@clawops/cli 2.1.1 → 2.1.3

package/README.md

@@ -2,6 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
 [![npm downloads](https://img.shields.io/npm/dm/@clawops/cli)](https://www.npmjs.com/package/@clawops/cli)
+[![clawops MCP server – quality and maintenance score on Glama](https://glama.ai/mcp/servers/dfridkin/clawops/badges/score.svg)](https://glama.ai/mcp/servers/dfridkin/clawops)
 
 MCP-native infrastructure ops for OpenClaw, with read-only mode, destructive-action confirmation, and audit logs built in.
 
@@ -362,6 +363,7 @@ Do not bind to a non-loopback address without additional authentication controls
 | `clawops_config_validate` | cli | Validate the deployed config against the OpenClaw schema |
 | `clawops_gateway_restart` | cli | Restart the gateway (elicits confirmation) |
 | `clawops_harden` | cli | Apply hardening modules; join or leave a tailnet (elicits confirmation) |
+| `clawops_init` | cli | Register a stack and write `~/.clawops/config.json` (no cloud resources) |
 | `clawops_workflow_deploy_app` | workflow | End-to-end deploy: plan → confirm → apply → status |
 | `clawops_workflow_recover` | workflow | Diagnostic workflow for an unhealthy stack |
 | `clawops_task_status` | cli | Poll a long-running task |
@@ -542,7 +544,7 @@ pnpm dev doctor        # verify toolchain
 ```bash
 pnpm dev                   # run CLI from src/ via tsx
 pnpm build                 # tsup → dist/
-pnpm test                  # vitest (1855 tests, ~13s)
+pnpm test                  # vitest (1897 tests, ~13s)
 pnpm test:changed          # vitest --changed (fast edit loop)
 pnpm test:integration      # Docker-based SSH integration tests
 pnpm typecheck             # tsc --noEmit
@@ -603,6 +605,7 @@ Use `pnpm changeset` to record a release note before merging a `feat` or `fix`.
 ## What's new in 2.1
 
 Private networking, hardening on every cloud, and two fixes to commands that could not start.
+2.1.1 follows with the fixes below it.
 
 ### Reach a stack over your tailnet
 
@@ -645,6 +648,25 @@ Private networking, hardening on every cloud, and two fixes to commands that cou
 - The published package carries its license, keywords and issue tracker, so it is findable on npm
   and its listing is complete.
 
+### 2.1.1
+
+- **`clawops` started with no command and a pipe on stdin serves MCP** instead of printing help.
+  That is how every MCP client starts a server, and how directories that infer a run command
+  start one; several were getting the help text and reporting the server as broken. Typed at a
+  terminal, `clawops` still prints help, and so does `clawops | less`.
+- The MCP config example is `npx -y @clawops/cli mcp serve`, which runs as written. It used to
+  say `/path/to/clawops`, which nothing could run and no directory could copy.
+- The description is inside the MCP registry's 100-character limit. The one 2.1.0 shipped was
+  110, and the registry refused it with a 422 after npm had already published — so 2.1.0 reached
+  npm and not the registry.
+- `clawops harden` says a stack is not deployed, or that its state could not be read, instead of
+  passing along `code: -2` and a subprocess dump.
+- The MCP registry backfill registers the version that was released rather than the one the
+  release tooling is preparing, so an entry that falls behind can actually be repaired.
+- The Docker image builds. It had never been built, and did not: `npm pack --pack-destination`
+  does not create its destination. `pnpm verify:docker` builds it and speaks MCP to the running
+  container, both through its entrypoint and as a bare binary, in CI.
