@clawops/cli 1.5.0 → 1.7.0

package/dist/cli.js

@@ -1,24 +1,27 @@
 #!/usr/bin/env node
+import {
+  monitor_default,
+  validateOpenclawConfig
+} from "./chunk-CG3Y7Y2R.js";
 import {
   MCP_APPS,
   buildMcpEntry,
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
+import "./chunk-ZFNPM2WG.js";
+import "./chunk-3MFZ7E74.js";
+import "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
 import {
+  REPO_URL,
   chalk,
   failure,
   info,
-  monitor_default,
   printCta,
   spinner,
   success,
-  validateOpenclawConfig,
   warn
-} from "./chunk-R5S6IXBE.js";
-import "./chunk-T5EX55GP.js";
-import "./chunk-ZVOEQCNW.js";
-import "./chunk-4U3LTLWZ.js";
-import "./chunk-ZFNPM2WG.js";
+} from "./chunk-Q7NQY5HV.js";
 import "./chunk-A2I76FTA.js";
 import {
   getConfig,
@@ -32,7 +35,7 @@ import {
 } from "./chunk-KGXPLI7W.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand21, runMain } from "citty";
+import { defineCommand as defineCommand23, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -204,7 +207,7 @@ var up_default = defineCommand2({
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     const openclawVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : "stable";
     if (ctx.adapter.name === "local") {
@@ -215,7 +218,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
+      const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -308,7 +311,7 @@ var up_default = defineCommand2({
   }
 });
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
   let overlay;
@@ -350,7 +353,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -414,7 +417,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -486,8 +489,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { generatePlan } = await import("./generate-2QGKYR42.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { generatePlan } = await import("./generate-ZTD4BVVI.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -577,7 +580,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-T5M5EHSJ.js");
-    const { applyPlan } = await import("./apply-5RREMN3L.js");
+    const { applyPlan } = await import("./apply-BTZFFGAD.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -693,7 +696,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -760,8 +763,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -847,9 +850,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-FBFHATDG.js");
+    const { acquireSession } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -915,9 +918,9 @@ var logs_default = defineCommand10({
     since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -1032,9 +1035,9 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1158,9 +1161,9 @@ var agents_default = defineCommand12({
     json: { type: "boolean", description: "Emit JSON (for list)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, name] = args._ ?? [];
     if (!action || !["list", "restart", "logs"].includes(action)) {
       failure("Usage: clawops agents <list | restart [name] | logs <name>>");
@@ -1262,9 +1265,9 @@ var gateway_default = defineCommand13({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
@@ -1375,8 +1378,8 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -1548,7 +1551,7 @@ var stacks_default = defineCommand15({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-PSGEX2D7.js");
+        const { buildContext } = await import("./context-ALSJMTHE.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -1669,9 +1672,9 @@ var doctor_default = defineCommand16({
       info("Credential checks skipped \u2014 no config");
     } else {
       const { getProvider } = await import("./providers-2OABPW2E.js");
-      await import("./aws-FRE2JVAZ.js");
-      await import("./gcp-BXDTC6EK.js");
-      await import("./azure-PVC3AQVC.js");
+      await import("./aws-D7Y6LCGK.js");
+      await import("./gcp-6FT2A45S.js");
+      await import("./azure-JQAMNVHN.js");
       await import("./local-DXBEVZ5C.js");
       const checkedProviders = /* @__PURE__ */ new Set();
       for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
@@ -1706,9 +1709,9 @@ var doctor_default = defineCommand16({
         info("Remote health skipped \u2014 no config");
       } else {
         try {
-          const { buildContext } = await import("./context-PSGEX2D7.js");
