@clawops/cli 1.7.9 → 2.0.0

package/dist/cli.js

@@ -6,21 +6,26 @@ import {
 } from "./chunk-OIGTOLB3.js";
 import {
   monitor_default,
-  validateOpenclawConfig
-} from "./chunk-FNS56UQY.js";
-import "./chunk-DQDAWNGB.js";
+  runDiagnostics
+} from "./chunk-GYV4KNW7.js";
 import {
-  IMAGE_INSPECT_CMD,
-  gatewayRunCommand,
-  imageForRestart,
-  versionOf
-} from "./chunk-SEZMVVAS.js";
-import "./chunk-P5LKWRPL.js";
-import "./chunk-EI7CQQ7D.js";
+  GATEWAY_LOGS_PROBE,
+  chooseLogSource,
+  containerLogsCommand,
+  gatewayLogsCommand
+} from "./chunk-SBLQH2TJ.js";
+import {
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+import {
+  execPrivileged,
+  execPrivilegedWithInput,
+  streamPrivileged
+} from "./chunk-NUDIHZEH.js";
 import {
   resolveSpecDir
-} from "./chunk-PVUVI35Y.js";
-import "./chunk-3XK66DKK.js";
+} from "./chunk-JW5A7E3X.js";
 import {
   REPO_URL,
   chalk,
@@ -31,7 +36,6 @@ import {
   success,
   warn
 } from "./chunk-Q7NQY5HV.js";
-import "./chunk-A2I76FTA.js";
 import {
   getConfig,
   getConfigDir,
@@ -42,9 +46,23 @@ import {
   ClawopsError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
+import {
+  CONFIG_FILENAME,
+  CONTAINER_UID,
+  GATEWAY_PORT,
+  IMAGE_INSPECT_CMD,
+  PUBLISH_INSPECT_CMD,
+  STATE_DIR_HOST_LINUX,
+  configPathForOS,
+  gatewayRunCommand,
+  imageForRestart,
+  publishForRestart,
+  versionOf
+} from "./chunk-6TIYVHPX.js";
+import "./chunk-EI7CQQ7D.js";
 
 // src/cli/index.ts
-import { defineCommand as defineCommand23, runMain } from "citty";
+import { defineCommand as defineCommand24, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
@@ -213,11 +231,12 @@ var up_default = defineCommand2({
     "no-wait": { type: "boolean", description: "Return immediately without waiting for healthy state" },
     "openclaw-version": { type: "string", description: "OpenClaw release (e.g. 2026.7.1-2). Moving tags are resolved and range-checked" },
     stack: { type: "string", description: "Target stack name" },
-    config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" }
+    config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" },
+    "gateway-port": { type: "string", description: `Host port to publish the gateway on (default ${GATEWAY_PORT}, local provider only \u2014 cloud stacks set spec.network.gatewayPort in the plan)` }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
-    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-VUCNZXQS.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
     const openclawVersion = await guardOpenclawVersion(requestedVersion);
@@ -229,7 +248,8 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-HL4DNUNG.js");
+      const { localBootstrap } = await import("./bootstrap-DMRPWJGN.js");
+      const gatewayPort = parseGatewayPort(args["gateway-port"]);
       const abortController = new AbortController();
       process3.on("SIGINT", () => abortController.abort());
       process3.on("SIGTERM", () => abortController.abort());
@@ -243,6 +263,7 @@ var up_default = defineCommand2({
           knownHostsPath: ctx.config.ssh.knownHostsPath,
           openclawVersion,
           stackName: ctx.stackName,
+          gatewayPort,
           noWait: Boolean(args["no-wait"]),
           signal: abortController.signal
         });
@@ -322,9 +343,9 @@ var up_default = defineCommand2({
   }
 });
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-CNJNLM3E.js");
+  const { connect } = await import("./ssh-B3NZAU4I.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QDLN4UMG.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-Z6IIZR3D.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -349,6 +370,14 @@ async function applyLocalConfigOverlay(opts) {
     session.close();
   }
 }
+function parseGatewayPort(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return void 0;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new UsageError(`--gateway-port must be a port number between 1 and 65535, got "${raw}"`);
+  }
+  return port;
+}
 
 // src/cli/commands/down.ts
 import { defineCommand as defineCommand3 } from "citty";
@@ -364,7 +393,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -428,7 +457,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -500,8 +529,8 @@ var plan_default = defineCommand5({
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
-    const { generatePlan } = await import("./generate-OAGYT3VH.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { generatePlan } = await import("./generate-2XV2GSP2.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -544,6 +573,7 @@ var plan_default = defineCommand5({
     const { spec, metadata } = plan;
     const sshCidrs = spec.network.allowedSshCidrs.join(", ") || "(none)";
     const gatewayCidrs = spec.network.allowedGatewayCidrs.join(", ") || "(none)";
+    const publish = spec.network.publishGateway ?? "loopback";
     process7.stderr.write(
       `
 Plan: ${metadata.name}  (${spec.provider}${spec.region ? ` / ${spec.region}` : ""})
@@ -551,6 +581,7 @@ Plan: ${metadata.name}  (${spec.provider}${spec.region ? ` / ${spec.region}` : "
   OpenClaw:  ${spec.openclaw.version}
   SSH CIDRs: ${sshCidrs}
   Gateway:   ${gatewayCidrs}
+  Published: ${publish === "all" ? "0.0.0.0 \u2014 reachable from the network; plaintext HTTP unless you add TLS" : "127.0.0.1 only \u2014 use `clawops tunnel` or a proxy on the host"}
 `
     );
     if (plan.diff) {
@@ -590,8 +621,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-CFQ4FH2T.js");
-    const { applyPlan } = await import("./apply-F3KY2HTB.js");
+    const { validatePlan } = await import("./validate-BOQRWX4F.js");
+    const { applyPlan } = await import("./apply-AM5HERE7.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -657,8 +688,8 @@ ${validation.errors.join("\n")}`);
     const spin = spinner(`Applying plan for stack "${typedPlan.spec.stackName}"\u2026`);
     try {
       const result = await applyPlan(typedPlan, {
-        onOutput: (line) => {
-          spin.text = line.trim() || spin.text;
+        onOutput: (line2) => {
+          spin.text = line2.trim() || spin.text;
         },
         signal: abortController.signal,
         confirmDrift: args.yes ? void 0 : async () => {
@@ -707,7 +738,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -774,8 +805,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -861,9 +892,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-QGFQRMGU.js");
+    const { acquireSession } = await import("./pool-EX4ZTA5P.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -926,12 +957,13 @@ var logs_default = defineCommand10({
     stack: { type: "string", description: "Target stack name" },
     follow: { type: "boolean", alias: "f", description: "Follow log output" },
     tail: { type: "string", description: "Number of lines to show from end (default: 100)" },
-    since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h)" }
+    since: { type: "string", description: "Show logs since duration (e.g. 5m, 1h). Reads container output \u2014 the gateway log command has no time filter" },
+    json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -950,18 +982,7 @@ var logs_default = defineCommand10({
     });
     const tailLines = typeof args.tail === "string" ? parseInt(args.tail, 10) : 100;
     const follow = Boolean(args.follow);
-    const sinceFlag = typeof args.since === "string" ? `--since "${args.since}"` : "";
-    const followFlag = follow ? "-f" : "";
-    const command = [
-      "journalctl -u openclaw",
-      `-n ${tailLines}`,
-      followFlag,
-      sinceFlag,
-      "2>/dev/null",
-      "|| docker logs openclaw",
-      `-n ${tailLines}`,
-      follow ? "-f" : ""
-    ].filter(Boolean).join(" ");
+    const since = typeof args.since === "string" ? args.since : void 0;
     const abortController = new AbortController();
     process12.on("SIGINT", () => abortController.abort());
     process12.on("SIGTERM", () => abortController.abort());
@@ -976,8 +997,13 @@ var logs_default = defineCommand10({
     });
     spin.stop();
     try {
+      const probe = since ? { stdout: "" } : await execPrivileged(session, GATEWAY_LOGS_PROBE, abortController.signal);
+      const choice = chooseLogSource({ since, gatewayReachable: probe.stdout.trim() === "ok" });
+      const opts = { tail: tailLines, follow, since, json: Boolean(args.json) };
+      const command = choice.source === "gateway" ? gatewayLogsCommand(opts) : containerLogsCommand(opts);
+      info(`Logs: ${choice.source} \u2014 ${choice.reason}`);
       if (follow) {
-        const logStream = await session.stream(command, abortController.signal);
+        const logStream = await streamPrivileged(session, command, abortController.signal);
         logStream.pipe(process12.stdout);
         await new Promise((resolve) => {
           logStream.on("end", resolve);
@@ -985,7 +1011,7 @@ var logs_default = defineCommand10({
           abortController.signal.addEventListener("abort", () => resolve(), { once: true });
         });
       } else {
-        const result = await session.exec(command, abortController.signal);
+        const result = await execPrivileged(session, command, abortController.signal);
         process12.stdout.write(result.stdout);
         if (result.stderr) process12.stderr.write(result.stderr);
       }
@@ -999,10 +1025,9 @@ var logs_default = defineCommand10({
 // src/cli/commands/config.ts
 import { defineCommand as defineCommand11 } from "citty";
 import process13 from "process";
-var OPENCLAW_CONFIG = "/home/clawops/openclaw.json";
-var OPENCLAW_TMP = "/tmp/clawops-config.json.tmp";
+var OPENCLAW_CONFIG = configPathForOS("Linux");
 function dockerRunCmd(image) {
-  return gatewayRunCommand({ image, configPath: OPENCLAW_CONFIG });
+  return gatewayRunCommand({ image, stateDir: STATE_DIR_HOST_LINUX });
 }
 function getPath(obj, dotKey) {
   return dotKey.split(".").reduce((cur, k) => {
@@ -1042,9 +1067,9 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1100,12 +1125,19 @@ var config_default = defineCommand11({
         return;
       }
       if (action === "validate") {
-        const issues = validateOpenclawConfig(cfg);
-        if (issues.length === 0) {
-          success("Config is valid.");
+        const { validateConfig } = await import("./config-validate-K2N6XLDX.js");
+        const yaml = await import("./js-yaml-PTEEG4FO.js");
+        const { loadVersionSpec } = await import("./versions-W5LRQCAJ.js");
+        const spec = loadVersionSpec(yaml);
+        const { errors, warnings } = await validateConfig(cfg, {
+          schemaCapturedFrom: spec.runtime?.configSchemaCapturedFrom
+        });
+        for (const w of warnings) warn(w);
+        if (errors.length === 0) {
+          success(warnings.length === 0 ? "Config is valid." : "Config is valid, with notes.");
         } else {
-          for (const issue of issues) warn(issue);
-          failure(`Config has ${issues.length} issue(s).`);
+          for (const e of errors) failure(e);
+          failure(`Config has ${errors.length} error(s).`);
           process13.exit(1);
         }
         return;
@@ -1125,23 +1157,23 @@ var config_default = defineCommand11({
         process13.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
         return;
       }
-      const json = JSON.stringify(cfg, null, 2);
-      const b64 = Buffer.from(json, "utf-8").toString("base64");
-      const writeCmd = `echo '${b64}' | base64 -d > ${OPENCLAW_TMP} && mv ${OPENCLAW_TMP} ${OPENCLAW_CONFIG} && chown clawops:clawops ${OPENCLAW_CONFIG}`;
-      const writeResult = await session.exec(writeCmd, abortController.signal);
-      if (writeResult.code !== 0) {
-        failure(`Failed to write config: ${writeResult.stderr}`);
+      const { atomicWriteConfig } = await import("./remote-config-Z6IIZR3D.js");
+      try {
+        await atomicWriteConfig(session, cfg, abortController.signal);
+      } catch (err) {
+        failure(err.message);
         process13.exit(1);
       }
       success(`config ${action}: ${key ?? "(all)"}`);
       if (args.restart) {
         info("Restarting gateway...");
-        const imgResult = await session.exec(
+        const imgResult = await execPrivileged(
+          session,
           `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo 'ghcr.io/openclaw/openclaw:stable'`,
           abortController.signal
         );
         const image = imgResult.stdout.trim();
-        const restartResult = await session.exec(dockerRunCmd(image), abortController.signal);
+        const restartResult = await execPrivileged(session, dockerRunCmd(image), abortController.signal);
         if (restartResult.code !== 0) {
           failure(`Restart failed: ${restartResult.stderr}`);
           process13.exit(1);
@@ -1161,19 +1193,27 @@ import process14 from "process";
 var agents_default = defineCommand12({
   meta: {
     name: "agents",
-    description: "Manage OpenClaw agents (list | restart [name] | logs <name>)"
+    description: "Manage OpenClaw agents (list | logs <name>)"
   },
   args: {
     stack: { type: "string", description: "Target stack name" },
-    json: { type: "boolean", description: "Emit JSON (for list)" }
+    json: { type: "boolean", description: "Emit JSON (for list and logs)" },
+    limit: { type: "string", description: "Max activity records for `logs` (default 50)" },
+    cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const [action, name] = args._ ?? [];
-    if (!action || !["list", "restart", "logs"].includes(action)) {
-      failure("Usage: clawops agents <list | restart [name] | logs <name>>");
+    if (action === "restart") {
+      failure(
+        "clawops agents restart was removed in clawops 2.0.\n  OpenClaw 2.0 has no per-agent restart; the only restart it offers is\n  gateway-wide and interrupts every agent on the host.\n  Run `clawops gateway restart` if that is what you want."
+      );
+      process14.exit(2);
+    }
+    if (!action || !["list", "logs"].includes(action)) {
+      failure("Usage: clawops agents <list | logs <name>>");
       process14.exit(2);
     }
     if (action === "logs" && !name) {
@@ -1205,15 +1245,24 @@ var agents_default = defineCommand12({
     });
     try {
       if (action === "list") {
-        const result = await session.exec(
-          "docker exec openclaw openclaw agents list --json 2>/dev/null || echo '[]'",
+        const result = await execPrivileged(
+          session,
+          "docker exec openclaw openclaw agents list --json",
           abortController.signal
         );
-        let agents = [];
+        if (result.code !== 0) {
+          const why = result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`;
+          failure(`Cannot list agents: ${why}`);
+          process14.exitCode = 1;
+          return;
+        }
+        let agents;
         try {
-          agents = JSON.parse(result.stdout.trim());
+          agents = JSON.parse(result.stdout.trim() || "[]");
         } catch {
-          agents = [];
+          failure(`Cannot list agents: unexpected output from OpenClaw: ${result.stdout.trim().slice(0, 200)}`);
+          process14.exitCode = 1;
+          return;
         }
         if (args.json) {
           printJson(jsonOk(agents));
@@ -1227,25 +1276,24 @@ var agents_default = defineCommand12({
             ) + "\n\n"
           );
         }
-      } else if (action === "restart") {
-        const cmd = name ? `docker exec openclaw openclaw agents restart ${name}` : "docker exec openclaw openclaw agents restart";
-        const result = await session.exec(cmd, abortController.signal);
-        if (result.code !== 0) {
-          failure(`Restart failed: ${result.stderr}`);
-          process14.exit(1);
-        }
-        success(name ? `Agent '${name}' restarted.` : "All agents restarted.");
       } else {
-        const logStream = await session.stream(
-          `docker exec -t openclaw openclaw agents logs ${name} --follow`,
+        const { agentAuditCommand } = await import("./logs-P7YCKVF4.js");
+        const limit = typeof args.limit === "string" ? parseInt(args.limit, 10) : 50;
+        const result = await execPrivileged(
+          session,
+          agentAuditCommand({ agentId: name, limit, cursor: typeof args.cursor === "string" ? args.cursor : void 0 }),
           abortController.signal
         );
-        logStream.pipe(process14.stdout);
-        await new Promise((resolve) => {
-          logStream.on("end", resolve);
-          logStream.on("close", resolve);
-          abortController.signal.addEventListener("abort", () => resolve(), { once: true });
-        });
+        if (result.code !== 0) {
+          failure(`Cannot read activity for "${name}": ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
+          process14.exitCode = 1;
+          return;
+        }
+        if (args.json) {
+          process14.stdout.write(result.stdout);
+        } else {
+          renderAgentRuns(name, result.stdout);
+        }
       }
     } finally {
       release();
@@ -1253,35 +1301,285 @@ var agents_default = defineCommand12({
     }
   }
 });
+function renderAgentRuns(agentId, stdout) {
+  let page;
+  try {
+    page = JSON.parse(stdout.trim() || "{}");
+  } catch {
+    failure(`Cannot read activity for "${agentId}": unexpected output: ${stdout.trim().slice(0, 200)}`);
+    process14.exitCode = 1;
+    return;
+  }
+  const records = page.records ?? [];
+  if (records.length === 0) {
+    info(`No recorded activity for agent "${agentId}".`);
+    return;
+  }
+  process14.stdout.write(
+    "\n" + renderTable(
+      ["When", "Status", "Detail"],
+      records.map((r) => [r.at ?? "\u2014", r.status ?? "\u2014", r.summary ?? r.message ?? "\u2014"])
+    ) + "\n"
+  );
+  if (page.cursor) {
+    info(`More records: clawops agents logs ${agentId} --cursor ${page.cursor}`);
+  }
+  process14.stdout.write("\n");
+}
 
