@clawops/cli 1.7.9 → 2.0.0

package/dist/config-validate-K2N6XLDX.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import {
+  compareVersions
+} from "./chunk-GAZPPSKU.js";
+import "./chunk-JW5A7E3X.js";
+import "./chunk-EI7CQQ7D.js";
+
+// src/openclaw/config-validate.ts
+var cached;
+async function getValidator() {
+  if (cached) return cached;
+  const [{ default: Ajv }, { default: addFormats }, { readFileSync }, { join }, { resolveSpecDir }] = await Promise.all([
+    import("ajv"),
+    import("ajv-formats"),
+    import("fs"),
+    import("path"),
+    import("./spec-path-KQOOIQCA.js")
+  ]);
+  const schema = JSON.parse(
+    readFileSync(join(resolveSpecDir(), "openclaw-2.0.config.schema.json"), "utf-8")
+  );
+  const ajv = new Ajv({ strict: false, allErrors: true });
+  addFormats(ajv);
+  cached = ajv.compile(schema);
+  return cached;
+}
+function isUnknownKey(e) {
+  return e.keyword === "additionalProperties";
+}
+function dotPath(instancePath) {
+  if (!instancePath) return "(root)";
+  return instancePath.slice(1).split("/").map((seg) => seg.replace(/~1/g, "/").replace(/~0/g, "~")).join(".");
+}
+function describe(e) {
+  const where = dotPath(e.instancePath);
+  if (isUnknownKey(e)) {
+    const extra = e.params.additionalProperty;
+    return `${where}: unknown key "${extra}"`;
+  }
+  return `${where}: ${e.message ?? "invalid"}`;
+}
+function deploymentContractErrors(cfg) {
+  const errors = [];
+  if (cfg === null || typeof cfg !== "object") return errors;
+  const gateway = cfg["gateway"];
+  const mode = gateway !== null && typeof gateway === "object" ? gateway["mode"] : void 0;
+  if (mode === void 0) {
+    errors.push(
+      'gateway.mode: required by clawops. OpenClaw treats it as optional only because --allow-unconfigured can bypass the check; clawops does not pass that flag, so a config without gateway.mode exits 78 with "Gateway start blocked". Set it to "local".'
+    );
+  }
+  return errors;
+}
+async function validateConfig(cfg, opts = {}) {
+  const validate = await getValidator();
+  const contract = deploymentContractErrors(cfg);
+  if (validate(cfg)) return { errors: contract, warnings: [] };
+  const { openclawVersion, schemaCapturedFrom } = opts;
+  const runtimeIsNewer = openclawVersion !== void 0 && schemaCapturedFrom !== void 0 && compareVersions(openclawVersion, schemaCapturedFrom) > 0;
+  const errors = [...contract];
+  const warnings = [];
+  for (const e of validate.errors ?? []) {
+    const text = describe(e);
+    if (isUnknownKey(e) && runtimeIsNewer) {
+      warnings.push(
+        `${text} \u2014 not in the schema captured from OpenClaw ${schemaCapturedFrom}; you are deploying ${openclawVersion}, so this may be a newer setting clawops does not know about yet.`
+      );
+    } else {
+      errors.push(text);
+    }
+  }
+  return { errors, warnings };
+}
+export {
+  validateConfig
+};

package/dist/{context-5LCUG2QR.js → context-KHKWJJMC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildContext
-} from "./chunk-P5LKWRPL.js";
+} from "./chunk-LU2V3LXA.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{firewall-XQGO7HWK.js → firewall-T3NTPZJD.js}

