@clawops/cli 2.0.1 → 2.1.0

package/dist/{package-5BCMEBTE.js → package-JWDMWPV3.js}

@@ -2,8 +2,39 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "2.0.1";
-var description = "Deploy and manage self-hosted OpenClaw instances across clouds";
+var version = "2.1.0";
+var description = "Deploy and operate self-hosted OpenClaw across AWS, GCP, Azure and local VMs \u2014 a CLI and an MCP server in one.";
+var keywords = [
+  "openclaw",
+  "mcp",
+  "mcp-server",
+  "model-context-protocol",
+  "pulumi",
+  "pulumi-automation-api",
+  "infrastructure-as-code",
+  "iac",
+  "devops",
+  "deployment",
+  "self-hosted",
+  "cli",
+  "aws",
+  "gcp",
+  "azure",
+  "ai-agent",
+  "agent-ops",
+  "claude-code",
+  "typescript",
+  "nodejs"
+];
+var homepage = "https://clawops.fyi";
+var bugs = {
+  url: "https://github.com/dfridkin/clawops/issues"
+};
+var repository = {
+  type: "git",
+  url: "git+https://github.com/dfridkin/clawops.git"
+};
+var license = "MPL-2.0";
 var type = "module";
 var bin = {
   clawops: "./dist/cli.js"
@@ -15,11 +46,6 @@ var files = [
   "dist",
   "spec"
 ];
-var repository = {
-  type: "git",
-  url: "git+https://github.com/dfridkin/clawops.git"
-};
-var homepage = "https://clawops.fyi";
 var mcpName = "io.github.dfridkin/clawops";
 var publishConfig = {
   access: "public",
@@ -43,7 +69,12 @@ var scripts = {
   changeset: "changeset",
   release: "pnpm build && changeset publish",
   "test:mutation": "node scripts/dev/mutation-check.mjs",
-  graph: "node scripts/dev/graph.mjs"
+  graph: "node scripts/dev/graph.mjs",
+  "verify:pack": "node scripts/dev/verify-pack.mjs",
+  "verify:mcp": "node scripts/dev/mcp-probe.mjs",
+  "verify:docker": "node scripts/dev/verify-docker.mjs",
+  "version:packages": "changeset version && node scripts/sync-server-json.mjs",
+  "sync:server-json": "node scripts/sync-server-json.mjs"
 };
 var dependencies = {
   "@aws-sdk/client-bedrock": "^3.1063.0",
@@ -106,12 +137,15 @@ var package_default = {
   name,
   version,
   description,
+  keywords,
+  homepage,
+  bugs,
+  repository,
+  license,
   type,
   bin,
   exports,
   files,
-  repository,
-  homepage,
   mcpName,
   publishConfig,
   engines,
@@ -123,6 +157,7 @@ var package_default = {
 };
 export {
   bin,
+  bugs,
   package_default as default,
   dependencies,
   description,
@@ -131,6 +166,8 @@ export {
   exports,
   files,
   homepage,
+  keywords,
+  license,
   mcpName,
   name,
   packageManager,

package/dist/preflight-7W23GP4R.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import {
+  REQUIRED_PROVIDERS,
+  availableSizes,
+  azurePreflight,
+  managementToken,
+  sizeCheck,
+  stateBackendCheck
+} from "./chunk-BTW7NHOH.js";
+import "./chunk-FEK7VJAY.js";
+import "./chunk-RHOWYIWT.js";
+export {
+  REQUIRED_PROVIDERS,
+  availableSizes,
+  azurePreflight,
+  managementToken,
+  sizeCheck,
+  stateBackendCheck
+};

package/dist/preflight-IE2YWBAC.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import {
+  gcloudConfiguredProject,
+  gcpPreflight,
+  projectFromIni,
+  resolveProjectId
+} from "./chunk-TC2VYPLH.js";
+export {
+  gcloudConfiguredProject,
+  gcpPreflight,
+  projectFromIni,
+  resolveProjectId
+};

