@clawops/cli 2.1.0 → 2.1.2

package/README.md

@@ -162,6 +162,21 @@ the correct absolute binary path.
 
 To add the entry manually instead, paste this into your editor's MCP config:
 
+```json
+{
+  "mcpServers": {
+    "clawops": {
+      "command": "npx",
+      "args": ["-y", "@clawops/cli", "mcp", "serve", "--read-only"]
+    }
+  }
+}
+```
+
+That form needs nothing on `$PATH` and is what a directory or an installer will copy. If you
+would rather point at the binary you already have, use its absolute path — the output of
+`which clawops` — with the same arguments:
+
 ```json
 {
   "mcpServers": {
@@ -173,7 +188,11 @@ To add the entry manually instead, paste this into your editor's MCP config:
 }
 ```
 
-Replace `/path/to/clawops` with the output of `which clawops`. Config file locations:
+Either way, pass the arguments. `mcp serve` is what speaks the protocol, and an explicit config
+is one that still reads clearly a year later. clawops does not strand a client that omits them:
+run with no command at all and a pipe on stdin — how every MCP client starts a server — and it
+starts `mcp serve`, saying so on stderr. Typed at a terminal, `clawops` still prints help.
+Config file locations:
 
 | App | Path |
 |---|---|
@@ -523,7 +542,7 @@ pnpm dev doctor        # verify toolchain
 ```bash
 pnpm dev                   # run CLI from src/ via tsx
 pnpm build                 # tsup → dist/
-pnpm test                  # vitest (1855 tests, ~13s)
+pnpm test                  # vitest (1897 tests, ~13s)
 pnpm test:changed          # vitest --changed (fast edit loop)
 pnpm test:integration      # Docker-based SSH integration tests
 pnpm typecheck             # tsc --noEmit
@@ -584,6 +603,7 @@ Use `pnpm changeset` to record a release note before merging a `feat` or `fix`.
 ## What's new in 2.1
 
 Private networking, hardening on every cloud, and two fixes to commands that could not start.
+2.1.1 follows with the fixes below it.
 
 ### Reach a stack over your tailnet
 
@@ -626,6 +646,25 @@ Private networking, hardening on every cloud, and two fixes to commands that cou
 - The published package carries its license, keywords and issue tracker, so it is findable on npm
   and its listing is complete.
 
+### 2.1.1
+
+- **`clawops` started with no command and a pipe on stdin serves MCP** instead of printing help.
+  That is how every MCP client starts a server, and how directories that infer a run command
+  start one; several were getting the help text and reporting the server as broken. Typed at a
+  terminal, `clawops` still prints help, and so does `clawops | less`.
+- The MCP config example is `npx -y @clawops/cli mcp serve`, which runs as written. It used to
+  say `/path/to/clawops`, which nothing could run and no directory could copy.
+- The description is inside the MCP registry's 100-character limit. The one 2.1.0 shipped was
+  110, and the registry refused it with a 422 after npm had already published — so 2.1.0 reached
+  npm and not the registry.
+- `clawops harden` says a stack is not deployed, or that its state could not be read, instead of
+  passing along `code: -2` and a subprocess dump.
+- The MCP registry backfill registers the version that was released rather than the one the
+  release tooling is preparing, so an entry that falls behind can actually be repaired.
+- The Docker image builds. It had never been built, and did not: `npm pack --pack-destination`
+  does not create its destination. `pnpm verify:docker` builds it and speaks MCP to the running
+  container, both through its entrypoint and as a bare binary, in CI.