@@ -45,7 +45,17 @@ async function detectEgressIp(checkUrl) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
+function resolveGatewayIngressCidrs(publishGateway, accessMode, allowedCidrs, portOverride, egressResult) {
+  if (publishGateway !== "all") return [];
+  return resolveIngressCidrs(accessMode, allowedCidrs, portOverride, egressResult);
+}
+function resolveGatewayPort(raw, fallback) {
+  const port = Number(raw);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : fallback;
+}
 export {
   detectEgressIp,
+  resolveGatewayIngressCidrs,
+  resolveGatewayPort,
   resolveIngressCidrs
 };

package/dist/{gcp-UG6AWPIZ.js → gcp-2JBTD7ZM.js}

@@ -1,24 +1,29 @@
 #!/usr/bin/env node
 import {
   makeStartupScript
-} from "./chunk-C5X375RO.js";
+} from "./chunk-CKSPROD5.js";
+import {
+  GATEWAY_PORT
+} from "./chunk-6TIYVHPX.js";
+import "./chunk-EI7CQQ7D.js";
 
 // src/providers/gcp/index.ts
 import process2 from "process";
 
 // src/providers/gcp/program.ts
-var GATEWAY_PORT = 18789;
 var SSH_PORT = 22;
 var gcpProgram = async () => {
-  const [pulumi, gcp, { resolveIngressCidrs, detectEgressIp }] = await Promise.all([
+  const [pulumi, gcp, { resolveIngressCidrs, resolveGatewayIngressCidrs, resolveGatewayPort, detectEgressIp }] = await Promise.all([
     import("@pulumi/pulumi"),
     import("@pulumi/gcp"),
-    import("./firewall-XQGO7HWK.js")
+    import("./firewall-T3NTPZJD.js")
   ]);
   const cfg = new pulumi.Config();
   const instanceType = cfg.get("instanceType") ?? "e2-standard-2";
   const region = cfg.get("region") ?? "us-central1";
   const openclawVersion = cfg.get("openclawVersion") ?? "latest";
+  const publishGateway = cfg.get("publishGateway") === "all" ? "all" : "loopback";
+  const gatewayPort = resolveGatewayPort(cfg.get("gatewayPort"), GATEWAY_PORT);
   const zone = cfg.get("zone") ?? `${region}-a`;
   const accessMode = cfg.get("accessMode") ?? "restricted";
   const allowedCidrs = cfg.get("allowedCidrs") ?? "";
@@ -37,7 +42,13 @@ var gcpProgram = async () => {
     );
   }
   const sshIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, sshCidrs, egressResult);
-  const gatewayIngressCidrs = resolveIngressCidrs(accessMode, allowedCidrs, gatewayCidrs, egressResult);
+  const gatewayIngressCidrs = resolveGatewayIngressCidrs(
+    publishGateway,
+    accessMode,
+    allowedCidrs,
+    gatewayCidrs,
+    egressResult
+  );
   const network = new gcp.compute.Network("clawops-network", {
     autoCreateSubnetworks: false,
     description: "clawops managed network"
@@ -58,7 +69,7 @@ var gcpProgram = async () => {
   if (gatewayIngressCidrs.length > 0) {
     new gcp.compute.Firewall("clawops-firewall-gateway", {
       network: network.selfLink,
-      allows: [{ protocol: "tcp", ports: [String(GATEWAY_PORT)] }],
+      allows: [{ protocol: "tcp", ports: [String(gatewayPort)] }],
       sourceRanges: gatewayIngressCidrs,
       targetTags: ["clawops"]
     });
@@ -89,7 +100,7 @@ var gcpProgram = async () => {
     metadata: {
       // GCP guest agent reads 'ssh-keys' and populates /home/<user>/.ssh/authorized_keys
       "ssh-keys": `clawops:${sshPublicKey}`,
-      "startup-script": makeStartupScript({ openclawVersion, os: "debian" })
+      "startup-script": makeStartupScript({ openclawVersion, os: "debian", publishGateway, gatewayPort })
     },
     serviceAccount: {
       scopes: ["https://www.googleapis.com/auth/cloud-platform"]
@@ -98,7 +109,7 @@ var gcpProgram = async () => {
   return {
     instanceId: instance.id,
     publicIp: address.address,
-    gatewayUrl: pulumi.interpolate`https://${address.address}:${GATEWAY_PORT}`,
+    gatewayUrl: pulumi.interpolate`https://${address.address}:${gatewayPort}`,
     sshHost: address.address,
     sshPort: SSH_PORT,
     sshUser: "clawops",

