@clawops/cli 1.7.7 → 1.7.8

package/README.md

@@ -12,6 +12,33 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
+## What's new in v1.7.8
+
+**`clawops mcp wire` never wired anything.** It wrote `gateway.mcpClients` — a key OpenClaw
+does not have, checked against the config schemas of `2026.4.5`, `2026.7.1-2` and `2026.9.2`.
+The real key is top-level `mcp.servers`. Nothing on this line validated the write, so clawops
+stored a key nothing read, restarted your gateway, and reported success. The entry also used
+stdio with `command: "clawops"`, which spawns inside the gateway container where clawops is
+not installed — so even the right key would not have worked.
+
+It delegates to `openclaw mcp add` now, which probes the server before saving: "wired" means
+the gateway connected. You run the server yourself, since clawops is not on the gateway host:
+
+```bash
+clawops mcp serve --http 18790 --bind 0.0.0.0 --token "$(openssl rand -hex 16)"
+clawops mcp wire --stack prod --token <same token>
+```
+
+**`clawops mcp serve --http` now requires a token off loopback — this may stop your server.**
+It had no authentication at all while exposing every tool, `clawops_destroy` included. It now
+requires a bearer token and refuses to start when bound off-loopback without one. If you run
+it with `--bind 0.0.0.0`, pass `--token` (or set `CLAWOPS_MCP_TOKEN`) before upgrading.
+
+**And it only ever served one client.** One transport for the whole process meant the first
+client to connect claimed it; every later one got `"Server already initialized"`.
+
+---
+
 ## What's new in v1.7.3
 
 **README maintenance.** The release-notes section had grown to four versions and was missing

package/dist/{server-U7C2RQWL.js → chunk-QQNKBTYZ.js}

@@ -2,14 +2,12 @@
 import {
   applyPlan
 } from "./chunk-35WVQY3X.js";
-import "./chunk-6ZFIFDBJ.js";
-import "./chunk-BOPSG2LI.js";
 import {
   extractBaseOutputs
 } from "./chunk-3QJBNAHW.js";
 import {
   generatePlan
-} from "./chunk-4AJ4F2PJ.js";
+} from "./chunk-RAAONHW3.js";
 import {
   validatePlan
 } from "./chunk-6X45DDGH.js";
@@ -37,11 +35,6 @@ import {
 import {
   buildContext
 } from "./chunk-P5LKWRPL.js";
-import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
-import "./chunk-3XK66DKK.js";
-import "./chunk-Q7NQY5HV.js";
-import "./chunk-A2I76FTA.js";
 import {
   getConfig,
   getConfigDir
@@ -53,7 +46,7 @@ import {
 
 // src/mcp/server.ts
 import { createServer } from "http";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID5, timingSafeEqual } from "crypto";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -1308,27 +1301,58 @@ If none of the above resolves the issue:
 }
 
