@clawops/cli 2.0.0 → 2.0.1

package/dist/cli.js

@@ -1,23 +1,20 @@
 #!/usr/bin/env node
-import {
-  MCP_APPS,
-  buildMcpEntry,
-  writeAppConfigs
-} from "./chunk-OIGTOLB3.js";
 import {
   monitor_default,
   runDiagnostics
-} from "./chunk-GYV4KNW7.js";
+} from "./chunk-IVWP4QUJ.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
-} from "./chunk-SBLQH2TJ.js";
+} from "./chunk-NUL5F6YV.js";
 import {
-  interpretProbe,
-  probeCommand
-} from "./chunk-LT4XMO5D.js";
+  MCP_APPS,
+  buildMcpEntry,
+  writeAppConfigs
+} from "./chunk-OIGTOLB3.js";
+import "./chunk-3OLUJPCB.js";
 import {
   execPrivileged,
   execPrivilegedWithInput,
@@ -26,6 +23,29 @@ import {
 import {
   resolveSpecDir
 } from "./chunk-JW5A7E3X.js";
+import {
+  interpretProbe,
+  probeCommand
+} from "./chunk-LT4XMO5D.js";
+import "./chunk-LEVIW2PV.js";
+import {
+  CONFIG_FILENAME,
+  CONTAINER_UID,
+  PUBLISH_INSPECT_CMD,
+  STATE_DIR_HOST_LINUX,
+  configPathForOS,
+  gatewayRunCommand,
+  publishForRestart
+} from "./chunk-GIEVAGEK.js";
+import {
+  GATEWAY_PORT,
+  IMAGE_INSPECT_CMD,
+  imageForRestart,
+  versionOf
+} from "./chunk-VOEJYRIK.js";
+import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
 import {
   REPO_URL,
   chalk,
@@ -36,6 +56,7 @@ import {
   success,
   warn
 } from "./chunk-Q7NQY5HV.js";
+import "./chunk-N4WZLWJ4.js";
 import {
   getConfig,
   getConfigDir,
@@ -46,30 +67,95 @@ import {
   ClawopsError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
-import {
-  CONFIG_FILENAME,
-  CONTAINER_UID,
-  GATEWAY_PORT,
-  IMAGE_INSPECT_CMD,
-  PUBLISH_INSPECT_CMD,
-  STATE_DIR_HOST_LINUX,
-  configPathForOS,
-  gatewayRunCommand,
-  imageForRestart,
-  publishForRestart,
-  versionOf
-} from "./chunk-6TIYVHPX.js";
-import "./chunk-EI7CQQ7D.js";
+import "./chunk-VUFMZEIM.js";
 
 // src/cli/index.ts
 import { defineCommand as defineCommand24, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
-import { generateKeyPairSync } from "crypto";
+import { spawnSync } from "child_process";
 import { writeFileSync, mkdirSync, existsSync } from "fs";
 import path from "path";
 import process2 from "process";
+
+// src/providers/state-bucket.ts
+function deriveStateBucket(provider, scope) {
+  if (provider === "azure") {
+    return { ok: true, name: "clawops-state" };
+  }
+  if (!scope.account) {
+    return {
+      ok: false,
+      needs: provider === "aws" ? "an AWS account id \u2014 set AWS_PROFILE, or run `aws sso login --profile <name>`" : "a GCP project \u2014 run `gcloud config set project <id>`, or set GOOGLE_CLOUD_PROJECT"
+    };
+  }
+  if (provider === "gcp") return { ok: true, name: `clawops-state-${scope.account}` };
+  if (!scope.region) return { ok: false, needs: "a region" };
+  return { ok: true, name: `clawops-state-${scope.account}-${scope.region}` };
+}
+function stateUrlFor(provider, bucket) {
+  const verdict = validateStateBucket(provider, bucket);
+  if (verdict !== true) throw new Error(`Not a usable ${provider} state backend name: ${verdict}`);
+  const scheme = provider === "aws" ? "s3://" : provider === "gcp" ? "gs://" : "azblob://";
+  return provider === "azure" ? `${scheme}${bucket}` : `${scheme}${bucket}/clawops`;
+}
+var IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function validateStateBucket(provider, name) {
+  const n = name.trim();
+  if (n === "") return "Required";
+  if (n !== name) return "No leading or trailing spaces";
+  if (n.length < 3) return `Too short \u2014 ${labelFor(provider)} names are at least 3 characters`;
+  const dotted = provider === "gcp" && n.includes(".");
+  const max = dotted ? 222 : 63;
+  if (n.length > max) return `Too long \u2014 ${labelFor(provider)} names are at most ${max} characters`;
+  if (dotted && n.split(".").some((part) => part.length > 63)) {
+    return "Each dot-separated part of a Cloud Storage name is at most 63 characters";
+  }
+  if (n !== n.toLowerCase()) return "Lowercase only";
+  if (provider === "azure") {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(n)) {
+      return "Letters, digits and single hyphens only, starting and ending with a letter or digit";
+    }
+    return true;
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/.test(n)) {
+    return "Letters, digits, dots, hyphens and underscores only, starting and ending with a letter or digit";
+  }
+  if (n.includes("..")) return "No consecutive dots";
+  if (IPV4.test(n)) return "Cannot be formatted as an IP address";
+  if (provider === "aws") {
+    if (n.startsWith("xn--")) return 'Cannot start with "xn--"';
+    if (n.startsWith("sthree-")) return 'Cannot start with "sthree-"';
+    if (n.endsWith("-s3alias")) return 'Cannot end with "-s3alias"';
+    if (n.endsWith("--ol-s3")) return 'Cannot end with "--ol-s3"';
+    if (n.includes("_")) return "Underscores are not allowed in S3 bucket names";
+    return true;
+  }
+  if (n.startsWith("goog")) return 'Cannot start with "goog"';
