@clawops/cli 1.4.0 → 1.5.0

package/README.md

@@ -1,5 +1,8 @@
 # clawops
 
+[![npm version](https://img.shields.io/npm/v/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+[![npm downloads](https://img.shields.io/npm/dm/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+
 MCP-native infrastructure ops for OpenClaw — with read-only mode, destructive-action confirmation, and audit logs built in.
 
 **clawops** is a CLI and [MCP](https://modelcontextprotocol.io/) server for deploying and operating
@@ -9,6 +12,27 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.5.0
+
+**`clawops mcp wire`** — wire the OpenClaw gateway's own AI as an MCP client of clawops.
+Once wired, in-conversation commands like "check if my stack is healthy" or "show me the last 20
+log lines" invoke the real `clawops` CLI rather than having the gateway AI guess.
+
+```bash
+clawops mcp wire                   # wire the default stack
+clawops mcp wire --stack prod      # target a named stack
+clawops mcp wire --force           # bypass gateway version check
+```
+
+Version-gated: requires OpenClaw ≥ 2026.4 on the gateway side. If the version is older, the
+command surfaces a clear upgrade prompt and exits cleanly.
+
+The `clawops setup` wizard now also asks at the end of a successful deploy:
+*"Should the OpenClaw gateway's AI also be able to manage this stack?"* — accepting wires the
+client automatically over the same SSH session.
+
+---
+
 ## What's new in v1.4.0
 
 **`clawops monitor`** — live dashboard for any deployed stack. Shows gateway health, container
@@ -247,8 +271,11 @@ clawops down --yes          # Destroy local-provider stack
 | `backup` | Create or restore an OpenClaw state backup |
 | `stacks` | List named stacks and their state |
 | `doctor` | Check Node version, config, SSH key, provider credentials, and Pulumi home |
+| `secret` | Manage secrets: `list`, `set`, `delete`, `rotate`, `audit` |
+| `monitor` | Live dashboard: gateway health, container stats, log tail, stack picker |
 | `mcp serve` | Start the embedded MCP server (stdio or HTTP) |
 | `mcp install` | Interactively wire clawops into AI editors |
+| `mcp wire` | Wire the gateway's AI as an MCP client of clawops |
 | `help` | List all commands and global flags |
 
 Full flag reference: `clawops <command> --help`
@@ -297,6 +324,18 @@ The wizard resolves the absolute binary path automatically so app launchers can
 without inheriting your shell's `PATH`. See [Connect an AI editor](#connect-an-ai-editor) above
 for manual config paths.
 
+### Wire the gateway AI
+
+The OpenClaw gateway runs its own AI agent. Once wired, that agent can call clawops directly
+instead of guessing at infrastructure state:
+
+```bash
+clawops mcp wire --stack prod   # write MCP client entry into gateway config + restart
+```
+
+Requires OpenClaw ≥ 2026.4 on the gateway. The `clawops setup` wizard offers this step
+automatically after a successful deploy.
+
 ### Stdio mode (Claude Code / Cursor / VS Code)
 
 Start the server manually or confirm your config is correct:

package/dist/{chunk-UAA6YOOP.js → chunk-IVX62LFO.js}

@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-WAJRGBBM.js");
+  const { version } = await import("./package-QLDA65A3.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/{chunk-JYQZJMD3.js → chunk-R5S6IXBE.js}

@@ -17,7 +17,7 @@ import {
 
 // src/cli/commands/monitor.ts
 import { defineCommand } from "citty";
-import process from "process";
+import process2 from "process";
 
 // src/output/human.ts
 import chalk from "chalk";
@@ -37,6 +37,12 @@ function info(msg) {
 function spinner(text) {
   return ora(text).start();
 }
+var REPO_URL = "https://github.com/dfridkin/clawops";
+function printCta() {
+  process.stdout.write(
+    "\n" + chalk.dim("  Thank you for using clawops! If it has been useful, star the project:") + "\n" + chalk.dim("  " + REPO_URL) + "\n\n" + chalk.dim("  Found a bug? Open an issue:") + "\n" + chalk.dim("  " + REPO_URL + "/issues") + "\n\n"
+  );
+}
 