package/dist/{generate-OAGYT3VH.js → generate-2XV2GSP2.js}

@@ -2,10 +2,10 @@
 import {
   generatePlan,
   planId
-} from "./chunk-A4QR4TXW.js";
-import "./chunk-6X45DDGH.js";
-import "./chunk-P5LKWRPL.js";
-import "./chunk-PVUVI35Y.js";
+} from "./chunk-WHJMKDV7.js";
+import "./chunk-YR3O2I3S.js";
+import "./chunk-LU2V3LXA.js";
+import "./chunk-JW5A7E3X.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";

package/dist/{harden-URPXLSVF.js → harden-PCDK3UQ5.js}

@@ -2,9 +2,16 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-DQDAWNGB.js";
-import "./chunk-3XK66DKK.js";
+} from "./chunk-3WYA2QDM.js";
+import "./chunk-AHAAEXWC.js";
 import "./chunk-KGXPLI7W.js";
+import {
+  GATEWAY_PORT,
+  PUBLISH_INSPECT_CMD,
+  publishForRestart,
+  publishedGatewayPort
+} from "./chunk-6TIYVHPX.js";
+import "./chunk-EI7CQQ7D.js";
 
 // src/harden/types.ts
 var SENTINEL_DIR = "/etc/clawops/hardening";
@@ -154,7 +161,11 @@ var sshModule = {
 
 // src/harden/modules/ufw.ts
 var SENTINEL2 = `${SENTINEL_DIR}/ufw.applied`;
-var GATEWAY_PORT = 18789;
+async function publishedGateway(exec) {
+  const { stdout } = await exec(`${PUBLISH_INSPECT_CMD} 2>/dev/null || true`);
+  if (publishForRestart(stdout) !== "all") return { exposed: false };
+  return { exposed: true, port: publishedGatewayPort(stdout) };
+}
 function makeUfwModule(sshPort = 22) {
   return {
     id: "ufw",
@@ -176,14 +187,24 @@ function makeUfwModule(sshPort = 22) {
       return { status: "missing", detail: "UFW installed but not active" };
     },
     async apply(exec) {
+      const gateway = await publishedGateway(exec);
+      const rules = [`ufw allow ${sshPort}/tcp comment "clawops SSH"`];
+      let gatewayNote;
+      if (!gateway.exposed) {
+        gatewayNote = "gateway port not opened (published on 127.0.0.1 \u2014 reach it with `clawops tunnel`)";
+      } else if (gateway.port === void 0) {
+        gatewayNote = "gateway published on every interface but its port could not be read \u2014 no rule added; run `clawops doctor --stack <name>` and open it yourself if that is intended";
+      } else {
+        rules.push(`ufw allow ${gateway.port}/tcp comment "OpenClaw gateway"`);
+        gatewayNote = `allow ${gateway.port}/tcp`;
+      }
       const script = [
         `mkdir -p ${SENTINEL_DIR}`,
         "apt-get install -y -q ufw",
         "ufw --force reset",
         "ufw default deny incoming",
         "ufw default allow outgoing",
-        `ufw allow ${sshPort}/tcp comment "clawops SSH"`,
-        `ufw allow ${GATEWAY_PORT}/tcp comment "OpenClaw gateway"`,
+        ...rules,
         "ufw --force enable",
         `touch ${SENTINEL2}`
       ].join(" && ");
@@ -191,7 +212,10 @@ function makeUfwModule(sshPort = 22) {
       if (code !== 0) {
         throw new Error(`UFW setup failed (exit ${code}): ${stderr.slice(0, 200)}`);
       }
-      return { changed: true, detail: `UFW enabled: deny-all in, allow ${sshPort}/tcp + ${GATEWAY_PORT}/tcp` };
+      return {
+        changed: true,
+        detail: `UFW enabled: deny-all in, allow ${sshPort}/tcp; ${gatewayNote}`
+      };
     }
   };
 }
@@ -473,7 +497,14 @@ var sysctlModule = {
 };
 