+
 ---
 
 ## What's new in 2.0.1

package/dist/{chunk-A2DS5SB7.js → chunk-IQQTB7ER.js}

@@ -71,7 +71,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-JWDMWPV3.js");
+  const { version } = await import("./package-JFVGCNKU.js");
   const config = getConfig();
   const instanceType = await resolveInstanceType(intent);
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");

package/dist/{chunk-AYUX4FOF.js → chunk-T5XCMYAV.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2I7KCMXZ.js";
 import {
   generatePlan
-} from "./chunk-A2DS5SB7.js";
+} from "./chunk-IQQTB7ER.js";
 import {
   validatePlan
 } from "./chunk-XFN3YDZE.js";
@@ -143,6 +143,7 @@ import { z } from "zod";
 var clawops_statusSchema = z.object({
   stackName: z.string().optional()
 });
+var clawops_statusDescription = "Get what is deployed for a clawops-managed stack: public IP, gateway URL,\nSSH user, or that nothing is deployed yet. Reads stack outputs; does not\ncontact the host.\n\nUse when: the user asks what exists for a stack, or where to reach it.\n\nDo NOT use when: the user asks whether the gateway is actually WORKING \u2014\nthat needs the host, so use clawops_doctor. Also not for live logs (use\nclawops_logs_tail) or config values (use clawops_config_get).";
 var clawops_statusAnnotations = {
   title: "Get Stack Status",
   readOnlyHint: true,
@@ -155,6 +156,7 @@ var clawops_doctorSchema = z.object({
   stackName: z.string().optional(),
   failuresOnly: z.boolean().optional().default(false)
 });
+var clawops_doctorDescription = "Run clawops's diagnostics and return the report: Node and Pulumi runtime, config,\nSSH key and known_hosts, cloud credentials per configured provider, and the\nsupported OpenClaw range. With stackName, also contacts the host for container\nstate, the deployed OpenClaw version, a real gateway health probe, whether the\nport is published to the internet, disk usage on the state directory, log\nrotation, and hardening drift.\n\nUse when: something is not working and you do not yet know what; before any\ndeploy, upgrade or migration; or to find out which OpenClaw version a gateway is\nactually running.\n\nDo NOT use when: you already know the problem and want to fix it. This tool only\nreports \u2014 it changes nothing, and never runs `openclaw doctor --fix`. No tool\nrepairs a gateway: `clawops gateway update` is CLI-only, so tell the user to run\nit themselves, after `clawops backup create`.\n\nEvery check carries a status: fail (something is wrong that clawops can name),\nwarn (worth knowing, not broken), info (did not apply). `ok` is false only when\nsomething failed \u2014 a fresh machine with no stacks is full of warnings and healthy.";
 var clawops_doctorAnnotations = {
   title: "Run Diagnostics",
   readOnlyHint: true,
@@ -168,6 +170,7 @@ var clawops_logs_tailSchema = z.object({
   tailLines: z.number().int().optional().default(100),
   sinceMin: z.number().int().optional()
 });
+var clawops_logs_tailDescription = "Tail recent gateway logs from a clawops-managed instance.\n\nUse when: the user wants to investigate recent activity or errors, or\nasks \"what's been happening\" on the gateway.\n\nDo NOT use when: the user wants real-time streaming logs (those are not\nwell-suited to tool calls; suggest the user run `clawops logs -f` directly\nin their terminal). Do NOT use for instance-level system logs: no tool runs\narbitrary remote commands, so tell the user to run `clawops ssh --command\n'journalctl ...'` themselves.";
 var clawops_logs_tailAnnotations = {
   title: "Tail Gateway Logs",
   readOnlyHint: true,
@@ -180,6 +183,7 @@ var clawops_monitorSchema = z.object({
   stackName: z.string().optional(),
   tailLines: z.number().int().optional().default(5)
 });
+var clawops_monitorDescription = "Take a live snapshot of a running clawops stack: gateway health, container\nstatus, resource usage (CPU, memory, disk), and recent log lines.\n\nUse when: the user wants to know if the gateway is running, how much\nmemory or CPU it is using, what recent log activity looks like, or\nwants a quick health overview richer than clawops_status.\n\nDo NOT use when: the user wants real-time streaming logs (use\nclawops_logs_tail or suggest `clawops logs -f`). Do NOT use for\nconfiguration queries (use clawops_config_get).";
 var clawops_monitorAnnotations = {
   title: "Monitor Stack Health",
   readOnlyHint: true,
@@ -189,6 +193,7 @@ var clawops_monitorAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_stacks_listSchema = z.object({});
+var clawops_stacks_listDescription = 'List all clawops-managed stacks across all configured providers.\n\nUse when: the user wants an overview of their deployments, asks "what\nstacks do I have", or wants to compare stacks before an operation.\n\nDo NOT use when: the user named a specific stack \u2014 use clawops_status\ndirectly with that name.';