+  if (n.includes("google")) return 'Cannot contain "google"';
+  return true;
+}
+function labelFor(provider) {
+  if (provider === "aws") return "S3 bucket";
+  if (provider === "gcp") return "Cloud Storage bucket";
+  return "blob container";
+}
+async function resolveScopeAccount(provider, signal) {
+  if (provider === "azure") return void 0;
+  try {
+    if (provider === "aws") {
+      const { callerAccount } = await import("./preflight-TFD4N5ZU.js");
+      return await callerAccount(signal);
+    }
+    const { resolveProjectId } = await import("./preflight-EF52S3WW.js");
+    return resolveProjectId();
+  } catch {
+    return void 0;
+  }
+}
+
+// src/cli/commands/init.ts
 var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
 var PROVIDER_DEFAULTS = {
   gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
@@ -111,9 +197,9 @@ var init_default = defineCommand({
       );
     }
     const existing = getConfig();
-    if (existing && !forceOverwrite && !nonInteractive) {
+    if (existing?.stacks[stackName] && !forceOverwrite) {
       failure(
-        `Config already exists at ${path.join(getConfigDir(), "config.json")}. Use --force to overwrite.`
+        `Stack "${stackName}" already exists in ${path.join(getConfigDir(), "config.json")} (${existing.stacks[stackName].stateUrl}). Use --force to overwrite its settings, or pass a different --stack name to add another one.`
       );
       process2.exit(1);
     }
@@ -126,12 +212,21 @@ var init_default = defineCommand({
         throw new UsageError(`SSH key not found at ${keyPath}`);
       }
       info("Generating SSH key pair...");
-      const { privateKey } = generateKeyPairSync("ed25519", {
-        privateKeyEncoding: { type: "pkcs8", format: "pem" },
-        publicKeyEncoding: { type: "spki", format: "pem" }
-      });
-      writeFileSync(keyPath, privateKey, { mode: 384 });
-      success(`SSH private key written to ${keyPath}`);
+      const gen = spawnSync(
+        "ssh-keygen",
+        ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops", "-q"],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+      if (gen.error || gen.status !== 0) {
+        const reason = gen.error?.message ?? gen.stderr?.toString().trim() ?? `exit ${gen.status}`;
+        throw new UsageError(
+          `Could not generate an SSH key: ${reason}
+Generate one yourself and point clawops at it:
+  ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops
+  clawops init --key-path ${keyPath}`
+        );
+      }
+      success(`SSH key pair written to ${keyPath} (and ${keyPath}.pub)`);
     } else {
       info(`Using existing SSH key at ${keyPath}`);
     }
@@ -146,43 +241,41 @@ var init_default = defineCommand({
       }
       const sshUser = typeof args["ssh-user"] === "string" ? args["ssh-user"] : "root";
       const sshPort = typeof args["ssh-port"] === "string" ? parseInt(args["ssh-port"], 10) : 22;
-      config = {
-        version: 1,
-        defaults: { stack: stackName, provider },
-        stacks: {
-          [stackName]: {
-            provider,
-            stateUrl: "file://~/.clawops/state",
-            credentialsRef: { source: "file", envVars: [] },
-            localOpts: { host, sshUser, sshPort, sshKeyPath: keyPath }
-          }
-        },
-        ssh: { keyPath, knownHostsPath }
-      };
+      config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
+        provider,
+        stateUrl: "file://~/.clawops/state",
+        credentialsRef: { source: "file", envVars: [] },
+        localOpts: { host, sshUser, sshPort, sshKeyPath: keyPath }
+      });
     } else {
       const defaults = PROVIDER_DEFAULTS[provider];
       const region = typeof args.region === "string" ? args.region : defaults.region;
-      const stateUrl = typeof args.state === "string" ? args.state : `${defaults.stateScheme}CHANGEME/clawops`;
-      config = {
-        version: 1,
-        defaults: { stack: stackName, provider },
-        stacks: {
-          [stackName]: {
-            provider,
-            stateUrl,
-            region,
-            credentialsRef: { source: "env", envVars: [defaults.credEnv] }
-          }
-        },
-        ssh: { keyPath, knownHostsPath }
-      };
-      if (stateUrl.includes("CHANGEME")) {
-        process2.stdout.write("\n");
-        info(
-          `Update stateUrl in the config to a real state backend before running \`clawops up\`.
-  Example: clawops init --provider ${provider} --state ${defaults.stateScheme}your-bucket/clawops`
-        );
+      let stateUrl;
+      if (typeof args.state === "string") {
+        stateUrl = args.state;
+      } else {
+        const account = await resolveScopeAccount(provider);
+        const derived = deriveStateBucket(provider, { account, region });
+        if (!derived.ok) {
+          throw new UsageError(
+            `Could not name a state backend for ${provider}: clawops needs ${derived.needs}.
