@clawops/cli 1.4.0 → 1.6.0

package/README.md

@@ -1,5 +1,8 @@
 # clawops
 
+[![npm version](https://img.shields.io/npm/v/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+[![npm downloads](https://img.shields.io/npm/dm/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+
 MCP-native infrastructure ops for OpenClaw — with read-only mode, destructive-action confirmation, and audit logs built in.
 
 **clawops** is a CLI and [MCP](https://modelcontextprotocol.io/) server for deploying and operating
@@ -9,6 +12,27 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.5.0
+
+**`clawops mcp wire`** — wire the OpenClaw gateway's own AI as an MCP client of clawops.
+Once wired, in-conversation commands like "check if my stack is healthy" or "show me the last 20
+log lines" invoke the real `clawops` CLI rather than having the gateway AI guess.
+
+```bash
+clawops mcp wire                   # wire the default stack
+clawops mcp wire --stack prod      # target a named stack
+clawops mcp wire --force           # bypass gateway version check
+```
+
+Version-gated: requires OpenClaw ≥ 2026.4 on the gateway side. If the version is older, the
+command surfaces a clear upgrade prompt and exits cleanly.
+
+The `clawops setup` wizard now also asks at the end of a successful deploy:
+*"Should the OpenClaw gateway's AI also be able to manage this stack?"* — accepting wires the
+client automatically over the same SSH session.
+
+---
+
 ## What's new in v1.4.0
 
 **`clawops monitor`** — live dashboard for any deployed stack. Shows gateway health, container
@@ -247,9 +271,13 @@ clawops down --yes          # Destroy local-provider stack
 | `backup` | Create or restore an OpenClaw state backup |
 | `stacks` | List named stacks and their state |
 | `doctor` | Check Node version, config, SSH key, provider credentials, and Pulumi home |
+| `secret` | Manage secrets: `list`, `set`, `delete`, `rotate`, `audit` |
+| `monitor` | Live dashboard: gateway health, container stats, log tail, stack picker |
 | `mcp serve` | Start the embedded MCP server (stdio or HTTP) |
 | `mcp install` | Interactively wire clawops into AI editors |
+| `mcp wire` | Wire the gateway's AI as an MCP client of clawops |
 | `help` | List all commands and global flags |
+| `bug` | Open a pre-filled GitHub issue with system context from `doctor` |
 
 Full flag reference: `clawops <command> --help`
 
@@ -297,6 +325,18 @@ The wizard resolves the absolute binary path automatically so app launchers can
 without inheriting your shell's `PATH`. See [Connect an AI editor](#connect-an-ai-editor) above
 for manual config paths.
 
+### Wire the gateway AI
+
+The OpenClaw gateway runs its own AI agent. Once wired, that agent can call clawops directly
+instead of guessing at infrastructure state:
+
+```bash
+clawops mcp wire --stack prod   # write MCP client entry into gateway config + restart
+```
+
+Requires OpenClaw ≥ 2026.4 on the gateway. The `clawops setup` wizard offers this step
+automatically after a successful deploy.
+
 ### Stdio mode (Claude Code / Cursor / VS Code)
 
 Start the server manually or confirm your config is correct:

package/dist/{apply-5RREMN3L.js → apply-SI3JKS4Z.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-ZONXY3C6.js";
+} from "./chunk-QHGFENYR.js";
 import "./chunk-YTH4L2GN.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-T5EX55GP.js";
+import "./chunk-QI75OVJK.js";
 import "./chunk-ZFNPM2WG.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";