package/dist/private-only-DIA26I2E.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import {
+  UsageError
+} from "./chunk-KGXPLI7W.js";
+
+// src/plan/private-only.ts
+function privateOnlyNetwork(flags, resolved, override, stackName) {
+  if (flags.sshCidr !== void 0 || flags.gatewayCidr !== void 0) {
+    throw new UsageError(
+      "--private-only closes public SSH and gateway access, so it cannot be combined with --ssh-cidr or --gateway-cidr. Drop those flags, or drop --private-only to keep a public rule."
+    );
+  }
+  const tailnet = requireOverride(override, stackName);
+  return {
+    ...resolved,
+    allowedSshCidrs: [],
+    allowedGatewayCidrs: [],
+    tailscale: { enabled: true, privateOnly: true, ip: tailnet.ip }
+  };
+}
+async function assertTailnetReachable(ctx, probe) {
+  const tailnet = requireOverride(ctx.config.stacks[ctx.stackName]?.tailscale, ctx.stackName);
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  let conn;
+  try {
+    const outputMap = await (await ctx.getStack()).outputs();
+    const raw = Object.fromEntries(Object.entries(outputMap).map(([k, v]) => [k, v.value]));
+    conn = ctx.adapter.getConnectionInfo({
+      ...extractBaseOutputs(raw),
+      privateKeyPath: ctx.config.ssh.keyPath,
+      knownHostsPath: ctx.config.ssh.knownHostsPath
+    });
+  } catch {
+    throw new UsageError(
+      `Stack "${ctx.stackName}" has no deployment to make private. Deploy it, then run \`clawops harden --tailscale\`, then plan with --private-only.`
+    );
+  }
+  if (!await probe(conn)) {
+    throw new UsageError(
+      `This machine cannot reach "${ctx.stackName}" at its tailnet address ${tailnet.ip}, so closing the public ports would leave no way in. Check that Tailscale is running here and signed in to the same tailnet, then try again. Nothing was changed.`
+    );
+  }
+  return tailnet.ip;
+}
+async function guardPrivateOnlyApply(plan, ctx, probe) {
+  const { network } = plan.spec;
+  if (network.tailscale?.privateOnly !== true) return;
+  if (network.allowedSshCidrs.length > 0 || network.allowedGatewayCidrs.length > 0) {
+    throw new UsageError(
+      `This plan is marked private-only but still opens public ports (SSH: ${network.allowedSshCidrs.join(", ") || "none"}; gateway: ${network.allowedGatewayCidrs.join(", ") || "none"}). Regenerate it with \`clawops plan --private-only\`.`
+    );
+  }
+  const override = ctx.config.stacks[ctx.stackName]?.tailscale;
+  const current = requireOverride(override, ctx.stackName);
+  if (network.tailscale.ip !== current.ip) {
+    throw new UsageError(
+      `This plan was made for the tailnet address ${network.tailscale.ip ?? "(none)"}, but "${ctx.stackName}" is now reached at ${current.ip}. Regenerate it with \`clawops plan --private-only\`.`
+    );
+  }
+  await assertTailnetReachable(ctx, probe);
+}
+function requireOverride(override, stackName) {
+  if (!override) {
+    throw new UsageError(
+      `Stack "${stackName}" has no verified tailnet address, so closing its public ports would leave no way in. Run \`clawops harden --tailscale\` first; it only records an address this machine has reached.`
+    );
+  }
+  return override;
+}
+export {
+  assertTailnetReachable,
+  guardPrivateOnlyApply,
+  privateOnlyNetwork
+};

package/dist/{server-GBA7BJGK.js → server-ZJPXPRZT.js}

@@ -5,27 +5,27 @@ import {
   bearerFrom,
   isLoopbackBind,
   serveMcp
-} from "./chunk-KC3GC3PE.js";
-import "./chunk-LBE6COC4.js";
+} from "./chunk-AYUX4FOF.js";
+import "./chunk-R3DTA35B.js";
 import "./chunk-BOPSG2LI.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-3QJBNAHW.js";
 import "./chunk-2I7KCMXZ.js";
-import "./chunk-HSPHXG6W.js";
+import "./chunk-3Z5TDXCJ.js";
 import "./chunk-AEEMRFZV.js";
-import "./chunk-STLRHLLV.js";
-import "./chunk-BSLIYB5Q.js";
+import "./chunk-A2DS5SB7.js";
+import "./chunk-XFN3YDZE.js";
 import "./chunk-2Z7J3ERQ.js";
 import "./chunk-E4NJSJ54.js";
 import "./chunk-MC5ATCXS.js";
-import "./chunk-5XT5IAJK.js";
-import "./chunk-IVWP4QUJ.js";
+import "./chunk-QDNFADJI.js";
+import "./chunk-GFUK6KDR.js";
 import "./chunk-NUL5F6YV.js";
 import "./chunk-3OLUJPCB.js";
 import "./chunk-NUDIHZEH.js";
 import "./chunk-JW5A7E3X.js";
 import "./chunk-LT4XMO5D.js";
-import "./chunk-LEVIW2PV.js";
+import "./chunk-BELTQGHT.js";
 import "./chunk-GIEVAGEK.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
@@ -33,8 +33,8 @@ import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-Q7NQY5HV.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+import "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 import "./chunk-VUFMZEIM.js";
 export {