-// src/cli/commands/gateway.ts
+// src/cli/commands/migrate.ts
 import { defineCommand as defineCommand13 } from "citty";
 import process15 from "process";
-var OPENCLAW_CONFIG2 = "/home/clawops/openclaw.json";
-function dockerRunCmd2(version) {
+
+// src/openclaw/migrate.ts
+async function migrate(steps) {
+  const sourceImage = await steps.inspectSource();
+  if (!sourceImage) {
+    return {
+      kind: "nothing-to-migrate",
+      reason: "No running OpenClaw container was found, so there is no 1.x state to extract. If this deployment was restarted on a clawops release before 2.0, its state was already lost \u2014 clawops mounted none, so every container replacement discarded it. Deploy fresh with `clawops up`."
+    };
+  }
+  const identityBefore = await steps.deviceId();
+  const backup = await steps.backup();
+  if (!backup.ok) {
+    return {
+      kind: "refused",
+      reason: `Refusing to migrate without a verified backup: ${backup.detail}
+This replaces the running container, and the state it extracts is the only copy.`
+    };
+  }
+  const extracted = await steps.extract();
+  if (!extracted.ok) {
+    return {
+      kind: "failed",
+      reason: "Could not extract state from the running container; it has not been touched.",
+      backupDetail: backup.detail
+    };
+  }
+  await steps.chown();
+  await steps.removeSource();
+  await steps.writeConfig();
+  await steps.start();
+  let restarts = 0;
+  let gate = await steps.gate();
+  if (!gate.ok) {
+    await steps.start();
+    restarts = 1;
+    gate = await steps.gate();
+  }
+  if (!gate.ok) {
+    return {
+      kind: "failed",
+      reason: gate.reason ?? "the gateway did not start after migration",
+      backupDetail: backup.detail
+    };
+  }
+  const identityAfter = await steps.deviceId();
+  const identity = identityBefore === void 0 || identityAfter === void 0 ? "unknown" : identityBefore === identityAfter ? "preserved" : "changed";
+  return { kind: "migrated", entries: extracted.entries, identity, restarts };
+}
+function describeMigration(o) {
+  switch (o.kind) {
+    case "migrated": {
+      const lines = [
+        `Migrated to the 2.0 runtime contract. Carried over: ${o.entries.join(", ") || "(nothing)"}.`
+      ];
+      if (o.restarts > 0) {
+        lines.push(
+          "The gateway needed a second start to finish its state-schema migration, which is expected for a 1.x database."
+        );
+      }
+      if (o.identity === "preserved") {
+        lines.push("Device identity preserved \u2014 paired devices do not need re-pairing.");
+      } else if (o.identity === "changed") {
+        lines.push(
+          "Device identity CHANGED. Paired devices and nodes must be re-paired \u2014 check `openclaw devices list` on the host for what was paired."
+        );
+      } else {
+        lines.push(
+          "Device identity could not be compared, so pairings may or may not have carried over. Check `openclaw devices list` before relying on them."
+        );
+      }
+      lines.push("Your 1.x config was NOT applied \u2014 it never took effect on 1.x either. Review it");
+      lines.push("and set what you need with `clawops config set`.");
+      return lines.join("\n");
+    }
+    case "nothing-to-migrate":
+      return o.reason;
+    case "refused":
+      return o.reason;
+    case "failed":
+      return `Migration failed: ${o.reason}
+A verified backup was taken first: ${o.backupDetail}
+Restore it with \`clawops backup restore --file <archive>\` before retrying.`;
+  }
+}
+
+// src/cli/commands/migrate.ts
+var SYNTHESISED_CONFIG = JSON.stringify({
+  meta: { lastTouchedVersion: "2026.9.2" },
+  gateway: { mode: "local", port: GATEWAY_PORT, auth: { mode: "token" } },
+  models: {},
+  channels: {}
+});
+var migrate_default = defineCommand13({
+  meta: {
+    name: "migrate",
+    description: "Move a 1.x OpenClaw deployment onto the 2.0 runtime contract"
+  },
+  args: {
+    stack: { type: "string", description: "Target stack name" },
+    "openclaw-version": { type: "string", description: "OpenClaw 2.x version to migrate to" },
+    yes: { type: "boolean", description: "Skip the confirmation prompt" }
+  },
+  async run({ args }) {
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+    const requested = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0;
+    const target = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
+    const targetImage = `ghcr.io/openclaw/openclaw:${target}`;
+    const ctx = buildContext(args);
+    const stack = await ctx.getStack();
+    const outputs = Object.fromEntries(
+      Object.entries(await stack.outputs()).map(([k, v]) => [k, v.value])
+    );
+    const conn = ctx.adapter.getConnectionInfo({
+      ...extractBaseOutputs(outputs),
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    const ac = new AbortController();
+    process15.on("SIGINT", () => ac.abort());
+    const { session, release } = await acquireSession({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal: ac.signal
+    });
+    const spin = spinner("Inspecting the deployment...");
+    const run = (cmd) => execPrivileged(session, cmd, ac.signal);
+    const archive = "/tmp/clawops-premigration.tar.gz";
+    const configPath = `${STATE_DIR_HOST_LINUX}/${CONFIG_FILENAME}`;
+    const steps = {
+      inspectSource: async () => {
+        const r = await run(`docker inspect openclaw --format '{{.Config.Image}}'`);
+        const image = r.stdout.trim();
+        return r.code === 0 && image.includes(":") ? image : void 0;
+      },
+      backup: async () => {
+        spin.text = "Taking a verified backup...";
+        const r = await run(
+          `docker exec openclaw openclaw backup create --output ${archive} --verify --json`
+        );
+        return r.code === 0 ? { ok: true, detail: `${archive} on the host (verified)` } : { ok: false, detail: (r.stderr || r.stdout).slice(0, 200) };
+      },
+      extract: async () => {
+        spin.text = "Extracting state from the running container...";
+        const mk = await run(`mkdir -p ${STATE_DIR_HOST_LINUX}`);
+        if (mk.code !== 0) return { ok: false, entries: [] };
+        const cp = await run(`docker cp openclaw:/home/node/.openclaw/. ${STATE_DIR_HOST_LINUX}/`);
+        if (cp.code !== 0) return { ok: false, entries: [] };
+        const ls = await run(`ls ${STATE_DIR_HOST_LINUX}`);
+        return { ok: true, entries: ls.stdout.trim().split(/\s+/).filter(Boolean) };
+      },
+      chown: async () => {
+        await run(`chown -R ${CONTAINER_UID}:${CONTAINER_UID} ${STATE_DIR_HOST_LINUX}`);
+      },
+      removeSource: async () => {
+        spin.text = "Stopping the 1.x container...";
+        await run("docker stop openclaw 2>/dev/null || true");
+        await run("docker rm   openclaw 2>/dev/null || true");
+      },
+      writeConfig: async () => {
+        const b64 = Buffer.from(SYNTHESISED_CONFIG, "utf-8").toString("base64");
+        await run(
+          `echo '${b64}' | base64 -d > ${configPath} && chown ${CONTAINER_UID}:${CONTAINER_UID} ${configPath}`
+        );
+      },
+      start: async () => {
+        spin.text = "Starting the 2.0 gateway...";
+        await run(gatewayRunCommand({ image: targetImage, stateDir: STATE_DIR_HOST_LINUX }));
+      },
+      gate: async () => {
+        spin.text = "Waiting for the gateway to start...";
+        let last;
+        for (let i = 0; i < 15; i++) {
+          if (ac.signal.aborted) return { ok: false, reason: "aborted" };
+          const r = await run(probeCommand("started", GATEWAY_PORT));
+          const v = interpretProbe("started", r.stdout);
+          if (v.ok) return { ok: true };
+          last = v.reason;
+          await new Promise((res) => setTimeout(res, 2e3));
+        }
+        return { ok: false, reason: last ?? "no response" };
+      },
+      deviceId: async () => {
+        const file = await run(
+          `docker exec openclaw sh -c 'cat ~/.openclaw/identity/device.json 2>/dev/null' || cat ${STATE_DIR_HOST_LINUX}/identity/device.json 2>/dev/null || true`
+        );
+        try {
+          const parsed = JSON.parse(file.stdout.trim());
+          return parsed.deviceId;
+        } catch {
+          return void 0;
+        }
+      }
+    };
+    try {
+      const outcome = await migrate(steps);
+      spin.stop();
+      const report = describeMigration(outcome);
+      if (outcome.kind === "migrated") {
+        success(report.split("\n")[0]);
+        for (const line2 of report.split("\n").slice(1)) {
+          if (/CHANGED|could not be compared/.test(line2)) warn(line2);
+          else info(line2);
+        }
+        info(`Pre-migration backup: ${archive}`);
+      } else {
+        failure(report);
+        process15.exit(outcome.kind === "nothing-to-migrate" ? 0 : 1);
+      }
+    } finally {
+      release();
+      drainPool();
+    }
+  }
+});
+
+// src/cli/commands/gateway.ts
+import { defineCommand as defineCommand14 } from "citty";
+import process16 from "process";
+function dockerRunCmd2(version, publish = "loopback") {
   return gatewayRunCommand({
     image: `ghcr.io/openclaw/openclaw:${version}`,
-    configPath: OPENCLAW_CONFIG2
+    stateDir: STATE_DIR_HOST_LINUX,
+    publish
   });
 }
-var gateway_default = defineCommand13({
+var gateway_default = defineCommand14({
   meta: {
     name: "gateway",
     description: "Manage the OpenClaw gateway daemon (status | restart | update [version])"
   },
   args: {
     stack: { type: "string", description: "Target stack name" },
-    channel: { type: "string", description: "Channel for update: stable | dev | <version>" },
+    channel: { type: "string", description: "Version for update (a concrete pin; moving tags are refused)" },
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
-      process15.exit(2);
+      process16.exit(2);
     }
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
@@ -1296,8 +1594,8 @@ var gateway_default = defineCommand13({
       knownHostsPath: ctx.config.ssh.knownHostsPath
     });
     const abortController = new AbortController();
-    process15.on("SIGINT", () => abortController.abort());
-    process15.on("SIGTERM", () => abortController.abort());
+    process16.on("SIGINT", () => abortController.abort());
+    process16.on("SIGTERM", () => abortController.abort());
     const { session, release } = await acquireSession({
       host: conn.host,
       port: conn.port,
@@ -1318,7 +1616,7 @@ var gateway_default = defineCommand13({
         if (args.json) {
           printJson(jsonOk(status));
         } else {
-          process15.stdout.write(
+          process16.stdout.write(
             "\n" + renderTable(
               ["Field", "Value"],
               [
@@ -1330,40 +1628,145 @@ var gateway_default = defineCommand13({
           );
         }
       } else if (action === "restart") {
-        const imgResult = await session.exec(IMAGE_INSPECT_CMD, abortController.signal);
+        const imgResult = await execPrivileged(session, IMAGE_INSPECT_CMD, abortController.signal);
         const image = imageForRestart(imgResult.stdout);
         if (!image.ok) {
           failure(image.error);
-          process15.exit(1);
+          process16.exit(1);
         }
         const version = versionOf(image.value);
+        const pub = await execPrivileged(session, PUBLISH_INSPECT_CMD, abortController.signal);
+        const publish = publishForRestart(pub.stdout);
         const spin = spinner("Restarting gateway...");
-        const result = await session.exec(dockerRunCmd2(version), abortController.signal);
+        const result = await execPrivileged(
+          session,
+          dockerRunCmd2(version, publish),
+          abortController.signal
+        );
         spin.stop();
         if (result.code !== 0) {
           failure(`Restart failed: ${result.stderr}`);
-          process15.exit(1);
+          process16.exit(1);
         }
         success(`Gateway restarted (${version}).`);
       } else {
-        const version = versionArg ?? args.channel ?? "stable";
+        const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+        const requested = versionArg ?? args.channel;
+        const version = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
         const spin = spinner(`Updating gateway to ${version}...`);
-        const pullResult = await session.exec(
-          `docker pull ghcr.io/openclaw/openclaw:${version}`,
+        const targetImage = `ghcr.io/openclaw/openclaw:${version}`;
+        const pullResult = await execPrivileged(
+          session,
+          `docker pull ${targetImage}`,
           abortController.signal
         );
         if (pullResult.code !== 0) {
           spin.stop();
           failure(`Pull failed: ${pullResult.stderr}`);
-          process15.exit(1);
+          process16.exit(1);
         }
-        const runResult = await session.exec(dockerRunCmd2(version), abortController.signal);
-        spin.stop();
+        spin.text = "Checking state compatibility...";
+        const {
+          snapshotCommand,
+          snapshotPathFrom,
+          preflightCommand,
+          parsePreflight,
+          judgePreflight
+        } = await import("./upgrade-ULD4KFYC.js");
+        const cur = imageForRestart(
+          (await execPrivileged(session, IMAGE_INSPECT_CMD, abortController.signal)).stdout
+        );
+        const snapRepo = `${STATE_DIR_HOST_LINUX}/snapshots`;
+        const snapOut = await execPrivileged(
+          session,
+          snapshotCommand(cur.ok ? cur.value : targetImage, STATE_DIR_HOST_LINUX, snapRepo),
+          abortController.signal
+        );
+        const snapPath = snapshotPathFrom(snapOut.stdout);
+        if (!snapPath) {
+          spin.stop();
+          failure(
+            "Could not snapshot the state database before upgrading, so neither the compatibility check nor a rollback point is available.\n" + (snapOut.stderr || snapOut.stdout).slice(0, 300)
+          );
+          process16.exit(1);
+        }
+        const pre = await execPrivileged(
+          session,
+          preflightCommand(targetImage, STATE_DIR_HOST_LINUX, `${snapPath}/database.sqlite`),
+          abortController.signal
+        );
+        const report = parsePreflight(pre.stdout);
+        const verdict = report ? judgePreflight(report) : { ok: false, reason: `preflight produced no readable report: ${pre.stderr.slice(0, 200)}` };
+        if (!verdict.ok) {
+          spin.stop();
+          failure(`Refusing to upgrade to ${version}: ${verdict.reason}`);
+          info(`A snapshot of the current state was kept at ${snapPath}.`);
+          process16.exit(1);
+        }
+        if (verdict.ok && verdict.note) info(verdict.note);
+        spin.text = `Updating gateway to ${version}...`;
+        const pubU = await execPrivileged(session, PUBLISH_INSPECT_CMD, abortController.signal);
+        const runResult = await execPrivileged(
+          session,
+          dockerRunCmd2(version, publishForRestart(pubU.stdout)),
+          abortController.signal
+        );
         if (runResult.code !== 0) {
+          spin.stop();
           failure(`Start failed: ${runResult.stderr}`);
-          process15.exit(1);
+          info(`State snapshot from before the upgrade: ${snapPath}`);
+          process16.exit(1);
+        }
+        spin.text = "Waiting for the gateway to start...";
+        const { probeCommand: probeCommand2, interpretProbe: interpretProbe2 } = await import("./health-5CCOXYGG.js");
+        const { repairCommand, describeOutcome } = await import("./upgrade-ULD4KFYC.js");
+        const publish = publishForRestart(pubU.stdout);
+        const gate = async () => {
+          let last;
+          for (let i = 0; i < 15; i++) {
+            if (abortController.signal.aborted) return { ok: false, reason: "aborted" };
+            const r = await execPrivileged(
+              session,
+              probeCommand2("started", GATEWAY_PORT),
+              abortController.signal
+            );
+            const v = interpretProbe2("started", r.stdout);
+            if (v.ok) return { ok: true };
+            last = v.reason;
+            await new Promise((res) => setTimeout(res, 2e3));
+          }
+          return { ok: false, reason: last ?? "no response" };
+        };
+        const { resolveUpgrade } = await import("./upgrade-ULD4KFYC.js");
+        const outcome = await resolveUpgrade(
+          {
+            gate,
+            repair: async () => {
+              spin.text = "Gateway did not start; attempting one-shot repair...";
+              await execPrivileged(
+                session,
+                repairCommand(targetImage, STATE_DIR_HOST_LINUX),
+                abortController.signal
+              );
+            },
+            run: async (v) => {
+              await execPrivileged(session, dockerRunCmd2(v, publish), abortController.signal);
+            }
+          },
+          {
+            version,
+            previousVersion: cur.ok ? versionOf(cur.value) : void 0,
+            snapshotPath: snapPath
+          }
+        );
+        spin.stop();
+        const message = describeOutcome(outcome, version);
+        if (outcome.kind === "started" || outcome.kind === "repaired") {
+          success(message);
+        } else {
+          failure(message);
+          process16.exit(1);
         }
-        success(`Gateway updated to ${version}.`);
       }
     } finally {
       release();
@@ -1373,11 +1776,11 @@ var gateway_default = defineCommand13({
 });
 