 // src/harden/modules/aws-sg-audit.ts
-var EXPECTED_OPEN_PORTS = /* @__PURE__ */ new Set([22, 18789]);
+var WORLD = /* @__PURE__ */ new Set(["0.0.0.0/0"]);
+var WORLD_V6 = /* @__PURE__ */ new Set(["::/0"]);
+var NAMED_PORTS = { 22: "SSH", [GATEWAY_PORT]: "the OpenClaw gateway" };
+function describe(fromPort, toPort) {
+  const range = fromPort === toPort ? `port ${fromPort}` : `ports ${fromPort}-${toPort}`;
+  const named = NAMED_PORTS[fromPort];
+  return named && fromPort === toPort ? `${range} (${named})` : range;
+}
 var awsSgAuditModule = {
   id: "aws-sg-audit",
   label: "AWS SG audit (check-only)",
@@ -492,19 +523,25 @@ var awsSgAuditModule = {
         for (const rule of sg.IpPermissions ?? []) {
           const fromPort = rule.FromPort ?? 0;
           const toPort = rule.ToPort ?? 65535;
+          const where = describe(fromPort, toPort);
           for (const range of rule.IpRanges ?? []) {
-            if (range.CidrIp === "0.0.0.0/0" && !EXPECTED_OPEN_PORTS.has(fromPort)) {
-              openRules.push(`port ${fromPort}\u2013${toPort} open to 0.0.0.0/0 in ${sg.GroupId}`);
+            if (range.CidrIp && WORLD.has(range.CidrIp)) {
+              openRules.push(`${where} open to ${range.CidrIp} in ${sg.GroupId}`);
+            }
+          }
+          for (const range of rule.Ipv6Ranges ?? []) {
+            if (range.CidrIpv6 && WORLD_V6.has(range.CidrIpv6)) {
+              openRules.push(`${where} open to ${range.CidrIpv6} in ${sg.GroupId}`);
             }
           }
         }
       }
       if (openRules.length === 0) {
-        return { status: "applied", detail: "No unexpected open ingress rules found" };
+        return { status: "applied", detail: "No ingress rule admits the whole internet" };
       }
       return {
         status: "drifted",
-        detail: `Open ingress rules detected: ${openRules.join("; ")}`
+        detail: `Ingress open to the internet: ${openRules.join("; ")}`
       };
     } catch (err) {
       return {

package/dist/health-5CCOXYGG.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  HEALTH_PATHS,
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+export {
+  HEALTH_PATHS,
+  interpretProbe,
+  probeCommand
+};

package/dist/logs-P7YCKVF4.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import {
+  GATEWAY_LOGS_PROBE,
+  agentAuditCommand,
+  chooseLogSource,
+  containerLogsCommand,
+  gatewayLogsCommand
+} from "./chunk-SBLQH2TJ.js";
+export {
+  GATEWAY_LOGS_PROBE,
+  agentAuditCommand,
+  chooseLogSource,
+  containerLogsCommand,
+  gatewayLogsCommand
+};