package/dist/{stack-config-R4SPSUQZ.js → stack-config-LUTS2XAD.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   writeStackConfig
-} from "./chunk-HSPHXG6W.js";
+} from "./chunk-3Z5TDXCJ.js";
 import "./chunk-AEEMRFZV.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
-import "./chunk-CX5SL5HP.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 export {
   writeStackConfig

package/dist/{state-PRBIIN7I.js → state-AOAYLYY5.js}

@@ -5,8 +5,8 @@ import {
   stateDir,
   statePath,
   writeLocalState
-} from "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+} from "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 export {
   localStateToConnectionInfo,

package/dist/{store-SDUR52Z5.js → store-OVB3DAJR.js}

@@ -5,7 +5,7 @@ import {
   getConfigPath,
   requireConfig,
   setConfig
-} from "./chunk-CX5SL5HP.js";
+} from "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 export {
   getConfig,

package/dist/tailscale-cutover-6YP2QKFM.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+import {
+  isTailscaleIpv4,
+  parseStatus,
+  rootPrefix
+} from "./chunk-X56CQ6GB.js";
+import {
+  formatKnownHostsLine,
+  keyTypeFromBlob,
+  verifyAgainstKnownHosts
+} from "./chunk-MC5ATCXS.js";
+import "./chunk-64PONSA5.js";
+import "./chunk-KGXPLI7W.js";
+
+// src/harden/tailscale-cutover.ts
+import { readFileSync, appendFileSync, mkdirSync } from "fs";
+import path from "path";
+function parseHostKeys(text) {
+  const out = [];
+  for (const line of text.split("\n")) {
+    const [declared, b64] = line.trim().split(/\s+/);
+    if (!declared || !b64) continue;
+    let blob;
+    try {
+      blob = Buffer.from(b64, "base64");
+    } catch {
+      continue;
+    }
+    const actual = keyTypeFromBlob(blob);
+    if (!actual || actual !== declared) continue;
+    out.push({ type: actual, blob });
+  }
+  return out;
+}
+function pinKeys(knownHostsPath, host, port, keys) {
+  let content = "";
+  try {
+    content = readFileSync(knownHostsPath, "utf-8");
+  } catch {
+  }
+  let added = 0;
+  mkdirSync(path.dirname(knownHostsPath), { recursive: true });
+  for (const k of keys) {
+    if (verifyAgainstKnownHosts(content, host, port, k.blob) === "match") continue;
+    const line = formatKnownHostsLine(host, port, k.type, k.blob);
+    appendFileSync(knownHostsPath, line, "utf-8");
+    content += line;
+    added += 1;
+  }
+  return added;
+}
+async function verifyTailnetAddress(publicConn, deps) {
+  const status = parseStatus((await deps.exec("tailscale status --json 2>/dev/null || true")).stdout);
+  if (status.state !== "Running" || !status.ipv4 || !isTailscaleIpv4(status.ipv4)) {
+    return {
+      ok: false,
+      reason: "The host is not on a tailnet yet, so there is no address to move to. Run `clawops harden --options tailscale` first."
+    };
+  }
+  const ip = status.ipv4;
+  const keys = parseHostKeys((await deps.exec("cat /etc/ssh/ssh_host_*_key.pub 2>/dev/null")).stdout);
+  if (keys.length === 0) {
+    return {
+      ok: false,
+      reason: "Could not read the host keys over the public connection, so the tailnet address cannot be tied to this host. Nothing was changed."
+    };
+  }
+  const pinned = pinKeys(publicConn.knownHostsPath, ip, publicConn.port, keys);
+  const reached = await deps.probe({ ...publicConn, host: ip });
+  if (!reached) {
+    return {
+      ok: false,
+      reason: `The host is on the tailnet as ${ip}, but this machine could not reach it there. The usual cause is that this machine is not on the same tailnet: install Tailscale here and sign in to the same account. clawops still uses the public address; nothing else was changed.`
+    };
+  }
+  return { ok: true, ip, ...status.hostname ? { hostname: status.hostname } : {}, pinned };
+}
+async function probeSsh(conn, signal) {
+  const { connect } = await import("./ssh-VAI5DU5M.js");
+  let session;
+  try {
+    session = await connect({
+      host: conn.host,
+      port: conn.port,
+      user: conn.user,
+      privateKeyPath: conn.privateKeyPath,
+      knownHostsPath: conn.knownHostsPath,
+      signal
+    });
+    return (await session.exec("true", signal)).code === 0;
+  } catch {
+    return false;
+  } finally {
+    session?.close();
+  }
+}
+async function leaveTailnet(exec) {
+  const sudo = await rootPrefix(exec);
+  const r = await exec(`${sudo}tailscale logout 2>&1`);
+  if (r.code === 0) return { ok: true };
+  if (/not logged in|NeedsLogin/i.test(r.stdout)) return { ok: true };
+  return {
+    ok: false,
+    reason: `tailscale logout failed on the host: ${r.stdout.trim().split("\n").slice(-1)[0] || `exit ${r.code}`}`
+  };
+}
+export {
+  leaveTailnet,
+  parseHostKeys,
+  pinKeys,
+  probeSsh,
+  verifyTailnetAddress
+};