 // src/cli/commands/backup.ts
-import { defineCommand as defineCommand14 } from "citty";
+import { defineCommand as defineCommand15 } from "citty";
 import { createWriteStream } from "fs";
 import { pipeline } from "stream/promises";
-import process16 from "process";
-var backup_default = defineCommand14({
+import process17 from "process";
+var backup_default = defineCommand15({
   meta: {
     name: "backup",
     description: "Create an OpenClaw backup (restore is unavailable on this release line)"
@@ -1390,8 +1793,8 @@ var backup_default = defineCommand14({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -1402,7 +1805,7 @@ var backup_default = defineCommand14({
       const state = ctx.localState;
       if (!state) {
         failure("Stack has no state. Run `clawops up` first.");
-        process16.exit(4);
+        process17.exit(4);
       }
       conn = {
         host: state.sshHost,
@@ -1420,7 +1823,7 @@ var backup_default = defineCommand14({
       );
       if (!outputs["publicIp"]) {
         failure("Stack has no outputs. Run `clawops up` first.");
-        process16.exit(4);
+        process17.exit(4);
       }
       const base = extractBaseOutputs(outputs);
       conn = ctx.adapter.getConnectionInfo({
@@ -1430,8 +1833,8 @@ var backup_default = defineCommand14({
       });
     }
     const abortController = new AbortController();
-    process16.on("SIGINT", () => abortController.abort());
-    process16.on("SIGTERM", () => abortController.abort());
+    process17.on("SIGINT", () => abortController.abort());
+    process17.on("SIGTERM", () => abortController.abort());
     const { session, release } = await acquireSession({
       host: conn.host,
       port: conn.port,
@@ -1446,7 +1849,8 @@ var backup_default = defineCommand14({
         info(`Writing backup to ${outPath}...`);
         const spin = spinner("Creating backup on remote host...");
         const remoteArchive = "/tmp/clawops-backup.tar.gz";
-        const createResult = await session.exec(
+        const createResult = await execPrivileged(
+          session,
           `docker exec openclaw sh -lc 'rm -f ${remoteArchive} && openclaw backup create --output ${remoteArchive} --verify --json'`,
           abortController.signal
         );
@@ -1454,23 +1858,72 @@ var backup_default = defineCommand14({
           spin.stop();
           throw new Error(`Backup failed on the remote host: ${createResult.stderr.slice(0, 300)}`);
         }
-        const backupStream = await session.stream(
+        const backupStream = await streamPrivileged(
+          session,
           `docker exec openclaw cat ${remoteArchive}`,
           abortController.signal
         );
         spin.stop();
-        const fileStream = createWriteStream(outPath);
+        const fileStream = createWriteStream(outPath, { mode: 384 });
         await pipeline(backupStream, fileStream);
-        await session.exec(
+        await execPrivileged(
+          session,
           `docker exec openclaw rm -f ${remoteArchive}`,
           abortController.signal
         );
         success(`Backup saved to ${outPath}`);
-        info("The archive contains credentials \u2014 store it accordingly.");
+        info("Saved with mode 0600. The archive contains the state database \u2014 OAuth tokens,");
+        info("secrets and device credentials, unencrypted. Treat it as a credential.");
       } else {
-        throw new UsageError(
-          "Restore is not available on this clawops release.\nOpenClaw up to 2026.7.1-2 provides `backup create` and `backup verify` only; restore arrived in OpenClaw 2.0 and will be supported by clawops 2.x.\nTo recover manually: copy the archive to the host, then extract it into the gateway container with the gateway stopped."
+        const file = typeof args.file === "string" ? args.file : void 0;
+        if (!file) {
+          throw new UsageError("Usage: clawops backup restore --file <archive.tar.gz>");
+        }
+        const { createReadStream } = await import("fs");
+        const remoteArchive = "/tmp/clawops-restore.tar.gz";
+        const staging = `/tmp/clawops-restored-${Date.now()}`;
+        const spin = spinner("Uploading archive...");
+        const uploadResult = await execPrivilegedWithInput(
+          session,
+          `docker exec -i openclaw sh -c 'cat > ${remoteArchive}'`,
+          createReadStream(file),
+          abortController.signal
+        );
+        if (uploadResult.code !== 0) {
+          spin.stop();
+          throw new Error(`Could not upload the archive: ${uploadResult.stderr.slice(0, 300)}`);
+        }
+        spin.text = "Verifying and restoring to a staging directory...";
+        const restore = await execPrivileged(
+          session,
+          `docker exec openclaw openclaw backup restore ${remoteArchive} --target ${staging} --json`,
+          abortController.signal
         );
+        await execPrivileged(
+          session,
+          `docker exec openclaw rm -f ${remoteArchive}`,
+          abortController.signal
+        );
+        spin.stop();
+        if (restore.code !== 0) {
+          throw new Error(`Restore failed: ${(restore.stderr || restore.stdout).slice(0, 400)}`);
+        }
+        let report = {};
+        try {
+          report = JSON.parse(restore.stdout.trim());
+        } catch {
+          info(restore.stdout);
+        }
+        success(`Archive verified and restored to ${staging} on the host.`);
+        if (report.entryCount !== void 0) info(`${report.entryCount} entries restored.`);
+        for (const w of report.warnings ?? []) warn(w);
+        info("");
+        info("Nothing has been activated. To adopt the restored state:");
+        info("  1. clawops ssh --command 'sudo docker stop openclaw'");
+        info(`  2. replace the state directory contents with ${staging}`);
+        info("  3. clawops gateway restart");
+        info("Provider plugins are not carried in the archive; re-run `clawops apply` to");
+        info("reinstall them, or the gateway starts without its model providers.");
       }
     } finally {
       release();
@@ -1480,9 +1933,9 @@ var backup_default = defineCommand14({
 });
 