 var clawops_stacks_listAnnotations = {
   title: "List Stacks",
   readOnlyHint: true,
@@ -201,6 +206,7 @@ var clawops_config_getSchema = z.object({
   stackName: z.string().optional(),
   key: z.string().optional()
 });
+var clawops_config_getDescription = "Read a configuration value from the remote OpenClaw gateway.\n\nUse when: the user wants to inspect current OpenClaw config (e.g., which\nmodel provider is active, which channels are enabled).\n\nDo NOT use when: the user wants to change the config \u2014 use\nclawops_config_set instead.";
 var clawops_config_getAnnotations = {
   title: "Get OpenClaw Config Value",
   readOnlyHint: true,
@@ -212,6 +218,7 @@ var clawops_config_getAnnotations = {
 var clawops_agents_listSchema = z.object({
   stackName: z.string().optional()
 });
+var clawops_agents_listDescription = "List agents currently registered on the remote OpenClaw gateway.\n\nUse when: the user wants to see which agents are running, debug agent\nrouting, or count active workspaces.\n\nDo NOT use when: the user wants one agent's logs \u2014 no tool exposes those; tell\nthe user to run `clawops agents logs <name>`.";
 var clawops_agents_listAnnotations = {
   title: "List OpenClaw Agents",
   readOnlyHint: true,
@@ -231,6 +238,7 @@ var clawops_upSchema = z.object({
   openclawVersion: z.string().optional(),
   dryRun: z.boolean().optional().default(false)
 });
+var clawops_upDescription = 'Provision and deploy a clawops stack. Idempotent \u2014 re-running with no spec\nchange produces no diff. Long-running (median 3min, p99 8min) so emits\nprogress notifications per R12.\n\nUse when: the user explicitly asks to deploy, provision, create, or "spin\nup" a stack. Always after the user has reviewed a plan\n(clawops_plan first when in doubt).\n\nDo NOT use when: the user has not yet generated a plan and is in\nexploratory/discovery mode \u2014 use clawops_plan first. Do NOT use for an\nexisting stack you only need to update; refresh first.';
 var clawops_upAnnotations = {
   title: "Provision and Deploy Stack",
   readOnlyHint: false,
@@ -243,6 +251,7 @@ var clawops_destroySchema = z.object({
   stackName: z.string(),
   yes: z.boolean().optional().default(false)
 });
+var clawops_destroyDescription = "Destroy a clawops stack. Removes ALL provisioned resources. Triggers\nelicitation confirmation showing the resource diff before execution\n(R19). Cannot be undone.\n\nUse when: the user explicitly asks to destroy, tear down, delete, or\nremove a stack. Always confirm the stack name.\n\nDo NOT use when: the user wants to stop the gateway temporarily \u2014 that is not\na destroy, and no tool stops a gateway; clawops_gateway_restart is the only\ngateway tool. Do NOT use when in doubt about which stack; list first with\nclawops_stacks_list.";
 var clawops_destroyAnnotations = {
   title: "Destroy Stack (DESTRUCTIVE)",
   readOnlyHint: false,
@@ -255,6 +264,7 @@ var clawops_applySchema = z.object({
   planPath: z.string(),
   yes: z.boolean().optional().default(false)
 });
+var clawops_applyDescription = "Apply a previously-generated Maker plan (deploy-plan.schema.json).\nDeterministic \u2014 the plan describes exactly what will be created.\n\nUse when: the user has a plan file path and wants to apply it. This is\nthe agent-friendly path for any deploy/destroy operation.\n\nDo NOT use when: there's no plan file \u2014 generate one first with\nclawops_plan.";
 var clawops_applyAnnotations = {
   title: "Apply Maker Plan",
   readOnlyHint: false,
@@ -275,6 +285,7 @@ var clawops_planSchema = z.object({
   privateOnly: z.boolean().optional(),
   outPath: z.string().optional()
 });
+var clawops_planDescription = "Generate a Maker deploy plan (does NOT apply). Plan is JSON conforming to\ndeploy-plan.schema.json \u2014 review before applying.\n\nUse when: the user wants to see what would be created before committing,\nor you (the agent) need a reviewable artifact for the user to approve.\n\nDo NOT use when: the user has explicitly asked to deploy and you already\nhave their approval \u2014 go directly to clawops_up.";
 var clawops_planAnnotations = {
   title: "Generate Deploy Plan",
   readOnlyHint: true,
@@ -289,6 +300,7 @@ var clawops_config_setSchema = z.object({
   value: z.string(),
   restart: z.boolean().optional().default(false)
 });
+var clawops_config_setDescription = "Set a configuration value on the remote OpenClaw gateway. Optionally\nrestarts the gateway after.\n\nUse when: the user wants to change OpenClaw configuration (model\nprovider, channel auth, gateway port).\n\nDo NOT use when: the user is reading config \u2014 use clawops_config_get.\nDo NOT bulk-edit; one key at a time so changes are auditable (R21).";
 var clawops_config_setAnnotations = {
   title: "Set OpenClaw Config Value",
   readOnlyHint: false,
@@ -302,6 +314,7 @@ var clawops_config_unsetSchema = z.object({