package/dist/{mcp-wire-7E5JQY47.js → mcp-wire-BFEY2Y6H.js}

@@ -1,24 +1,30 @@
 #!/usr/bin/env node
 import {
   MCP_HTTP_PORT
-} from "./chunk-GZN7PKP4.js";
-import "./chunk-35WVQY3X.js";
+} from "./chunk-AX74VXTV.js";
+import "./chunk-UFRO4H5W.js";
+import "./chunk-N44K3LHE.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-WHJMKDV7.js";
+import "./chunk-YR3O2I3S.js";
 import "./chunk-6ZFIFDBJ.js";
+import "./chunk-3WYA2QDM.js";
+import "./chunk-AHAAEXWC.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-3QJBNAHW.js";
-import "./chunk-A4QR4TXW.js";
-import "./chunk-6X45DDGH.js";
-import "./chunk-FNS56UQY.js";
-import "./chunk-DQDAWNGB.js";
-import "./chunk-SEZMVVAS.js";
-import "./chunk-P5LKWRPL.js";
-import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
-import "./chunk-3XK66DKK.js";
+import "./chunk-LU2V3LXA.js";
+import "./chunk-GYV4KNW7.js";
+import "./chunk-SBLQH2TJ.js";
+import "./chunk-LT4XMO5D.js";
+import {
+  execPrivileged
+} from "./chunk-NUDIHZEH.js";
+import "./chunk-JW5A7E3X.js";
 import "./chunk-Q7NQY5HV.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
+import "./chunk-6TIYVHPX.js";
+import "./chunk-EI7CQQ7D.js";
 
 // src/cli/mcp-wire.ts
 var GATEWAY_MCP_NAME = "clawops";
@@ -30,17 +36,17 @@ function shellQuote(value) {
 }
 var OC = "docker exec openclaw openclaw mcp";
 async function supportsMcpAdd(session, signal) {
-  const help = await session.exec(`${OC} add --help`, signal);
+  const help = await execPrivileged(session, `${OC} add --help`, signal);
   return help.code === 0;
 }
 async function wireGatewayMcp(session, signal, opts = {}) {
   const url = opts.url ?? defaultGatewayMcpUrl();
   if (!await supportsMcpAdd(session, signal)) return { status: "unsupported", url };
-  const existing = await session.exec(`${OC} show ${GATEWAY_MCP_NAME}`, signal);
+  const existing = await execPrivileged(session, `${OC} show ${GATEWAY_MCP_NAME}`, signal);
   const alreadyWired = existing.code === 0;
   if (alreadyWired && !opts.rewire) return { status: "exists", url };
   if (alreadyWired) {
-    const removed = await session.exec(`${OC} unset ${GATEWAY_MCP_NAME}`, signal);
+    const removed = await execPrivileged(session, `${OC} unset ${GATEWAY_MCP_NAME}`, signal);
     if (removed.code !== 0) {
       return {
         status: "probe-failed",
@@ -54,7 +60,7 @@ async function wireGatewayMcp(session, signal, opts = {}) {
     `--url ${shellQuote(url)}`,
     ...opts.token ? [`--header ${shellQuote(`Authorization=Bearer ${opts.token}`)}`] : []
   ].join(" ");
-  const added = await session.exec(`${OC} add ${GATEWAY_MCP_NAME} ${flags}`, signal);
+  const added = await execPrivileged(session, `${OC} add ${GATEWAY_MCP_NAME} ${flags}`, signal);
   if (added.code !== 0) {
     return {
       status: "probe-failed",
@@ -62,7 +68,7 @@ async function wireGatewayMcp(session, signal, opts = {}) {
       url
     };
   }
-  await session.exec(`${OC} reload`, signal);
+  await execPrivileged(session, `${OC} reload`, signal);
   return { status: "wired", rewired: alreadyWired, url };
 }
 export {

package/dist/{package-5AR4ZPK4.js → package-3HUW57XH.js}

@@ -2,7 +2,7 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "1.7.9";
+var version = "2.0.0";
 var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
 var type = "module";
 var bin = {
@@ -35,13 +35,13 @@ var scripts = {
   test: "vitest run",
   "test:pulumi": "vitest run tests/providers/aws/program.test.ts tests/providers/azure/program.test.ts",
   "test:changed": "vitest --changed",
-  "test:mutation": "node scripts/dev/mutation-check.mjs",
   "test:integration": "vitest run --config vitest.integration.config.ts",
   typecheck: "NODE_OPTIONS=--max-old-space-size=4096 tsc --noEmit",
   lint: "eslint --max-warnings=0 src tests scripts",
   "gen:schemas": "tsx scripts/gen-schemas.ts",
   changeset: "changeset",
-  release: "pnpm build && changeset publish"
+  release: "pnpm build && changeset publish",
+  "test:mutation": "node scripts/dev/mutation-check.mjs"
 };
 var dependencies = {
   "@aws-sdk/client-cloudwatch-logs": "^3.1063.0",