+          const { buildContext } = await import("./context-ALSJMTHE.js");
           const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-          const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+          const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
           const ctx = buildContext({ stack: args.stack });
           const stack = await ctx.getStack();
           const outputMap = await stack.outputs();
@@ -1792,8 +1795,53 @@ var doctor_default = defineCommand16({
         }
       }
     }
+    if (args.stack && config) {
+      process18.stdout.write("\nHardening\n");
+      try {
+        const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-BDVYW567.js");
+        const { buildContext } = await import("./context-ALSJMTHE.js");
+        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+        const ctx = buildContext({ stack: args.stack });
+        const stackObj = await ctx.getStack();
+        const outputMap = await stackObj.outputs();
+        const outputs = Object.fromEntries(
+          Object.entries(outputMap).map(([k, v]) => [k, v.value])
+        );
+        const base = extractBaseOutputs(outputs);
+        const conn = ctx.adapter.getConnectionInfo({
+          ...base,
+          privateKeyPath: config.ssh.keyPath,
+          knownHostsPath: config.ssh.knownHostsPath
+        });
+        const hardenAc = new AbortController();
+        process18.on("SIGINT", () => hardenAc.abort());
+        const provider = ctx.adapter.name;
+        const modules = resolveModules(MODULE_CATALOG, void 0, provider);
+        await withRemoteExec(conn, hardenAc.signal, async (exec) => {
+          for (const mod of modules) {
+            const result = await mod.check(exec);
+            if (result.status === "applied") {
+              success(`${mod.label.padEnd(32)} applied`);
+            } else if (result.status === "drifted") {
+              warn(`${mod.label.padEnd(32)} drifted \u2014 ${result.detail}`);
+            } else if (result.status === "missing") {
+              info(`${mod.label.padEnd(32)} not applied \u2014 run \`clawops harden\``);
+            }
+          }
+        });
+      } catch (err) {
+        failure(`Hardening checks failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
     process18.stdout.write("\n");
-    if (!nodeOk) process18.exit(1);
+    if (!nodeOk) {
+      process18.stdout.write(
+        `Run \`clawops bug\` to open a pre-filled issue at ${REPO_URL}/issues
+
+`
+      );
+      process18.exit(1);
+    }
   }
 });
 
@@ -1814,7 +1862,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-LOL2NUJ2.js");
+    const { serveMcp } = await import("./server-EXBOOIEP.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1889,8 +1937,8 @@ var wireCmd = defineCommand17({
     force: { type: "boolean", description: "Apply even if gateway version is below minimum" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-PSGEX2D7.js");
-    const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
     const ac = new AbortController();
@@ -2386,6 +2434,12 @@ var setup_default = defineCommand18({
           signal: ac.signal,
           inquirer
         });
+        await maybeHarden({
+          stackName: stackAnswers.stackName,
+          provider: "local",
+          signal: ac.signal,
+          inquirer
+        });
       } else {
         const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
         const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -2404,7 +2458,7 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-5RREMN3L.js");
+        const { applyPlan } = await import("./apply-BTZFFGAD.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2418,6 +2472,12 @@ var setup_default = defineCommand18({
           process20.exit(1);
         }
         await maybeWireGatewayMcpCloud({ stackName: stackAnswers.stackName, signal: ac.signal, inquirer });
+        await maybeHarden({
+          stackName: stackAnswers.stackName,
+          provider,
+          signal: ac.signal,
+          inquirer
+        });
       } else {
         info(`
 To deploy later:  clawops apply ${outputPath}`);
@@ -2427,8 +2487,8 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-G4UZ2FKH.js");