   key: z.string(),
   restart: z.boolean().optional().default(false)
 });
+var clawops_config_unsetDescription = "Remove a configuration key from the remote OpenClaw gateway config, reverting\nit to the OpenClaw default.\n\nUse when: the user wants to delete a config key entirely (e.g., remove a\nchannel, clear an override).\n\nDo NOT use when: the user wants to set the key to a new value \u2014 use\nclawops_config_set instead.";
 var clawops_config_unsetAnnotations = {
   title: "Unset OpenClaw Config Key",
   readOnlyHint: false,
@@ -313,6 +326,7 @@ var clawops_config_unsetAnnotations = {
 var clawops_config_validateSchema = z.object({
   stackName: z.string().optional()
 });
+var clawops_config_validateDescription = "Validate the remote OpenClaw gateway config against the known schema. Checks\nfor structural errors (wrong types, unknown top-level keys) that would cause\nOpenClaw to fail on startup.\n\nUse when: the user wants to verify config before restarting the gateway, or\nafter editing openclaw.json manually.\n\nDo NOT use when: the user wants to change config \u2014 use clawops_config_set.";
 var clawops_config_validateAnnotations = {
   title: "Validate OpenClaw Config",
   readOnlyHint: true,
@@ -324,6 +338,7 @@ var clawops_config_validateAnnotations = {
 var clawops_gateway_restartSchema = z.object({
   stackName: z.string().optional()
 });
+var clawops_gateway_restartDescription = "Restart the OpenClaw gateway daemon on the remote instance.\n\nUse when: a gateway-wide config change requires reload, or the gateway is\nreported as unresponsive.\n\nNote: OpenClaw 2.0 removed per-agent restart; `gateway restart` is the only\nrestart it offers, and it affects every agent on the host. Brief downtime (~10s).";
 var clawops_gateway_restartAnnotations = {
   title: "Restart Gateway Daemon",
   readOnlyHint: false,
@@ -340,6 +355,7 @@ var clawops_hardenSchema = z.object({
   tailscaleRevert: z.boolean().optional().default(false),
   yes: z.boolean().optional().default(false)
 });
+var clawops_hardenDescription = "Apply security hardening to a deployed stack: SSH, UFW, fail2ban,\nunattended-upgrades, the Docker socket, and per-cloud checks. Optionally join\nthe stack to a Tailscale network and reach it there instead of over the public\ninternet.\n\nUse when: the user asks to harden, secure, or lock down a stack; asks what the\nhardening report says (with dryRun: true, which changes nothing); or asks to put\na stack on their tailnet.\n\ntailscale: true installs Tailscale, joins the tailnet as clawops-<stack>, and\nthen moves clawops onto that address \u2014 but only after opening an SSH session to\nit, against host keys pinned over the connection already trusted. If that fails,\nnothing is recorded and the public address stays in use. The auth key comes from\n`clawops secret set TAILSCALE_AUTH_KEY` and is never passed through this tool\n(R6).\n\ntailscaleRevert: true takes the host back off the tailnet, over its public\naddress. On a private-only stack it refuses and names the plan/apply commands\nthat reopen SSH first \u2014 relay them rather than trying to work around it.\n\nTo close the public ports afterwards, plan with privateOnly: true and apply that\nplan; this tool does not change firewall rules.\n\nDo NOT use when: the user wants to know whether a stack is healthy \u2014 that is\nclawops_doctor. Do NOT pass tailscale and tailscaleRevert together.";
 var clawops_hardenAnnotations = {
   title: "Harden Stack",
   readOnlyHint: false,
@@ -354,6 +370,7 @@ var clawops_workflow_deploy_appSchema = z.object({
   stackName: z.string().optional().default("default"),
   instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional().default("small")
 });
+var clawops_workflow_deploy_appDescription = 'Single-tool workflow that takes a user from "I want to deploy OpenClaw\nto <provider>" to a verified, healthy gateway. Internally: plan \u2192 user\nconfirms (elicitation) \u2192 up \u2192 wait for healthy \u2192 return URL.\n\nUse when: the user expresses end-to-end deployment intent ("deploy to\nAWS", "spin up an OpenClaw on GCP for me").\n\nDo NOT use when: the user is mid-deployment and only needs one step\n(e.g., they already have a plan; use clawops_apply). Do NOT use for\ndestroying or updating \u2014 separate workflows.';
 var clawops_workflow_deploy_appAnnotations = {
   title: "Deploy OpenClaw (End-to-End Workflow)",
   readOnlyHint: false,
@@ -365,6 +382,15 @@ var clawops_workflow_deploy_appAnnotations = {
 var clawops_workflow_recoverSchema = z.object({
   stackName: z.string().optional()
 });
+var clawops_workflow_recoverDescription = `Diagnostic workflow for an unhealthy stack. Internally: status check \u2192
+gateway logs \u2192 agent logs \u2192 systemd service status \u2192 produces a structured
+diagnostic report with suggested remediation.