+
 ---
 
 ## What's new in 2.0.1

package/dist/{apply-HJ5GAKHW.js → apply-JARPVA5Y.js}

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-R3DTA35B.js";
+} from "./chunk-7T4CIT7C.js";
 import "./chunk-BOPSG2LI.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-2I7KCMXZ.js";
-import "./chunk-3Z5TDXCJ.js";
-import "./chunk-AEEMRFZV.js";
 import "./chunk-XFN3YDZE.js";
-import "./chunk-QDNFADJI.js";
+import "./chunk-55UMO37O.js";
+import "./chunk-AEEMRFZV.js";
+import "./chunk-AVERNLUY.js";
 import "./chunk-NUDIHZEH.js";
+import "./chunk-CHNSL3TC.js";
 import "./chunk-JW5A7E3X.js";
-import "./chunk-BELTQGHT.js";
+import "./chunk-VUFMZEIM.js";
 import "./chunk-GIEVAGEK.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-ELU3XQEA.js";
-import "./chunk-64PONSA5.js";
+import "./chunk-RDUKRIRC.js";
+import "./chunk-GFIR2IIJ.js";
 import "./chunk-KGXPLI7W.js";
-import "./chunk-VUFMZEIM.js";
 export {
   applyPlan
 };

package/dist/{automation-MKCJ46I6.js → automation-NBYQ6MFZ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-V25QRZRB.js";
 import {
   getConfigDir
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/pulumi/automation.ts

package/dist/{bootstrap-NN647RCY.js → bootstrap-3PBVY7MA.js}

@@ -14,8 +14,8 @@ import {
 import "./chunk-EI7CQQ7D.js";
 import {
   writeLocalState
-} from "./chunk-ELU3XQEA.js";
-import "./chunk-64PONSA5.js";
+} from "./chunk-RDUKRIRC.js";
+import "./chunk-GFIR2IIJ.js";
 import {
   ProviderError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-X56CQ6GB.js → chunk-4MHDW2NB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 
 // src/config/secrets.ts
 import { readFileSync, existsSync } from "fs";

package/dist/{chunk-3Z5TDXCJ.js → chunk-55UMO37O.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VOEJYRIK.js";
 import {
   getConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";

package/dist/chunk-755X5OGS.js

@@ -0,0 +1,213 @@
+#!/usr/bin/env node
+import {
+  getConfig,
+  getConfigDir,
+  setConfig
+} from "./chunk-GFIR2IIJ.js";
+
+// src/config/init.ts
+import { spawnSync } from "child_process";
+import { writeFileSync, mkdirSync, existsSync } from "fs";
+import path from "path";
+
+// src/providers/state-bucket.ts
+function deriveStateBucket(provider, scope) {
+  if (provider === "azure") {
+    return { ok: true, name: "clawops-state" };
+  }
+  if (!scope.account) {
+    return {
+      ok: false,
+      needs: provider === "aws" ? "an AWS account id \u2014 set AWS_PROFILE, or run `aws sso login --profile <name>`" : "a GCP project \u2014 run `gcloud config set project <id>`, or set GOOGLE_CLOUD_PROJECT"
+    };
+  }
+  if (provider === "gcp") return { ok: true, name: `clawops-state-${scope.account}` };
+  if (!scope.region) return { ok: false, needs: "a region" };
+  return { ok: true, name: `clawops-state-${scope.account}-${scope.region}` };
+}
+function stateUrlFor(provider, bucket) {
+  const verdict = validateStateBucket(provider, bucket);
+  if (verdict !== true) throw new Error(`Not a usable ${provider} state backend name: ${verdict}`);
+  const scheme = provider === "aws" ? "s3://" : provider === "gcp" ? "gs://" : "azblob://";
+  return provider === "azure" ? `${scheme}${bucket}` : `${scheme}${bucket}/clawops`;
+}
+var IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function validateStateBucket(provider, name) {
+  const n = name.trim();
+  if (n === "") return "Required";
+  if (n !== name) return "No leading or trailing spaces";
+  if (n.length < 3) return `Too short \u2014 ${labelFor(provider)} names are at least 3 characters`;
+  const dotted = provider === "gcp" && n.includes(".");