package/dist/{validate-YVI3BJ55.js → validate-JXKN5WD6.js}

@@ -4,7 +4,7 @@ import {
   validatePlan,
   validatePlanConfig,
   validatePlanNetwork
-} from "./chunk-BSLIYB5Q.js";
+} from "./chunk-XFN3YDZE.js";
 import "./chunk-JW5A7E3X.js";
 export {
   assertValidPlan,

package/package.json

@@ -1,7 +1,38 @@
 {
   "name": "@clawops/cli",
-  "version": "2.0.1",
-  "description": "Deploy and manage self-hosted OpenClaw instances across clouds",
+  "version": "2.1.0",
+  "description": "Deploy and operate self-hosted OpenClaw across AWS, GCP, Azure and local VMs — a CLI and an MCP server in one.",
+  "keywords": [
+    "openclaw",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "pulumi",
+    "pulumi-automation-api",
+    "infrastructure-as-code",
+    "iac",
+    "devops",
+    "deployment",
+    "self-hosted",
+    "cli",
+    "aws",
+    "gcp",
+    "azure",
+    "ai-agent",
+    "agent-ops",
+    "claude-code",
+    "typescript",
+    "nodejs"
+  ],
+  "homepage": "https://clawops.fyi",
+  "bugs": {
+    "url": "https://github.com/dfridkin/clawops/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dfridkin/clawops.git"
+  },
+  "license": "MPL-2.0",
   "type": "module",
   "bin": {
     "clawops": "./dist/cli.js"
@@ -13,11 +44,6 @@
     "dist",
     "spec"
   ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/dfridkin/clawops.git"
-  },
-  "homepage": "https://clawops.fyi",
   "mcpName": "io.github.dfridkin/clawops",
   "publishConfig": {
     "access": "public",
@@ -40,7 +66,12 @@
     "changeset": "changeset",
     "release": "pnpm build && changeset publish",
     "test:mutation": "node scripts/dev/mutation-check.mjs",
-    "graph": "node scripts/dev/graph.mjs"
+    "graph": "node scripts/dev/graph.mjs",
+    "verify:pack": "node scripts/dev/verify-pack.mjs",
+    "verify:mcp": "node scripts/dev/mcp-probe.mjs",
+    "verify:docker": "node scripts/dev/verify-docker.mjs",
+    "version:packages": "changeset version && node scripts/sync-server-json.mjs",
+    "sync:server-json": "node scripts/sync-server-json.mjs"
   },
   "dependencies": {
     "@aws-sdk/client-bedrock": "^3.1063.0",