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { localBootstrap } = await import("./bootstrap-RY4VOSDJ.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -2510,7 +2570,7 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-FBFHATDG.js");
+  const { drainPool } = await import("./pool-JZGKPP6K.js");
   drainPool();
   const tokenPath = path3.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
@@ -2648,7 +2708,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-FBFHATDG.js");
+  const { acquireSession } = await import("./pool-JZGKPP6K.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -2695,7 +2755,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-FBFHATDG.js");
+  const { acquireSession } = await import("./pool-JZGKPP6K.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -2899,7 +2959,7 @@ async function maybeWireGatewayMcp(opts) {
   process20.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-IQXNME3D.js");
+  const { connect } = await import("./ssh-E2AMBPZY.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
   const { wireGatewayMcp } = await import("./mcp-wire-ZWIYMLEW.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
@@ -2992,6 +3052,68 @@ function instanceChoices(provider) {
   };
   return table[provider] ?? [];
 }
+async function maybeHarden(opts) {
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-BDVYW567.js");
+  const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+  const config = getConfig2();
+  if (!config) return;
+  const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
+  if (availableModules.length === 0) return;
+  process20.stdout.write("\n");
+  const { selectedIds } = await opts.inquirer.prompt([{
+    type: "checkbox",
+    name: "selectedIds",
+    message: "Apply security hardening? (Space to toggle, Enter to confirm)",
+    choices: availableModules.map((m) => ({
+      name: `${m.label}${m.defaultOn ? "" : "  (opt-in)"}`,
+      value: m.id,
+      checked: m.defaultOn
+    }))
+  }]);
+  if (selectedIds.length === 0) {
+    info("Hardening skipped. Run `clawops harden --stack " + opts.stackName + "` later.");
+    return;
+  }
+  const modules = availableModules.filter((m) => selectedIds.includes(m.id));
+  process20.stdout.write("\nApplying hardening modules...\n\n");
+  try {
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const ctx = buildContext({ stack: opts.stackName });
+    const stackObj = await ctx.getStack();
+    const outputMap = await stackObj.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: config.ssh.keyPath,
+      knownHostsPath: config.ssh.knownHostsPath
+    });
+    const { success: ok, failure: fail } = await import("./human-Z44CW7TR.js");
+    const results = await runHardening(conn, {
+      modules,
+      signal: opts.signal,
+      onProgress: (r) => {
+        process20.stdout.write(`  \xB7 ${r.module.label}
+`);
+      }
+    });
+    process20.stdout.write("\n" + formatHardenSummary(results));
+    const errors = results.filter((r) => r.error);
+    if (errors.length > 0) {
+      for (const r of errors) fail(`${r.module.label}: ${r.error}`);
+      info("Some modules failed. Run `clawops harden --stack " + opts.stackName + "` to retry.");
+    } else {
+      ok("Hardening complete.");
+    }
+  } catch (err) {
+    const { failure: fail } = await import("./human-Z44CW7TR.js");
+    fail(`Hardening failed: ${err instanceof Error ? err.message : String(err)}`);
+    info("Run `clawops harden --stack " + opts.stackName + "` to retry.");
+  }
+}
 
 // src/cli/commands/secret.ts
 import { defineCommand as defineCommand19 } from "citty";
@@ -3164,10 +3286,10 @@ var rotateCmd = defineCommand19({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-PSGEX2D7.js");
+      const { buildContext } = await import("./context-ALSJMTHE.js");
       const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QF5TT7GU.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-FBFHATDG.js");
+      const { acquireSession, drainPool } = await import("./pool-JZGKPP6K.js");
       const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
@@ -3344,26 +3466,254 @@ ${dim("Run `clawops <command> --help` for command-specific flags.")}
   }
 });
 
-// src/cli/error-handler.ts
+// src/cli/commands/bug.ts
+import { defineCommand as defineCommand21 } from "citty";
 import process22 from "process";