 // src/mcp/server.ts
+var MCP_HTTP_PORT = 18790;
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
+function isLoopbackBind(bind) {
+  return LOOPBACK.has(bind);
+}
+function authRequirement(bind, token) {
+  if (isLoopbackBind(bind) || token) return { ok: true };
+  return {
+    ok: false,
+    error: `Refusing to serve MCP on ${bind} without a token. This server exposes every clawops tool, including destructive ones, and has no other authentication. Pass --token <value> (or set CLAWOPS_MCP_TOKEN), or bind to 127.0.0.1 and reach it through an SSH tunnel.`
+  };
+}
+function tokenMatches(expected, presented) {
+  const a = Buffer.from(expected);
+  const b = Buffer.from(presented);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function bearerFrom(header) {
+  if (!header) return void 0;
+  const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
+  return match?.[1]?.trim();
+}
 async function serveMcp(opts) {
-  const { version } = await import("./package-DHSANJT6.js");
-  const server = new McpServer({ name: "clawops", version });
-  registerTools(server, opts);
-  registerResources(server);
-  registerPrompts(server);
+  const { version } = await import("./package-QYZFN3FP.js");
+  const makeServer = () => {
+    const server = new McpServer({ name: "clawops", version });
+    registerTools(server, opts);
+    registerResources(server);
+    registerPrompts(server);
+    return server;
+  };
   if (opts.port) {
     const bind = opts.bind ?? "127.0.0.1";
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID5() });
+    const token = opts.token ?? process.env["CLAWOPS_MCP_TOKEN"];
+    const allowed = authRequirement(bind, token);
+    if (!allowed.ok) throw new Error(allowed.error);
+    const sessions = /* @__PURE__ */ new Map();
     const httpServer = createServer((req, res) => {
-      void transport.handleRequest(req, res);
+      void handleHttp(req, res, sessions, makeServer, token);
     });
     await new Promise((resolve, reject) => {
       httpServer.once("error", reject);
       httpServer.listen(opts.port, bind, resolve);
     });
-    process.stderr.write(`[clawops] MCP HTTP server listening on ${bind}:${opts.port}
-`);
-    await server.connect(transport);
+    process.stderr.write(
+      `[clawops] MCP HTTP server listening on ${bind}:${opts.port}${token ? " (bearer token required)" : " (loopback, no token)"}
+`
+    );
     await new Promise((resolve) => httpServer.once("close", resolve));
   } else {
+    const server = makeServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
     await new Promise((resolve) => {
@@ -1336,6 +1360,55 @@ async function serveMcp(opts) {
     });
   }
 }
+async function handleHttp(req, res, sessions, makeServer, token) {
+  if (token) {
+    const presented = bearerFrom(req.headers["authorization"]);
+    if (!presented || !tokenMatches(token, presented)) {
+      res.writeHead(401, { "content-type": "application/json", "www-authenticate": "Bearer" });
+      res.end(
+        JSON.stringify({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Unauthorized" },
+          id: null
+        })
+      );
+      return;
+    }
+  }
+  const sessionId = req.headers["mcp-session-id"];
+  const existing = typeof sessionId === "string" ? sessions.get(sessionId) : void 0;
+  if (existing) {
+    await existing.handleRequest(req, res);
+    return;
+  }
+  if (typeof sessionId === "string") {
+    res.writeHead(404, { "content-type": "application/json" });
+    res.end(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        error: { code: -32001, message: "Unknown session" },
+        id: null
+      })
+    );
+    return;
+  }
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: () => randomUUID5(),
+    onsessioninitialized: (id) => {
+      sessions.set(id, transport);
+    }
+  });
+  transport.onclose = () => {
+    if (transport.sessionId) sessions.delete(transport.sessionId);
+  };
+  await makeServer().connect(transport);
+  await transport.handleRequest(req, res);
+}
+
 export {
+  MCP_HTTP_PORT,
+  isLoopbackBind,
+  authRequirement,
+  bearerFrom,
   serveMcp
 };

package/dist/{chunk-4AJ4F2PJ.js → chunk-RAAONHW3.js}

@@ -45,7 +45,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-DHSANJT6.js");
+  const { version } = await import("./package-QYZFN3FP.js");
   const config = getConfig();
   const instanceType = intent.instanceType ?? "small";
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-VUCNZXQS.js");

