@clawops/cli 2.0.1 → 2.1.0

package/dist/{apply-KYFPWI5U.js → apply-HJ5GAKHW.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-LBE6COC4.js";
+} from "./chunk-R3DTA35B.js";
 import "./chunk-BOPSG2LI.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-2I7KCMXZ.js";
-import "./chunk-HSPHXG6W.js";
+import "./chunk-3Z5TDXCJ.js";
 import "./chunk-AEEMRFZV.js";
-import "./chunk-BSLIYB5Q.js";
-import "./chunk-5XT5IAJK.js";
+import "./chunk-XFN3YDZE.js";
+import "./chunk-QDNFADJI.js";
 import "./chunk-NUDIHZEH.js";
 import "./chunk-JW5A7E3X.js";
-import "./chunk-LEVIW2PV.js";
+import "./chunk-BELTQGHT.js";
 import "./chunk-GIEVAGEK.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+import "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 import "./chunk-VUFMZEIM.js";
 export {

package/dist/{automation-RMAIBNVC.js → automation-MKCJ46I6.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   ensurePulumiCli
-} from "./chunk-W3OLNNJW.js";
+} from "./chunk-PSOSBJVO.js";
 import {
   ensurePassphrase
 } from "./chunk-V25QRZRB.js";
 import {
   getConfigDir
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/pulumi/automation.ts
 import path from "path";
-import { LocalWorkspace } from "@pulumi/pulumi/automation";
+import { LocalWorkspace } from "@pulumi/pulumi/automation/index.js";
 async function getOrCreateStack(opts) {
   const configDir = opts.configDir ?? getConfigDir();
   const pulumiCommand = await ensurePulumiCli({ configDir, onInstall: opts.onInstall });

package/dist/{bootstrap-HNGKY6WW.js → bootstrap-NN647RCY.js}

@@ -14,8 +14,8 @@ import {
 import "./chunk-EI7CQQ7D.js";
 import {
   writeLocalState
-} from "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+} from "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import {
   ProviderError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-HSPHXG6W.js → chunk-3Z5TDXCJ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VOEJYRIK.js";
 import {
   getConfig
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -34,7 +34,7 @@ async function writeStackConfig(stack, plan) {
     value: String(plan.spec.network?.gatewayPort ?? GATEWAY_PORT)
   });
   if (plan.spec.provider === "gcp") {
-    const { resolveProjectId } = await import("./preflight-EF52S3WW.js");
+    const { resolveProjectId } = await import("./preflight-IE2YWBAC.js");
     const project = resolveProjectId();
     if (project) await stack.setConfig("gcp:project", { value: project });
   }

package/dist/{chunk-CX5SL5HP.js → chunk-64PONSA5.js}

@@ -22,12 +22,21 @@ var LocalOptsSchema = z.object({
   sshPort: z.number(),
   sshKeyPath: z.string()
 });
+var TailscaleOverrideSchema = z.object({
+  ip: z.string(),
+  hostname: z.string().optional(),
+  /** When the address was verified, ISO 8601. */
+  verifiedAt: z.string(),
+  /** Set once --private-only has closed the public ports, so revert knows to reopen them. */
+  privateOnly: z.boolean().optional()
+});
 var StackConfigSchema = z.object({
   provider: z.string(),
   stateUrl: z.string(),
   region: z.string().optional(),
   credentialsRef: CredentialsRefSchema,
-  localOpts: LocalOptsSchema.optional()
+  localOpts: LocalOptsSchema.optional(),
+  tailscale: TailscaleOverrideSchema.optional()
 });
 var ClawopsConfigSchema = z.object({
   version: z.literal(1),

package/dist/{chunk-STLRHLLV.js → chunk-A2DS5SB7.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   validatePlan
-} from "./chunk-BSLIYB5Q.js";
+} from "./chunk-XFN3YDZE.js";
 import {
   buildContext,
   loadAdapterModule
-} from "./chunk-5XT5IAJK.js";
+} from "./chunk-QDNFADJI.js";
 import {
   getConfig
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import {
   StateError,
   UsageError
@@ -16,11 +16,12 @@ import {
 
