@clawops/cli 2.0.1 → 2.1.0

package/dist/cli.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
+import {
+  MCP_APPS,
+  buildMcpEntry,
+  writeAppConfigs
+} from "./chunk-OIGTOLB3.js";
 import {
   monitor_default,
   runDiagnostics
-} from "./chunk-IVWP4QUJ.js";
+} from "./chunk-GFUK6KDR.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
 } from "./chunk-NUL5F6YV.js";
-import {
-  MCP_APPS,
-  buildMcpEntry,
-  writeAppConfigs
-} from "./chunk-OIGTOLB3.js";
 import "./chunk-3OLUJPCB.js";
 import {
   execPrivileged,
@@ -27,7 +27,7 @@ import {
   interpretProbe,
   probeCommand
 } from "./chunk-LT4XMO5D.js";
-import "./chunk-LEVIW2PV.js";
+import "./chunk-BELTQGHT.js";
 import {
   CONFIG_FILENAME,
   CONTAINER_UID,
@@ -62,7 +62,7 @@ import {
   getConfigDir,
   requireConfig,
   setConfig
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import {
   ClawopsError,
   UsageError
@@ -148,7 +148,7 @@ async function resolveScopeAccount(provider, signal) {
       const { callerAccount } = await import("./preflight-TFD4N5ZU.js");
       return await callerAccount(signal);
     }
-    const { resolveProjectId } = await import("./preflight-EF52S3WW.js");
+    const { resolveProjectId } = await import("./preflight-IE2YWBAC.js");
     return resolveProjectId();
   } catch {
     return void 0;
@@ -339,7 +339,7 @@ var up_default = defineCommand2({
     "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
@@ -352,7 +352,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-HNGKY6WW.js");
+      const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
       const gatewayPort = parseGatewayPort(args["gateway-port"]);
       const abortController2 = new AbortController();
       process3.on("SIGINT", () => abortController2.abort());
@@ -392,8 +392,8 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const { generatePlan } = await import("./generate-I6YQ5V2T.js");
-    const { applyPlan } = await import("./apply-KYFPWI5U.js");
+    const { generatePlan } = await import("./generate-YEM73KVB.js");
+    const { applyPlan } = await import("./apply-HJ5GAKHW.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const isDryRun = Boolean(args["dry-run"]);
@@ -523,7 +523,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -587,7 +587,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -645,6 +645,30 @@ import { defineCommand as defineCommand5 } from "citty";
 import process7 from "process";
 import { writeFileSync as writeFileSync2 } from "fs";
 import { isAbsolute } from "path";
+function disruptionWarnings(diff) {
+  const out = [];
+  const isInstance = (type) => /:(Instance|instance)/.test(type);
+  const replaced = diff.replace ?? [];
+  if (replaced.length > 0) {
+    const instance = replaced.some((r) => isInstance(r.type));
+    out.push(
+      `This plan REPLACES ${replaced.length} existing resource${replaced.length === 1 ? "" : "s"}: ` + replaced.map((r) => r.name ?? r.type).join(", ") + "." + (instance ? " Replacing the instance destroys its boot disk, and with it the OpenClaw config, database, sessions and transcripts on the host. Take a backup first: `clawops backup create`." : "")
+    );
+  }
+  if (diff.update.length > 0) {
+    const instance = diff.update.some((u) => isInstance(u.resource.type));
+    out.push(
+      `This plan modifies ${diff.update.length} existing resource${diff.update.length === 1 ? "" : "s"}.` + (instance ? " Some instance changes require the machine to be stopped and started, so the gateway goes down for the duration and in-flight work is lost. State on disk is kept." : "")
+    );
+  }
+  if (diff.delete.length > 0) {
+    out.push(`This plan DELETES ${diff.delete.length} existing resource${diff.delete.length === 1 ? "" : "s"}.`);
+  }
+  return out;
+}
+function warnAboutDisruption(diff) {
+  for (const line2 of disruptionWarnings(diff)) warn(line2);
+}
 var plan_default = defineCommand5({
   meta: {
     name: "plan",
@@ -659,11 +683,12 @@ var plan_default = defineCommand5({
     "ssh-cidr": { type: "string", description: "CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for this machine's IP. Omitted = none, and nothing will be able to connect" },
     "gateway-cidr": { type: "string", description: "CIDR(s) allowed to reach the gateway port, comma-separated, or 'auto'. Requires --publish-gateway all" },
     "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' },
-    out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" }
+    out: { type: "string", description: "Write plan JSON to this absolute path (default: stdout)" },