+Authenticate and run this again, or name the backend yourself:
+  clawops init --provider ${provider} --state ${defaults.stateScheme}your-bucket/clawops`
+          );
+        }
+        stateUrl = stateUrlFor(provider, derived.name);
       }
+      config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
+        provider,
+        stateUrl,
+        region,
+        credentialsRef: { source: "env", envVars: [defaults.credEnv] }
+      });
+      process2.stdout.write("\n");
+      info(
+        `State backend: ${stateUrl}
+  clawops doctor --provider ${provider} checks it exists, and clawops setup offers to create it.`
+      );
       process2.stdout.write("\n");
       success(`Provider: ${provider}  Region: ${region}  Stack: ${stackName}`);
       setConfig(config);
@@ -195,6 +288,15 @@ var init_default = defineCommand({
     success(`Provider: ${provider}  Stack: ${stackName}`);
   }
 });
+function merge(existing, stackName, provider, keyPath, knownHostsPath, stack) {
+  return {
+    ...existing ?? {},
+    version: 1,
+    defaults: { stack: stackName, provider },
+    stacks: { ...existing?.stacks ?? {}, [stackName]: stack },
+    ssh: { keyPath, knownHostsPath }
+  };
+}
 
 // src/cli/commands/up.ts
 import { defineCommand as defineCommand2 } from "citty";
@@ -217,7 +319,6 @@ function renderTable(headers, rows) {
 }
 
 // src/cli/commands/up.ts
-var VALID_INSTANCE_TYPES = ["micro", "small", "medium", "large", "gpu"];
 var up_default = defineCommand2({
   meta: {
     name: "up",
@@ -226,17 +327,20 @@ var up_default = defineCommand2({
   args: {
     provider: { type: "string", description: "Cloud provider (gcp|aws|azure|local)" },
     region: { type: "string", description: "Cloud region" },
-    "instance-type": { type: "string", description: "Instance size alias (micro|small|medium|large|gpu)" },
+    "instance-type": { type: "string", description: "Instance size: a clawops alias (micro|small|medium|large|gpu) or a type your cloud names itself, e.g. t3.small" },
     "dry-run": { type: "boolean", description: "Preview without applying" },
     "no-wait": { type: "boolean", description: "Return immediately without waiting for healthy state" },
     "openclaw-version": { type: "string", description: "OpenClaw release (e.g. 2026.7.1-2). Moving tags are resolved and range-checked" },
     stack: { type: "string", description: "Target stack name" },
     config: { type: "string", description: "Path to openclaw config overlay JSON (local provider only)" },
-    "gateway-port": { type: "string", description: `Host port to publish the gateway on (default ${GATEWAY_PORT}, local provider only \u2014 cloud stacks set spec.network.gatewayPort in the plan)` }
+    "gateway-port": { type: "string", description: `Host port to publish the gateway on (default ${GATEWAY_PORT})` },
+    "ssh-cidr": { type: "string", description: "CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for this machine's IP. Omitted = none, and nothing will be able to connect" },
+    "gateway-cidr": { type: "string", description: "CIDR(s) allowed to reach the gateway port, or 'auto'. Requires --publish-gateway all" },
+    "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
-    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
     const openclawVersion = await guardOpenclawVersion(requestedVersion);
@@ -248,11 +352,11 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-DMRPWJGN.js");
+      const { localBootstrap } = await import("./bootstrap-HNGKY6WW.js");
       const gatewayPort = parseGatewayPort(args["gateway-port"]);
-      const abortController = new AbortController();
-      process3.on("SIGINT", () => abortController.abort());
-      process3.on("SIGTERM", () => abortController.abort());
+      const abortController2 = new AbortController();
+      process3.on("SIGINT", () => abortController2.abort());
+      process3.on("SIGTERM", () => abortController2.abort());
       const spin2 = spinner(`Bootstrapping local host "${localOpts.host}"...`);
       try {
         const state = await localBootstrap({
@@ -265,7 +369,7 @@ var up_default = defineCommand2({
           stackName: ctx.stackName,
           gatewayPort,
           noWait: Boolean(args["no-wait"]),
-          signal: abortController.signal
+          signal: abortController2.signal
         });
         spin2.succeed(`Host "${localOpts.host}" bootstrapped`);
         info(`Gateway URL: ${state.gatewayUrl}`);
@@ -278,7 +382,7 @@ var up_default = defineCommand2({
             user: localOpts.sshUser,
             privateKeyPath: localOpts.sshKeyPath,
             knownHostsPath: ctx.config.ssh.knownHostsPath,
-            signal: abortController.signal
+            signal: abortController2.signal
           });
           info("Config overlay applied and gateway restarted.");
         }
@@ -288,64 +392,90 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const instanceAlias = typeof args["instance-type"] === "string" ? args["instance-type"] : "small";
-    if (!VALID_INSTANCE_TYPES.includes(instanceAlias)) {
-      throw new UsageError(
-        `Invalid --instance-type: ${instanceAlias}. Valid values: ${VALID_INSTANCE_TYPES.join(", ")}`
-      );
-    }
+    const { generatePlan } = await import("./generate-I6YQ5V2T.js");
+    const { applyPlan } = await import("./apply-KYFPWI5U.js");
+    const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
+    const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const isDryRun = Boolean(args["dry-run"]);
     const validation = await ctx.adapter.validateConfig();
     if (!validation.ok) {
       for (const e of validation.errors) failure(e);
       process3.exit(3);
     }
-    const stack = await ctx.getStack();
-    const region = typeof args.region === "string" ? args.region : ctx.adapter.defaultRegion();
-    const instanceType = ctx.adapter.normalizeInstanceType(
-      instanceAlias
-    );
-    await stack.setConfig("region", { value: region });
-    await stack.setConfig("instanceType", { value: instanceType });
-    await stack.setConfig("openclawVersion", { value: openclawVersion });
-    if (isDryRun) {
-      info("Previewing changes (--dry-run)...");
-      const preview = await stack.preview({ onOutput: (out) => process3.stdout.write(out) });
-      process3.stdout.write("\n");
-      if (preview.changeSummary) {
-        const rows = Object.entries(preview.changeSummary).filter(([, count]) => count > 0).map(([op, count]) => [op, String(count)]);
-        if (rows.length > 0) {
-          process3.stdout.write(renderTable(["Operation", "Count"], rows) + "\n");
-        }
-      }
-      success("Preview complete (no resources changed)");
-      return;
+    if (typeof args.config === "string") {
+      info("--config applies to local stacks only; put the overlay in the plan for a cloud stack.");
     }
+    const abortController = new AbortController();