+
+Use when: the user reports any "not working" symptom and you don't know
+where to start. Best entry point for troubleshooting.
+
+Do NOT use when: the user has already identified the problem and asks for
+a specific fix.`;
 var clawops_workflow_recoverAnnotations = {
   title: "Recover/Diagnose Stack",
   readOnlyHint: true,
@@ -376,6 +402,7 @@ var clawops_workflow_recoverAnnotations = {
 var clawops_task_statusSchema = z.object({
   taskId: z.string()
 });
+var clawops_task_statusDescription = "Poll the status of a long-running clawops task (returned by clawops_up,\nclawops_destroy, clawops_apply, etc.). Per R12 streaming model.\n\nUse when: the user is waiting on a long-running deploy/destroy and wants\nprogress, OR you need to check whether a previously-started operation\nfinished.\n\nDo NOT use when: there is no active taskId \u2014 start the operation first.";
 var clawops_task_statusAnnotations = {
   title: "Get Task Status",
   readOnlyHint: true,
@@ -873,7 +900,7 @@ async function handleUp(input, server) {
   const progressToken = void 0;
   const emit = makeProgressEmitter(server, progressToken);
   startTask(taskId, `clawops_up stack=${ctx.stackName}`);
-  const { generatePlan: generatePlan2 } = await import("./generate-YEM73KVB.js");
+  const { generatePlan: generatePlan2 } = await import("./generate-Q2BGVMH7.js");
   const { applyPlan: applyPlan2 } = await import("./apply-HJ5GAKHW.js");
   const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
   const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
@@ -1329,29 +1356,29 @@ Error: ${err instanceof Error ? err.message : String(err)}`);
 }
 
 // src/mcp/tools/registry.ts
-function makeEntry(schema, annotations, handler) {
-  return { schema, annotations, handler };
+function makeEntry(schema, annotations, handler, description) {
+  return { schema, annotations, handler, description };
 }
 var TOOL_REGISTRY = {
-  clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus),
-  clawops_doctor: makeEntry(clawops_doctorSchema, clawops_doctorAnnotations, handleDoctor),
-  clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail),
-  clawops_monitor: makeEntry(clawops_monitorSchema, clawops_monitorAnnotations, handleMonitor),
-  clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList),
-  clawops_config_get: makeEntry(clawops_config_getSchema, clawops_config_getAnnotations, handleConfigGet),
-  clawops_agents_list: makeEntry(clawops_agents_listSchema, clawops_agents_listAnnotations, handleAgentsList),
-  clawops_up: makeEntry(clawops_upSchema, clawops_upAnnotations, handleUp),
-  clawops_destroy: makeEntry(clawops_destroySchema, clawops_destroyAnnotations, handleDestroy),
-  clawops_apply: makeEntry(clawops_applySchema, clawops_applyAnnotations, handleApply),
-  clawops_plan: makeEntry(clawops_planSchema, clawops_planAnnotations, handlePlan),
-  clawops_harden: makeEntry(clawops_hardenSchema, clawops_hardenAnnotations, handleHarden),
-  clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet),
-  clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset),
-  clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate),
-  clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart),
-  clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp),
-  clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover),
-  clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus)
+  clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus, clawops_statusDescription),
+  clawops_doctor: makeEntry(clawops_doctorSchema, clawops_doctorAnnotations, handleDoctor, clawops_doctorDescription),
+  clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail, clawops_logs_tailDescription),
+  clawops_monitor: makeEntry(clawops_monitorSchema, clawops_monitorAnnotations, handleMonitor, clawops_monitorDescription),
+  clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList, clawops_stacks_listDescription),