 // src/cli/commands/monitor.ts
 var GATEWAY_PORT = 18789;
@@ -228,7 +234,7 @@ async function deleteFromRegistry(name) {
   setConfig(updated);
 }
 async function runStackMenu(ac, setKeyHandler, noColor) {
-  process.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
+  process2.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
   const entries = await probeEntries();
   if (ac.signal.aborted) return null;
   let selectedIdx = 0;
@@ -238,7 +244,7 @@ async function runStackMenu(ac, setKeyHandler, noColor) {
     return showAll ? entries : entries.filter((e) => e.deployed);
   }
   function redraw() {
-    process.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
+    process2.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
   }
   redraw();
   return new Promise((resolve) => {
@@ -317,7 +323,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       noColor: opts.noColor,
       menuMode
     });
-    process.stdout.write("\x1B[2J\x1B[H" + out + "\n");
+    process2.stdout.write("\x1B[2J\x1B[H" + out + "\n");
   }
   async function doRefresh() {
     cancelRefresh();
@@ -327,7 +333,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       redraw();
     } catch (err) {
       if (!ac.signal.aborted) {
-        process.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
+        process2.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
       }
     }
     if (!ac.signal.aborted) scheduleRefresh();
@@ -373,20 +379,20 @@ var monitor_default = defineCommand({
   async run({ args }) {
     const intervalSec = Math.max(2, parseInt(String(args.interval ?? "10"), 10) || 10);
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
-    const isTTY = Boolean(process.stdout.isTTY);
+    const isTTY = Boolean(process2.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
     const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
     const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-FBFHATDG.js");
     const ac = new AbortController();
-    process.on("SIGINT", () => ac.abort());
-    process.on("SIGTERM", () => ac.abort());
+    process2.on("SIGINT", () => ac.abort());
+    process2.on("SIGTERM", () => ac.abort());
     if (args.stack) {
       const ctx = buildContext2(args);
       let conn;
       if (ctx.adapter.name === "local") {
         if (!ctx.localState) {
           failure("Stack is not bootstrapped. Run `clawops up` first.");
-          process.exit(4);
+          process2.exit(4);
         }
         const ls = ctx.localState;
         conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
@@ -399,7 +405,7 @@ var monitor_default = defineCommand({
         );
         if (!outputs["publicIp"]) {
           failure("Stack has no outputs. Run `clawops up` first.");
-          process.exit(4);
+          process2.exit(4);
         }
         const base = extractBaseOutputs(outputs);
         conn = ctx.adapter.getConnectionInfo({
@@ -412,7 +418,7 @@ var monitor_default = defineCommand({
         const { session: session2, release: release2 } = await acquireSession2({ ...conn, signal: ac.signal });
         try {
           const snap = await gatherSnapshot(session2, ac.signal, tailLines);
-          process.stdout.write(
+          process2.stdout.write(
             renderSnapshot(snap, { stackName: ctx.stackName, intervalSec, showLogs: true, noColor }) + "\n"
           );
         } finally {
@@ -422,21 +428,21 @@ var monitor_default = defineCommand({
         return;
       }
       const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
-      process.stdin.setRawMode(true);
-      process.stdin.resume();
-      process.stdin.setEncoding("utf8");
-      process.stdout.write("\x1B[?25l");
+      process2.stdin.setRawMode(true);
+      process2.stdin.resume();
+      process2.stdin.setEncoding("utf8");
+      process2.stdout.write("\x1B[?25l");
       let keyHandler2 = () => {
       };
-      process.stdin.on("data", (key) => keyHandler2(key));
+      process2.stdin.on("data", (key) => keyHandler2(key));
       try {
         await runDashboard(session, ctx.stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
           keyHandler2 = fn;
         }, false);
       } finally {
-        process.stdin.setRawMode(false);
-        process.stdin.pause();
-        process.stdout.write("\x1B[?25h\n");
+        process2.stdin.setRawMode(false);
+        process2.stdin.pause();
+        process2.stdout.write("\x1B[?25h\n");
         release();
         drainPool2();
       }
@@ -444,15 +450,15 @@ var monitor_default = defineCommand({
     }
     if (!isTTY) {
       failure("Pass --stack <name> or run in a TTY for interactive stack selection.");
-      process.exit(2);
+      process2.exit(2);
     }
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding("utf8");
-    process.stdout.write("\x1B[?25l");
+    process2.stdin.setRawMode(true);
+    process2.stdin.resume();
+    process2.stdin.setEncoding("utf8");
+    process2.stdout.write("\x1B[?25l");
     let keyHandler = () => {
     };
-    process.stdin.on("data", (key) => keyHandler(key));
+    process2.stdin.on("data", (key) => keyHandler(key));
     try {
       while (!ac.signal.aborted) {
         const stackName = await runStackMenu(ac, (fn) => {
@@ -497,9 +503,9 @@ var monitor_default = defineCommand({
         }
       }
     } finally {
-      process.stdin.setRawMode(false);
-      process.stdin.pause();
-      process.stdout.write("\x1B[?25h\n");
+      process2.stdin.setRawMode(false);
+      process2.stdin.pause();
+      process2.stdout.write("\x1B[?25h\n");
     }
   }
 });
@@ -750,6 +756,7 @@ export {
   warn,
   info,
   spinner,
+  printCta,
   resolveConn,
   errText,
   okText,