+    process3.on("SIGINT", () => abortController.abort());
+    process3.on("SIGTERM", () => abortController.abort());
+    const network = await resolveNetworkFlags(
+      {
+        sshCidr: strArg(args["ssh-cidr"]),
+        gatewayCidr: strArg(args["gateway-cidr"]),
+        publishGateway: strArg(args["publish-gateway"])
+      },
+      { detectEgressIp: () => detectEgressIp("https://ifconfig.me/ip") }
+    );
+    const cloudGatewayPort = strArg(args["gateway-port"]);
+    if (cloudGatewayPort) network.gatewayPort = parseGatewayPort(cloudGatewayPort);
     const spin = spinner(`Deploying stack "${ctx.stackName}"...`);
     try {
-      const result = await stack.up({
-        onOutput: (out) => {
-          spin.text = out.trim() || spin.text;
+      const plan = await generatePlan(
+        {
+          stackName: ctx.stackName,
+          provider: ctx.adapter.name,
+          ...strArg(args.region) ? { region: strArg(args.region) } : {},
+          ...strArg(args["instance-type"]) ? { instanceType: strArg(args["instance-type"]) } : {},
+          openclawVersion,
+          network
+        },
+        { signal: abortController.signal }
+      );
+      if (isDryRun) {
+        spin.stop();
+        info("Previewing changes (--dry-run)...");
+        const diff = plan.diff;
+        if (diff && diff.totalChanges > 0) {
+          const rows = [
+            ["create", String(diff.create.length)],
+            ["update", String(diff.update.length)],
+            ["delete", String(diff.delete.length)]
+          ].filter(([, count]) => count !== "0");
+          process3.stdout.write(renderTable(["Operation", "Count"], rows) + "\n");
         }
+        success("Preview complete (no resources changed)");
+        return;
+      }
+      const result = await applyPlan(plan, {
+        onOutput: (line2) => {
+          spin.text = line2.trim() || spin.text;
+        },
+        onProgress: (line2) => {
+          const text = line2.trim();
+          if (!text) return;
+          spin.text = text;
+          if (!process3.stderr.isTTY) process3.stderr.write(`${text}
+`);
+        },
+        signal: abortController.signal,
+        skipReadiness: Boolean(args["no-wait"])
       });
       spin.succeed(`Stack "${ctx.stackName}" deployed`);
-      const outputs = result.outputs;
-      if (outputs["publicIp"]) {
-        info(`Public IP:   ${outputs["publicIp"].value}`);
-      }
-      if (outputs["gatewayUrl"]) {
-        info(`Gateway URL: ${outputs["gatewayUrl"].value}`);
-      }
+      if (result.outputs["publicIp"]) info(`Public IP:   ${String(result.outputs["publicIp"])}`);
+      if (result.outputs["gatewayUrl"]) info(`Gateway URL: ${String(result.outputs["gatewayUrl"])}`);
     } catch (err) {
       spin.fail("Deployment failed");
       throw err;
     }
   }
 });
+function strArg(value) {
+  return typeof value === "string" ? value : void 0;
+}
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-B3NZAU4I.js");
+  const { connect } = await import("./ssh-VAI5DU5M.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-Z6IIZR3D.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -393,7 +523,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -457,7 +587,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -524,13 +654,18 @@ var plan_default = defineCommand5({
     provider: { type: "string", description: "Cloud provider (aws|gcp|azure)" },
     stack: { type: "string", description: "Target stack name" },
     region: { type: "string", description: "Cloud region" },
-    "instance-type": { type: "string", description: "Instance size alias (micro|small|medium|large|gpu)" },
+    "instance-type": { type: "string", description: "Instance size: a clawops alias (micro|small|medium|large|gpu) or a type your cloud names itself, e.g. t3.small" },
     "openclaw-version": { type: "string", description: "semver or 'stable'/'dev'" },
+    "ssh-cidr": { type: "string", description: "CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for this machine's IP. Omitted = none, and nothing will be able to connect" },
+    "gateway-cidr": { type: "string", description: "CIDR(s) allowed to reach the gateway port, comma-separated, or 'auto'. Requires --publish-gateway all" },
+    "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' },
     out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
-    const { generatePlan } = await import("./generate-2XV2GSP2.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { generatePlan } = await import("./generate-I6YQ5V2T.js");
+    const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
+    const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -542,6 +677,14 @@ var plan_default = defineCommand5({
     if (outPath && !isAbsolute(outPath)) {
       throw new UsageError("--out path must be absolute (R7). Use an absolute path like /tmp/plan.json.");
     }
+    const network = await resolveNetworkFlags(
+      {
+        sshCidr: strArg2(args["ssh-cidr"]),
+        gatewayCidr: strArg2(args["gateway-cidr"]),
+        publishGateway: strArg2(args["publish-gateway"])
+      },
+      { detectEgressIp: () => detectEgressIp("https://ifconfig.me/ip") }
+    );
     const abortController = new AbortController();
     process7.on("SIGINT", () => abortController.abort());
     process7.on("SIGTERM", () => abortController.abort());
@@ -554,7 +697,8 @@ var plan_default = defineCommand5({
           provider,
           region: typeof args.region === "string" ? args.region : void 0,
           instanceType: typeof args["instance-type"] === "string" ? args["instance-type"] : void 0,
-          openclawVersion: typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0
+          openclawVersion: typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0,
+          network
         },
         { signal: abortController.signal }
       );
@@ -604,6 +748,9 @@ Changes: ${create.length} to create, ${update.length} to update, ${del.length} t
     }
   }
 });
+function strArg2(value) {
+  return typeof value === "string" ? value : void 0;
+}
 
 // src/cli/commands/apply.ts
 import { defineCommand as defineCommand6 } from "citty";
@@ -621,8 +768,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-BOQRWX4F.js");
-    const { applyPlan } = await import("./apply-AM5HERE7.js");
+    const { validatePlan } = await import("./validate-YVI3BJ55.js");
+    const { applyPlan } = await import("./apply-KYFPWI5U.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -691,6 +838,16 @@ ${validation.errors.join("\n")}`);
         onOutput: (line2) => {
           spin.text = line2.trim() || spin.text;
         },
+        // A spinner renders nothing without a TTY, so a scripted or CI deploy sat silent
+        // through the minutes an image pull takes. These lines are rare — one per half
+        // minute at most — so they are cheap to print outright where nothing else will.