+    "private-only": { type: "boolean", description: "Close public SSH and gateway access; reach the stack over its tailnet. Needs `clawops harden --tailscale` first, and checks the tailnet answers before planning" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
-    const { generatePlan } = await import("./generate-I6YQ5V2T.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { generatePlan } = await import("./generate-YEM73KVB.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
@@ -677,14 +702,21 @@ var plan_default = defineCommand5({
     if (outPath && !isAbsolute(outPath)) {
       throw new UsageError("--out path must be absolute (R7). Use an absolute path like /tmp/plan.json.");
     }
-    const network = await resolveNetworkFlags(
-      {
-        sshCidr: strArg2(args["ssh-cidr"]),
-        gatewayCidr: strArg2(args["gateway-cidr"]),
-        publishGateway: strArg2(args["publish-gateway"])
-      },
-      { detectEgressIp: () => detectEgressIp("https://ifconfig.me/ip") }
-    );
+    const flags = {
+      sshCidr: strArg2(args["ssh-cidr"]),
+      gatewayCidr: strArg2(args["gateway-cidr"]),
+      publishGateway: strArg2(args["publish-gateway"])
+    };
+    const resolved = await resolveNetworkFlags(flags, {
+      detectEgressIp: () => detectEgressIp("https://ifconfig.me/ip")
+    });
+    let network = resolved;
+    if (args["private-only"]) {
+      const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
+      const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+      network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[ctx.stackName]?.tailscale, ctx.stackName);
+      await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
+    }
     const abortController = new AbortController();
     process7.on("SIGINT", () => abortController.abort());
     process7.on("SIGTERM", () => abortController.abort());
@@ -715,7 +747,8 @@ var plan_default = defineCommand5({
       process7.stdout.write(planJson + "\n");
     }
     const { spec, metadata } = plan;
-    const sshCidrs = spec.network.allowedSshCidrs.join(", ") || "(none)";
+    const tailnetIp = spec.network.tailscale?.privateOnly ? spec.network.tailscale.ip : void 0;
+    const sshCidrs = spec.network.allowedSshCidrs.join(", ") || (tailnetIp ? `(none) \u2014 tailnet only, at ${tailnetIp}` : "(none)");
     const gatewayCidrs = spec.network.allowedGatewayCidrs.join(", ") || "(none)";
     const publish = spec.network.publishGateway ?? "loopback";
     process7.stderr.write(
@@ -729,20 +762,22 @@ Plan: ${metadata.name}  (${spec.provider}${spec.region ? ` / ${spec.region}` : "
 `
     );
     if (plan.diff) {
-      const { create, update, delete: del, totalChanges } = plan.diff;
+      const { create, update, delete: del, replace = [], totalChanges } = plan.diff;
       process7.stderr.write(
         `
-Changes: ${create.length} to create, ${update.length} to update, ${del.length} to delete (${totalChanges} total)
+Changes: ${create.length} to create, ${update.length} to update, ${replace.length} to replace, ${del.length} to delete (${totalChanges} total)
 `
       );
       const rows = [
         ...create.map((r) => ["+", r.type, r.name ?? ""]),
         ...update.map((r) => ["~", r.resource.type, r.resource.name ?? ""]),
+        ...replace.map((r) => ["+-", r.type, r.name ?? ""]),
         ...del.map((r) => ["-", r.type, r.name ?? ""])
       ];
       if (rows.length > 0) {
         process7.stderr.write(renderTable(["Op", "Resource Type", "Name"], rows) + "\n");
       }
+      warnAboutDisruption(plan.diff);
     } else {
       process7.stderr.write("\n(diff unavailable \u2014 preview could not run against this stack)\n");
     }
@@ -768,8 +803,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-YVI3BJ55.js");
-    const { applyPlan } = await import("./apply-KYFPWI5U.js");
+    const { validatePlan } = await import("./validate-JXKN5WD6.js");
+    const { applyPlan } = await import("./apply-HJ5GAKHW.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -895,7 +930,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -933,7 +968,7 @@ Pass --yes to proceed with destruction.
     const abortController = new AbortController();
     process9.on("SIGINT", () => abortController.abort());
     process9.on("SIGTERM", () => abortController.abort());
-    const doomedHost = await hostOf(stack, ctx);
+    const doomedHosts = await hostsOf(stack, ctx);
     const spin = spinner(`Destroying stack "${ctx.stackName}"\u2026`);
     try {
       await stack.destroy({
@@ -947,31 +982,29 @@ Pass --yes to proceed with destruction.