 // src/cli/commands/stacks.ts
-import { defineCommand as defineCommand15 } from "citty";
-import process17 from "process";
-var stacks_default = defineCommand15({
+import { defineCommand as defineCommand16 } from "citty";
+import process18 from "process";
+var stacks_default = defineCommand16({
   meta: {
     name: "stacks",
     description: "Manage clawops stacks (list | delete <name>)"
@@ -1496,7 +1949,7 @@ var stacks_default = defineCommand15({
     const [action, name] = args._ ?? [];
     if (!action || !["list", "delete"].includes(action)) {
       failure("Usage: clawops stacks <list | delete <name>>");
-      process17.exit(2);
+      process18.exit(2);
     }
     if (action === "list") {
       const config2 = requireConfig();
@@ -1519,7 +1972,7 @@ var stacks_default = defineCommand15({
       } else if (rows.length === 0) {
         info("No stacks configured.");
       } else {
-        process17.stdout.write(
+        process18.stdout.write(
           "\n" + renderTable(
             ["Name", "Provider", "Region", "State URL"],
             rows
@@ -1531,7 +1984,7 @@ var stacks_default = defineCommand15({
     }
     if (!name) {
       failure("Usage: clawops stacks delete <name>");
-      process17.exit(2);
+      process18.exit(2);
     }
     const config = requireConfig();
     if (!(name in config.stacks)) {
@@ -1551,7 +2004,7 @@ var stacks_default = defineCommand15({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-5LCUG2QR.js");
+        const { buildContext } = await import("./context-KHKWJJMC.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -1571,7 +2024,7 @@ var stacks_default = defineCommand15({
       failure(
         `Stack "${name}" is still deployed. Run \`clawops down --stack ${name}\` first to destroy cloud resources, or pass --force to remove from registry only.`
       );
-      process17.exit(1);
+      process18.exit(1);
     }
     warn(
       `This removes "${name}" from clawops config only. Cloud resources are NOT destroyed. Run \`clawops destroy --stack ` + name + "` first if you want to remove cloud resources."
@@ -1599,7 +2052,7 @@ var stacks_default = defineCommand15({
 });
 async function confirm(message) {
   const { createInterface: createInterface3 } = await import("readline/promises");
-  const rl = createInterface3({ input: process17.stdin, output: process17.stdout });
+  const rl = createInterface3({ input: process18.stdin, output: process18.stdout });
   try {
     const answer = await rl.question(`${message} (y/N) `);
     return answer.trim().toLowerCase() === "y";
@@ -1609,286 +2062,68 @@ async function confirm(message) {
 }
 
 // src/cli/commands/doctor.ts
-import { defineCommand as defineCommand16 } from "citty";
-import process18 from "process";
-import { accessSync, mkdirSync as mkdirSync2, constants } from "fs";
-import path2 from "path";
-var doctor_default = defineCommand16({
+import { defineCommand as defineCommand17 } from "citty";
+import process19 from "process";
+var NAME_COLUMN = 13;
+var doctor_default = defineCommand17({
   meta: {
     name: "doctor",
     description: "Check system prerequisites, config, SSH keys, and cloud credentials"
   },
   args: {
-    stack: { type: "string", description: "Stack name to include remote health checks" }
+    stack: { type: "string", description: "Stack name to include remote health checks" },
+    json: { type: "boolean", description: "Emit the report as JSON" }
   },
   async run({ args }) {
-    const { getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-    process18.stdout.write("\nclawops doctor\n");
-    process18.stdout.write("\nRuntime\n");
-    const nodeVersion = process18.version;
-    const nodeMajor = parseInt(nodeVersion.slice(1).split(".")[0] ?? "0", 10);
-    const nodeOk = nodeMajor >= 22;
-    if (nodeOk) {
-      success(`Node.js ${nodeVersion}`);
-    } else {
-      failure(`Node.js ${nodeVersion}  (requires >=22)`);
-    }
-    const configDir = getConfigDir2();
-    const pulumiHome = path2.join(configDir, ".pulumi");
+    const ac = new AbortController();
+    const abort = () => ac.abort();
+    process19.on("SIGINT", abort);
+    process19.on("SIGTERM", abort);
+    let report;
     try {
-      mkdirSync2(pulumiHome, { recursive: true });
-      success(`Pulumi home  ${pulumiHome}`);
-    } catch {
-      failure(`Pulumi home  ${pulumiHome}  (not writable)`);
-    }
-    process18.stdout.write("\nConfig\n");
-    const config = getConfig2();
-    if (!config) {
-      warn("No config file found \u2014 run `clawops init` to create one");
-    } else {
-      success(`Config file  ${path2.join(configDir, "config.json")}`);
-    }
-    process18.stdout.write("\nSSH\n");
-    if (!config) {
-      info("SSH checks skipped \u2014 no config");
-    } else {
-      const keyPath = config.ssh.keyPath.replace(/^~/, process18.env["HOME"] ?? "~");
-      try {
-        accessSync(keyPath, constants.R_OK);
-        success(`SSH key      ${keyPath}`);
-      } catch {
-        failure(`SSH key      ${keyPath}  (not found or not readable)`);
-      }
-      const knownHostsPath = config.ssh.knownHostsPath.replace(/^~/, process18.env["HOME"] ?? "~");
-      try {
-        accessSync(knownHostsPath, constants.F_OK);
-        success(`known_hosts  ${knownHostsPath}`);
-      } catch {
-        warn(`known_hosts  ${knownHostsPath}  (does not exist \u2014 will be created on first connect)`);
-      }
+      report = await runDiagnostics({ stack: args.stack, signal: ac.signal });
+    } finally {
+      process19.off("SIGINT", abort);
+      process19.off("SIGTERM", abort);
     }
-    process18.stdout.write("\nCredentials\n");
-    if (!config) {
-      info("Credential checks skipped \u2014 no config");
+    if (args.json) {
+      printJson(jsonOk(report));
     } else {
-      const { getProvider } = await import("./providers-2OABPW2E.js");
-      await import("./aws-L4RR2LSE.js");
-      await import("./gcp-UG6AWPIZ.js");
-      await import("./azure-7OXQENQL.js");
-      await import("./local-DXBEVZ5C.js");
-      const checkedProviders = /* @__PURE__ */ new Set();
-      for (const [stackName, stackCfg] of Object.entries(config.stacks)) {
-        const providerName = stackCfg.provider;
-        if (checkedProviders.has(providerName)) continue;
-        checkedProviders.add(providerName);
-        if (providerName === "local") {
-          success(`local  stack "${stackName}"  (SSH-only, no cloud credentials required)`);
-          continue;
-        }
-        try {
-          const adapter = getProvider(providerName);
-          const result = await adapter.validateConfig();
-          if (result.ok) {
-            success(`${providerName}  stack "${stackName}"`);
-          } else {
-            for (const err of result.errors) {
-              failure(`${providerName}  stack "${stackName}"  \u2014 ${err}`);
-            }
-          }
-        } catch (err) {
-          failure(`${providerName}  stack "${stackName}"  \u2014 ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-      if (checkedProviders.size === 0) {
-        warn("No stacks configured \u2014 run `clawops init`");
-      }
-    }
-    process18.stdout.write("\nOpenClaw\n");
-    try {
-      const yaml = await import("./js-yaml-PTEEG4FO.js");
-      const { loadVersionSpec, describeRange } = await import("./versions-2UVAT6PQ.js");
-      const support = loadVersionSpec(yaml).support;
-      success(`Supported range  ${describeRange(support)}  (recommended ${support.recommended})`);
-      if (!support.max) {
-        warn("No upper bound declared \u2014 this line would accept any OpenClaw release");
-      }
-    } catch (e) {
-      failure(`Version matrix   ${e.message}`);
-    }
-    if (args.stack) {
-      process18.stdout.write("\nRemote health\n");
-      if (!config) {
-        info("Remote health skipped \u2014 no config");
-      } else {
-        try {
-          const { buildContext } = await import("./context-5LCUG2QR.js");
-          const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-          const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
-          const ctx = buildContext({ stack: args.stack });
-          const stack = await ctx.getStack();
-          const outputMap = await stack.outputs();
-          const outputs = Object.fromEntries(
-            Object.entries(outputMap).map(([k, v]) => [k, v.value])
-          );
-          const base = extractBaseOutputs(outputs);
-          const conn = ctx.adapter.getConnectionInfo({
-            ...base,
-            privateKeyPath: config.ssh.keyPath,
-            knownHostsPath: config.ssh.knownHostsPath
-          });
-          const ac = new AbortController();
-          process18.on("SIGINT", () => ac.abort());
-          process18.on("SIGTERM", () => ac.abort());
-          const { session, release } = await acquireSession({
-            host: conn.host,
-            port: conn.port,
-            user: conn.user,
-            privateKeyPath: conn.privateKeyPath,
-            knownHostsPath: conn.knownHostsPath,
-            signal: ac.signal
-          });
-          try {
-            const containerResult = await session.exec(
-              `docker inspect openclaw --format '{{.State.Status}}' 2>/dev/null || echo 'not found'`,
-              ac.signal
-            );
-            const containerStatus = containerResult.stdout.trim();
-            if (containerStatus === "running") {
-              success(`Container    running`);
-            } else {
-              failure(`Container    ${containerStatus || "unknown"}`);
-            }
-            const imageResult = await session.exec(
-              `docker inspect openclaw --format '{{.Config.Image}}' 2>/dev/null || echo ''`,
-              ac.signal
-            );
-            const image = imageResult.stdout.trim();
-            const deployedVersion = image.includes(":") ? image.slice(image.lastIndexOf(":") + 1) : "";
-            if (deployedVersion) {
-              const yaml = await import("./js-yaml-PTEEG4FO.js");
-              const { loadVersionSpec, checkVersion, isMovingTag } = await import("./versions-2UVAT6PQ.js");
-              const support = loadVersionSpec(yaml).support;
-              if (isMovingTag(deployedVersion)) {
-                warn(
-                  `Deployed     ${image}  (moving tag \u2014 pin an explicit version; "${deployedVersion}" now resolves to OpenClaw 2.0)`
-                );
-              } else {
-                const check = checkVersion(deployedVersion, support);
-                if (check.ok) {
-                  success(`Deployed     OpenClaw ${deployedVersion}`);
-                } else {
-                  failure(`Deployed     OpenClaw ${deployedVersion} is not supported by this clawops line`);
-                  if (check.error.reason === "too-new") {
-                    warn(
-                      "  This gateway is running OpenClaw 2.0 or later. Session state may already have been lost: 2.0 stores sessions and credentials in SQLite under a directory this clawops line does not mount, so every container restart discards them. Upgrade to clawops 2.x before making changes."
-                    );
-                  }
-                }
-              }
-            }
-            const healthResult = await session.exec(
-              `docker inspect openclaw --format '{{.State.Health.Status}}' 2>/dev/null || echo 'none'`,
-              ac.signal
-            );
-            const healthStatus = healthResult.stdout.trim();
-            if (healthStatus === "healthy") {
-              success(`Healthcheck  healthy`);
-            } else if (healthStatus === "none" || healthStatus === "<no value>") {
-              info(`Healthcheck  no healthcheck configured`);
-            } else {
-              warn(`Healthcheck  ${healthStatus}`);
-            }
-            const diskResult = await session.exec(
-              `df -h /home/clawops 2>/dev/null | awk 'NR==2{print $5" used ("$3" of "$2")"}'`,
-              ac.signal
-            );
-            const diskUsage = diskResult.stdout.trim();
-            if (diskUsage) {
-              const pctMatch = diskUsage.match(/^(\d+)%/);
-              const pct = pctMatch ? parseInt(pctMatch[1], 10) : 0;
-              if (pct >= 90) {
-                failure(`Disk         ${diskUsage}`);
-              } else if (pct >= 75) {
-                warn(`Disk         ${diskUsage}`);
-              } else {
-                success(`Disk         ${diskUsage}`);
-              }
-            } else {
-              warn("Disk         unable to determine disk usage");
-            }
-            const logrotateResult = await session.exec(
-              `test -f /etc/logrotate.d/openclaw && echo 'configured' || echo 'not configured'`,
-              ac.signal
-            );
-            const logrotate = logrotateResult.stdout.trim();
-            if (logrotate === "configured") {
-              success(`Log rotation configured`);
-            } else {
-              warn(`Log rotation not configured \u2014 logs may grow unbounded`);
-            }
-          } finally {
-            release();
-            drainPool();
-          }
-        } catch (err) {
-          failure(`Remote health checks failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-    }
-    if (args.stack && config) {
-      process18.stdout.write("\nHardening\n");
-      try {
-        const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-URPXLSVF.js");
-        const { buildContext } = await import("./context-5LCUG2QR.js");
-        const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-        const ctx = buildContext({ stack: args.stack });
-        const stackObj = await ctx.getStack();
-        const outputMap = await stackObj.outputs();
-        const outputs = Object.fromEntries(
-          Object.entries(outputMap).map(([k, v]) => [k, v.value])
-        );
-        const base = extractBaseOutputs(outputs);
-        const conn = ctx.adapter.getConnectionInfo({
-          ...base,
-          privateKeyPath: config.ssh.keyPath,
-          knownHostsPath: config.ssh.knownHostsPath
-        });
-        const hardenAc = new AbortController();
-        process18.on("SIGINT", () => hardenAc.abort());
-        const provider = ctx.adapter.name;
-        const modules = resolveModules(MODULE_CATALOG, void 0, provider);
-        await withRemoteExec(conn, hardenAc.signal, async (exec) => {
-          for (const mod of modules) {
-            const result = await mod.check(exec);
-            if (result.status === "applied") {
-              success(`${mod.label.padEnd(32)} applied`);
-            } else if (result.status === "drifted") {
-              warn(`${mod.label.padEnd(32)} drifted \u2014 ${result.detail}`);
-            } else if (result.status === "missing") {
-              info(`${mod.label.padEnd(32)} not applied \u2014 run \`clawops harden\``);
-            }
-          }
-        });
-      } catch (err) {
-        failure(`Hardening checks failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
+      render(report);
     }
-    process18.stdout.write("\n");
-    if (!nodeOk) {
-      process18.stdout.write(
-        `Run \`clawops bug\` to open a pre-filled issue at ${REPO_URL}/issues
+    if (!report.ok) {
+      if (!args.json) {
+        process19.stdout.write(
+          `Run \`clawops bug\` to open a pre-filled issue at ${REPO_URL}/issues
 