+        onProgress: (line2) => {
+          const text = line2.trim();
+          if (!text) return;
+          spin.text = text;
+          if (!process8.stderr.isTTY) process8.stderr.write(`${text}
+`);
+        },
         signal: abortController.signal,
         confirmDrift: args.yes ? void 0 : async () => {
           spin.stop();
@@ -738,7 +895,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -776,6 +933,7 @@ Pass --yes to proceed with destruction.
     const abortController = new AbortController();
     process9.on("SIGINT", () => abortController.abort());
     process9.on("SIGTERM", () => abortController.abort());
+    const doomedHost = await hostOf(stack, ctx);
     const spin = spinner(`Destroying stack "${ctx.stackName}"\u2026`);
     try {
       await stack.destroy({
@@ -789,8 +947,35 @@ Pass --yes to proceed with destruction.
       spin.fail("Destroy failed");
       throw err;
     }
+    if (doomedHost) {
+      const { forgetHost } = await import("./known-hosts-file-I3Q3NBYQ.js");
+      const removed = forgetHost(
+        expandHome(ctx.config.ssh.knownHostsPath),
+        doomedHost.host,
+        doomedHost.port
+      );
+      if (removed) info(`Forgot the host key for ${doomedHost.host} \u2014 its instance is gone.`);
+    }
   }
 });
+async function hostOf(stack, ctx) {
+  try {
+    const outputMap = await stack.outputs();
+    const raw = Object.fromEntries(Object.entries(outputMap).map(([k, v]) => [k, v.value]));
+    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+    const conn = ctx.adapter.getConnectionInfo({
+      ...extractBaseOutputs(raw),
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+    return conn.host ? { host: conn.host, port: conn.port } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function expandHome(p) {
+  return p.replace(/^~/, process9.env["HOME"] ?? "~");
+}
 
 // src/cli/commands/ssh.ts
 import { defineCommand as defineCommand8 } from "citty";
@@ -805,8 +990,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -892,9 +1077,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-EX4ZTA5P.js");
+    const { acquireSession } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -961,9 +1146,9 @@ var logs_default = defineCommand10({
     json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -997,8 +1182,8 @@ var logs_default = defineCommand10({
     });
     spin.stop();
     try {
-      const probe = since ? { stdout: "" } : await execPrivileged(session, GATEWAY_LOGS_PROBE, abortController.signal);
-      const choice = chooseLogSource({ since, gatewayReachable: probe.stdout.trim() === "ok" });
+      const probe = since ? { code: 1, stderr: "" } : await execPrivileged(session, GATEWAY_LOGS_PROBE, abortController.signal);
+      const choice = chooseLogSource({ since, gatewayReachable: probe.code === 0 });
       const opts = { tail: tailLines, follow, since, json: Boolean(args.json) };
       const command = choice.source === "gateway" ? gatewayLogsCommand(opts) : containerLogsCommand(opts);
       info(`Logs: ${choice.source} \u2014 ${choice.reason}`);
@@ -1067,9 +1252,9 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1157,7 +1342,7 @@ var config_default = defineCommand11({
         process13.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
         return;
       }
-      const { atomicWriteConfig } = await import("./remote-config-Z6IIZR3D.js");
+      const { atomicWriteConfig } = await import("./remote-config-3HZLUWEA.js");
       try {
         await atomicWriteConfig(session, cfg, abortController.signal);
       } catch (err) {
@@ -1202,9 +1387,9 @@ var agents_default = defineCommand12({
     cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, name] = args._ ?? [];
     if (action === "restart") {
       failure(
@@ -1277,7 +1462,7 @@ var agents_default = defineCommand12({
           );
         }
       } else {
-        const { agentAuditCommand } = await import("./logs-P7YCKVF4.js");
+        const { agentAuditCommand } = await import("./logs-5A7YYA53.js");
         const limit = typeof args.limit === "string" ? parseInt(args.limit, 10) : 50;
         const result = await execPrivileged(
           session,
@@ -1434,10 +1619,10 @@ var migrate_default = defineCommand13({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
-    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const requested = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0;
     const target = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
     const targetImage = `ghcr.io/openclaw/openclaw:${target}`;
@@ -1573,9 +1758,9 @@ var gateway_default = defineCommand14({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
@@ -1606,12 +1791,24 @@ var gateway_default = defineCommand14({
     });
     try {
       if (action === "status") {
-        const statusCmd = `docker inspect openclaw --format '{"status":"{{.State.Status}}","started":"{{.State.StartedAt}}","image":"{{.Config.Image}}"}' 2>/dev/null || echo '{"status":"not running","started":"","image":""}'`;
-        const result = await session.exec(statusCmd, abortController.signal);
+        const { inspectContainer } = await import("./docker-3PDO4TS7.js");
+        const inspected = await inspectContainer(
+          session,
+          "openclaw",
+          '{"status":"{{.State.Status}}","started":"{{.State.StartedAt}}","image":"{{.Config.Image}}"}',
+          abortController.signal
+        );
         let status = { status: "unknown", started: "", image: "" };
-        try {
-          status = JSON.parse(result.stdout.trim());
-        } catch {
+        if (inspected.kind === "ok") {
+          try {
+            status = JSON.parse(inspected.value);
+          } catch {
+          }
+        } else if (inspected.kind === "missing") {
+          status = { status: "not running", started: "", image: "" };
+        } else {
+          failure(`Could not ask docker about the gateway: ${inspected.detail}`);