+  clawops_config_get: makeEntry(clawops_config_getSchema, clawops_config_getAnnotations, handleConfigGet, clawops_config_getDescription),
+  clawops_agents_list: makeEntry(clawops_agents_listSchema, clawops_agents_listAnnotations, handleAgentsList, clawops_agents_listDescription),
+  clawops_up: makeEntry(clawops_upSchema, clawops_upAnnotations, handleUp, clawops_upDescription),
+  clawops_destroy: makeEntry(clawops_destroySchema, clawops_destroyAnnotations, handleDestroy, clawops_destroyDescription),
+  clawops_apply: makeEntry(clawops_applySchema, clawops_applyAnnotations, handleApply, clawops_applyDescription),
+  clawops_plan: makeEntry(clawops_planSchema, clawops_planAnnotations, handlePlan, clawops_planDescription),
+  clawops_harden: makeEntry(clawops_hardenSchema, clawops_hardenAnnotations, handleHarden, clawops_hardenDescription),
+  clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet, clawops_config_setDescription),
+  clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset, clawops_config_unsetDescription),
+  clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate, clawops_config_validateDescription),
+  clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart, clawops_gateway_restartDescription),
+  clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp, clawops_workflow_deploy_appDescription),
+  clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover, clawops_workflow_recoverDescription),
+  clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus, clawops_task_statusDescription)
 };
 var TOOL_NAMES = Object.keys(TOOL_REGISTRY);
 function resolveEnabledTools(opts) {
@@ -1380,13 +1407,16 @@ function registerTools(server, opts) {
   for (const toolName of enabled) {
     const entry = TOOL_REGISTRY[toolName];
     if (!entry) continue;
-    const { schema, annotations, handler } = entry;
+    const { schema, annotations, handler, description } = entry;
     const { title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint } = annotations;
     const audited = withAudit(toolName, (input) => handler(input, server));
     server.registerTool(
       toolName,
       {
         title,
+        // What a model reads when it picks a tool. Written per R3 to say when to use this one
+        // and when to reach for another; omitted here, every client saw a nameless capability.
+        description,
         inputSchema: schema,
         annotations: { title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint }
       },
@@ -1646,7 +1676,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-JWDMWPV3.js");
+  const { version } = await import("./package-JFVGCNKU.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);

package/dist/cli.js

@@ -392,7 +392,7 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const { generatePlan } = await import("./generate-YEM73KVB.js");
+    const { generatePlan } = await import("./generate-Q2BGVMH7.js");
     const { applyPlan } = await import("./apply-HJ5GAKHW.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
@@ -688,7 +688,7 @@ var plan_default = defineCommand5({
   },
   async run({ args }) {
     const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { generatePlan } = await import("./generate-YEM73KVB.js");
+    const { generatePlan } = await import("./generate-Q2BGVMH7.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
@@ -2375,7 +2375,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-ZJPXPRZT.js");
+    const { serveMcp } = await import("./server-B7I6HBQH.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -2456,8 +2456,8 @@ var wireCmd = defineCommand18({
     const { buildContext } = await import("./context-7VI3R6EK.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-TE2ZL6HD.js");
-    const { MCP_HTTP_PORT } = await import("./server-ZJPXPRZT.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-FQOMM7MK.js");
