if (referencingStacks.length > 0) {
+      warn(`Secret "${name}" is referenced by stack(s): ${referencingStacks.join(", ")}`);
+      warn("Deleting it will leave those stacks with an unresolvable $secret: ref.");
+    }
+    if (!args.yes) {
+      const inquirer = (await import("inquirer")).default;
+      const { confirmed } = await inquirer.prompt([{
+        type: "confirm",
+        name: "confirmed",
+        message: `Delete secret "${name}"?`,
+        default: false
+      }]);
+      if (!confirmed) {
+        info("Aborted.");
+        return;
+      }
+    }
+    unlinkSync(p);
+    success(`Secret "${name}" deleted.`);
+  }
+});
+var rotateCmd = defineCommand19({
+  meta: { name: "rotate", description: "Update a secret and re-apply config to a running stack" },
+  args: {
+    stack: { type: "string", description: "Stack name to re-apply (defaults to config default)" },
+    value: { type: "string", description: "New secret value (skips interactive prompt)" }
+  },
+  async run({ args }) {
+    const [name] = args._ ?? [];
+    if (!name) {
+      failure("Usage: clawops secret rotate <name> [--stack <name>]");
+      process21.exit(2);
+    }
+    const inquirer = (await import("inquirer")).default;
+    let value;
+    if (args.value) {
+      value = args.value;
+    } else {
+      const { secretValue } = await inquirer.prompt([{
+        type: "password",
+        name: "secretValue",
+        message: `New value for secret "${name}": (input is hidden)`,
+        validate: (v) => typeof v === "string" && v.trim() !== "" || "Value cannot be empty"
+      }]);
+      value = secretValue;
+    }
+    mkdirSync4(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" updated.`);
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const cfg = getConfig2();
+    const targetStack = args.stack ?? cfg?.defaults?.stack;
+    if (!targetStack) {
+      warn("No stack specified and no default stack in config \u2014 skipping re-apply.");
+      info("Run `clawops secret rotate <name> --stack <name>` to re-apply to a specific stack.");
+      return;
+    }
+    const { loadOverlay } = await import("./overlay-store-ADZPD7EU.js");
+    const stored = loadOverlay(targetStack);
+    if (!stored) {
+      warn(`No stored overlay for stack "${targetStack}" \u2014 cannot re-apply automatically.`);
+      info("Re-run `clawops setup` or `clawops apply` to propagate the new secret.");
+      return;
+    }
+    info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
+    try {
+      const { buildContext } = await import("./context-PSGEX2D7.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
+      const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
+      const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+      const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
+      const ctx = buildContext({ stack: targetStack });
+      let conn;
+      if (ctx.adapter.name === "local") {
+        if (!ctx.localState) throw new Error(`Stack "${targetStack}" has not been bootstrapped yet.`);
+        conn = localStateToConnectionInfo(ctx.localState);
+      } else {
+        const stack = await ctx.getStack();
+        const outputMap = await stack.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+        const base = extractBaseOutputs(outputs);
+        conn = ctx.adapter.getConnectionInfo({ ...base, privateKeyPath: ctx.config.ssh.keyPath, knownHostsPath: ctx.config.ssh.knownHostsPath });
+      }
+      const { session, release } = await acquireSession(conn);
+      try {
+        const remote = await readRemoteConfig(session);
+        const resolved = resolveSecrets(stored.overlay, stored.secrets);
+        const merged = deepMerge(remote, resolved);
+        await atomicWriteConfig(session, merged);
+        await restartGateway(session);
+      } finally {
+        release();
+        drainPool();
+      }
+      success(`Config overlay re-applied and gateway restarted on "${targetStack}".`);
+    } catch (err) {
+      failure(`Re-apply failed: ${err.message}`);
+      info("The secret file has been updated. Re-run `clawops setup` or `clawops apply` to propagate.");
+    }
+  }
+});
+var auditCmd = defineCommand19({
+  meta: { name: "audit", description: "Report missing secrets and unresolvable $secret: refs" },
+  args: {
+    json: { type: "boolean", description: "Emit JSON" }
+  },