+          process16.exit(1);
         }
         if (args.json) {
           printJson(jsonOk(status));
@@ -1650,7 +1847,7 @@ var gateway_default = defineCommand14({
         }
         success(`Gateway restarted (${version}).`);
       } else {
-        const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-GPSTCPT7.js");
+        const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
         const requested = versionArg ?? args.channel;
         const version = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
         const spin = spinner(`Updating gateway to ${version}...`);
@@ -1793,8 +1990,8 @@ var backup_default = defineCommand15({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -2004,7 +2201,7 @@ var stacks_default = defineCommand16({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-KHKWJJMC.js");
+        const { buildContext } = await import("./context-7EVC6W45.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -2072,6 +2269,8 @@ var doctor_default = defineCommand17({
   },
   args: {
     stack: { type: "string", description: "Stack name to include remote health checks" },
+    provider: { type: "string", description: "Check this provider's credentials and account setup, with or without a stack" },
+    "instance-type": { type: "string", description: "Ask account checks about this machine size rather than the provider default" },
     json: { type: "boolean", description: "Emit the report as JSON" }
   },
   async run({ args }) {
@@ -2081,7 +2280,12 @@ var doctor_default = defineCommand17({
     process19.on("SIGTERM", abort);
     let report;
     try {
-      report = await runDiagnostics({ stack: args.stack, signal: ac.signal });
+      report = await runDiagnostics({
+        stack: args.stack,
+        provider: typeof args.provider === "string" ? args.provider : void 0,
+        instanceType: typeof args["instance-type"] === "string" ? args["instance-type"] : void 0,
+        signal: ac.signal
+      });
     } finally {
       process19.off("SIGINT", abort);
       process19.off("SIGTERM", abort);
@@ -2114,7 +2318,7 @@ ${section.title}
   process19.stdout.write("\n");
 }
 function line(check) {
-  const label = check.detail ? `${check.name.padEnd(NAME_COLUMN)}${check.detail}` : check.name;
+  const label = check.detail ? `${check.name.padEnd(NAME_COLUMN)}${check.name.length >= NAME_COLUMN ? "  " : ""}${check.detail}` : check.name;
   const emit = { pass: success, fail: failure, warn, info }[check.status];
   emit(label);
   if (check.remedy) info(`  ${check.remedy}`);
@@ -2138,7 +2342,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-A5AB67GQ.js");
+    const { serveMcp } = await import("./server-GBA7BJGK.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -2216,11 +2420,11 @@ var wireCmd = defineCommand18({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
-    const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-BFEY2Y6H.js");
-    const { MCP_HTTP_PORT } = await import("./server-A5AB67GQ.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-3SWBM7D6.js");
+    const { MCP_HTTP_PORT } = await import("./server-GBA7BJGK.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -2321,7 +2525,7 @@ import process21 from "process";
 import os from "os";
 import { randomBytes } from "crypto";
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { execSync, spawnSync, spawn as spawn2 } from "child_process";
+import { execSync, spawnSync as spawnSync2, spawn as spawn2 } from "child_process";
 import path2 from "path";
 var setup_default = defineCommand19({
   meta: {
@@ -2433,6 +2637,14 @@ var setup_default = defineCommand19({
     }
     process21.stdout.write("\n");
     const sshCidrDefault = provider === "local" ? void 0 : await detectSshCidrDefault();
+    const scopeAccount = provider === "local" ? void 0 : await resolveScopeAccount(provider);
+    if (provider !== "local" && provider !== "azure" && !scopeAccount) {
+      const needed = deriveStateBucket(provider, {});
+      if (!needed.ok) {
+        warn(`clawops cannot suggest a name for the state backend: it needs ${needed.needs}.`);
+        info("Type the name of a bucket you already have, or quit, authenticate, and start again.\n");
+      }
+    }
     const stackAnswers = await inquirer.prompt([
       {
         type: "input",
@@ -2454,12 +2666,7 @@ var setup_default = defineCommand19({
           message: "Server size: (bigger = faster, but costs more per month)",
           choices: instanceChoices(provider)
         },
-        {
-          type: "input",
-          name: "stateBucket",
-          message: `${stateLabel(provider)} bucket name: (a storage bucket that tracks what's deployed \u2014 create one first if you haven't)`,
-          validate: (v) => v.trim() !== "" || "Required \u2014 create a bucket in your cloud console first"
-        },
+        stateBucketQuestion(provider, scopeAccount),
         {
           type: "input",
           name: "sshKeyPath",
@@ -2485,6 +2692,18 @@ var setup_default = defineCommand19({
         default: "latest"
       }
     ]);
+    if (provider !== "local") {
+      await runAccountPreflight({
+        provider,
+        region: typeof stackAnswers.region === "string" ? stackAnswers.region : void 0,
+        bucket: stackAnswers.stateBucket,
+        // The size was chosen three questions ago. Azure offers SKU families per subscription,
+        // so asking about the provider default here would clear a size the operator is not
+        // deploying and say nothing about the one they are.
+        instanceType: typeof stackAnswers.instanceSize === "string" ? stackAnswers.instanceSize : void 0,
+        inquirer
+      });
+    }
     if (provider !== "local" && admitsInternet(stackAnswers.sshCidr)) {
       warn(
         "SSH will be reachable from anywhere on the internet. `clawops harden` reports this as a finding; narrowing it to your own IP is the usual fix."