package/dist/cli.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import {
-  monitor_default,
-  validateOpenclawConfig
-} from "./chunk-FNS56UQY.js";
 import {
   MCP_APPS,
   buildMcpEntry,
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
+import {
+  monitor_default,
+  validateOpenclawConfig
+} from "./chunk-FNS56UQY.js";
 import "./chunk-DQDAWNGB.js";
 import {
   IMAGE_INSPECT_CMD,
@@ -501,7 +501,7 @@ var plan_default = defineCommand5({
   },
   async run({ args }) {
     const { buildContext } = await import("./context-5LCUG2QR.js");
-    const { generatePlan } = await import("./generate-PAGV574G.js");
+    const { generatePlan } = await import("./generate-ELD7QF5Z.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -1895,17 +1895,19 @@ var serveCmd = defineCommand17({
   },
   args: {
     http: { type: "string", description: "HTTP port for standalone mode" },
-    bind: { type: "string", description: "Bind address for HTTP mode" },
+    bind: { type: "string", description: "Bind address for HTTP mode (default 127.0.0.1)" },
+    token: { type: "string", description: "Bearer token required on every HTTP request. Required unless bound to loopback; also read from CLAWOPS_MCP_TOKEN" },
     "read-only": { type: "boolean", description: "Only register read toolset" },
     "no-destructive": { type: "boolean", description: "Filter out destructive tools" },
     toolsets: { type: "string", description: "Comma-separated toolsets to enable" },
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-U7C2RQWL.js");
+    const { serveMcp } = await import("./server-FWTOSSZP.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
+      token: args.token,
       readOnly: Boolean(args["read-only"]),
       noDestructive: Boolean(args["no-destructive"]),
       toolsets: args.toolsets ? args.toolsets.split(",").map((s) => s.trim()) : void 0,
@@ -1974,13 +1976,16 @@ var wireCmd = defineCommand17({
   },
   args: {
     stack: { type: "string", description: "Target stack name" },
-    force: { type: "boolean", description: "Apply even if gateway version is below minimum" }
+    url: { type: "string", description: "Where the gateway should reach clawops (default http://host.docker.internal:18790/)" },
+    token: { type: "string", description: "Bearer token the clawops MCP server requires" },
+    rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
     const { buildContext } = await import("./context-5LCUG2QR.js");
     const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-FR3W2CB6.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-ZMIVFAUC.js");
+    const { MCP_HTTP_PORT } = await import("./server-FWTOSSZP.js");
     const ac = new AbortController();
     process19.on("SIGINT", () => {
       ac.abort();
@@ -2021,21 +2026,37 @@ var wireCmd = defineCommand17({
     const spin = spinner(`Connecting to ${conn.host}...`);
     const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
     try {
-      spin.text = "Reading gateway config...";
-      const result = await wireGatewayMcp(session, ac.signal, { force: Boolean(args.force) });
-      if (result.status === "version-blocked") {
-        spin.fail("Gateway version is too old for MCP client support.");
-        warn(`Gateway version ${result.version} requires at least 2026.4 for MCP client support.`);
-        info("Upgrade OpenClaw and re-run, or bypass with: clawops mcp wire --force");
+      spin.text = "Asking the gateway to connect to clawops...";
+      const result = await wireGatewayMcp(session, ac.signal, {
+        url: typeof args.url === "string" ? args.url : void 0,
+        token: typeof args.token === "string" ? args.token : void 0,
+        rewire: Boolean(args.rewire)
+      });
+      if (result.status === "unsupported") {
+        spin.fail("This gateway has no `openclaw mcp add`, so clawops cannot wire it.");
+        info("OpenClaw 2026.4.5 ships `openclaw mcp` with only `list` and `serve`.");
+        info("Upgrade the gateway to 2026.7.1-2 or later, then re-run this command.");
         process19.exit(1);
       }
-      if (result.rewired) {
-        spin.succeed("Re-wiring clawops MCP client \u2014 previous entry replaced.");
-      } else {
-        spin.succeed("Gateway MCP client wired.");
+      if (result.status === "exists") {
+        spin.info("The gateway already has a clawops MCP server configured.");
+        info(`Pointing at ${result.url}. Replace it with: clawops mcp wire --rewire`);
+        return;
       }
+      if (result.status === "probe-failed") {
+        spin.fail("The gateway could not connect to clawops. Nothing was changed.");
+        failure(result.error);
+        warn("clawops does not run on the gateway host. Start it where the gateway can reach it:");
+        info(`  clawops mcp serve --http ${MCP_HTTP_PORT} --bind 0.0.0.0 --token <token>`);
+        info(`Then re-run: clawops mcp wire --url ${result.url} --token <token>`);
+        process19.exit(1);
+      }
+      spin.succeed(
+        result.rewired ? "Re-wired the gateway to clawops \u2014 previous entry replaced." : "Gateway wired to clawops, and the connection was verified."
+      );
       success("The gateway's AI can now run clawops commands.");
       info('Try asking it: "check if my stack is healthy"');
+      warn("The MCP server exposes destructive tools. Keep it bound where only the gateway can reach it.");
     } catch (err) {
       spin.fail("Failed to wire gateway MCP client.");
       failure(err instanceof Error ? err.message : String(err));
@@ -3004,7 +3025,7 @@ async function maybeWireGatewayMcp(opts) {
   if (!wireGateway) return;
   const { connect } = await import("./ssh-CNJNLM3E.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-FR3W2CB6.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-ZMIVFAUC.js");
   const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3017,9 +3038,16 @@ async function maybeWireGatewayMcp(opts) {
   });
   try {
     const result = await wireGatewayMcp(session, opts.signal ?? AbortSignal.timeout(3e4));
-    if (result.status === "version-blocked") {
-      spin.warn(`Gateway version ${result.version} is too old for MCP client support (requires \u2265 2026.4).`);
-      info("Upgrade OpenClaw and run: clawops mcp wire --stack " + opts.stackName);
+    if (result.status === "unsupported") {
+      spin.warn("This gateway has no `openclaw mcp add`, so nothing was wired.");
+      info("OpenClaw 2026.4.5 ships `openclaw mcp` with only `list` and `serve`.");
+      info("Upgrade to 2026.7.1-2 and run: clawops mcp wire --stack " + opts.stackName);
+    } else if (result.status === "probe-failed") {
+      spin.warn("The gateway could not reach clawops, so nothing was wired.");
+      info("clawops does not run on the gateway host. Start it where the gateway can reach it,");
+      info("then run: clawops mcp wire --stack " + opts.stackName + " --url <url> --token <token>");
+    } else if (result.status === "exists") {
+      spin.info("The gateway is already wired to clawops.");
     } else {
       spin.succeed(result.rewired ? "Gateway MCP client re-wired." : "Gateway MCP client wired.");
       success("The gateway's AI can now run clawops commands.");
@@ -3522,7 +3550,7 @@ import { accessSync as accessSync2, constants as constants2 } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "1.7.7" : "dev";
+var VERSION = true ? "1.7.8" : "dev";
 async function collectContext() {
   const nodeVersion = process22.version;
   const os3 = `${process22.platform} ${process22.arch}`;
@@ -3762,7 +3790,7 @@ function handleError(err) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "1.7.7" : "dev";
+var CLI_VERSION = true ? "1.7.8" : "dev";
 var main = defineCommand23({
   meta: {
     name: "clawops",