package/spec/deploy-plan.schema.json

@@ -162,7 +162,7 @@
                 "type": "string",
                 "format": "cidr"
               },
-              "description": "CIDRs allowed to reach the gateway port. Only meaningful with publishGateway \"all\" — under \"loopback\" nothing listens on a routable interface, so these rules would admit traffic to a closed port. clawops refuses that combination rather than creating rules that do nothing."
+              "description": "CIDRs allowed to reach the gateway port. Only meaningful with publishGateway \"all\" \u2014 under \"loopback\" nothing listens on a routable interface, so these rules would admit traffic to a closed port. clawops refuses that combination rather than creating rules that do nothing."
             },
             "gatewayPort": {
               "type": "integer",
@@ -181,6 +181,14 @@
                 "authKeyRef": {
                   "type": "string",
                   "description": "Reference to a secret containing the Tailscale auth key"
+                },
+                "privateOnly": {
+                  "type": "boolean",
+                  "description": "The plan closes public SSH and gateway ingress because the stack is reached over its tailnet (WO-34 step 6; ADR 0013). Apply refuses it unless the stack has a verified tailnet address, equal to `ip`, that answers SSH at apply time. Both CIDR lists must be empty."
+                },
+                "ip": {
+                  "type": "string",
+                  "description": "The tailnet address the plan relies on once public ingress is closed. Recorded so the reviewer sees which address remains, and so apply can refuse a plan made for an address the stack no longer has."
                 }
               }
             },
@@ -253,6 +261,13 @@
         },
         "totalChanges": {
           "type": "integer"
+        },
+        "replace": {
+          "type": "array",
+          "description": "Resources Pulumi will destroy and recreate. A replaced instance loses its boot disk, and with it every byte of OpenClaw state on the host.",
+          "items": {
+            "$ref": "#/$defs/ResourceRef"
+          }
         }
       }
     }

package/spec/mcp-tools.yaml

@@ -86,8 +86,9 @@ tools:
       actually running.
 
       Do NOT use when: you already know the problem and want to fix it. This tool only
-      reports — it changes nothing, and never runs `openclaw doctor --fix`. Repair is
-      part of clawops_gateway_update, where it is gated on a verified backup.
+      reports — it changes nothing, and never runs `openclaw doctor --fix`. No tool
+      repairs a gateway: `clawops gateway update` is CLI-only, so tell the user to run
+      it themselves, after `clawops backup create`.
 
       Every check carries a status: fail (something is wrong that clawops can name),
       warn (worth knowing, not broken), info (did not apply). `ok` is false only when
@@ -125,8 +126,9 @@ tools:
 
       Do NOT use when: the user wants real-time streaming logs (those are not
       well-suited to tool calls; suggest the user run `clawops logs -f` directly
-      in their terminal). Do NOT use for instance-level system logs (use
-      clawops_ssh with `journalctl`).
+      in their terminal). Do NOT use for instance-level system logs: no tool runs
+      arbitrary remote commands, so tell the user to run `clawops ssh --command
+      'journalctl ...'` themselves.
     annotations:
       title: Tail Gateway Logs
       readOnlyHint: true
@@ -238,7 +240,8 @@ tools:
       Use when: the user wants to see which agents are running, debug agent
       routing, or count active workspaces.
 
-      Do NOT use when: the user wants agent logs (use clawops_agents_logs).
+      Do NOT use when: the user wants one agent's logs — no tool exposes those; tell
+      the user to run `clawops agents logs <name>`.
     annotations:
       title: List OpenClaw Agents
       readOnlyHint: true
@@ -332,9 +335,10 @@ tools:
       Use when: the user explicitly asks to destroy, tear down, delete, or
       remove a stack. Always confirm the stack name.
 