@@ -2502,6 +2721,8 @@ var setup_default = defineCommand19({
     const modelProvider = catalogs.models.find((p) => p.id === modelProviderId);
     const modelConfig = {};
     const secrets = [];
+    let resolvedModelId;
+    let bedrockRegion;
     const { selectedModelId } = await inquirer.prompt([{
       type: "list",
       name: "selectedModelId",
@@ -2521,7 +2742,22 @@ var setup_default = defineCommand19({
     } else if (modelProvider.credentialSource === "aws-profile") {
       process21.stdout.write("\n");
       info(modelProvider.iamNote ?? "Bedrock uses your AWS server's IAM role \u2014 no API key needed.");
-      info("Make sure your EC2 instance has the AmazonBedrockFullAccess IAM policy attached.\n");
+      bedrockRegion = typeof stackAnswers.region === "string" && stackAnswers.region ? stackAnswers.region : defaultRegion("aws");
+      const { fetchInferenceProfiles, resolveInferenceProfile } = await import("./bedrock-XVASJX2K.js");
+      const listed = await fetchInferenceProfiles(bedrockRegion);
+      if (!listed.ok) {
+        warn(listed.error);
+        info("Continuing with the foundation-model id; Bedrock will refuse it until this is fixed.");
+      } else {
+        const wanted = selectedModel.modelId ?? selectedModel.id;
+        const resolution = resolveInferenceProfile(wanted, listed.profiles, bedrockRegion);
+        if (!resolution.ok) {
+          const { UsageError: UsageError2 } = await import("./errors-OK47MQFD.js");
+          throw new UsageError2(resolution.error);
+        }
+        resolvedModelId = resolution.profileId;
+        info(`Using inference profile ${resolution.profileId} (${resolution.why}).`);
+      }
     } else if (modelProvider.id === "ollama") {
       const { baseUrl } = await inquirer.prompt([{
         type: "input",
@@ -2535,11 +2771,15 @@ var setup_default = defineCommand19({
       }
       modelConfig["baseUrl"] = rewritten;
     }
-    const builtModelConfig = {
-      provider: modelProviderId,
-      ...selectedModel.modelId ? { modelId: selectedModel.modelId } : { model: selectedModel.id },
-      ...modelConfig
-    };
+    const { buildModelsBlock } = await import("./models-AGTQWYDL.js");
+    const builtModelConfig = buildModelsBlock({
+      provider: modelProvider,
+      model: { id: selectedModel.id, modelId: selectedModel.modelId, displayName: selectedModel.displayName },
+      resolvedModelId,
+      apiKeyRef: typeof modelConfig["apiKey"] === "string" ? modelConfig["apiKey"] : void 0,
+      baseUrl: typeof modelConfig["baseUrl"] === "string" ? modelConfig["baseUrl"] : void 0,
+      region: modelProvider.credentialSource === "aws-profile" ? bedrockRegion : void 0
+    });
     process21.stdout.write("\n");
     info("Use \u2191\u2193 to move, Space to select/deselect, Enter to confirm.");
     const { selectedIntegrationIds } = await inquirer.prompt([{
@@ -2603,7 +2843,7 @@ var setup_default = defineCommand19({
     const gatewayToken = randomBytes(24).toString("hex");
     const secretsDir2 = path2.join(os.homedir(), ".clawops", "secrets");
     mkdirSync2(secretsDir2, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    spawnSync2("chmod", ["700", secretsDir2], { stdio: "ignore" });
     const tokenPath = path2.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
     writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
@@ -2784,7 +3024,7 @@ var setup_default = defineCommand19({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-AM5HERE7.js");
+        const { applyPlan } = await import("./apply-KYFPWI5U.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2813,9 +3053,9 @@ To deploy later:  clawops apply ${outputPath}`);
 });
 async function runLocalDeploy(opts) {
   const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-DMRPWJGN.js");
-  const { connect } = await import("./ssh-B3NZAU4I.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-Z6IIZR3D.js");
+  const { localBootstrap } = await import("./bootstrap-HNGKY6WW.js");
+  const { connect } = await import("./ssh-VAI5DU5M.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const existing = getConfig2();
@@ -2896,7 +3136,7 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-EX4ZTA5P.js");
+  const { drainPool } = await import("./pool-PIIKJ4L2.js");
   drainPool();
   const tokenPath = path2.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
@@ -2956,7 +3196,7 @@ ${cfg.loginHint}`);
   }]);
   if (runNow) {
     process21.stdout.write("\n");
-    const result = spawnSync(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
+    const result = spawnSync2(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
     if (result.error) {
       failure(`Could not launch ${cliName} \u2014 is it installed? (${result.error.message})`);
       info(`Install guide: ${cliInstallUrl(provider)}`);
@@ -3001,7 +3241,7 @@ async function promptSecret(name, label, envDefault, inquirer) {
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
     mkdirSync2(secretsDir2, { recursive: true });
-    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    spawnSync2("chmod", ["700", secretsDir2], { stdio: "ignore" });
     const secretPath2 = path2.join(secretsDir2, name);
     writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret saved to ${secretPath2}  (chmod 600)`);
@@ -3034,7 +3274,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-EX4ZTA5P.js");
+  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -3081,7 +3321,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-EX4ZTA5P.js");
+  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -3178,7 +3418,7 @@ async function startDockerAndWait(inquirer) {
     await pollUntilDockerReady("Waiting for Docker daemon...");
   } else if (choice === "systemctl") {
     const spin = spinner("Running: sudo systemctl start docker...");
-    const res = spawnSync("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
+    const res = spawnSync2("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
     if (res.status !== 0) {
       spin.fail("systemctl start docker failed.");
       throw new Error("systemctl start docker failed");
@@ -3186,18 +3426,18 @@ async function startDockerAndWait(inquirer) {
     spin.succeed("Docker service started.");
     await pollUntilDockerReady("Waiting for Docker daemon to be reachable...");
   } else if (choice === "desktop") {
-    const backendRunning = spawnSync("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
+    const backendRunning = spawnSync2("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
     if (backendRunning) {
       const killSpin = spinner("Docker Desktop is stuck \u2014 force-restarting...");
       for (const pat of ["com.docker.backend", "com.docker.virtualization", "com.docker.build", "Docker Desktop"]) {
-        spawnSync("pkill", ["-9", "-f", pat], { stdio: "ignore" });
+        spawnSync2("pkill", ["-9", "-f", pat], { stdio: "ignore" });
       }
       await new Promise((r) => setTimeout(r, 2e3));
       killSpin.succeed("Old Docker processes cleared.");
     }
     const openSpin = spinner("Launching Docker Desktop...");
-    let opened = spawnSync("open", ["-a", "Docker"], { stdio: "ignore" });
-    if (opened.status !== 0) opened = spawnSync("open", ["/Applications/Docker.app"], { stdio: "ignore" });
+    let opened = spawnSync2("open", ["-a", "Docker"], { stdio: "ignore" });
+    if (opened.status !== 0) opened = spawnSync2("open", ["/Applications/Docker.app"], { stdio: "ignore" });
     if (opened.status !== 0) {
       openSpin.fail("Could not open Docker Desktop \u2014 is it installed in /Applications?");
       throw new Error("Failed to open Docker Desktop");
@@ -3206,7 +3446,7 @@ async function startDockerAndWait(inquirer) {