package/dist/cli.js

@@ -9,11 +9,12 @@ import {
   failure,
   info,
   monitor_default,
+  printCta,
   spinner,
   success,
   validateOpenclawConfig,
   warn
-} from "./chunk-JYQZJMD3.js";
+} from "./chunk-R5S6IXBE.js";
 import "./chunk-T5EX55GP.js";
 import "./chunk-ZVOEQCNW.js";
 import "./chunk-4U3LTLWZ.js";
@@ -486,7 +487,7 @@ var plan_default = defineCommand5({
   },
   async run({ args }) {
     const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { generatePlan } = await import("./generate-Z7DBMANX.js");
+    const { generatePlan } = await import("./generate-2QGKYR42.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -1813,7 +1814,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-IWLZJ4EU.js");
+    const { serveMcp } = await import("./server-LOL2NUJ2.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1878,6 +1879,85 @@ var installCmd = defineCommand17({
     }
   }
 });
+var wireCmd = defineCommand17({
+  meta: {
+    name: "wire",
+    description: "Wire the gateway AI as an MCP client of clawops (WO-28)"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    force: { type: "boolean", description: "Apply even if gateway version is below minimum" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
+    const ac = new AbortController();
+    process19.on("SIGINT", () => {
+      ac.abort();
+      process19.exit(130);
+    });
+    process19.on("SIGTERM", () => {
+      ac.abort();
+      process19.exit(143);
+    });
+    const ctx = buildContext({ stack: args.stack });
+    let conn;
+    if (ctx.adapter.name === "local") {
+      if (!ctx.localState) {
+        failure("Stack is not deployed. Run `clawops up` first.");
+        process19.exit(1);
+      }
+      const ls = ctx.localState;
+      conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
+    } else {
+      const stack = await ctx.getStack();
+      const outputMap = await stack.outputs();
+      const outputs = Object.fromEntries(
+        Object.entries(outputMap).map(([k, v]) => [k, v.value])
+      );
+      if (!outputs["publicIp"]) {
+        failure("Stack has no outputs. Run `clawops up` first.");
+        process19.exit(1);
+      }
+      const base = extractBaseOutputs(outputs);
+      conn = {
+        host: base.publicIp,
+        port: base.sshPort ?? 22,
+        user: base.sshUser ?? "ubuntu",
+        privateKeyPath: ctx.config.ssh.keyPath,
+        knownHostsPath: ctx.config.ssh.knownHostsPath
+      };
+    }
+    const spin = spinner(`Connecting to ${conn.host}...`);
+    const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
+    try {
+      spin.text = "Reading gateway config...";
+      const result = await wireGatewayMcp(session, ac.signal, { force: Boolean(args.force) });
+      if (result.status === "version-blocked") {
+        spin.fail("Gateway version is too old for MCP client support.");
+        warn(`Gateway version ${result.version} requires at least 2026.4 for MCP client support.`);
+        info("Upgrade OpenClaw and re-run, or bypass with: clawops mcp wire --force");
+        process19.exit(1);
+      }
+      if (result.rewired) {
+        spin.succeed("Re-wiring clawops MCP client \u2014 previous entry replaced.");
+      } else {
+        spin.succeed("Gateway MCP client wired.");
+      }
+      success("The gateway's AI can now run clawops commands.");
+      info('Try asking it: "check if my stack is healthy"');
+    } catch (err) {
+      spin.fail("Failed to wire gateway MCP client.");
+      failure(err instanceof Error ? err.message : String(err));
+      process19.exit(1);
+    } finally {
+      release();
+      drainPool();
+    }
+  }
+});
 var mcp_default = defineCommand17({
   meta: {
     name: "mcp",
@@ -1886,7 +1966,8 @@ var mcp_default = defineCommand17({
   args: {},
   subCommands: {
     serve: serveCmd,
-    install: installCmd
+    install: installCmd,
+    wire: wireCmd
   }
 });
 