+import { accessSync as accessSync2, constants as constants2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+var ISSUES_URL = `${REPO_URL}/issues/new`;
+var BODY_CAP = 2e3;
+var VERSION = true ? "1.7.0" : "dev";
+async function collectContext() {
+  const nodeVersion = process22.version;
+  const os3 = `${process22.platform} ${process22.arch}`;
+  let provider = "unknown";
+  let stackCount = 0;
+  let sshKey = "unknown";
+  try {
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const config = getConfig2();
+    if (config) {
+      const stacks = Object.values(config.stacks);
+      stackCount = stacks.length;
+      provider = stacks[0]?.provider ?? "none";
+      const keyPath = config.ssh.keyPath.replace(/^~/, process22.env["HOME"] ?? "~");
+      try {
+        accessSync2(keyPath, constants2.R_OK);
+        sshKey = "present";
+      } catch {
+        sshKey = "missing";
+      }
+    } else {
+      provider = "not configured";
+      sshKey = "not configured";
+    }
+  } catch {
+  }
+  return [
+    `**clawops version:** ${VERSION}`,
+    `**Node:** ${nodeVersion}`,
+    `**OS:** ${os3}`,
+    `**Provider:** ${provider}`,
+    `**Stacks:** ${stackCount}`,
+    `**SSH key:** ${sshKey}`
+  ].join("\n");
+}
+function buildIssueUrl(title, command, context) {
+  const body = [
+    context,
+    "",
+    "**Description:**",
+    title,
+    "",
+    command ? `**Command:**
+\`${command}\`` : "",
+    "",
+    "**Steps to reproduce:**",
+    "<!-- Please describe what you did -->\n"
+  ].filter((l) => l !== void 0).join("\n").slice(0, BODY_CAP);
+  const params = new URLSearchParams({ title, body });
+  return `${ISSUES_URL}?${params.toString()}`;
+}
+function openBrowser2(url) {
+  try {
+    const cmd = process22.platform === "darwin" ? "open" : "xdg-open";
+    execSync2(`${cmd} "${url}"`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var bug_default = defineCommand21({
+  meta: {
+    name: "bug",
+    description: "Open a pre-filled GitHub issue with system context from clawops doctor"
+  },
+  args: {
+    json: { type: "boolean", description: "Emit issue URL as JSON without opening a browser" }
+  },
+  async run({ args }) {
+    const context = await collectContext();
+    let title = "";
+    let command = "";
+    if (!args.json) {
+      const { createInterface: createInterface3 } = await import("readline/promises");
+      const rl = createInterface3({ input: process22.stdin, output: process22.stdout });
+      try {
+        title = (await rl.question("Describe the issue in one line: ")).trim();
+        command = (await rl.question("Which command triggered it? (optional): ")).trim();
+      } finally {
+        rl.close();
+      }
+    }
+    const url = buildIssueUrl(title, command, context);
+    if (args.json) {
+      printJson(jsonOk({ url }));
+      return;
+    }
+    process22.stdout.write("\n");
+    info(`Opening: ${url}`);
+    process22.stdout.write("\n");
+    const opened = openBrowser2(url);
+    if (!opened) {
+      process22.stdout.write(`Open this URL to file the issue:
+${url}
+`);
+    }
+  }
+});
+
+// src/cli/commands/harden.ts
+import { defineCommand as defineCommand22 } from "citty";
+import process23 from "process";
+var harden_default = defineCommand22({
+  meta: {
+    name: "harden",
+    description: "Apply security hardening modules to a deployed stack"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    options: { type: "string", description: "Comma-separated module IDs to run (default: all defaultOn modules)" },
+    list: { type: "boolean", description: "List available modules and exit" },
+    "dry-run": { type: "boolean", description: "Check current state without applying changes" },
+    yes: { type: "boolean", description: "Skip confirmation prompt" },
+    json: { type: "boolean", description: "Emit structured JSON output" }
+  },
+  async run({ args }) {
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-BDVYW567.js");
+    const { buildContext } = await import("./context-ALSJMTHE.js");
+    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    if (args.list) {
+      process23.stdout.write("\nAvailable hardening modules:\n\n");
+      for (const mod of MODULE_CATALOG) {
+        const on = mod.defaultOn ? chalk.green("ON ") : chalk.dim("off");
+        const providers = mod.providers === "all" ? "all" : mod.providers.join(", ");