+  const max = dotted ? 222 : 63;
+  if (n.length > max) return `Too long \u2014 ${labelFor(provider)} names are at most ${max} characters`;
+  if (dotted && n.split(".").some((part) => part.length > 63)) {
+    return "Each dot-separated part of a Cloud Storage name is at most 63 characters";
+  }
+  if (n !== n.toLowerCase()) return "Lowercase only";
+  if (provider === "azure") {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(n)) {
+      return "Letters, digits and single hyphens only, starting and ending with a letter or digit";
+    }
+    return true;
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/.test(n)) {
+    return "Letters, digits, dots, hyphens and underscores only, starting and ending with a letter or digit";
+  }
+  if (n.includes("..")) return "No consecutive dots";
+  if (IPV4.test(n)) return "Cannot be formatted as an IP address";
+  if (provider === "aws") {
+    if (n.startsWith("xn--")) return 'Cannot start with "xn--"';
+    if (n.startsWith("sthree-")) return 'Cannot start with "sthree-"';
+    if (n.endsWith("-s3alias")) return 'Cannot end with "-s3alias"';
+    if (n.endsWith("--ol-s3")) return 'Cannot end with "--ol-s3"';
+    if (n.includes("_")) return "Underscores are not allowed in S3 bucket names";
+    return true;
+  }
+  if (n.startsWith("goog")) return 'Cannot start with "goog"';
+  if (n.includes("google")) return 'Cannot contain "google"';
+  return true;
+}
+function labelFor(provider) {
+  if (provider === "aws") return "S3 bucket";
+  if (provider === "gcp") return "Cloud Storage bucket";
+  return "blob container";
+}
+async function resolveScopeAccount(provider, signal) {
+  if (provider === "azure") return void 0;
+  try {
+    if (provider === "aws") {
+      const { callerAccount } = await import("./preflight-TFD4N5ZU.js");
+      return await callerAccount(signal);
+    }
+    const { resolveProjectId } = await import("./preflight-IE2YWBAC.js");
+    return resolveProjectId();
+  } catch {
+    return void 0;
+  }
+}
+
+// src/config/init.ts
+var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
+var PROVIDER_DEFAULTS = {
+  gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
+  aws: { region: "us-east-1", credEnv: "AWS_PROFILE", stateScheme: "s3://" },
+  azure: { region: "eastus", credEnv: "AZURE_CLIENT_ID", stateScheme: "azblob://" }
+};
+async function initStack(opts) {
+  const provider = opts.provider;
+  if (!SUPPORTED_PROVIDERS.includes(provider)) {
+    return {
+      ok: false,
+      reason: `Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`
+    };
+  }
+  const stackName = opts.stackName ?? "default";
+  const existing = getConfig();
+  if (existing?.stacks[stackName] && !opts.force) {
+    return {
+      ok: false,
+      reason: `Stack "${stackName}" already exists in ${path.join(getConfigDir(), "config.json")} (${existing.stacks[stackName].stateUrl}). Pass force to overwrite its settings, or use a different stack name to add another one.`
+    };
+  }
+  const configDir = getConfigDir();
+  mkdirSync(configDir, { recursive: true });
+  const keyPath = opts.keyPath ?? path.join(configDir, "id_ed25519");
+  const knownHostsPath = path.join(configDir, "known_hosts");
+  let keyGenerated = false;
+  if (!existsSync(keyPath)) {
+    if (opts.keyPath) return { ok: false, reason: `SSH key not found at ${keyPath}` };
+    const gen = spawnSync(
+      "ssh-keygen",
+      ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops", "-q"],
+      { stdio: ["ignore", "pipe", "pipe"] }
+    );
+    if (gen.error || gen.status !== 0) {