package/dist/{aws-FRE2JVAZ.js → aws-D7Y6LCGK.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/aws/index.ts
 import process2 from "process";
@@ -10,7 +13,7 @@ var awsProgram = async () => {
   const [pulumi, aws, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/aws"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "t3.small";
@@ -21,20 +24,21 @@ var awsProgram = async () => {
   const sshCidrs = cfg.get("sshCidrs") ?? "";
   const gatewayCidrs = cfg.get("gatewayCidrs") ?? "";
   const bedrockEnabled = cfg.get("bedrockEnabled") === "true";
+  const pinnedAmiId = cfg.get("amiId");
   const sshPublicKey = cfg.get("sshPublicKey");
   if (!sshPublicKey) {
     throw new Error(
       'Stack config "sshPublicKey" is required for the AWS adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://checkip.amazonaws.com") : "";
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const vpc = new aws.ec2.Vpc("clawops-vpc", {
     cidrBlock: "10.0.0.0/16",
     enableDnsHostnames: true,
@@ -68,33 +72,36 @@ var awsProgram = async () => {
     subnetId: subnet.id,
     routeTableId: routeTable.id
   });
-  const ingressRules = [
-    ...sshIngressCidrs.map((cidr) => ({
-      protocol: "tcp",
+  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
+    vpcId: vpc.id,
+    description: "clawops managed security group",
+    tags: { Name: "clawops" }
+  });
+  sshIngressCidrs.forEach((cidr, i) => {
+    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-ssh-${i}`, {
+      securityGroupId: sg.id,
+      ipProtocol: "tcp",
       fromPort: SSH_PORT,
       toPort: SSH_PORT,
-      cidrBlocks: [cidr],
-      description: "SSH"
-    })),
-    ...gatewayIngressCidrs.map((cidr) => ({
-      protocol: "tcp",
+      cidrIpv4: cidr,
+      tags: { Name: `clawops-ssh-${i}` }
+    });
+  });
+  gatewayIngressCidrs.forEach((cidr, i) => {
+    new aws.vpc.SecurityGroupIngressRule(`clawops-sg-gw-${i}`, {
+      securityGroupId: sg.id,
+      ipProtocol: "tcp",
       fromPort: GATEWAY_PORT,
       toPort: GATEWAY_PORT,
-      cidrBlocks: [cidr],
-      description: "OpenClaw gateway"
-    }))
-  ];
-  const sg = new aws.ec2.SecurityGroup("clawops-sg", {
-    vpcId: vpc.id,
-    ingress: ingressRules,
-    egress: [{
-      protocol: "-1",
-      fromPort: 0,
-      toPort: 0,
-      cidrBlocks: ["0.0.0.0/0"],
-      description: "Allow all egress"
-    }],
-    tags: { Name: "clawops" }
+      cidrIpv4: cidr,
+      tags: { Name: `clawops-gateway-${i}` }
+    });
+  });
+  new aws.vpc.SecurityGroupEgressRule("clawops-sg-egress", {
+    securityGroupId: sg.id,
+    ipProtocol: "-1",
+    cidrIpv4: "0.0.0.0/0",
+    tags: { Name: "clawops-egress" }
   });
   const role = new aws.iam.Role("clawops-role", {
     assumeRolePolicy: JSON.stringify({
@@ -112,10 +119,19 @@ var awsProgram = async () => {
     policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
   });
   if (bedrockEnabled) {
-    new aws.iam.RolePolicyAttachment("clawops-bedrock", {
+    new aws.iam.RolePolicy("clawops-bedrock-invoke", {
       role: role.name,
-      // FullAccess required for bedrock:InvokeModel — ReadOnly only covers describe/list.
-      policyArn: "arn:aws:iam::aws:policy/AmazonBedrockFullAccess"
+      policy: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+          Effect: "Allow",
+          Action: [
+            "bedrock:InvokeModel",
+            "bedrock:InvokeModelWithResponseStream"
+          ],
+          Resource: "*"
+        }]
+      })
     });
   }
   const instanceProfile = new aws.iam.InstanceProfile("clawops-profile", {
@@ -125,7 +141,7 @@ var awsProgram = async () => {
     publicKey: sshPublicKey,
     tags: { Name: "clawops" }
   });
-  const ami = await aws.ec2.getAmi({
+  const amiId = pinnedAmiId ?? (await aws.ec2.getAmi({
     mostRecent: true,
     owners: ["099720109477"],
     // Canonical
@@ -133,15 +149,17 @@ var awsProgram = async () => {
       { name: "name", values: ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"] },
       { name: "virtualization-type", values: ["hvm"] }
     ]
-  });
+  })).id;
+  process.stderr.write(`[clawops] Using AMI: ${amiId}
+`);
   const instance = new aws.ec2.Instance("clawops-instance", {
-    ami: ami.id,
+    ami: amiId,
     instanceType,
     subnetId: subnet.id,
     vpcSecurityGroupIds: [sg.id],
     iamInstanceProfile: instanceProfile.name,
     keyName: keyPair.keyName,
-    userData: makeStartupScript(openclawVersion, bedrockEnabled),
+    userData: makeStartupScript({ openclawVersion, os: "ubuntu", bedrockEnabled }),
     // IMDSv2 with hopLimit=2 so Docker containers on this host can reach IMDS
     // and obtain the instance role credentials (required for Bedrock access).
     metadataOptions: {
@@ -169,62 +187,6 @@ var awsProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion, bedrockEnabled) {
-  const bedrockEnvFlag = bedrockEnabled ? "  -e AWS_DEFAULT_REGION=$(curl -sf http://169.254.169.254/latest/meta-data/placement/region || echo us-east-1) \\\n" : "";
-  return `#!/bin/bash
-set -euo pipefail
-
-# Create clawops user with SSH access
-id -u clawops &>/dev/null || useradd -m -s /bin/bash clawops
-mkdir -p /home/clawops/.ssh
-chmod 700 /home/clawops/.ssh
-chown clawops:clawops /home/clawops/.ssh
-
-# Install Docker if not present (AWS AMI is ubuntu-22.04)
-if ! command -v docker &>/dev/null; then
-  export DEBIAN_FRONTEND=noninteractive
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-# apply.ts will overwrite this with the plan's config overlay post-provisioning.
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p ${GATEWAY_PORT}:${GATEWAY_PORT} \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-${bedrockEnvFlag}  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/aws/index.ts
 var INSTANCE_TYPE_MAP = {