 `
-      );
-      process18.exit(1);
+        );
+      }
+      process19.exit(1);
     }
   }
 });
+function render(report) {
+  process19.stdout.write("\nclawops doctor\n");
+  for (const section of report.sections) {
+    process19.stdout.write(`
+${section.title}
+`);
+    for (const check of section.checks) line(check);
+  }
+  process19.stdout.write("\n");
+}
+function line(check) {
+  const label = check.detail ? `${check.name.padEnd(NAME_COLUMN)}${check.detail}` : check.name;
+  const emit = { pass: success, fail: failure, warn, info }[check.status];
+  emit(label);
+  if (check.remedy) info(`  ${check.remedy}`);
+}
 
 // src/cli/commands/mcp.ts
-import { defineCommand as defineCommand17 } from "citty";
-import process19 from "process";
-var serveCmd = defineCommand17({
+import { defineCommand as defineCommand18 } from "citty";
+import process20 from "process";
+var serveCmd = defineCommand18({
   meta: {
     name: "serve",
     description: "Start the clawops MCP server"
@@ -1903,7 +2138,7 @@ var serveCmd = defineCommand17({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-FIZCOLHL.js");
+    const { serveMcp } = await import("./server-A5AB67GQ.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1915,7 +2150,7 @@ var serveCmd = defineCommand17({
     });
   }
 });
-var installCmd = defineCommand17({
+var installCmd = defineCommand18({
   meta: {
     name: "install",
     description: "Interactively wire clawops into AI editors (Claude Desktop, Claude Code, Cursor, \u2026)"
@@ -1946,7 +2181,7 @@ var installCmd = defineCommand17({
     const selected = MCP_APPS2.filter((app) => selectedIds.includes(app.id));
     if (selected.length === 0) {
       info("No apps selected. Add this to an app's MCP config manually:");
-      process19.stdout.write(JSON.stringify({
+      process20.stdout.write(JSON.stringify({
         mcpServers: { clawops: { command: mcpEntry.command, args: mcpEntry.args } }
       }, null, 2) + "\n\n");
       info("Config file locations:");
@@ -1969,7 +2204,7 @@ var installCmd = defineCommand17({
     }
   }
 });
-var wireCmd = defineCommand17({
+var wireCmd = defineCommand18({
   meta: {
     name: "wire",
     description: "Wire the gateway AI as an MCP client of clawops (WO-28)"
@@ -1981,26 +2216,26 @@ var wireCmd = defineCommand17({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
-    const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-7E5JQY47.js");
-    const { MCP_HTTP_PORT } = await import("./server-FIZCOLHL.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-BFEY2Y6H.js");
+    const { MCP_HTTP_PORT } = await import("./server-A5AB67GQ.js");
     const ac = new AbortController();
-    process19.on("SIGINT", () => {
+    process20.on("SIGINT", () => {
       ac.abort();
-      process19.exit(130);
+      process20.exit(130);
     });
-    process19.on("SIGTERM", () => {
+    process20.on("SIGTERM", () => {
       ac.abort();
-      process19.exit(143);
+      process20.exit(143);
     });
     const ctx = buildContext({ stack: args.stack });
     let conn;
     if (ctx.adapter.name === "local") {
       if (!ctx.localState) {
         failure("Stack is not deployed. Run `clawops up` first.");
-        process19.exit(1);
+        process20.exit(1);
       }
       const ls = ctx.localState;
       conn = { host: ls.sshHost, port: ls.sshPort, user: ls.sshUser, privateKeyPath: ls.privateKeyPath, knownHostsPath: ls.knownHostsPath };
@@ -2012,7 +2247,7 @@ var wireCmd = defineCommand17({
       );
       if (!outputs["publicIp"]) {
         failure("Stack has no outputs. Run `clawops up` first.");
-        process19.exit(1);
+        process20.exit(1);
       }
       const base = extractBaseOutputs(outputs);
       conn = {
@@ -2036,7 +2271,7 @@ var wireCmd = defineCommand17({
         spin.fail("This gateway has no `openclaw mcp add`, so clawops cannot wire it.");
         info("OpenClaw 2026.4.5 ships `openclaw mcp` with only `list` and `serve`.");
         info("Upgrade the gateway to 2026.7.1-2 or later, then re-run this command.");
-        process19.exit(1);
+        process20.exit(1);
       }
       if (result.status === "exists") {
         spin.info("The gateway already has a clawops MCP server configured.");
@@ -2049,7 +2284,7 @@ var wireCmd = defineCommand17({
         warn("clawops does not run on the gateway host. Start it where the gateway can reach it:");
         info(`  clawops mcp serve --http ${MCP_HTTP_PORT} --bind 0.0.0.0 --token <token>`);
         info(`Then re-run: clawops mcp wire --url ${result.url} --token <token>`);
-        process19.exit(1);
+        process20.exit(1);
       }
       spin.succeed(
         result.rewired ? "Re-wired the gateway to clawops \u2014 previous entry replaced." : "Gateway wired to clawops, and the connection was verified."
@@ -2060,14 +2295,14 @@ var wireCmd = defineCommand17({
     } catch (err) {
       spin.fail("Failed to wire gateway MCP client.");
       failure(err instanceof Error ? err.message : String(err));
-      process19.exit(1);
+      process20.exit(1);
     } finally {
       release();
       drainPool();
     }
   }
 });
-var mcp_default = defineCommand17({
+var mcp_default = defineCommand18({
   meta: {
     name: "mcp",
     description: "MCP server operations"
@@ -2081,14 +2316,14 @@ var mcp_default = defineCommand17({
 });
 