+  async run({ args }) {
+    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
+    const overlays = listOverlays();
+    const issues = [];
+    for (const name of listSecretNames()) {
+      const p = secretPath(name);
+      try {
+        const content = readFileSync4(p, "utf-8").trim();
+        if (content.length === 0) {
+          issues.push({ kind: "empty-secret", secret: name, detail: `File exists but is empty: ${p}` });
+        }
+      } catch {
+        issues.push({ kind: "unreadable-secret", secret: name, detail: `Cannot read: ${p}` });
+      }
+    }
+    for (const overlay of overlays) {
+      for (const s of overlay.secrets) {
+        if (s.source === "file") {
+          const ref = s.ref ?? secretPath(s.name);
+          if (!existsSync3(ref)) {
+            issues.push({ kind: "missing-file", stack: overlay.stackName, secret: s.name, detail: `File not found: ${ref}` });
+          }
+        } else if (s.source === "env") {
+          const envVar = s.ref ?? s.name;
+          if (!process21.env[envVar]) {
+            issues.push({ kind: "missing-env", stack: overlay.stackName, secret: s.name, detail: `Env var not set: ${envVar}` });
+          }
+        } else {
+          issues.push({ kind: "cloud-sm-unresolved", stack: overlay.stackName, secret: s.name, detail: `Source "${s.source}" is not auto-resolved \u2014 set manually` });
+        }
+      }
+    }
+    if (args.json) {
+      process21.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
+      return;
+    }
+    if (issues.length === 0) {
+      success("All secrets are resolvable. No issues found.");
+      return;
+    }
+    failure(`${issues.length} issue${issues.length === 1 ? "" : "s"} found:
+`);
+    for (const issue of issues) {
+      const prefix = issue.stack ? `[${issue.stack}] ` : "";
+      warn(`${prefix}${issue.secret}: ${issue.detail}`);
+    }
+    process21.stdout.write("\n");
+    info("Run `clawops secret set <name>` to update a missing or empty secret.");
+  }
+});
+var secret_default = defineCommand19({
+  meta: {
+    name: "secret",
+    description: "Manage clawops secrets (list | set | delete | rotate | audit)"
+  },
+  args: {},
+  subCommands: {
+    list: listCmd,
+    set: setCmd,
+    delete: deleteCmd,
+    rotate: rotateCmd,
+    audit: auditCmd
+  }
+});
+
+// src/cli/commands/help.ts
+import { defineCommand as defineCommand20 } from "citty";
 var COMMANDS = [
   ["setup", "Interactive first-run wizard \u2014 configure, deploy, and wire AI apps"],
   ["init", "Write config and generate SSH key pair (non-interactive)"],
@@ -2866,6 +3152,8 @@ var COMMANDS = [
   ["stacks", "List named stacks and their state"],
   ["doctor", "Check Node version, config, SSH key, provider credentials, and Pulumi home"],
   ["mcp", "MCP server operations (mcp serve | mcp install)"],
+  ["secret", "Manage secrets (secret list | set | delete | rotate | audit)"],
+  ["monitor", "Live dashboard: gateway health, container status, resource usage, log tail"],
   ["help", "Show this help message"]
 ];
 var GLOBAL_FLAGS = [
@@ -2876,7 +3164,7 @@ var GLOBAL_FLAGS = [
   ["--dry-run", "Preview without applying (mutating commands)"],
   ["--yes", "Skip interactive confirmations (CI mode)"]
 ];
-var help_default = defineCommand19({
+var help_default = defineCommand20({
   meta: {
     name: "help",
     description: "Show available commands and global flags"
@@ -2916,25 +3204,25 @@ ${dim("Run `clawops <command> --help` for command-specific flags.")}
 });
 
 // src/cli/error-handler.ts
-import process21 from "process";
+import process22 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process21.exit(err.exitCode);
+    process22.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process21.env["DEBUG"]) {
-      process21.stderr.write(err.stack ?? "\n");
+    if (process22.env["DEBUG"]) {
+      process22.stderr.write(err.stack ?? "\n");
     }
-    process21.exit(1);
+    process22.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process21.exit(1);
+  process22.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand20({
+var main = defineCommand21({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -2968,6 +3256,8 @@ var main = defineCommand20({
     doctor: doctor_default,
     mcp: mcp_default,
     setup: setup_default,
+    secret: secret_default,
+    monitor: monitor_default,
     help: help_default
   }
 });