package/dist/{azure-PVC3AQVC.js → azure-JQAMNVHN.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  makeStartupScript
+} from "./chunk-XKT42M34.js";
 
 // src/providers/azure/index.ts
 import process2 from "process";
@@ -12,7 +15,7 @@ var azureProgram = async () => {
     import("@pulumi/pulumi"),
     import("@pulumi/azure-native"),
     import("@pulumi/random"),
-    import("./firewall-YYDOWDDP.js")
+    import("./firewall-XQGO7HWK.js")
   ]);
   const cfg = new pulumi.Config();
   const stackName = pulumi.getStack();
@@ -31,14 +34,15 @@ var azureProgram = async () => {
       'Stack config "sshPublicKey" is required for the Azure adapter. Set it with: pulumi config set --stack <name> sshPublicKey "ssh-ed25519 ..."'
     );
   }
-  const detectedIp = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : "";
+  const clientConfig = await azure.authorization.getClientConfig({});
+  const egressResult = accessMode === "auto" ? await detectEgressIp("https://ifconfig.me") : { ok: true, ip: "" };
   if (accessMode === "open") {
     process.stderr.write(
       "[clawops] WARNING: accessMode=open allows 0.0.0.0/0 on SSH and gateway ports. Only use this for development/sandbox stacks.\n"
     );
   }
-  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, detectedIp);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, detectedIp);
+  const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
+  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
   const rg = new azure.resources.ResourceGroup("clawops-rg", {
     resourceGroupName,
     location
@@ -111,7 +115,7 @@ var azureProgram = async () => {
     osProfile: {
       adminUsername: "clawops",
       computerName: "clawops",
-      customData: Buffer.from(makeStartupScript(openclawVersion)).toString("base64"),
+      customData: Buffer.from(makeStartupScript({ openclawVersion, os: "ubuntu" })).toString("base64"),
       linuxConfiguration: {
         disablePasswordAuthentication: true,
         ssh: {
@@ -125,8 +129,10 @@ var azureProgram = async () => {
     storageProfile: {
       imageReference: {
         publisher: "Canonical",
-        offer: "UbuntuServer",
-        sku: "22.04-LTS",
+        // Ubuntu 22.04 LTS — Canonical migrated from the legacy 'UbuntuServer'
+        // offer to this naming scheme. 22_04-lts-gen2 is available in all regions.
+        offer: "0001-com-ubuntu-server-jammy",
+        sku: "22_04-lts-gen2",
         version: "latest"
       },
       osDisk: {
@@ -153,10 +159,10 @@ var azureProgram = async () => {
         enableRbacAuthorization: true
       }
     });
+    const kvSecretsUserRoleId = `/subscriptions/${clientConfig.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6`;
     new azure.authorization.RoleAssignment("clawops-kv-role", {
       scope: kv.id,
-      roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6",
-      // Key Vault Secrets User
+      roleDefinitionId: kvSecretsUserRoleId,
       principalId: pulumi.output(vm.identity).apply((i) => i?.principalId ?? ""),
       principalType: "ServicePrincipal"
     });
@@ -183,53 +189,6 @@ var azureProgram = async () => {
     provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 };
-function makeStartupScript(openclawVersion) {
-  return `#!/bin/bash
-set -euo pipefail
-
-# Install Docker if not present
-if ! command -v docker &>/dev/null; then
-  apt-get update -q
-  apt-get install -y -q ca-certificates curl gnupg lsb-release
-  install -m 0755 -d /etc/apt/keyrings
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg \\
-    | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-  chmod a+r /etc/apt/keyrings/docker.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \\
-    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \\
-    > /etc/apt/sources.list.d/docker.list
-  apt-get update -q
-  apt-get install -y -q docker-ce docker-ce-cli containerd.io
-  systemctl enable --now docker
-fi
-
-usermod -aG docker clawops
-
-# Pull OpenClaw image
-OPENCLAW_VERSION="${openclawVersion}"
-docker pull ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION}
-
-# Create default openclaw.json if not present
-OPENCLAW_CONFIG=/home/clawops/openclaw.json
-if [ ! -f "\${OPENCLAW_CONFIG}" ]; then
-  cat > "\${OPENCLAW_CONFIG}" <<'OPENCLAWJSON'
-{"meta":{"lastTouchedVersion":"2026.4"},"gateway":{"port":18789,"auth":{"mode":"token"}},"models":{},"channels":{}}
-OPENCLAWJSON
-  chown clawops:clawops "\${OPENCLAW_CONFIG}"
-fi
-
-# Start OpenClaw container
-docker stop openclaw 2>/dev/null || true
-docker rm   openclaw 2>/dev/null || true
-docker run -d \\
-  --name openclaw \\
-  --restart unless-stopped \\
-  -p 18789:18789 \\
-  -v "\${OPENCLAW_CONFIG}":/app/config.json:ro \\
-  ghcr.io/openclaw/openclaw:\${OPENCLAW_VERSION} \\
-  node openclaw.mjs gateway run --allow-unconfigured
-`;
-}
 