 // src/cli/commands/setup.ts
-import { defineCommand as defineCommand18 } from "citty";
-import process20 from "process";
+import { defineCommand as defineCommand19 } from "citty";
+import process21 from "process";
 import os from "os";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
 import { execSync, spawnSync, spawn as spawn2 } from "child_process";
-import path3 from "path";
-var setup_default = defineCommand18({
+import path2 from "path";
+var setup_default = defineCommand19({
   meta: {
     name: "setup",
     description: "Interactive wizard: configure and deploy an OpenClaw stack"
@@ -2103,16 +2338,16 @@ var setup_default = defineCommand18({
     const catalogs = loadCatalogs(yaml);
     const dryRun = Boolean(args["dry-run"]);
     const ac = new AbortController();
-    process20.on("SIGINT", () => {
+    process21.on("SIGINT", () => {
       ac.abort();
-      process20.exit(130);
+      process21.exit(130);
     });
-    process20.on("SIGTERM", () => {
+    process21.on("SIGTERM", () => {
       ac.abort();
-      process20.exit(143);
+      process21.exit(143);
     });
-    process20.stdout.write("\nWelcome to clawops setup. This wizard will help you deploy OpenClaw\n");
-    process20.stdout.write("and connect it to your AI tools. It takes about 2 minutes.\n\n");
+    process21.stdout.write("\nWelcome to clawops setup. This wizard will help you deploy OpenClaw\n");
+    process21.stdout.write("and connect it to your AI tools. It takes about 2 minutes.\n\n");
     const { deploymentType } = await inquirer.prompt([{
       type: "list",
       name: "deploymentType",
@@ -2140,7 +2375,7 @@ var setup_default = defineCommand18({
         ]
       }]);
       provider = answer.provider;
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       await ensureCloudAuth(provider, inquirer);
     } else {
       provider = "local";
@@ -2196,7 +2431,8 @@ var setup_default = defineCommand18({
       }]);
       localSudoPassword = sudoPass;
     }
-    process20.stdout.write("\n");
+    process21.stdout.write("\n");
+    const sshCidrDefault = provider === "local" ? void 0 : await detectSshCidrDefault();
     const stackAnswers = await inquirer.prompt([
       {
         type: "input",
@@ -2233,8 +2469,13 @@ var setup_default = defineCommand18({
         {
           type: "input",
           name: "sshCidr",
-          message: "Restrict SSH access to: (your IP address for security, or 0.0.0.0/0 to allow access from anywhere)",
-          default: "0.0.0.0/0"
+          message: sshCidrDefault ? "Restrict SSH access to: (detected your current IP \u2014 press Enter to accept, or enter another CIDR)" : "Restrict SSH access to: (a CIDR such as 203.0.113.4/32 \u2014 your own IP is the usual answer)",
+          // Defaulted to 0.0.0.0/0 until 2.0, so pressing Enter opened SSH to the whole
+          // internet on the path most first-time users take. N10 forbids exactly that
+          // default. When the egress IP cannot be detected there is no default at all and
+          // the answer is required — an unanswerable prompt is better than a wide one.
+          ...sshCidrDefault ? { default: sshCidrDefault } : {},
+          validate: validateCidrAnswer
         }
       ] : [],
       {
@@ -2244,7 +2485,12 @@ var setup_default = defineCommand18({
         default: "latest"
       }
     ]);
-    process20.stdout.write("\n");
+    if (provider !== "local" && admitsInternet(stackAnswers.sshCidr)) {
+      warn(
+        "SSH will be reachable from anywhere on the internet. `clawops harden` reports this as a finding; narrowing it to your own IP is the usual fix."
+      );
+    }
+    process21.stdout.write("\n");
     info("Choose the AI model that your OpenClaw agent will use.");
     info("You'll need an API key from your chosen provider (except Bedrock and Ollama).\n");
     const { modelProviderId } = await inquirer.prompt([{
@@ -2273,7 +2519,7 @@ var setup_default = defineCommand18({
       secrets.push(entry);
       modelConfig["apiKey"] = `$secret:${secretName}`;
     } else if (modelProvider.credentialSource === "aws-profile") {
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       info(modelProvider.iamNote ?? "Bedrock uses your AWS server's IAM role \u2014 no API key needed.");
       info("Make sure your EC2 instance has the AmazonBedrockFullAccess IAM policy attached.\n");
     } else if (modelProvider.id === "ollama") {
@@ -2294,13 +2540,13 @@ var setup_default = defineCommand18({
       ...selectedModel.modelId ? { modelId: selectedModel.modelId } : { model: selectedModel.id },
       ...modelConfig
     };
-    process20.stdout.write("\n");
+    process21.stdout.write("\n");
     info("Use \u2191\u2193 to move, Space to select/deselect, Enter to confirm.");
     const { selectedIntegrationIds } = await inquirer.prompt([{
       type: "checkbox",
       name: "selectedIntegrationIds",
       message: "Which chat integrations would you like to enable?",
-      choices: catalogs.integrations.map((integ) => ({
+      choices: wizardChannels(catalogs.integrations).map((integ) => ({
         name: `${integ.displayName} \u2014 ${integ.description}`,
         value: integ.id,
         checked: false
@@ -2310,9 +2556,9 @@ var setup_default = defineCommand18({
     const channelsConfig = {};
     const infraRequired = [];
     for (const integ of catalogs.integrations.filter((i) => selectedIntegrationIds.includes(i.id))) {
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       info(`Setting up ${integ.displayName}:`);
-      const channelConfig = {};
+      const channelConfig = startChannelConfig(integ);
       for (const field of integ.fields) {
         if (field.sensitive && field.envDefault) {
           const entry = await promptSecret(field.envDefault, `${integ.displayName} ${field.label}`, field.envDefault, inquirer);
@@ -2328,6 +2574,15 @@ var setup_default = defineCommand18({
           channelConfig[field.name] = value;
         }
       }
+      if (integ.useEnvSupported === false) {
+        warn(`${integ.displayName} has no non-interactive setup in OpenClaw.`);
+        info(`  Run \`openclaw channels add --channel ${integ.channelKey}\` on the host, interactively.`);
+      } else if (integ.plugin?.source === "bundled") {
+        info(`${integ.displayName} ships in the image. Activate it on the host with:`);
+        info(`  openclaw channels add --channel ${integ.channelKey} --use-env`);
+      } else if (integ.plugin?.package) {
+        info(`${integ.displayName} needs ${integ.plugin.package}; clawops installs it during apply.`);
+      }
       channelsConfig[integ.channelKey] = channelConfig;
       if (integ.infraRequired) infraRequired.push(integ);
     }
@@ -2346,10 +2601,10 @@ var setup_default = defineCommand18({
       }
     }
     const gatewayToken = randomBytes(24).toString("hex");
-    const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
-    mkdirSync3(secretsDir2, { recursive: true });
+    const secretsDir2 = path2.join(os.homedir(), ".clawops", "secrets");
+    mkdirSync2(secretsDir2, { recursive: true });
     spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
-    const tokenPath = path3.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
+    const tokenPath = path2.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
     writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
       models: builtModelConfig,
@@ -2360,9 +2615,9 @@ var setup_default = defineCommand18({
     }
     let outputPath;
     if (provider === "local") {
-      outputPath = path3.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
+      outputPath = path2.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
       writeFileSync3(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       success(`Config file saved to ${outputPath}`);
     } else {
       let sshPublicKey = "";
@@ -2370,7 +2625,7 @@ var setup_default = defineCommand18({
         sshPublicKey = readFileSync3(stackAnswers.sshKeyPath ?? "", "utf-8").trim();
       } catch {
         failure(`Cannot read SSH public key at ${stackAnswers.sshKeyPath ?? ""}`);
-        process20.exit(1);
+        process21.exit(1);
       }
       const plan = {
         apiVersion: "clawops.dev/v1",
@@ -2392,19 +2647,26 @@ var setup_default = defineCommand18({
           },
           secrets,
           network: {
-            allowedSshCidrs: [stackAnswers.sshCidr ?? "0.0.0.0/0"],
-            allowedGatewayCidrs: [stackAnswers.sshCidr ?? "0.0.0.0/0"]
+            // No `?? '0.0.0.0/0'`. The prompt requires an answer now, and a fallback that
+            // opened the internet would reintroduce the default it replaced.
+            allowedSshCidrs: [stackAnswers.sshCidr.trim()],
+            // Empty, not the SSH CIDR. Reusing it opened a plaintext HTTP dashboard to
+            // whatever network the operator picked for shell access — two very different
+            // risks answered by one question. The gateway is reached with
+            // `clawops tunnel`; exposing it is an explicit choice (network.publishGateway).
+            allowedGatewayCidrs: [],
+            publishGateway: "loopback"
           },
           ssh: { publicKey: sshPublicKey },
           ...stackAnswers.stateBucket ? { stateBucket: stackAnswers.stateBucket } : {}
         }
       };
-      outputPath = path3.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
+      outputPath = path2.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
       writeFileSync3(outputPath, JSON.stringify(plan, null, 2), "utf-8");
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       success(`Deployment plan saved to ${outputPath}`);
     }
-    process20.stdout.write("\n");
+    process21.stdout.write("\n");
     const mcpEntry = buildMcpEntry();
     if (!mcpEntry.resolved) {
       info("Note: clawops is not installed globally \u2014 AI apps will not be able to start");
@@ -2450,7 +2712,7 @@ var setup_default = defineCommand18({
       }
     }
     if (infraRequired.length > 0) {
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       info("\u2500\u2500 Action required: webhook registration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
       info("These integrations need a webhook URL set up in their developer portal:");
       for (const integ of infraRequired) {
@@ -2461,7 +2723,7 @@ var setup_default = defineCommand18({
       }
     }
     if (modelProvider.id === "ollama" && selectedModel.pullSuffix !== void 0) {
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       info("\u2500\u2500 Action required: download the Ollama model \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
       info("After deployment, run this command on the server (or locally if Ollama is local):");
       info(`  ollama pull ${selectedModel.id}${selectedModel.pullSuffix}`);
@@ -2506,8 +2768,8 @@ var setup_default = defineCommand18({
         });
       } else {
         const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-        const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
-        process20.stdout.write("\n");
+        const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
+        process21.stdout.write("\n");
         info("To deploy later, run these two commands:");
         info(`  clawops init --provider local --host ${localHost} --port ${localPort} --user ${localUser} --key ${localKeyPath} --stack ${stackAnswers.stackName}`);
         info(`  clawops up --stack ${stackAnswers.stackName} --config ${outputPath}`);
@@ -2522,18 +2784,18 @@ var setup_default = defineCommand18({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-F3KY2HTB.js");
+        const { applyPlan } = await import("./apply-AM5HERE7.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
-            onOutput: (line) => process20.stdout.write(line),
+            onOutput: (line2) => process21.stdout.write(line2),
             signal: ac.signal
           });
           success("Server provisioned and OpenClaw installed.");
           info(`Run: clawops doctor --stack ${stackAnswers.stackName}  to verify everything is healthy`);
         } catch (err) {
           failure(err instanceof Error ? err.message : String(err));
-          process20.exit(1);
+          process21.exit(1);
         }
         await maybeWireGatewayMcpCloud({ stackName: stackAnswers.stackName, signal: ac.signal, inquirer });
         await maybeHarden({
@@ -2551,11 +2813,11 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-HL4DNUNG.js");
-  const { connect } = await import("./ssh-CNJNLM3E.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QDLN4UMG.js");
+  const { localBootstrap } = await import("./bootstrap-DMRPWJGN.js");
+  const { connect } = await import("./ssh-B3NZAU4I.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-Z6IIZR3D.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
+  const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const existing = getConfig2();
   const stackEntry = {
     provider: "local",
@@ -2593,9 +2855,9 @@ async function runLocalDeploy(opts) {
       stackName: opts.stackName,
       sudoPassword: opts.sudoPassword,
       noWait: false,
-      onOutput: (line) => {
+      onOutput: (line2) => {
         for (const [pattern, label] of STAGES) {
-          if (pattern.test(line)) {
+          if (pattern.test(line2)) {
             spin.text = label;
             break;
           }
@@ -2634,11 +2896,11 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-QGFQRMGU.js");
+  const { drainPool } = await import("./pool-EX4ZTA5P.js");
   drainPool();
-  const tokenPath = path3.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
+  const tokenPath = path2.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
-  process20.stdout.write("\n");
+  process21.stdout.write("\n");
   success("All done! OpenClaw is running.");
   info(`Open dashboard: ${dashboardUrl}`);
   info(`  (or enter the token manually in the "Gateway Token" field: ${opts.gatewayToken})`);
@@ -2693,7 +2955,7 @@ ${cfg.loginHint}`);
     default: true
   }]);
   if (runNow) {
-    process20.stdout.write("\n");
+    process21.stdout.write("\n");
     const result = spawnSync(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
     if (result.error) {
       failure(`Could not launch ${cliName} \u2014 is it installed? (${result.error.message})`);
@@ -2703,10 +2965,10 @@ ${cfg.loginHint}`);
     }
     try {
       const identity = cfg.check();
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       success(`Authenticated: ${cfg.identity(identity)}`);
     } catch {
-      process20.stdout.write("\n");
+      process21.stdout.write("\n");
       failure(`Still not authenticated \u2014 the sign-in may have been cancelled or failed.`);
       info("Re-run `clawops setup` after signing in, or continue and authenticate before running `clawops up`.\n");
     }
@@ -2720,7 +2982,7 @@ function cliInstallUrl(provider) {
   return "https://learn.microsoft.com/en-us/cli/azure/install-azure-cli";
 }
 async function promptSecret(name, label, envDefault, inquirer) {
-  const secretsDir2 = path3.join(os.homedir(), ".clawops", "secrets");
+  const secretsDir2 = path2.join(os.homedir(), ".clawops", "secrets");
   const { secretSource } = await inquirer.prompt([{
     type: "list",
     name: "secretSource",
@@ -2738,9 +3000,9 @@ async function promptSecret(name, label, envDefault, inquirer) {
       message: `Paste your ${label}: (input is hidden)`,
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
-    mkdirSync3(secretsDir2, { recursive: true });
+    mkdirSync2(secretsDir2, { recursive: true });
     spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
-    const secretPath2 = path3.join(secretsDir2, name);
+    const secretPath2 = path2.join(secretsDir2, name);
     writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret saved to ${secretPath2}  (chmod 600)`);
     return { name, source: "file", ref: secretPath2 };
@@ -2772,7 +3034,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-QGFQRMGU.js");
+  const { acquireSession } = await import("./pool-EX4ZTA5P.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -2787,7 +3049,7 @@ async function checkDockerPreflight(opts) {
   });
   let out = "";
   try {
-    const result = await session.exec(DOCKER_CHECK_CMD, execSignal);
+    const result = await execPrivileged(session, DOCKER_CHECK_CMD, execSignal);
     out = result.stdout.trim();
   } catch {
     spin.warn("Docker check timed out \u2014 proceeding anyway. Bootstrap will verify.");
@@ -2819,7 +3081,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-QGFQRMGU.js");
+  const { acquireSession } = await import("./pool-EX4ZTA5P.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -2845,7 +3107,8 @@ async function startRemoteDocker(opts, spin) {
     while (Date.now() < deadline) {
       await new Promise((r) => setTimeout(r, DOCKER_POLL_MS));
       spin.text = `Waiting for Docker to start on ${opts.host}...`;
-      const check = await session.exec(
+      const check = await execPrivileged(
+        session,
         "docker version >/dev/null 2>&1 && echo OK || echo NOT_RUNNING",
         opts.signal
       );
@@ -2891,7 +3154,7 @@ async function pollUntilDockerReady(label) {
   throw new Error("Docker daemon did not become ready within timeout.");
 }
 async function startDockerAndWait(inquirer) {
-  const isLinux = process20.platform === "linux";
+  const isLinux = process21.platform === "linux";
   const { choice } = await inquirer.prompt([{
     type: "list",
     name: "choice",
@@ -2958,7 +3221,7 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
   if (!existsSync2(pubKeyPath)) return;
   const pubKey = readFileSync3(pubKeyPath, "utf-8").trim();
   const isLocal = LOCALHOST_ALIASES.has(host.toLowerCase());
-  const authorizedKeysPath = path3.join(os.homedir(), ".ssh", "authorized_keys");
+  const authorizedKeysPath = path2.join(os.homedir(), ".ssh", "authorized_keys");
   if (isLocal) {
     const existing = existsSync2(authorizedKeysPath) ? readFileSync3(authorizedKeysPath, "utf-8") : "";
     if (existing.includes(pubKey)) {
@@ -2973,7 +3236,7 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       default: true
     }]);
     if (addKey) {
-      mkdirSync3(path3.join(os.homedir(), ".ssh"), { recursive: true });
+      mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
       const entry = existing.endsWith("\n") || existing === "" ? pubKey + "\n" : "\n" + pubKey + "\n";
       writeFileSync3(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
       spawnSync("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
@@ -2983,15 +3246,15 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       info(`  ${pubKey}`);
     }
   } else {
-    process20.stdout.write("\n");
+    process21.stdout.write("\n");
     info("Make sure this public key is in ~/.ssh/authorized_keys on your server:");
     info(`  ${pubKey}`);
     info("(If you just created the server, paste the line above into the server's ~/.ssh/authorized_keys file.)\n");
   }
 }
 async function generateSshKey() {
-  const keyPath = path3.join(os.homedir(), ".ssh", "id_ed25519");
-  mkdirSync3(path3.join(os.homedir(), ".ssh"), { recursive: true });
+  const keyPath = path2.join(os.homedir(), ".ssh", "id_ed25519");
+  mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
   const result = spawnSync("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -3006,27 +3269,27 @@ async function generateSshKey() {
 function detectSshKey() {
   const candidates = ["id_ed25519", "id_ecdsa", "id_rsa", "id_dsa"];
   for (const name of candidates) {
-    const p = path3.join(os.homedir(), ".ssh", name);
+    const p = path2.join(os.homedir(), ".ssh", name);
     if (existsSync2(p)) return p;
   }
-  return path3.join(os.homedir(), ".ssh", "id_ed25519");
+  return path2.join(os.homedir(), ".ssh", "id_ed25519");
 }
 function printMcpSnippet() {
-  process20.stdout.write("\n");
-  process20.stdout.write(JSON.stringify({
+  process21.stdout.write("\n");
+  process21.stdout.write(JSON.stringify({
     mcpServers: {
       clawops: { command: "clawops", args: ["mcp", "serve", "--read-only"] }
     }
   }, null, 2) + "\n\n");
 }
 async function maybeWireGatewayMcp(opts) {
-  process20.stdout.write("\n");
+  process21.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-CNJNLM3E.js");
+  const { connect } = await import("./ssh-B3NZAU4I.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-7E5JQY47.js");
-  const knownHostsPath = path3.join(getConfigDir2(), "known_hosts");
+  const { wireGatewayMcp } = await import("./mcp-wire-BFEY2Y6H.js");
+  const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
     host: opts.host,
@@ -3040,8 +3303,7 @@ async function maybeWireGatewayMcp(opts) {
     const result = await wireGatewayMcp(session, opts.signal ?? AbortSignal.timeout(3e4));
     if (result.status === "unsupported") {
       spin.warn("This gateway has no `openclaw mcp add`, so nothing was wired.");
-      info("OpenClaw 2026.4.5 ships `openclaw mcp` with only `list` and `serve`.");
-      info("Upgrade to 2026.7.1-2 and run: clawops mcp wire --stack " + opts.stackName);
+      info("Upgrade OpenClaw to 2026.7.1-2 or later and run: clawops mcp wire --stack " + opts.stackName);
     } else if (result.status === "probe-failed") {
       spin.warn("The gateway could not reach clawops, so nothing was wired.");
       info("clawops does not run on the gateway host. Start it where the gateway can reach it,");
@@ -3062,7 +3324,7 @@ async function maybeWireGatewayMcp(opts) {
   }
 }
 async function maybeWireGatewayMcpCloud(opts) {
-  process20.stdout.write("\n");
+  process21.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
   info(`Run this after the server is ready:  clawops mcp wire --stack ${opts.stackName}`);
@@ -3078,8 +3340,8 @@ async function inquirerPromptWire(inquirer) {
 function loadCatalogs(yaml) {
   const specDir = resolveSpecDir();
   try {
-    const modelsRaw = yaml.load(readFileSync3(path3.join(specDir, "models.yaml"), "utf-8"));
-    const integrationsRaw = yaml.load(readFileSync3(path3.join(specDir, "integrations.yaml"), "utf-8"));
+    const modelsRaw = yaml.load(readFileSync3(path2.join(specDir, "models.yaml"), "utf-8"));
+    const integrationsRaw = yaml.load(readFileSync3(path2.join(specDir, "integrations.yaml"), "utf-8"));
     return {
       models: modelsRaw.providers,
       integrations: integrationsRaw.integrations
@@ -3130,13 +3392,13 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-URPXLSVF.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-PCDK3UQ5.js");
   const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
   const config = getConfig2();
   if (!config) return;
   const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
   if (availableModules.length === 0) return;
-  process20.stdout.write("\n");
+  process21.stdout.write("\n");
   const { selectedIds } = await opts.inquirer.prompt([{
     type: "checkbox",
     name: "selectedIds",
@@ -3152,9 +3414,9 @@ async function maybeHarden(opts) {
     return;
   }
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
-  process20.stdout.write("\nApplying hardening modules...\n\n");
+  process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3173,11 +3435,11 @@ async function maybeHarden(opts) {
       modules,
       signal: opts.signal,
       onProgress: (r) => {
-        process20.stdout.write(`  \xB7 ${r.module.label}
+        process21.stdout.write(`  \xB7 ${r.module.label}
 `);
       }
     });
-    process20.stdout.write("\n" + formatHardenSummary(results));
+    process21.stdout.write("\n" + formatHardenSummary(results));
     const errors = results.filter((r) => r.error);
     if (errors.length > 0) {
       for (const r of errors) fail(`${r.module.label}: ${r.error}`);
@@ -3191,26 +3453,52 @@ async function maybeHarden(opts) {
     info("Run `clawops harden --stack " + opts.stackName + "` to retry.");
   }
 }
+async function detectSshCidrDefault() {
+  const { detectEgressIp } = await import("./firewall-T3NTPZJD.js");
+  const result = await detectEgressIp("https://ifconfig.me");
+  if (!result.ok) return void 0;
+  const ip = result.ip.trim();
+  return ip === "" ? void 0 : ip.includes("/") ? ip : `${ip}/32`;
+}
+function validateCidrAnswer(value) {
+  const v = value.trim();
+  if (v === "") return "Required \u2014 enter a CIDR such as 203.0.113.4/32";
+  const looksIpv6 = v.includes(":");
+  if (!looksIpv6 && !/^(\d{1,3}\.){3}\d{1,3}\/(3[0-2]|[12]?\d)$/.test(v)) {
+    return `"${v}" is not a CIDR. Use an address and a prefix, e.g. 203.0.113.4/32`;
+  }
+  return true;
+}
+function admitsInternet(cidr) {
+  const v = cidr.trim();
+  return v === "0.0.0.0/0" || v === "::/0";
+}
+function wizardChannels(integrations) {
+  return integrations.filter((i) => i.wizardSupported !== false);
+}
+function startChannelConfig(integ) {
+  return { ...integ.defaults ?? {} };
+}
 