@@ -2296,6 +2377,15 @@ var setup_default = defineCommand18({
           signal: ac.signal,
           inquirer
         });
+        await maybeWireGatewayMcp({
+          stackName: stackAnswers.stackName,
+          host: localHost,
+          port: localPort,
+          user: localUser,
+          keyPath: localKeyPath,
+          signal: ac.signal,
+          inquirer
+        });
       } else {
         const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
         const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -2327,6 +2417,7 @@ var setup_default = defineCommand18({
           failure(err instanceof Error ? err.message : String(err));
           process20.exit(1);
         }
+        await maybeWireGatewayMcpCloud({ stackName: stackAnswers.stackName, signal: ac.signal, inquirer });
       } else {
         info(`
 To deploy later:  clawops apply ${outputPath}`);
@@ -2431,6 +2522,7 @@ async function runLocalDeploy(opts) {
   info(`Token saved to  ${tokenPath}`);
   info(`
 Run  clawops doctor --stack ${opts.stackName}  to check everything is healthy`);
+  printCta();
 }
 var CLOUD_AUTH = {
   aws: {
@@ -2803,6 +2895,55 @@ function printMcpSnippet() {
     }
   }, null, 2) + "\n\n");
 }
+async function maybeWireGatewayMcp(opts) {
+  process20.stdout.write("\n");
+  const { wireGateway } = await inquirerPromptWire(opts.inquirer);
+  if (!wireGateway) return;
+  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
+  const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
+  const spin = spinner("Wiring gateway MCP client...");
+  const session = await connect({
+    host: opts.host,
+    port: opts.port,
+    user: opts.user,
+    privateKeyPath: opts.keyPath,
+    knownHostsPath,
+    signal: opts.signal
+  });
+  try {
+    const result = await wireGatewayMcp(session, opts.signal ?? AbortSignal.timeout(3e4));
+    if (result.status === "version-blocked") {
+      spin.warn(`Gateway version ${result.version} is too old for MCP client support (requires \u2265 2026.4).`);
+      info("Upgrade OpenClaw and run: clawops mcp wire --stack " + opts.stackName);
+    } else {
+      spin.succeed(result.rewired ? "Gateway MCP client re-wired." : "Gateway MCP client wired.");
+      success("The gateway's AI can now run clawops commands.");
+      info('Try asking it: "check if my stack is healthy"');
+    }
+  } catch (err) {
+    spin.fail("Failed to wire gateway MCP client.");
+    failure(err instanceof Error ? err.message : String(err));
+    info("You can retry later: clawops mcp wire --stack " + opts.stackName);
+  } finally {
+    session.close();
+  }
+}
+async function maybeWireGatewayMcpCloud(opts) {
+  process20.stdout.write("\n");
+  const { wireGateway } = await inquirerPromptWire(opts.inquirer);
+  if (!wireGateway) return;
+  info(`Run this after the server is ready:  clawops mcp wire --stack ${opts.stackName}`);
+}
+async function inquirerPromptWire(inquirer) {
+  return inquirer.prompt([{
+    type: "confirm",
+    name: "wireGateway",
+    message: "Should the OpenClaw gateway's AI also be able to manage this stack? (adds clawops MCP client to gateway)",
+    default: false
+  }]);
+}
 function loadCatalogs(yaml) {
   const specDir = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "../../../spec");
   try {
@@ -3151,7 +3292,7 @@ var COMMANDS = [
   ["backup", "Create or restore an OpenClaw state backup"],
   ["stacks", "List named stacks and their state"],
   ["doctor", "Check Node version, config, SSH key, provider credentials, and Pulumi home"],
-  ["mcp", "MCP server operations (mcp serve | mcp install)"],
+  ["mcp", "MCP server operations (mcp serve | mcp install | mcp wire)"],
   ["secret", "Manage secrets (secret list | set | delete | rotate | audit)"],
   ["monitor", "Live dashboard: gateway health, container status, resource usage, log tail"],
   ["help", "Show this help message"]
@@ -3198,8 +3339,8 @@ ${bold("Global flags:")}
     }
     process.stdout.write(`
 ${dim("Run `clawops <command> --help` for command-specific flags.")}
-
 `);
+    printCta();
   }
 });
 