     await pollUntilDockerReady("Waiting for Docker engine to start...");
   } else if (choice === "colima") {
     const spin = spinner("Running: colima start...");
-    const res = spawnSync("colima", ["start"], { stdio: "pipe" });
+    const res = spawnSync2("colima", ["start"], { stdio: "pipe" });
     if (res.status !== 0) {
       spin.fail("colima start failed \u2014 is Colima installed? (brew install colima docker)");
       throw new Error("colima start failed");
@@ -3239,7 +3479,7 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
       const entry = existing.endsWith("\n") || existing === "" ? pubKey + "\n" : "\n" + pubKey + "\n";
       writeFileSync3(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
-      spawnSync("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
+      spawnSync2("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
       success("Public key added to ~/.ssh/authorized_keys.");
     } else {
       info("SSH will likely fail. Add this line to ~/.ssh/authorized_keys manually:");
@@ -3255,7 +3495,7 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
 async function generateSshKey() {
   const keyPath = path2.join(os.homedir(), ".ssh", "id_ed25519");
   mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
-  const result = spawnSync("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
+  const result = spawnSync2("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
@@ -3286,9 +3526,9 @@ async function maybeWireGatewayMcp(opts) {
   process21.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-B3NZAU4I.js");
+  const { connect } = await import("./ssh-VAI5DU5M.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-BFEY2Y6H.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-3SWBM7D6.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3362,6 +3602,21 @@ function defaultRegion(provider) {
   if (provider === "azure") return "eastus";
   return "";
 }
+function stateBucketQuestion(provider, account) {
+  return {
+    type: "input",
+    name: "stateBucket",
+    message: `${stateLabel(provider)} name: (where clawops records what it deployed \u2014 press Enter to accept)`,
+    default: (answers) => {
+      const derived = deriveStateBucket(provider, {
+        account,
+        region: answers.region ?? defaultRegion(provider)
+      });
+      return derived.ok ? derived.name : void 0;
+    },
+    validate: (v) => validateStateBucket(provider, v)
+  };
+}
 function stateLabel(provider) {
   if (provider === "aws") return "S3";
   if (provider === "gcp") return "GCS";
@@ -3392,7 +3647,7 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-PCDK3UQ5.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-72JMRT4E.js");
   const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
   const config = getConfig2();
   if (!config) return;
@@ -3416,7 +3671,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3454,8 +3709,8 @@ async function maybeHarden(opts) {
   }
 }
 async function detectSshCidrDefault() {
-  const { detectEgressIp } = await import("./firewall-T3NTPZJD.js");
-  const result = await detectEgressIp("https://ifconfig.me");
+  const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
+  const result = await detectEgressIp("https://ifconfig.me/ip");
   if (!result.ok) return void 0;
   const ip = result.ip.trim();
   return ip === "" ? void 0 : ip.includes("/") ? ip : `${ip}/32`;
@@ -3479,11 +3734,68 @@ function wizardChannels(integrations) {
 function startChannelConfig(integ) {
   return { ...integ.defaults ?? {} };
 }
+async function runAccountPreflight(opts) {
+  const { getProvider } = await import("./providers-FW6H6OPF.js");
+  let checks;
+  try {
+    const adapter = getProvider(opts.provider);
+    if (!adapter.preflight) return;
+    checks = await adapter.preflight({
+      region: opts.region,
+      bucket: opts.bucket,
+      instanceType: opts.instanceType
+    });
+  } catch (err) {
+    warn(`Could not check the ${opts.provider} account: ${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  const unanswered = checks.filter((c) => c.unknown);
+  const failed = checks.filter((c) => !c.ok && !c.unknown);
+  if (unanswered.length > 0) {
+    process21.stdout.write("\n");
+    for (const check of unanswered) {
+      warn(`Could not check: ${check.label}`);
+      if (check.detail) info(`  ${check.detail}`);
+    }
+  }
+  if (failed.length === 0) {
+    success(
+      unanswered.length > 0 ? `${opts.provider} account is ready, as far as clawops could tell.` : `${opts.provider} account is ready.`
+    );
+    process21.stdout.write("\n");
+    return;
+  }
+  process21.stdout.write("\n");
+  for (const check of failed) {
+    warn(check.label);
+    if (check.detail) info(`  ${check.detail}`);
+    if (!check.fix) {
+      continue;
+    }
+    const { apply } = await opts.inquirer.prompt([{
+      type: "confirm",
+      name: "apply",
+      message: `Fix this now? ${check.mutates}`,
+      default: true
+    }]);
+    if (!apply) {
+      info("  Left as is. The deploy will fail until this is resolved.");
+      continue;
+    }
+    try {
+      await check.fix();
+      success(`  Done \u2014 ${check.mutates}`);
+    } catch (err) {
+      failure(`  Could not fix it: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  process21.stdout.write("\n");
+}
 
 // src/cli/commands/secret.ts
 import { defineCommand as defineCommand20 } from "citty";
 import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync3, statSync } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import path3 from "path";
 import os2 from "os";
 import process22 from "process";
@@ -3560,7 +3872,7 @@ var setCmd = defineCommand20({
       value = secretValue;
     }
     mkdirSync3(secretsDir(), { recursive: true });
-    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
     writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
     info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
@@ -3631,7 +3943,7 @@ var rotateCmd = defineCommand20({
       value = secretValue;
     }
     mkdirSync3(secretsDir(), { recursive: true });
-    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
     writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
     const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
@@ -3651,10 +3963,10 @@ var rotateCmd = defineCommand20({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-KHKWJJMC.js");
-      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-Z6IIZR3D.js");
+      const { buildContext } = await import("./context-7EVC6W45.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-EX4ZTA5P.js");
+      const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
       const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
@@ -3838,7 +4150,7 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.0.0" : "dev";
+var VERSION = true ? "2.0.1" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
   const os3 = `${process23.platform} ${process23.arch}`;
@@ -3955,8 +4267,8 @@ var harden_default = defineCommand23({
     json: { type: "boolean", description: "Emit structured JSON output" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-PCDK3UQ5.js");
-    const { buildContext } = await import("./context-KHKWJJMC.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-72JMRT4E.js");
+    const { buildContext } = await import("./context-7EVC6W45.js");
     const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
     if (args.list) {
       process24.stdout.write("\nAvailable hardening modules:\n\n");
@@ -4078,7 +4390,7 @@ function handleError(err) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.0.0" : "dev";
+var CLI_VERSION = true ? "2.0.1" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",