 // src/cli/commands/secret.ts
-import { defineCommand as defineCommand19 } from "citty";
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync4, statSync } from "fs";
+import { defineCommand as defineCommand20 } from "citty";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync3, statSync } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
-import path4 from "path";
+import path3 from "path";
 import os2 from "os";
-import process21 from "process";
-var SECRETS_DIR = path4.join(os2.homedir(), ".clawops", "secrets");
+import process22 from "process";
+var SECRETS_DIR = path3.join(os2.homedir(), ".clawops", "secrets");
 function secretsDir() {
   return SECRETS_DIR;
 }
 function secretPath(name) {
-  return path4.join(secretsDir(), name);
+  return path3.join(secretsDir(), name);
 }
 function listSecretNames() {
   if (!existsSync3(secretsDir())) return [];
   return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
 }
-var listCmd = defineCommand19({
+var listCmd = defineCommand20({
   meta: { name: "list", description: "List all stored secrets and their status" },
   args: {
     json: { type: "boolean", description: "Emit JSON" }
@@ -3235,7 +3523,7 @@ var listCmd = defineCommand19({
       }
     });
     if (args.json) {
-      process21.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+      process22.stdout.write(JSON.stringify(rows, null, 2) + "\n");
       return;
     }
     const tableRows = rows.map((r) => [
@@ -3244,10 +3532,10 @@ var listCmd = defineCommand19({
       r.modified,
       r.path
     ]);
-    process21.stdout.write("\n" + renderTable(["Name", "Status", "Modified", "Path"], tableRows) + "\n\n");
+    process22.stdout.write("\n" + renderTable(["Name", "Status", "Modified", "Path"], tableRows) + "\n\n");
   }
 });
-var setCmd = defineCommand19({
+var setCmd = defineCommand20({
   meta: { name: "set", description: "Create or update a secret" },
   args: {
     value: { type: "string", description: "Secret value (skips interactive prompt)" }
@@ -3256,7 +3544,7 @@ var setCmd = defineCommand19({
     const [name] = args._ ?? [];
     if (!name) {
       failure("Usage: clawops secret set <name>");
-      process21.exit(2);
+      process22.exit(2);
     }
     const inquirer = (await import("inquirer")).default;
     let value;
@@ -3271,14 +3559,14 @@ var setCmd = defineCommand19({
       }]);
       value = secretValue;
     }
-    mkdirSync4(secretsDir(), { recursive: true });
+    mkdirSync3(secretsDir(), { recursive: true });
     spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
     writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
     info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
   }
 });
-var deleteCmd = defineCommand19({
+var deleteCmd = defineCommand20({
   meta: { name: "delete", description: "Remove a stored secret" },
   args: {
     yes: { type: "boolean", description: "Skip confirmation prompt" }
@@ -3287,12 +3575,12 @@ var deleteCmd = defineCommand19({
     const [name] = args._ ?? [];
     if (!name) {
       failure("Usage: clawops secret delete <name>");
-      process21.exit(2);
+      process22.exit(2);
     }
     const p = secretPath(name);
     if (!existsSync3(p)) {
       failure(`Secret "${name}" not found at ${p}`);
-      process21.exit(1);
+      process22.exit(1);
     }
     const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
     const referencingStacks = listOverlays().filter((o) => o.secrets.some((s) => s.name === name)).map((o) => o.stackName);
@@ -3317,7 +3605,7 @@ var deleteCmd = defineCommand19({
     success(`Secret "${name}" deleted.`);
   }
 });
-var rotateCmd = defineCommand19({
+var rotateCmd = defineCommand20({
   meta: { name: "rotate", description: "Update a secret and re-apply config to a running stack" },
   args: {
     stack: { type: "string", description: "Stack name to re-apply (defaults to config default)" },
@@ -3327,7 +3615,7 @@ var rotateCmd = defineCommand19({
     const [name] = args._ ?? [];
     if (!name) {
       failure("Usage: clawops secret rotate <name> [--stack <name>]");
-      process21.exit(2);
+      process22.exit(2);
     }
     const inquirer = (await import("inquirer")).default;
     let value;
@@ -3342,7 +3630,7 @@ var rotateCmd = defineCommand19({
       }]);
       value = secretValue;
     }
-    mkdirSync4(secretsDir(), { recursive: true });
+    mkdirSync3(secretsDir(), { recursive: true });
     spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
     writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
@@ -3363,10 +3651,10 @@ var rotateCmd = defineCommand19({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-5LCUG2QR.js");
-      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-QDLN4UMG.js");
+      const { buildContext } = await import("./context-KHKWJJMC.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-Z6IIZR3D.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-QGFQRMGU.js");
+      const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
       const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
@@ -3401,7 +3689,7 @@ var rotateCmd = defineCommand19({
     }
   }
 });
-var auditCmd = defineCommand19({
+var auditCmd = defineCommand20({
   meta: { name: "audit", description: "Report missing secrets and unresolvable $secret: refs" },
   args: {
     json: { type: "boolean", description: "Emit JSON" }
@@ -3430,7 +3718,7 @@ var auditCmd = defineCommand19({
           }
         } else if (s.source === "env") {
           const envVar = s.ref ?? s.name;
-          if (!process21.env[envVar]) {
+          if (!process22.env[envVar]) {
             issues.push({ kind: "missing-env", stack: overlay.stackName, secret: s.name, detail: `Env var not set: ${envVar}` });
           }
         } else {
@@ -3439,7 +3727,7 @@ var auditCmd = defineCommand19({
       }
     }
     if (args.json) {
-      process21.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
+      process22.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
       return;
     }
     if (issues.length === 0) {
@@ -3452,11 +3740,11 @@ var auditCmd = defineCommand19({
       const prefix = issue.stack ? `[${issue.stack}] ` : "";
       warn(`${prefix}${issue.secret}: ${issue.detail}`);
     }
-    process21.stdout.write("\n");
+    process22.stdout.write("\n");
     info("Run `clawops secret set <name>` to update a missing or empty secret.");
   }
 });
-var secret_default = defineCommand19({
+var secret_default = defineCommand20({
   meta: {
     name: "secret",
     description: "Manage clawops secrets (list | set | delete | rotate | audit)"
@@ -3472,7 +3760,7 @@ var secret_default = defineCommand19({
 });
 