package/dist/{generate-Z7DBMANX.js → generate-2QGKYR42.js}

@@ -2,7 +2,7 @@
 import {
   generatePlan,
   planId
-} from "./chunk-UAA6YOOP.js";
+} from "./chunk-IVX62LFO.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-T5EX55GP.js";
 import "./chunk-A2I76FTA.js";

package/dist/mcp-wire-ZWIYMLEW.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import {
+  atomicWriteConfig,
+  deepMerge,
+  readRemoteConfig,
+  restartGateway
+} from "./chunk-ZFNPM2WG.js";
+
+// src/cli/mcp-wire.ts
+var GATEWAY_MCP_MIN_VERSION = "2026.4";
+var GATEWAY_MCP_ENTRY = {
+  command: "clawops",
+  args: ["mcp", "serve"],
+  transport: "stdio"
+};
+function versionAtLeast(version, min) {
+  const [vy = 0, vm = 0] = version.split(".").map(Number);
+  const [my = 0, mm = 0] = min.split(".").map(Number);
+  if (vy !== my) return vy > my;
+  return vm >= mm;
+}
+async function wireGatewayMcp(session, signal, opts = {}) {
+  const cfg = await readRemoteConfig(session, signal);
+  const version = cfg["meta"]?.["lastTouchedVersion"];
+  if (version && !versionAtLeast(version, GATEWAY_MCP_MIN_VERSION) && !opts.force) {
+    return { status: "version-blocked", version };
+  }
+  const mcpClients = cfg["gateway"]?.["mcpClients"];
+  const rewired = !!mcpClients?.["clawops"];
+  const updated = deepMerge(cfg, {
+    gateway: {
+      mcpClients: {
+        clawops: GATEWAY_MCP_ENTRY
+      }
+    }
+  });
+  await atomicWriteConfig(session, updated, signal);
+  await restartGateway(session, signal);
+  return { status: "wired", rewired };
+}
+export {
+  GATEWAY_MCP_ENTRY,
+  GATEWAY_MCP_MIN_VERSION,
+  wireGatewayMcp
+};

package/dist/{package-WAJRGBBM.js → package-QLDA65A3.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.4.0";
+var version = "1.5.0";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {

package/dist/{server-IWLZJ4EU.js → server-LOL2NUJ2.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-UAA6YOOP.js";
+} from "./chunk-IVX62LFO.js";
 import {
   applyPlan
 } from "./chunk-ZONXY3C6.js";
@@ -23,7 +23,7 @@ import {
   handleConfigValidate,
   okText,
   resolveConn
-} from "./chunk-JYQZJMD3.js";
+} from "./chunk-R5S6IXBE.js";
 import {
   buildContext
 } from "./chunk-T5EX55GP.js";
@@ -1305,7 +1305,7 @@ If none of the above resolves the issue:
 
 // src/mcp/server.ts
 async function serveMcp(opts) {
-  const { version } = await import("./package-WAJRGBBM.js");
+  const { version } = await import("./package-QLDA65A3.js");
   const server = new McpServer({ name: "clawops", version });
   registerTools(server, opts);
   registerResources(server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -24,6 +24,19 @@
   "engines": {
     "node": ">=22"
   },
+  "scripts": {
+    "dev": "tsx src/cli/index.ts",
+    "build": "tsup",
+    "test": "vitest run",
+    "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
+    "test:changed": "vitest --changed",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
+    "lint": "eslint --max-warnings=0 src tests scripts",
+    "gen:schemas": "tsx scripts/gen-schemas.ts",
+    "changeset": "changeset",
+    "release": "pnpm build && changeset publish"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@pulumi/aws": "^6.0.0",
@@ -60,17 +73,16 @@
     "typescript-eslint": "^8.0.0",
     "vitest": "^2.0.0"
   },
-  "scripts": {
-    "dev": "tsx src/cli/index.ts",
-    "build": "tsup",
-    "test": "vitest run",
-    "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
-    "test:changed": "vitest --changed",
-    "test:integration": "vitest run --config vitest.integration.config.ts",
-    "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
-    "lint": "eslint --max-warnings=0 src tests scripts",
-    "gen:schemas": "tsx scripts/gen-schemas.ts",
-    "changeset": "changeset",
-    "release": "pnpm build && changeset publish"
+  "pnpm": {
+    "overrides": {
+      "@pulumi/pulumi": "^3.0.0"
+    },
+    "onlyBuiltDependencies": [
+      "@pulumi/command",
+      "cpu-features",
+      "esbuild",
+      "protobufjs",
+      "ssh2"
+    ]
   }
-}
+}