       spin.fail("Destroy failed");
       throw err;
     }
-    if (doomedHost) {
-      const { forgetHost } = await import("./known-hosts-file-I3Q3NBYQ.js");
-      const removed = forgetHost(
-        expandHome(ctx.config.ssh.knownHostsPath),
-        doomedHost.host,
-        doomedHost.port
-      );
-      if (removed) info(`Forgot the host key for ${doomedHost.host} \u2014 its instance is gone.`);
+    const { forgetHost } = await import("./known-hosts-file-I3Q3NBYQ.js");
+    for (const doomed of doomedHosts) {
+      const removed = forgetHost(expandHome(ctx.config.ssh.knownHostsPath), doomed.host, doomed.port);
+      if (removed) info(`Forgot the host key for ${doomed.host} \u2014 its instance is gone.`);
     }
   }
 });
-async function hostOf(stack, ctx) {
+async function hostsOf(stack, ctx) {
+  const hosts = [];
   try {
     const outputMap = await stack.outputs();
     const raw = Object.fromEntries(Object.entries(outputMap).map(([k, v]) => [k, v.value]));
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const conn = ctx.adapter.getConnectionInfo({
-      ...extractBaseOutputs(raw),
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
-    return conn.host ? { host: conn.host, port: conn.port } : void 0;
+    const base = extractBaseOutputs(raw);
+    if (base.sshHost) hosts.push({ host: base.sshHost, port: base.sshPort });
   } catch {
-    return void 0;
   }
+  const tailnet = ctx.config.stacks?.[ctx.stackName]?.tailscale;
+  if (tailnet?.ip) {
+    const port = hosts[0]?.port ?? 22;
+    if (!hosts.some((h) => h.host === tailnet.ip)) hosts.push({ host: tailnet.ip, port });
+  }
+  return hosts;
 }
 function expandHome(p) {
   return p.replace(/^~/, process9.env["HOME"] ?? "~");
@@ -990,7 +1023,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
     let conn;
@@ -1077,7 +1110,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
@@ -1146,7 +1179,7 @@ var logs_default = defineCommand10({
     json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
@@ -1252,7 +1285,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, key, value] = args._ ?? [];
@@ -1387,7 +1420,7 @@ var agents_default = defineCommand12({
     cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, name] = args._ ?? [];
@@ -1619,7 +1652,7 @@ var migrate_default = defineCommand13({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
@@ -1758,7 +1791,7 @@ var gateway_default = defineCommand14({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, versionArg] = args._ ?? [];
@@ -1990,7 +2023,7 @@ var backup_default = defineCommand15({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -2201,7 +2234,7 @@ var stacks_default = defineCommand16({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-7EVC6W45.js");
+        const { buildContext } = await import("./context-7VI3R6EK.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -2342,7 +2375,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-GBA7BJGK.js");
+    const { serveMcp } = await import("./server-ZJPXPRZT.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -2420,11 +2453,11 @@ var wireCmd = defineCommand18({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-3SWBM7D6.js");
-    const { MCP_HTTP_PORT } = await import("./server-GBA7BJGK.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-TE2ZL6HD.js");
+    const { MCP_HTTP_PORT } = await import("./server-ZJPXPRZT.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -3007,7 +3040,7 @@ var setup_default = defineCommand19({
           inquirer
         });
       } else {
-        const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
+        const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
         const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
         process21.stdout.write("\n");
         info("To deploy later, run these two commands:");
@@ -3024,7 +3057,7 @@ var setup_default = defineCommand19({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-KYFPWI5U.js");
+        const { applyPlan } = await import("./apply-HJ5GAKHW.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -3052,8 +3085,8 @@ To deploy later:  clawops apply ${outputPath}`);
   }
 });
 async function runLocalDeploy(opts) {
-  const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { localBootstrap } = await import("./bootstrap-HNGKY6WW.js");
+  const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
+  const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
   const { connect } = await import("./ssh-VAI5DU5M.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
@@ -3527,8 +3560,8 @@ async function maybeWireGatewayMcp(opts) {
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
   const { connect } = await import("./ssh-VAI5DU5M.js");
-  const { getConfigDir: getConfigDir2 } = await import("./store-SDUR52Z5.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-3SWBM7D6.js");
+  const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-TE2ZL6HD.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3647,8 +3680,8 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-72JMRT4E.js");
-  const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-3KKCR7BL.js");
+  const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
   const config = getConfig2();
   if (!config) return;
   const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
@@ -3671,7 +3704,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-7EVC6W45.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3946,7 +3979,7 @@ var rotateCmd = defineCommand20({
     spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
     writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
-    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
     const cfg = getConfig2();
     const targetStack = args.stack ?? cfg?.defaults?.stack;
     if (!targetStack) {
@@ -3963,11 +3996,11 @@ var rotateCmd = defineCommand20({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-7EVC6W45.js");
+      const { buildContext } = await import("./context-7VI3R6EK.js");
       const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
       const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
-      const { localStateToConnectionInfo } = await import("./state-PRBIIN7I.js");
+      const { localStateToConnectionInfo } = await import("./state-AOAYLYY5.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
       if (ctx.adapter.name === "local") {
@@ -4150,7 +4183,7 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.0.1" : "dev";
+var VERSION = true ? "2.1.0" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
   const os3 = `${process23.platform} ${process23.arch}`;
@@ -4158,7 +4191,7 @@ async function collectContext() {
   let stackCount = 0;
   let sshKey = "unknown";
   try {
-    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
     const config = getConfig2();
     if (config) {
       const stacks = Object.values(config.stacks);
@@ -4264,12 +4297,14 @@ var harden_default = defineCommand23({
     list: { type: "boolean", description: "List available modules and exit" },
     "dry-run": { type: "boolean", description: "Check current state without applying changes" },
     yes: { type: "boolean", description: "Skip confirmation prompt" },
-    json: { type: "boolean", description: "Emit structured JSON output" }
+    json: { type: "boolean", description: "Emit structured JSON output" },
+    tailscale: { type: "boolean", description: "Join the tailnet, verify this machine can reach the host there, then use that address" },
+    "tailscale-revert": { type: "boolean", description: "Take the host off its tailnet and go back to its public address. A private-only stack must be reopened with a plan first" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-72JMRT4E.js");
-    const { buildContext } = await import("./context-7EVC6W45.js");
-    const { getConfig: getConfig2 } = await import("./store-SDUR52Z5.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-3KKCR7BL.js");
+    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
     if (args.list) {
       process24.stdout.write("\nAvailable hardening modules:\n\n");
       for (const mod of MODULE_CATALOG) {
@@ -4290,7 +4325,36 @@ var harden_default = defineCommand23({
     }
     const ctx = buildContext({ stack: args.stack });
     const provider = ctx.adapter.name;
-    const modules = resolveModules(MODULE_CATALOG, args.options, provider);
+    if (args["tailscale-revert"]) {
+      const { revertTailnet } = await import("./flows-RI7FGHAM.js");
+      const override = config.stacks[ctx.stackName]?.tailscale;
+      if (override && args.yes !== true) {
+        const { createInterface: createInterface3 } = await import("readline/promises");
+        const rl = createInterface3({ input: process24.stdin, output: process24.stdout });
+        const answer = await rl.question(
+          `Take "${ctx.stackName}" off the tailnet (${override.ip}) and use its public address again? [y/N] `
+        );
+        rl.close();
+        if (!answer.toLowerCase().startsWith("y")) {
+          info("Aborted.");
+          return;
+        }
+      }
+      const outcome = await revertTailnet(ctx, config);
+      if (!outcome.ok) {
+        failure(outcome.reason);
+        process24.exit(1);
+      }
+      if ("noop" in outcome) info(outcome.message);
+      else success(outcome.message);
+      return;
+    }
+    const { makeTailscaleModule } = await import("./harden-3KKCR7BL.js");
+    const forStack = makeTailscaleModule(ctx.stackName);
+    const resolved = resolveModules(MODULE_CATALOG, args.options, provider).map(
+      (m) => m.id === "tailscale" ? forStack : m
+    );
+    const modules = args.tailscale && !resolved.some((m) => m.id === "tailscale") ? [...resolved, forStack] : resolved;
     if (modules.length === 0) {
       warn("No modules selected for this provider. Use --options to specify modules or --list to see all.");
       return;
@@ -4368,6 +4432,16 @@ var harden_default = defineCommand23({
     if (!args["dry-run"]) {
       success("Hardening complete.");
     }
+    if (args.tailscale && !args["dry-run"]) {
+      const { cutOverToTailnet } = await import("./flows-RI7FGHAM.js");
+      process24.stdout.write("\nVerifying the tailnet address before using it...\n");
+      const outcome = await cutOverToTailnet(ctx, conn, config);
+      if (!outcome.ok) {
+        failure(outcome.reason);
+        process24.exit(1);
+      }
+      success(outcome.message);
+    }
   }
 });
 
@@ -4390,7 +4464,7 @@ function handleError(err) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.0.1" : "dev";
+var CLI_VERSION = true ? "2.1.0" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",

package/dist/{context-7EVC6W45.js → context-7VI3R6EK.js}

@@ -2,16 +2,16 @@
 import {
   buildContext,
   loadAdapterModule
-} from "./chunk-5XT5IAJK.js";
-import "./chunk-LEVIW2PV.js";
+} from "./chunk-QDNFADJI.js";
+import "./chunk-BELTQGHT.js";
 import "./chunk-GIEVAGEK.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+import "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 import "./chunk-VUFMZEIM.js";
 export {