 // src/plan/generate.ts
 import { randomUUID } from "crypto";
-var PREVIEW_LINE_RE = /^([+~-])\s+(\S+)\s+(\S+)?/;
+var PREVIEW_LINE_RE = /^(\+-|-\+|[+~-])\s+(\S+)\s+(\S+)?/;
 function parseDiff(lines) {
   const create = [];
   const update = [];
   const del = [];
+  const replace = [];
   const seen = /* @__PURE__ */ new Set();
   for (const line of lines) {
     const m = PREVIEW_LINE_RE.exec(line.trimStart());
@@ -34,7 +35,8 @@ function parseDiff(lines) {
       type: resourceType,
       ...name ? { name } : {}
     };
-    if (op === "+") create.push(ref);
+    if (op === "+-" || op === "-+") replace.push(ref);
+    else if (op === "+") create.push(ref);
     else if (op === "~") update.push({ resource: ref, before: null, after: null });
     else if (op === "-") del.push(ref);
   }
@@ -42,7 +44,8 @@ function parseDiff(lines) {
     create,
     update,
     delete: del,
-    totalChanges: create.length + update.length + del.length
+    replace,
+    totalChanges: create.length + update.length + del.length + replace.length
   };
 }
 var INSTANCE_ALIASES = ["micro", "small", "medium", "large", "gpu"];
@@ -68,7 +71,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-5BCMEBTE.js");
+  const { version } = await import("./package-JWDMWPV3.js");
   const config = getConfig();
   const instanceType = await resolveInstanceType(intent);
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
@@ -120,7 +123,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     );
   }
   try {
-    const { writeStackConfig } = await import("./stack-config-R4SPSUQZ.js");
+    const { writeStackConfig } = await import("./stack-config-LUTS2XAD.js");
     await writeStackConfig(stack, plan);
     const outputLines = [];
     const preview = await stack.preview({
@@ -148,7 +151,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     throw new Error(`Generated plan failed schema validation:
 ${validation.errors.join("\n")}`);
   }
-  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-YVI3BJ55.js");
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-JXKN5WD6.js");
   const cfgCheck = await validatePlanConfig(plan);
   for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
 `);