 // src/cli/commands/help.ts
-import { defineCommand as defineCommand20 } from "citty";
+import { defineCommand as defineCommand21 } from "citty";
 var COMMANDS = [
   ["setup", "Interactive first-run wizard \u2014 configure, deploy, and wire AI apps"],
   ["init", "Write config and generate SSH key pair (non-interactive)"],
@@ -3504,7 +3792,7 @@ var GLOBAL_FLAGS = [
   ["--dry-run", "Preview without applying (mutating commands)"],
   ["--yes", "Skip interactive confirmations (CI mode)"]
 ];
-var help_default = defineCommand20({
+var help_default = defineCommand21({
   meta: {
     name: "help",
     description: "Show available commands and global flags"
@@ -3544,16 +3832,16 @@ ${dim("Run `clawops <command> --help` for command-specific flags.")}
 });
 
 // src/cli/commands/bug.ts
-import { defineCommand as defineCommand21 } from "citty";
-import process22 from "process";
-import { accessSync as accessSync2, constants as constants2 } from "fs";
+import { defineCommand as defineCommand22 } from "citty";
+import process23 from "process";
+import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "1.7.9" : "dev";
+var VERSION = true ? "2.0.0" : "dev";
 async function collectContext() {
-  const nodeVersion = process22.version;
-  const os3 = `${process22.platform} ${process22.arch}`;
+  const nodeVersion = process23.version;
+  const os3 = `${process23.platform} ${process23.arch}`;
   let provider = "unknown";
   let stackCount = 0;
   let sshKey = "unknown";
@@ -3564,9 +3852,9 @@ async function collectContext() {
       const stacks = Object.values(config.stacks);
       stackCount = stacks.length;
       provider = stacks[0]?.provider ?? "none";
-      const keyPath = config.ssh.keyPath.replace(/^~/, process22.env["HOME"] ?? "~");
+      const keyPath = config.ssh.keyPath.replace(/^~/, process23.env["HOME"] ?? "~");
       try {
-        accessSync2(keyPath, constants2.R_OK);
+        accessSync(keyPath, constants.R_OK);
         sshKey = "present";
       } catch {
         sshKey = "missing";
@@ -3604,14 +3892,14 @@ function buildIssueUrl(title, command, context) {
 }
 function openBrowser2(url) {
   try {
-    const cmd = process22.platform === "darwin" ? "open" : "xdg-open";
+    const cmd = process23.platform === "darwin" ? "open" : "xdg-open";
     execSync2(`${cmd} "${url}"`, { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
-var bug_default = defineCommand21({
+var bug_default = defineCommand22({
   meta: {
     name: "bug",
     description: "Open a pre-filled GitHub issue with system context from clawops doctor"
@@ -3625,7 +3913,7 @@ var bug_default = defineCommand21({
     let command = "";
     if (!args.json) {
       const { createInterface: createInterface3 } = await import("readline/promises");
-      const rl = createInterface3({ input: process22.stdin, output: process22.stdout });
+      const rl = createInterface3({ input: process23.stdin, output: process23.stdout });
       try {
         title = (await rl.question("Describe the issue in one line: ")).trim();
         command = (await rl.question("Which command triggered it? (optional): ")).trim();
@@ -3638,12 +3926,12 @@ var bug_default = defineCommand21({
       printJson(jsonOk({ url }));
       return;
     }
-    process22.stdout.write("\n");
+    process23.stdout.write("\n");
     info(`Opening: ${url}`);
-    process22.stdout.write("\n");
+    process23.stdout.write("\n");
     const opened = openBrowser2(url);
     if (!opened) {
-      process22.stdout.write(`Open this URL to file the issue:
+      process23.stdout.write(`Open this URL to file the issue:
 ${url}
 `);
     }
@@ -3651,9 +3939,9 @@ ${url}
 });
 
 // src/cli/commands/harden.ts
-import { defineCommand as defineCommand22 } from "citty";
-import process23 from "process";
-var harden_default = defineCommand22({
+import { defineCommand as defineCommand23 } from "citty";
+import process24 from "process";
+var harden_default = defineCommand23({
   meta: {
     name: "harden",
     description: "Apply security hardening modules to a deployed stack"
@@ -3667,26 +3955,26 @@ var harden_default = defineCommand22({
     json: { type: "boolean", description: "Emit structured JSON output" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-URPXLSVF.js");
-    const { buildContext } = await import("./context-5LCUG2QR.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-PCDK3UQ5.js");
+    const { buildContext } = await import("./context-KHKWJJMC.js");
     const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
     if (args.list) {
-      process23.stdout.write("\nAvailable hardening modules:\n\n");
+      process24.stdout.write("\nAvailable hardening modules:\n\n");
       for (const mod of MODULE_CATALOG) {
         const on = mod.defaultOn ? chalk.green("ON ") : chalk.dim("off");
         const providers = mod.providers === "all" ? "all" : mod.providers.join(", ");
-        process23.stdout.write(
+        process24.stdout.write(
           `  ${on}  ${mod.id.padEnd(28)} ${mod.label}  [${providers}]
 `
         );
       }
-      process23.stdout.write("\n");
+      process24.stdout.write("\n");
       return;
     }
     const config = getConfig2();
     if (!config) {
       failure("No clawops config found. Run `clawops init` first.");
-      process23.exit(1);
+      process24.exit(1);
     }
     const ctx = buildContext({ stack: args.stack });
     const provider = ctx.adapter.name;
@@ -3696,17 +3984,17 @@ var harden_default = defineCommand22({
       return;
     }
     if (!args.json) {
-      process23.stdout.write("\nModules to run:\n");
+      process24.stdout.write("\nModules to run:\n");
       for (const mod of modules) {
         const flag = mod.defaultOn ? "" : chalk.yellow(" [opt-in]");
-        process23.stdout.write(`  \xB7 ${mod.label}${flag}
+        process24.stdout.write(`  \xB7 ${mod.label}${flag}
 `);
       }
-      process23.stdout.write("\n");
+      process24.stdout.write("\n");
     }
     if (!args["dry-run"] && !args.yes && !args.json) {
       const { createInterface: createInterface3 } = await import("readline/promises");
-      const rl = createInterface3({ input: process23.stdin, output: process23.stdout });
+      const rl = createInterface3({ input: process24.stdin, output: process24.stdout });
       const answer = await rl.question("Apply these hardening modules? [y/N] ");
       rl.close();
       if (!answer.toLowerCase().startsWith("y")) {
@@ -3715,8 +4003,8 @@ var harden_default = defineCommand22({
       }
     }
     const ac = new AbortController();
-    process23.on("SIGINT", () => ac.abort());
-    process23.on("SIGTERM", () => ac.abort());
+    process24.on("SIGINT", () => ac.abort());
+    process24.on("SIGTERM", () => ac.abort());
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const stackObj = await ctx.getStack();
     const outputMap = await stackObj.outputs();
@@ -3730,7 +4018,7 @@ var harden_default = defineCommand22({
       knownHostsPath: config.ssh.knownHostsPath
     });
     if (!args.json) {
-      process23.stdout.write(args["dry-run"] ? "Checking hardening state...\n\n" : "Applying hardening...\n\n");
+      process24.stdout.write(args["dry-run"] ? "Checking hardening state...\n\n" : "Applying hardening...\n\n");
     }
     const results = await runHardening(conn, {
       modules,
@@ -3738,7 +4026,7 @@ var harden_default = defineCommand22({
       signal: ac.signal,
       onProgress: args.json ? void 0 : (r) => {
         const icon = r.error ? chalk.red("\u2717") : r.applyResult?.changed ? chalk.green("\u2713") : chalk.dim("\xB7");
-        process23.stdout.write(`  ${icon}  ${r.module.label}
+        process24.stdout.write(`  ${icon}  ${r.module.label}
 `);
       }
     });
@@ -3756,14 +4044,14 @@ var harden_default = defineCommand22({
       }));
       return;
     }
-    process23.stdout.write("\n" + formatHardenSummary(results));
+    process24.stdout.write("\n" + formatHardenSummary(results));
     const errors = results.filter((r) => r.error);
     if (errors.length > 0) {
-      process23.stdout.write("\n");
+      process24.stdout.write("\n");
       for (const r of errors) {
         failure(`${r.module.label}: ${r.error}`);
       }
-      process23.exit(1);
+      process24.exit(1);
     }
     if (!args["dry-run"]) {
       success("Hardening complete.");
@@ -3772,26 +4060,26 @@ var harden_default = defineCommand22({
 });
 
 // src/cli/error-handler.ts
-import process24 from "process";
+import process25 from "process";
 function handleError(err) {
   if (err instanceof ClawopsError) {
     failure(err.message);
-    process24.exit(err.exitCode);
+    process25.exit(err.exitCode);
   }
   if (err instanceof Error) {
     failure(`Unexpected error: ${err.message}`);
-    if (process24.env["DEBUG"]) {
-      process24.stderr.write(err.stack ?? "\n");
+    if (process25.env["DEBUG"]) {
+      process25.stderr.write(err.stack ?? "\n");
     }
-    process24.exit(1);
+    process25.exit(1);
   }
   failure(`Unknown error: ${String(err)}`);
-  process24.exit(1);
+  process25.exit(1);
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "1.7.9" : "dev";
-var main = defineCommand23({
+var CLI_VERSION = true ? "2.0.0" : "dev";
+var main = defineCommand24({
   meta: {
     name: "clawops",
     description: "Deploy and manage self-hosted OpenClaw instances across clouds",
@@ -3819,6 +4107,7 @@ var main = defineCommand23({
     logs: logs_default,
     config: config_default,
     agents: agents_default,
+    migrate: migrate_default,
     gateway: gateway_default,
     backup: backup_default,
     stacks: stacks_default,