 // src/providers/azure/index.ts
 var INSTANCE_TYPE_MAP = {

package/dist/{bootstrap-G4UZ2FKH.js → bootstrap-RY4VOSDJ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   acquireSession
-} from "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
+} from "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import {
   writeLocalState
 } from "./chunk-A2I76FTA.js";

package/dist/{chunk-UAA6YOOP.js → chunk-72FF7IK2.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YTH4L2GN.js";
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import {
   getConfig
 } from "./chunk-CX5SL5HP.js";
@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-WAJRGBBM.js");
+  const { version } = await import("./package-EW3FS257.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const openclawVersion = intent.openclawVersion ?? "latest";

package/dist/{chunk-JYQZJMD3.js → chunk-C5NDLOK2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-T5EX55GP.js";
+} from "./chunk-QI75OVJK.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-ZVOEQCNW.js";
+} from "./chunk-LCKD7L7X.js";
 import {
   OPENCLAW_CONFIG,
   atomicWriteConfig,
@@ -17,7 +17,7 @@ import {
 
 // src/cli/commands/monitor.ts
 import { defineCommand } from "citty";
-import process from "process";
+import process2 from "process";
 
 // src/output/human.ts
 import chalk from "chalk";
@@ -37,6 +37,12 @@ function info(msg) {
 function spinner(text) {
   return ora(text).start();
 }
+var REPO_URL = "https://github.com/dfridkin/clawops";
+function printCta() {
+  process.stdout.write(
+    "\n" + chalk.dim("  Thank you for using clawops! If it has been useful, star the project:") + "\n" + chalk.dim("  " + REPO_URL) + "\n\n" + chalk.dim("  Found a bug? Open an issue:") + "\n" + chalk.dim("  " + REPO_URL + "/issues") + "\n\n"
+  );
+}
 