package/dist/{chunk-KC3GC3PE.js → chunk-AYUX4FOF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-LBE6COC4.js";
+} from "./chunk-R3DTA35B.js";
 import {
   extractBaseOutputs
 } from "./chunk-3QJBNAHW.js";
@@ -12,22 +12,22 @@ import {
 } from "./chunk-2I7KCMXZ.js";
 import {
   generatePlan
-} from "./chunk-STLRHLLV.js";
+} from "./chunk-A2DS5SB7.js";
 import {
   validatePlan
-} from "./chunk-BSLIYB5Q.js";
+} from "./chunk-XFN3YDZE.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-2Z7J3ERQ.js";
 import {
   buildContext
-} from "./chunk-5XT5IAJK.js";
+} from "./chunk-QDNFADJI.js";
 import {
   formatUptime,
   gatherSnapshot,
   runDiagnostics
-} from "./chunk-IVWP4QUJ.js";
+} from "./chunk-GFUK6KDR.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
@@ -48,7 +48,7 @@ import {
 import {
   getConfig,
   getConfigDir
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import {
   StateError,
   UsageError
@@ -121,7 +121,7 @@ function withAudit(toolName, handler) {
         tool: toolName,
         args: sanitize(input),
         durationMs: Date.now() - start,
-        result: "ok"
+        result: result.isError === true ? "error" : "ok"
       });
       return result;
     } catch (err) {
@@ -267,7 +267,12 @@ var clawops_planSchema = z.object({
   stackName: z.string().optional(),
   provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
   region: z.string().optional(),
-  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional(),
+  instanceType: z.string().optional(),
+  openclawVersion: z.string().optional(),
+  sshCidr: z.string().optional(),
+  gatewayCidr: z.string().optional(),
+  publishGateway: z.enum(["loopback", "all"]).optional(),
+  privateOnly: z.boolean().optional(),
   outPath: z.string().optional()
 });
 var clawops_planAnnotations = {
@@ -327,6 +332,22 @@ var clawops_gateway_restartAnnotations = {
   openWorldHint: true,
   toolsets: ["cli"]
 };
+var clawops_hardenSchema = z.object({
+  stackName: z.string().optional(),
+  options: z.string().optional(),
+  dryRun: z.boolean().optional().default(false),
+  tailscale: z.boolean().optional().default(false),
+  tailscaleRevert: z.boolean().optional().default(false),
+  yes: z.boolean().optional().default(false)
+});
+var clawops_hardenAnnotations = {
+  title: "Harden Stack",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
 var clawops_workflow_deploy_appSchema = z.object({
   provider: z.enum(["aws", "gcp", "azure", "local"]),
   region: z.string().optional(),
@@ -379,6 +400,7 @@ var TOOLSETS = {
     "clawops_config_unset",
     "clawops_config_validate",
     "clawops_gateway_restart",
+    "clawops_harden",
     "clawops_task_status"
   ],
   workflow: [
@@ -828,7 +850,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-HNGKY6WW.js");
+    const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -851,8 +873,8 @@ async function handleUp(input, server) {
   const progressToken = void 0;
   const emit = makeProgressEmitter(server, progressToken);
   startTask(taskId, `clawops_up stack=${ctx.stackName}`);
-  const { generatePlan: generatePlan2 } = await import("./generate-I6YQ5V2T.js");
-  const { applyPlan: applyPlan2 } = await import("./apply-KYFPWI5U.js");
+  const { generatePlan: generatePlan2 } = await import("./generate-YEM73KVB.js");
+  const { applyPlan: applyPlan2 } = await import("./apply-HJ5GAKHW.js");
   const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
   const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
   const network = await resolveNetworkFlags(
@@ -955,13 +977,32 @@ async function handlePlan(input, _server) {
   }
   const provider = input.provider ?? ctx.adapter.name;
   const stackName = ctx.stackName;
+  const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
+  const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
+  const flags = {
+    sshCidr: input.sshCidr,
+    gatewayCidr: input.gatewayCidr,
+    publishGateway: input.publishGateway
+  };
   let plan;
   try {
+    const resolved = await resolveNetworkFlags(flags, {
+      detectEgressIp: () => detectEgressIp("https://ifconfig.me/ip")
+    });
+    let network = resolved;
+    if (input.privateOnly) {
+      const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
+      const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+      network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[stackName]?.tailscale, stackName);
+      await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
+    }
     plan = await generatePlan({
       stackName,
       provider,
       region: input.region,
-      instanceType: input.instanceType
+      instanceType: input.instanceType,
+      openclawVersion: input.openclawVersion,
+      network
     });
   } catch (err) {
     return errText(`Plan generation failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -981,6 +1022,78 @@ async function handlePlan(input, _server) {
   };
 }
 