-      Do NOT use when: the user wants to stop the gateway temporarily — use
-      clawops_gateway_stop instead. Do NOT use when in doubt about which stack;
-      list first with clawops_stacks_list.
+      Do NOT use when: the user wants to stop the gateway temporarily — that is not
+      a destroy, and no tool stops a gateway; clawops_gateway_restart is the only
+      gateway tool. Do NOT use when in doubt about which stack; list first with
+      clawops_stacks_list.
     annotations:
       title: Destroy Stack (DESTRUCTIVE)
       readOnlyHint: false
@@ -393,7 +397,12 @@ tools:
       stackName: { type: string, optional: true }
       provider: { type: enum, values: [aws, gcp, azure, local], optional: true }
       region: { type: string, optional: true }
-      instanceType: { type: enum, values: [micro, small, medium, large, gpu], optional: true }
+      instanceType: { type: string, optional: true, description: "A clawops alias (micro|small|medium|large|gpu) or a machine type the cloud names itself, e.g. t3.small" }
+      openclawVersion: { type: string, optional: true, description: "semver, or 'stable'/'dev'" }
+      sshCidr: { type: string, optional: true, description: "CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for this machine. Omitted = none, and nothing will be able to connect" }
+      gatewayCidr: { type: string, optional: true, description: "CIDR(s) allowed to reach the gateway port, or 'auto'. Requires publishGateway=all" }
+      publishGateway: { type: enum, values: [loopback, all], optional: true, description: "Which interface the gateway binds. loopback (default) keeps it off the network" }
+      privateOnly: { type: boolean, optional: true, description: "Close public SSH and gateway access; reach the stack over its tailnet. Requires a verified tailnet address (clawops_harden with tailscale), and refuses unless that address answers SSH now" }
       outPath: { type: string, optional: true, description: "Absolute path to write plan; if omitted, plan returned inline" }
     output:
       planPath: { type: string, description: "Absolute path; only set if outPath provided" }
@@ -499,6 +508,55 @@ tools:
 # COMPOSITE WORKFLOW TOOLS (R2: encode user intent, not API sequences)
 # ────────────────────────────────────────────────────────────────────────────
 
+  - name: clawops_harden
+    toolset: [cli]
+    description: |
+      Apply security hardening to a deployed stack: SSH, UFW, fail2ban,
+      unattended-upgrades, the Docker socket, and per-cloud checks. Optionally join
+      the stack to a Tailscale network and reach it there instead of over the public
+      internet.
+
+      Use when: the user asks to harden, secure, or lock down a stack; asks what the
+      hardening report says (with dryRun: true, which changes nothing); or asks to put
+      a stack on their tailnet.
+
+      tailscale: true installs Tailscale, joins the tailnet as clawops-<stack>, and
+      then moves clawops onto that address — but only after opening an SSH session to
+      it, against host keys pinned over the connection already trusted. If that fails,
+      nothing is recorded and the public address stays in use. The auth key comes from
+      `clawops secret set TAILSCALE_AUTH_KEY` and is never passed through this tool
+      (R6).
+
+      tailscaleRevert: true takes the host back off the tailnet, over its public
+      address. On a private-only stack it refuses and names the plan/apply commands
+      that reopen SSH first — relay them rather than trying to work around it.
+
+      To close the public ports afterwards, plan with privateOnly: true and apply that
+      plan; this tool does not change firewall rules.
+
+      Do NOT use when: the user wants to know whether a stack is healthy — that is
+      clawops_doctor. Do NOT pass tailscale and tailscaleRevert together.
+    annotations:
+      title: Harden Stack
+      readOnlyHint: false
+      destructiveHint: true
+      idempotentHint: true
+      openWorldHint: true
+    input:
+      stackName: { type: string, optional: true }
+      options: { type: string, optional: true, description: "Comma-separated module IDs; default is every defaultOn module for the provider" }
+      dryRun: { type: boolean, optional: true, default: false, description: "Report the current state, change nothing" }
+      tailscale: { type: boolean, optional: true, default: false, description: "Join the tailnet, verify this machine reaches the host there, then use that address" }
+      tailscaleRevert: { type: boolean, optional: true, default: false, description: "Leave the tailnet and go back to the public address" }
+      yes: { type: boolean, optional: true, default: false, description: "Skip elicitation; CI/scripted use only" }
+    output:
+      modules:
+        type: array
+        description: "Per module: id, status, whether it changed anything, and detail"
+      tailnet:
+        type: object
+        description: "Set when tailscale or tailscaleRevert ran: the address now in use, or why it was refused"
+
   - name: clawops_workflow_deploy_app
     toolset: [workflow]
     description: |