package/dist/plugins-DTST3OER.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+
+// src/openclaw/plugins.ts
+function providerIdOf(p) {
+  return p.configPath?.split(".").pop() ?? p.id;
+}
+function requiredPlugins(cfg, catalog) {
+  if (cfg === null || typeof cfg !== "object") return [];
+  const models = cfg["models"];
+  if (models === null || typeof models !== "object") return [];
+  const providers = models["providers"];
+  if (providers === null || typeof providers !== "object") return [];
+  const configured = new Set(Object.keys(providers));
+  const out = [];
+  for (const entry of catalog.providers) {
+    if (!entry.plugin) continue;
+    const id = providerIdOf(entry);
+    if (configured.has(id)) {
+      out.push({ providerId: id, package: entry.plugin.package, version: entry.plugin.version });
+    }
+  }
+  return out;
+}
+function installCommand(plugin, image, stateDir) {
+  return `docker run --rm -v ${stateDir}:/home/node/.openclaw ${image} openclaw plugins install 'clawhub:${plugin.package}@${plugin.version}' --accept-capabilities`;
+}
+function missingProviders(cfg, pluginsListJson) {
+  let loaded = /* @__PURE__ */ new Set();
+  try {
+    const parsed = JSON.parse(pluginsListJson);
+    const list = Array.isArray(parsed) ? parsed : parsed.plugins ?? [];
+    loaded = new Set(
+      list.filter((p) => p.enabled !== false && p.status !== "error").flatMap((p) => p.providerIds ?? [])
+    );
+  } catch {
+    return [];
+  }
+  if (cfg === null || typeof cfg !== "object") return [];
+  const models = cfg["models"];
+  if (models === null || typeof models !== "object") return [];
+  const providers = models["providers"];
+  if (providers === null || typeof providers !== "object") return [];
+  return Object.keys(providers).filter((id) => !loaded.has(id));
+}
+export {
+  installCommand,
+  missingProviders,
+  requiredPlugins
+};

package/dist/{pool-QGFQRMGU.js → pool-EX4ZTA5P.js}

@@ -2,8 +2,8 @@
 import {
   acquireSession,
   drainPool
-} from "./chunk-DQDAWNGB.js";
-import "./chunk-3XK66DKK.js";
+} from "./chunk-3WYA2QDM.js";
+import "./chunk-AHAAEXWC.js";
 import "./chunk-KGXPLI7W.js";
 export {
   acquireSession,

package/dist/privileged-JFA6LLTV.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import {
+  execPrivileged,
+  execPrivilegedWithInput,
+  resetPrivilegeCache,
+  shellQuote,
+  streamPrivileged,
+  sudoWrap
+} from "./chunk-NUDIHZEH.js";
+export {
+  execPrivileged,
+  execPrivilegedWithInput,
+  resetPrivilegeCache,
+  shellQuote,
+  streamPrivileged,
+  sudoWrap
+};

package/dist/{remote-config-QDLN4UMG.js → remote-config-Z6IIZR3D.js}

@@ -6,10 +6,11 @@ import {
   OPENCLAW_TMP,
   atomicWriteConfig,
   deepMerge,
-  normaliseGatewayPort,
   readRemoteConfig,
   restartGateway
-} from "./chunk-SEZMVVAS.js";
+} from "./chunk-N44K3LHE.js";
+import "./chunk-NUDIHZEH.js";
+import "./chunk-6TIYVHPX.js";
 import "./chunk-EI7CQQ7D.js";
 export {
   OPENCLAW_CONFIG,
@@ -18,7 +19,6 @@ export {
   OPENCLAW_TMP,
   atomicWriteConfig,
   deepMerge,
-  normaliseGatewayPort,
   readRemoteConfig,
   restartGateway
 };