+// src/mcp/tools/cli/harden.ts
+async function handleHarden(input, server) {
+  if (input.tailscale && input.tailscaleRevert) {
+    return errText(
+      "tailscale and tailscaleRevert do the opposite of each other; pass one, not both."
+    );
+  }
+  const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
+  const config = getConfig2();
+  if (!config) return errText("No clawops config found. The user needs to run `clawops init` first.");
+  const ctx = buildContext({ stack: input.stackName });
+  if (!input.dryRun && !input.yes) {
+    const what = input.tailscaleRevert ? `Take "${ctx.stackName}" off its tailnet and go back to its public address?` : input.tailscale ? `Harden "${ctx.stackName}" and join it to your tailnet? clawops will use the tailnet address afterwards.` : `Apply hardening modules to "${ctx.stackName}"? This changes the running host.`;
+    const elicit = await server.server.elicitInput({
+      message: what,
+      requestedSchema: {
+        type: "object",
+        properties: { confirmed: { type: "boolean", title: "Confirm" } },
+        required: ["confirmed"]
+      }
+    });
+    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+      return okText("Hardening cancelled. Nothing was changed.");
+    }
+  }
+  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-RI7FGHAM.js");
+  if (input.tailscaleRevert) {
+    const outcome = await revertTailnet(ctx, config);
+    return outcome.ok ? okText(outcome.message) : errText(outcome.reason);
+  }
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-3KKCR7BL.js");
+  const forStack = makeTailscaleModule(ctx.stackName);
+  const resolved = resolveModules(MODULE_CATALOG, input.options, ctx.adapter.name).map(
+    (m) => m.id === "tailscale" ? forStack : m
+  );
+  const modules = input.tailscale && !resolved.some((m) => m.id === "tailscale") ? [...resolved, forStack] : resolved;
+  if (modules.length === 0) {
+    return okText(
+      `No hardening modules apply to "${ctx.stackName}" (provider: ${ctx.adapter.name}) with those options.`
+    );
+  }
+  let conn;
+  try {
+    conn = await connectionFor(ctx, config);
+  } catch (err) {
+    const detail = (err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ").trim();
+    return errText(
+      `Stack "${ctx.stackName}" has no deployment to harden, or clawops could not read its state. Deploy it first, and check the credentials for its state backend. (${detail.slice(0, 200)})`
+    );
+  }
+  const results = await runHardening(conn, { modules, dryRun: input.dryRun });
+  const lines = [formatHardenSummary(results)];
+  const failed = results.filter((r) => r.error);
+  for (const r of failed) lines.push(`FAILED  ${r.module.label}: ${r.error}`);
+  if (input.tailscale && !input.dryRun && failed.length === 0) {
+    const outcome = await cutOverToTailnet(ctx, conn, config);
+    if (!outcome.ok) {
+      lines.push(
+        `The host is hardened, but clawops still uses its public address: ${outcome.reason}`
+      );
+      const { content: content2 } = trimForMcp(lines.join("\n"), ctx.stackName);
+      return errText(content2);
+    }
+    lines.push(outcome.message);
+    lines.push(
+      "To close the public ports, plan with privateOnly: true and apply that plan. Nothing has been closed yet."
+    );
+  }
+  const { content } = trimForMcp(lines.join("\n"), ctx.stackName);
+  return failed.length > 0 ? errText(content) : okText(content);
+}
+
 // src/mcp/tools/cli/apply.ts
 import { readFileSync } from "fs";
 import { randomUUID as randomUUID4 } from "crypto";
@@ -1231,6 +1344,7 @@ var TOOL_REGISTRY = {
   clawops_destroy: makeEntry(clawops_destroySchema, clawops_destroyAnnotations, handleDestroy),
   clawops_apply: makeEntry(clawops_applySchema, clawops_applyAnnotations, handleApply),
   clawops_plan: makeEntry(clawops_planSchema, clawops_planAnnotations, handlePlan),
+  clawops_harden: makeEntry(clawops_hardenSchema, clawops_hardenAnnotations, handleHarden),
   clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet),
   clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset),
   clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate),
@@ -1532,7 +1646,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-5BCMEBTE.js");
+  const { version } = await import("./package-JWDMWPV3.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);