package/dist/{generate-PAGV574G.js → generate-ELD7QF5Z.js}

@@ -2,7 +2,7 @@
 import {
   generatePlan,
   planId
-} from "./chunk-4AJ4F2PJ.js";
+} from "./chunk-RAAONHW3.js";
 import "./chunk-6X45DDGH.js";
 import "./chunk-P5LKWRPL.js";
 import "./chunk-PVUVI35Y.js";

package/dist/mcp-wire-ZMIVFAUC.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import {
+  MCP_HTTP_PORT
+} from "./chunk-QQNKBTYZ.js";
+import "./chunk-35WVQY3X.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-BOPSG2LI.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-RAAONHW3.js";
+import "./chunk-6X45DDGH.js";
+import "./chunk-FNS56UQY.js";
+import "./chunk-DQDAWNGB.js";
+import "./chunk-SEZMVVAS.js";
+import "./chunk-P5LKWRPL.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-PVUVI35Y.js";
+import "./chunk-3XK66DKK.js";
+import "./chunk-Q7NQY5HV.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+
+// src/cli/mcp-wire.ts
+var GATEWAY_MCP_NAME = "clawops";
+function defaultGatewayMcpUrl(port = MCP_HTTP_PORT) {
+  return `http://host.docker.internal:${port}/`;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+var OC = "docker exec openclaw openclaw mcp";
+async function supportsMcpAdd(session, signal) {
+  const help = await session.exec(`${OC} add --help`, signal);
+  return help.code === 0;
+}
+async function wireGatewayMcp(session, signal, opts = {}) {
+  const url = opts.url ?? defaultGatewayMcpUrl();
+  if (!await supportsMcpAdd(session, signal)) return { status: "unsupported", url };
+  const existing = await session.exec(`${OC} show ${GATEWAY_MCP_NAME}`, signal);
+  const alreadyWired = existing.code === 0;
+  if (alreadyWired && !opts.rewire) return { status: "exists", url };
+  if (alreadyWired) {
+    const removed = await session.exec(`${OC} unset ${GATEWAY_MCP_NAME}`, signal);
+    if (removed.code !== 0) {
+      return {
+        status: "probe-failed",
+        error: `Could not remove the existing entry: ${removed.stderr.trim() || removed.stdout.trim()}`,
+        url
+      };
+    }
+  }
+  const flags = [
+    `--transport streamable-http`,
+    `--url ${shellQuote(url)}`,
+    ...opts.token ? [`--header ${shellQuote(`Authorization=Bearer ${opts.token}`)}`] : []
+  ].join(" ");
+  const added = await session.exec(`${OC} add ${GATEWAY_MCP_NAME} ${flags}`, signal);
+  if (added.code !== 0) {
+    return {
+      status: "probe-failed",
+      error: added.stderr.trim() || added.stdout.trim() || `exit ${added.code}`,
+      url
+    };
+  }
+  await session.exec(`${OC} reload`, signal);
+  return { status: "wired", rewired: alreadyWired, url };
+}
+export {
+  GATEWAY_MCP_NAME,
+  defaultGatewayMcpUrl,
+  wireGatewayMcp
+};