package/dist/runtime-LZ7NA53V.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+import {
+  ADD_HOST_FLAG,
+  CONFIG_FILENAME,
+  CONFIG_MOUNT_PATH,
+  CONTAINER_UID,
+  ENV_FILE_PATH,
+  GATEWAY_PORT,
+  PUBLISH_INSPECT_CMD,
+  SECURITY_FLAGS,
+  STATE_DIR_CONTAINER,
+  STATE_DIR_HOST_LINUX,
+  STATE_DIR_HOST_MACOS,
+  SUPERVISOR_ENV,
+  configPathForOS,
+  gatewayRunArgs,
+  gatewayRunCommand,
+  publishForRestart,
+  publishedGatewayPort,
+  stateDirForOS
+} from "./chunk-6TIYVHPX.js";
+import "./chunk-EI7CQQ7D.js";
+export {
+  ADD_HOST_FLAG,
+  CONFIG_FILENAME,
+  CONFIG_MOUNT_PATH,
+  CONTAINER_UID,
+  ENV_FILE_PATH,
+  GATEWAY_PORT,
+  PUBLISH_INSPECT_CMD,
+  SECURITY_FLAGS,
+  STATE_DIR_CONTAINER,
+  STATE_DIR_HOST_LINUX,
+  STATE_DIR_HOST_MACOS,
+  SUPERVISOR_ENV,
+  configPathForOS,
+  gatewayRunArgs,
+  gatewayRunCommand,
+  publishForRestart,
+  publishedGatewayPort,
+  stateDirForOS
+};

package/dist/{server-FIZCOLHL.js → server-A5AB67GQ.js}

@@ -5,24 +5,28 @@ import {
   bearerFrom,
   isLoopbackBind,
   serveMcp
-} from "./chunk-GZN7PKP4.js";
-import "./chunk-35WVQY3X.js";
+} from "./chunk-AX74VXTV.js";
+import "./chunk-UFRO4H5W.js";
+import "./chunk-N44K3LHE.js";
+import "./chunk-3QJBNAHW.js";
+import "./chunk-WHJMKDV7.js";
+import "./chunk-YR3O2I3S.js";
 import "./chunk-6ZFIFDBJ.js";
+import "./chunk-3WYA2QDM.js";
+import "./chunk-AHAAEXWC.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-3QJBNAHW.js";
-import "./chunk-A4QR4TXW.js";
-import "./chunk-6X45DDGH.js";
-import "./chunk-FNS56UQY.js";
-import "./chunk-DQDAWNGB.js";
-import "./chunk-SEZMVVAS.js";
-import "./chunk-P5LKWRPL.js";
-import "./chunk-EI7CQQ7D.js";
-import "./chunk-PVUVI35Y.js";
-import "./chunk-3XK66DKK.js";
+import "./chunk-LU2V3LXA.js";
+import "./chunk-GYV4KNW7.js";
+import "./chunk-SBLQH2TJ.js";
+import "./chunk-LT4XMO5D.js";
+import "./chunk-NUDIHZEH.js";
+import "./chunk-JW5A7E3X.js";
 import "./chunk-Q7NQY5HV.js";
 import "./chunk-A2I76FTA.js";
 import "./chunk-CX5SL5HP.js";
 import "./chunk-KGXPLI7W.js";
+import "./chunk-6TIYVHPX.js";
+import "./chunk-EI7CQQ7D.js";
 export {
   MCP_HTTP_PORT,
   authRequirement,

package/dist/spec-path-KQOOIQCA.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  _resetSpecDirCache,
+  resolveSpecDir
+} from "./chunk-JW5A7E3X.js";
+export {
+  _resetSpecDirCache,
+  resolveSpecDir
+};

package/dist/{ssh-CNJNLM3E.js → ssh-B3NZAU4I.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   connect
-} from "./chunk-3XK66DKK.js";
+} from "./chunk-AHAAEXWC.js";
 import "./chunk-KGXPLI7W.js";
 export {
   connect