package/dist/{chunk-LEVIW2PV.js → chunk-BELTQGHT.js}

@@ -461,6 +461,20 @@ var gcpProgram = async () => {
     machineType: instanceType,
     zone,
     tags: ["clawops"],
+    // debian-12 advertises UEFI_COMPATIBLE, so all three protections are available. Left
+    // unset, GCP turns on vTPM and integrity monitoring and leaves Secure Boot off, which is
+    // what `clawops harden` was reporting on every GCP stack.
+    //
+    // Changing this on an existing instance is an update, not a replacement: Pulumi stops the
+    // machine, applies it and starts it again, and the boot disk is untouched. Verified against
+    // a live stack — the preview reads "0 to create, 1 to update, 0 to delete". Without
+    // allowStoppingForUpdate the provider refuses the update rather than replacing anything.
+    allowStoppingForUpdate: true,
+    shieldedInstanceConfig: {
+      enableSecureBoot: true,
+      enableVtpm: true,
+      enableIntegrityMonitoring: true
+    },
     bootDisk: {
       initializeParams: {
         image: "debian-cloud/debian-12",
@@ -555,7 +569,7 @@ var gcpAdapter = {
     return { ok: errors.length === 0, errors };
   },
   async preflight(opts) {
-    const { gcpPreflight } = await import("./preflight-EF52S3WW.js");
+    const { gcpPreflight } = await import("./preflight-IE2YWBAC.js");
     return gcpPreflight(opts);
   }
 };
@@ -807,7 +821,7 @@ var azureAdapter = {
     return `azblob://${bucket}`;
   },
   async preflight(opts) {
-    const { azurePreflight } = await import("./preflight-MWWM5JT3.js");
+    const { azurePreflight } = await import("./preflight-7W23GP4R.js");
     return azurePreflight(opts);
   },
   async validateConfig() {

package/dist/{preflight-MWWM5JT3.js → chunk-BTW7NHOH.js}

@@ -171,11 +171,12 @@ function stateBackendCheck(container) {
     detail: ok ? `${where} on storage account ${account}` : `${where} needs AZURE_STORAGE_ACCOUNT and one of AZURE_STORAGE_KEY or AZURE_STORAGE_SAS_TOKEN. Pulumi authenticates to blob storage with these and not with your \`az login\`, so every other check here can pass and the deploy still fail to open its own state.`
   };
 }
+
 export {
   REQUIRED_PROVIDERS,
-  availableSizes,
-  azurePreflight,
   managementToken,
+  availableSizes,
   sizeCheck,
+  azurePreflight,
   stateBackendCheck
 };

package/dist/{chunk-A2I76FTA.js → chunk-ELU3XQEA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 
 // src/providers/local/state.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";

package/dist/{chunk-IVWP4QUJ.js → chunk-GFUK6KDR.js}

@@ -146,8 +146,8 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext } = await import("./context-7EVC6W45.js");
-  const { getConfig } = await import("./store-SDUR52Z5.js");
+  const { buildContext } = await import("./context-7VI3R6EK.js");
+  const { getConfig } = await import("./store-OVB3DAJR.js");
   const config = getConfig();
   if (!config) return [];
   return Promise.all(
@@ -215,7 +215,7 @@ function renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete) {
   return lines.join("\n");
 }
 async function deleteFromRegistry(name) {
-  const { requireConfig, setConfig } = await import("./store-SDUR52Z5.js");
+  const { requireConfig, setConfig } = await import("./store-OVB3DAJR.js");
   const config = requireConfig();
   const newStacks = { ...config.stacks };
   delete newStacks[name];
@@ -373,7 +373,7 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
@@ -508,7 +508,7 @@ import { accessSync, mkdirSync, readFileSync, constants } from "fs";
 import ssh2 from "ssh2";
 import path from "path";
 async function runDiagnostics(opts = {}, deps = {}) {
-  const { getConfig, getConfigDir } = await import("./store-SDUR52Z5.js");
+  const { getConfig, getConfigDir } = await import("./store-OVB3DAJR.js");
   const config = getConfig();
   const sections = [];
   sections.push({ title: "Runtime", checks: await runtimeChecks(getConfigDir()) });
@@ -576,7 +576,7 @@ async function runtimeChecks(configDir) {
   } catch {
     checks.push({ name: "Pulumi home", status: "fail", detail: `${pulumiHome} (not writable)` });
   }
-  const { pulumiCliStatus } = await import("./cli-WLD3EBEM.js");
+  const { pulumiCliStatus } = await import("./cli-NH7VUNOU.js");
   const cli = await pulumiCliStatus(configDir);
   checks.push(
     cli.kind === "managed" ? { name: "Pulumi CLI", status: "pass", detail: `${cli.version} (${cli.root})` } : cli.kind === "path" ? { name: "Pulumi CLI", status: "pass", detail: `${cli.version} (on PATH)` } : {
@@ -808,8 +808,8 @@ async function deployedVersionCheck(image, deployedVersion) {
 }
 async function hardeningChecks(conn, stack, signal) {
   try {
-    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-72JMRT4E.js");
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-3KKCR7BL.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const provider = buildContext({ stack }).adapter.name;
     const modules = resolveModules(MODULE_CATALOG, void 0, provider);
     const checks = [];
@@ -831,8 +831,8 @@ async function hardeningChecks(conn, stack, signal) {
   }
 }
 async function defaultOpenSession(stack, signal) {
-  const { getConfig } = await import("./store-SDUR52Z5.js");
-  const { buildContext } = await import("./context-7EVC6W45.js");
+  const { getConfig } = await import("./store-OVB3DAJR.js");
+  const { buildContext } = await import("./context-7VI3R6EK.js");
   const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
   const { acquireSession } = await import("./pool-PIIKJ4L2.js");
   const config = getConfig();