+        process23.stdout.write(
+          `  ${on}  ${mod.id.padEnd(28)} ${mod.label}  [${providers}]
+`
+        );
+      }
+      process23.stdout.write("\n");
+      return;
+    }
+    const config = getConfig2();
+    if (!config) {
+      failure("No clawops config found. Run `clawops init` first.");
+      process23.exit(1);
+    }
+    const ctx = buildContext({ stack: args.stack });
+    const provider = ctx.adapter.name;
+    const modules = resolveModules(MODULE_CATALOG, args.options, provider);
+    if (modules.length === 0) {
+      warn("No modules selected for this provider. Use --options to specify modules or --list to see all.");
+      return;
+    }
+    if (!args.json) {
+      process23.stdout.write("\nModules to run:\n");
+      for (const mod of modules) {
+        const flag = mod.defaultOn ? "" : chalk.yellow(" [opt-in]");
+        process23.stdout.write(`  \xB7 ${mod.label}${flag}
+`);
+      }
+      process23.stdout.write("\n");
+    }
+    if (!args["dry-run"] && !args.yes && !args.json) {
+      const { createInterface: createInterface3 } = await import("readline/promises");
+      const rl = createInterface3({ input: process23.stdin, output: process23.stdout });
+      const answer = await rl.question("Apply these hardening modules? [y/N] ");
+      rl.close();
+      if (!answer.toLowerCase().startsWith("y")) {
+        info("Aborted.");
+        return;
+      }
+    }
+    const ac = new AbortController();
+    process23.on("SIGINT", () => ac.abort());
+    process23.on("SIGTERM", () => ac.abort());
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const stackObj = await ctx.getStack();
+    const outputMap = await stackObj.outputs();
+    const outputs = Object.fromEntries(
+      Object.entries(outputMap).map(([k, v]) => [k, v.value])
+    );
+    const base = extractBaseOutputs(outputs);
+    const conn = ctx.adapter.getConnectionInfo({
+      ...base,
+      privateKeyPath: config.ssh.keyPath,
+      knownHostsPath: config.ssh.knownHostsPath
+    });
+    if (!args.json) {
+      process23.stdout.write(args["dry-run"] ? "Checking hardening state...\n\n" : "Applying hardening...\n\n");
+    }
+    const results = await runHardening(conn, {
+      modules,
+      dryRun: args["dry-run"],
+      signal: ac.signal,
+      onProgress: args.json ? void 0 : (r) => {
+        const icon = r.error ? chalk.red("\u2717") : r.applyResult?.changed ? chalk.green("\u2713") : chalk.dim("\xB7");
+        process23.stdout.write(`  ${icon}  ${r.module.label}
+`);
+      }
+    });
+    if (args.json) {
+      printJson(jsonOk({
+        dryRun: args["dry-run"] ?? false,
+        results: results.map((r) => ({
+          id: r.module.id,
+          status: r.checkResult.status,
+          changed: r.applyResult?.changed ?? false,
+          detail: r.applyResult?.detail ?? r.checkResult.detail,
+          error: r.error,
+          durationMs: r.durationMs
+        }))
+      }));
+      return;
+    }
+    process23.stdout.write("\n" + formatHardenSummary(results));
+    const errors = results.filter((r) => r.error);
+    if (errors.length > 0) {
+      process23.stdout.write("\n");
+      for (const r of errors) {
+        failure(`${r.module.label}: ${r.error}`);
+      }
+      process23.exit(1);
+    }
+    if (!args["dry-run"]) {
+      success("Hardening complete.");
+    }
+  }
+});
+
+// src/cli/error-handler.ts
+import process24 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process22.exit(err.exitCode);
+    process24.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process22.env["DEBUG"]) {
-      process22.stderr.write(err.stack ?? "\n");
+    if (process24.env["DEBUG"]) {
+      process24.stderr.write(err.stack ?? "\n");
     }
-    process22.exit(1);
+    process24.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process22.exit(1);
+  process24.exit(1);
 }
 
 // src/cli/index.ts
-var main = defineCommand21({
+var main = defineCommand23({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -3399,7 +3749,9 @@ var main = defineCommand21({
     setup: setup_default,
     secret: secret_default,
     monitor: monitor_default,
-    help: help_default
+    help: help_default,
+    bug: bug_default,
+    harden: harden_default
   }
 });
 try {