+    const { MCP_HTTP_PORT } = await import("./server-B7I6HBQH.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -3561,7 +3561,7 @@ async function maybeWireGatewayMcp(opts) {
   if (!wireGateway) return;
   const { connect } = await import("./ssh-VAI5DU5M.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-TE2ZL6HD.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-FQOMM7MK.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -4183,7 +4183,7 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.1.0" : "dev";
+var VERSION = true ? "2.1.2" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
   const os3 = `${process23.platform} ${process23.arch}`;
@@ -4463,8 +4463,14 @@ function handleError(err) {
   process25.exit(1);
 }
 
+// src/cli/default-command.ts
+function resolveArgv(argv2, stdinIsTty) {
+  if (argv2.length === 0 && !stdinIsTty) return ["mcp", "serve"];
+  return [...argv2];
+}
+
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.1.0" : "dev";
+var CLI_VERSION = true ? "2.1.2" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",
@@ -4507,8 +4513,14 @@ var main = defineCommand24({
     harden: harden_default
   }
 });
+var argv = resolveArgv(process.argv.slice(2), Boolean(process.stdin.isTTY));
+if (argv.length === 2 && argv[0] === "mcp" && process.argv.length === 2) {
+  process.stderr.write(
+    "[clawops] no command given and stdin is not a terminal, so starting `clawops mcp serve`. Pass `mcp serve` explicitly to make this deliberate, or run clawops from a terminal for help.\n"
+  );
+}
 try {
-  await runMain(main);
+  await runMain(main, { rawArgs: argv });
 } catch (err) {
   handleError(err);
 }

package/dist/{generate-YEM73KVB.js → generate-Q2BGVMH7.js}

@@ -5,7 +5,7 @@ import {
   isInstanceAlias,
   parseDiffForTest,
   planId
-} from "./chunk-A2DS5SB7.js";
+} from "./chunk-IQQTB7ER.js";
 import "./chunk-XFN3YDZE.js";
 import "./chunk-QDNFADJI.js";
 import "./chunk-JW5A7E3X.js";

package/dist/{mcp-wire-TE2ZL6HD.js → mcp-wire-FQOMM7MK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   MCP_HTTP_PORT
-} from "./chunk-AYUX4FOF.js";
+} from "./chunk-T5XCMYAV.js";
 import "./chunk-R3DTA35B.js";
 import "./chunk-BOPSG2LI.js";
 import "./chunk-6ZFIFDBJ.js";
@@ -9,7 +9,7 @@ import "./chunk-3QJBNAHW.js";
 import "./chunk-2I7KCMXZ.js";
 import "./chunk-3Z5TDXCJ.js";
 import "./chunk-AEEMRFZV.js";
-import "./chunk-A2DS5SB7.js";
+import "./chunk-IQQTB7ER.js";
 import "./chunk-XFN3YDZE.js";
 import "./chunk-2Z7J3ERQ.js";
 import "./chunk-E4NJSJ54.js";

package/dist/{package-JWDMWPV3.js → package-JFVGCNKU.js}

@@ -2,8 +2,8 @@
 
 // package.json
 var name = "@clawops/cli";
-var version = "2.1.0";
-var description = "Deploy and operate self-hosted OpenClaw across AWS, GCP, Azure and local VMs \u2014 a CLI and an MCP server in one.";
+var version = "2.1.2";
+var description = "Deploy self-hosted OpenClaw to AWS, GCP, Azure or a local VM \u2014 a CLI and an MCP server in one.";
 var keywords = [
   "openclaw",
   "mcp",

package/dist/{server-ZJPXPRZT.js → server-B7I6HBQH.js}

@@ -5,7 +5,7 @@ import {
   bearerFrom,
   isLoopbackBind,
   serveMcp
-} from "./chunk-AYUX4FOF.js";
+} from "./chunk-T5XCMYAV.js";
 import "./chunk-R3DTA35B.js";
 import "./chunk-BOPSG2LI.js";
 import "./chunk-6ZFIFDBJ.js";
@@ -13,7 +13,7 @@ import "./chunk-3QJBNAHW.js";
 import "./chunk-2I7KCMXZ.js";
 import "./chunk-3Z5TDXCJ.js";
 import "./chunk-AEEMRFZV.js";
-import "./chunk-A2DS5SB7.js";
+import "./chunk-IQQTB7ER.js";
 import "./chunk-XFN3YDZE.js";
 import "./chunk-2Z7J3ERQ.js";
 import "./chunk-E4NJSJ54.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@clawops/cli",
-  "version": "2.1.0",
-  "description": "Deploy and operate self-hosted OpenClaw across AWS, GCP, Azure and local VMs — a CLI and an MCP server in one.",
+  "version": "2.1.2",
+  "description": "Deploy self-hosted OpenClaw to AWS, GCP, Azure or a local VM — a CLI and an MCP server in one.",
   "keywords": [
     "openclaw",
     "mcp",