package/dist/{package-DHSANJT6.js → package-QYZFN3FP.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.7.7";
+var version = "1.7.8";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {
@@ -35,6 +35,7 @@ var scripts = {
   test: "vitest run",
   "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
   "test:changed": "vitest --changed",
+  "test:mutation": "node scripts/dev/mutation-check.mjs",
   "test:integration": "vitest run --config vitest.integration.config.ts",
   typecheck: "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
   lint: "eslint --max-warnings=0 src tests scripts",

package/dist/server-FWTOSSZP.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import {
+  MCP_HTTP_PORT,
+  authRequirement,
+  bearerFrom,
+  isLoopbackBind,
+  serveMcp
+} from "./chunk-QQNKBTYZ.js";
+import "./chunk-35WVQY3X.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-BOPSG2LI.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-RAAONHW3.js";
+import "./chunk-6X45DDGH.js";
+import "./chunk-FNS56UQY.js";
+import "./chunk-DQDAWNGB.js";
+import "./chunk-SEZMVVAS.js";
+import "./chunk-P5LKWRPL.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-PVUVI35Y.js";
+import "./chunk-3XK66DKK.js";
+import "./chunk-Q7NQY5HV.js";
+import "./chunk-A2I76FTA.js";
+import "./chunk-CX5SL5HP.js";
+import "./chunk-KGXPLI7W.js";
+export {
+  MCP_HTTP_PORT,
+  authRequirement,
+  bearerFrom,
+  isLoopbackBind,
+  serveMcp
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawops/cli",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
   "type": "module",
   "bin": {
@@ -32,6 +32,7 @@
     "test": "vitest run",
     "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
     "test:changed": "vitest --changed",
+    "test:mutation": "node scripts/dev/mutation-check.mjs",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "typecheck": "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
     "lint": "eslint --max-warnings=0 src tests scripts",

package/dist/mcp-wire-FR3W2CB6.js

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-import {
-  atomicWriteConfig,
-  deepMerge,
-  readRemoteConfig,
-  restartGateway
-} from "./chunk-SEZMVVAS.js";
-import "./chunk-EI7CQQ7D.js";
-
-// src/cli/mcp-wire.ts
-var GATEWAY_MCP_MIN_VERSION = "2026.4";
-var GATEWAY_MCP_ENTRY = {
-  command: "clawops",
-  args: ["mcp", "serve"],
-  transport: "stdio"
-};
-function versionAtLeast(version, min) {
-  const [vy = 0, vm = 0] = version.split(".").map(Number);
-  const [my = 0, mm = 0] = min.split(".").map(Number);
-  if (vy !== my) return vy > my;
-  return vm >= mm;
-}
-async function wireGatewayMcp(session, signal, opts = {}) {
-  const cfg = await readRemoteConfig(session, signal);
-  const version = cfg["meta"]?.["lastTouchedVersion"];
-  if (version && !versionAtLeast(version, GATEWAY_MCP_MIN_VERSION) && !opts.force) {
-    return { status: "version-blocked", version };
-  }
-  const mcpClients = cfg["gateway"]?.["mcpClients"];
-  const rewired = !!mcpClients?.["clawops"];
-  const updated = deepMerge(cfg, {
-    gateway: {
-      mcpClients: {
-        clawops: GATEWAY_MCP_ENTRY
-      }
-    }
-  });
-  await atomicWriteConfig(session, updated, signal);
-  await restartGateway(session, signal);
-  return { status: "wired", rewired };
-}
-export {
-  GATEWAY_MCP_ENTRY,
-  GATEWAY_MCP_MIN_VERSION,
-  wireGatewayMcp
-};