package/dist/{chunk-W3OLNNJW.js → chunk-PSOSBJVO.js}

@@ -3,7 +3,7 @@
 // src/pulumi/cli.ts
 import path from "path";
 import process from "process";
-import { PulumiCommand } from "@pulumi/pulumi/automation";
+import { PulumiCommand } from "@pulumi/pulumi/automation/index.js";
 function pulumiCliRoot(configDir) {
   return path.join(configDir, ".pulumi-cli");
 }

package/dist/{chunk-5XT5IAJK.js → chunk-QDNFADJI.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   readLocalState
-} from "./chunk-A2I76FTA.js";
+} from "./chunk-ELU3XQEA.js";
 import {
   getConfigDir,
   requireConfig
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -18,8 +18,10 @@ function buildContext(args) {
   const config = requireConfig();
   const stackName = typeof args.stack === "string" ? args.stack : config.defaults.stack;
   const providerName = typeof args.provider === "string" ? args.provider : config.stacks[stackName]?.provider ?? config.defaults.provider;
-  const adapter = loadProvider(providerName);
-  const localState = providerName === "local" ? readLocalState(stackName) : void 0;
+  const tailscale = args.ignoreTailnet === true ? void 0 : config.stacks[stackName]?.tailscale;
+  const adapter = tailscale ? viaTailscale(loadProvider(providerName), tailscale.ip) : loadProvider(providerName);
+  const persisted = providerName === "local" ? readLocalState(stackName) : void 0;
+  const localState = persisted && tailscale ? { ...persisted, sshHost: tailscale.ip } : persisted;
   let stackCache = null;
   return {
     config,
@@ -39,7 +41,7 @@ function buildContext(args) {
           `Stack "${stackName}" not found in config. Run \`clawops init\` or use \`--stack\` to specify a different stack.`
         );
       }
-      const { getOrCreateStack } = await import("./automation-RMAIBNVC.js");
+      const { getOrCreateStack } = await import("./automation-MKCJ46I6.js");
       stackCache = await getOrCreateStack({
         stack: stackName,
         stateUrl: stackConfig.stateUrl,
@@ -50,6 +52,11 @@ function buildContext(args) {
     }
   };
 }
+function viaTailscale(adapter, ip) {
+  const wrapped = Object.create(adapter);
+  wrapped.getConnectionInfo = (outputs) => ({ ...adapter.getConnectionInfo(outputs), host: ip });
+  return wrapped;
+}
 function loadProvider(name) {
   try {
     return getProvider(name);