 // src/cli/commands/monitor.ts
 var GATEWAY_PORT = 18789;
@@ -148,7 +154,7 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
+  const { buildContext: buildContext2 } = await import("./context-KPKBOWOP.js");
   const { getConfig } = await import("./store-SDUR52Z5.js");
   const config = getConfig();
   if (!config) return [];
@@ -228,7 +234,7 @@ async function deleteFromRegistry(name) {
   setConfig(updated);
 }
 async function runStackMenu(ac, setKeyHandler, noColor) {
-  process.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
+  process2.stdout.write("\x1B[2J\x1B[H\n  Checking stacks...\n");
   const entries = await probeEntries();
   if (ac.signal.aborted) return null;
   let selectedIdx = 0;
@@ -238,7 +244,7 @@ async function runStackMenu(ac, setKeyHandler, noColor) {
     return showAll ? entries : entries.filter((e) => e.deployed);
   }
   function redraw() {
-    process.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
+    process2.stdout.write("\x1B[2J\x1B[H" + renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete));
   }
   redraw();
   return new Promise((resolve) => {
@@ -317,7 +323,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       noColor: opts.noColor,
       menuMode
     });
-    process.stdout.write("\x1B[2J\x1B[H" + out + "\n");
+    process2.stdout.write("\x1B[2J\x1B[H" + out + "\n");
   }
   async function doRefresh() {
     cancelRefresh();
@@ -327,7 +333,7 @@ async function runDashboard(session, stackName, opts, ac, setKeyHandler, menuMod
       redraw();
     } catch (err) {
       if (!ac.signal.aborted) {
-        process.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
+        process2.stdout.write("\x1B[2J\x1B[H  Error gathering snapshot: " + (err instanceof Error ? err.message : String(err)) + "\n");
       }
     }
     if (!ac.signal.aborted) scheduleRefresh();
@@ -373,20 +379,20 @@ var monitor_default = defineCommand({
   async run({ args }) {
     const intervalSec = Math.max(2, parseInt(String(args.interval ?? "10"), 10) || 10);
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
-    const isTTY = Boolean(process.stdout.isTTY);
+    const isTTY = Boolean(process2.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext: buildContext2 } = await import("./context-PSGEX2D7.js");
-    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-FBFHATDG.js");
+    const { buildContext: buildContext2 } = await import("./context-KPKBOWOP.js");
+    const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-JZGKPP6K.js");
     const ac = new AbortController();
-    process.on("SIGINT", () => ac.abort());
-    process.on("SIGTERM", () => ac.abort());
+    process2.on("SIGINT", () => ac.abort());
+    process2.on("SIGTERM", () => ac.abort());
     if (args.stack) {
       const ctx = buildContext2(args);
       let conn;
       if (ctx.adapter.name === "local") {
         if (!ctx.localState) {
           failure("Stack is not bootstrapped. Run `clawops up` first.");
-          process.exit(4);
+          process2.exit(4);
         }
         const ls = ctx.localState;
         conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
@@ -399,7 +405,7 @@ var monitor_default = defineCommand({
         );
         if (!outputs["publicIp"]) {
           failure("Stack has no outputs. Run `clawops up` first.");
-          process.exit(4);
+          process2.exit(4);
         }
         const base = extractBaseOutputs(outputs);
         conn = ctx.adapter.getConnectionInfo({
@@ -412,7 +418,7 @@ var monitor_default = defineCommand({
         const { session: session2, release: release2 } = await acquireSession2({ ...conn, signal: ac.signal });
         try {
           const snap = await gatherSnapshot(session2, ac.signal, tailLines);
-          process.stdout.write(
+          process2.stdout.write(
             renderSnapshot(snap, { stackName: ctx.stackName, intervalSec, showLogs: true, noColor }) + "\n"
           );
         } finally {
@@ -422,21 +428,21 @@ var monitor_default = defineCommand({
         return;
       }
       const { session, release } = await acquireSession2({ ...conn, signal: ac.signal });
-      process.stdin.setRawMode(true);
-      process.stdin.resume();
-      process.stdin.setEncoding("utf8");
-      process.stdout.write("\x1B[?25l");
+      process2.stdin.setRawMode(true);
+      process2.stdin.resume();
+      process2.stdin.setEncoding("utf8");
+      process2.stdout.write("\x1B[?25l");
       let keyHandler2 = () => {
       };
-      process.stdin.on("data", (key) => keyHandler2(key));
+      process2.stdin.on("data", (key) => keyHandler2(key));
       try {
         await runDashboard(session, ctx.stackName, { intervalSec, tailLines, noColor }, ac, (fn) => {
           keyHandler2 = fn;
         }, false);
       } finally {
-        process.stdin.setRawMode(false);
-        process.stdin.pause();
-        process.stdout.write("\x1B[?25h\n");
+        process2.stdin.setRawMode(false);
+        process2.stdin.pause();
+        process2.stdout.write("\x1B[?25h\n");
         release();
         drainPool2();
       }
@@ -444,15 +450,15 @@ var monitor_default = defineCommand({
     }
     if (!isTTY) {
       failure("Pass --stack <name> or run in a TTY for interactive stack selection.");
-      process.exit(2);
+      process2.exit(2);
     }
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding("utf8");
-    process.stdout.write("\x1B[?25l");
+    process2.stdin.setRawMode(true);
+    process2.stdin.resume();
+    process2.stdin.setEncoding("utf8");
+    process2.stdout.write("\x1B[?25l");
     let keyHandler = () => {
     };
-    process.stdin.on("data", (key) => keyHandler(key));
+    process2.stdin.on("data", (key) => keyHandler(key));
     try {
       while (!ac.signal.aborted) {
         const stackName = await runStackMenu(ac, (fn) => {
@@ -497,9 +503,9 @@ var monitor_default = defineCommand({
         }
       }
     } finally {
-      process.stdin.setRawMode(false);
-      process.stdin.pause();
-      process.stdout.write("\x1B[?25h\n");
+      process2.stdin.setRawMode(false);
+      process2.stdin.pause();
+      process2.stdout.write("\x1B[?25h\n");
     }
   }
 });
@@ -750,6 +756,8 @@ export {
   warn,
   info,
   spinner,
+  REPO_URL,
+  printCta,
   resolveConn,
   errText,
   okText,