+      const reason = gen.error?.message ?? gen.stderr?.toString().trim() ?? `exit ${gen.status}`;
+      return {
+        ok: false,
+        reason: `Could not generate an SSH key: ${reason}
+Generate one yourself and point clawops at it:
+  ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops
+  clawops init --key-path ${keyPath}`
+      };
+    }
+    keyGenerated = true;
+  }
+  if (!existsSync(knownHostsPath)) writeFileSync(knownHostsPath, "", "utf-8");
+  if (provider === "local") {
+    if (!opts.host) return { ok: false, reason: "host is required for the local provider" };
+    const config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
+      provider,
+      stateUrl: "file://~/.clawops/state",
+      credentialsRef: { source: "file", envVars: [] },
+      localOpts: {
+        host: opts.host,
+        sshUser: opts.sshUser ?? "root",
+        sshPort: opts.sshPort ?? 22,
+        sshKeyPath: keyPath
+      }
+    });
+    setConfig(config);
+    return {
+      ok: true,
+      configPath: path.join(configDir, "config.json"),
+      stackName,
+      provider,
+      stateUrl: "file://~/.clawops/state",
+      keyPath,
+      keyGenerated
+    };
+  }
+  const defaults = PROVIDER_DEFAULTS[provider];
+  const region = opts.region ?? defaults.region;
+  let stateUrl;
+  if (opts.stateUrl) {
+    stateUrl = opts.stateUrl;
+  } else {
+    const account = await resolveScopeAccount(provider);
+    const derived = deriveStateBucket(provider, { account, region });
+    if (!derived.ok) {
+      return {
+        ok: false,
+        reason: `Could not name a state backend for ${provider}: clawops needs ${derived.needs}. Authenticate first, or name the backend yourself, e.g. ${defaults.stateScheme}your-bucket/clawops`
+      };
+    }
+    stateUrl = stateUrlFor(provider, derived.name);
+  }
+  setConfig(
+    merge(existing, stackName, provider, keyPath, knownHostsPath, {
+      provider,
+      stateUrl,
+      region,
+      credentialsRef: { source: "env", envVars: [defaults.credEnv] }
+    })
+  );
+  return {
+    ok: true,
+    configPath: path.join(configDir, "config.json"),
+    stackName,
+    provider,
+    stateUrl,
+    region,
+    keyPath,
+    keyGenerated
+  };
+}
+function merge(existing, stackName, provider, keyPath, knownHostsPath, stack) {
+  return {
+    ...existing ?? {},
+    version: 1,
+    defaults: { stack: stackName, provider },
+    stacks: { ...existing?.stacks ?? {}, [stackName]: stack },
+    ssh: { keyPath, knownHostsPath }
+  };
+}
+
+export {
+  deriveStateBucket,
+  validateStateBucket,
+  resolveScopeAccount,
+  SUPPORTED_PROVIDERS,
+  PROVIDER_DEFAULTS,
+  initStack
+};

package/dist/{chunk-R3DTA35B.js → chunk-7T4CIT7C.js}

@@ -11,22 +11,22 @@ import {
   readRemoteConfig,
   restartGateway
 } from "./chunk-2I7KCMXZ.js";
-import {
-  writeStackConfig
-} from "./chunk-3Z5TDXCJ.js";
 import {
   validatePlan
 } from "./chunk-XFN3YDZE.js";
+import {
+  writeStackConfig
+} from "./chunk-55UMO37O.js";
 import {
   buildContext
-} from "./chunk-QDNFADJI.js";
+} from "./chunk-AVERNLUY.js";
 import {
   GATEWAY_PORT
 } from "./chunk-VOEJYRIK.js";
 import {
   getConfig,
   setConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -54,7 +54,7 @@ ${validation.errors.join("\n")}`
   });
   const stack = await ctx.getStack();
   const { guardPrivateOnlyApply } = await import("./private-only-DIA26I2E.js");
-  const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+  const { probeSsh } = await import("./tailscale-cutover-EKAQSDXP.js");
   await guardPrivateOnlyApply(plan, ctx, opts?.probeTailnet ?? ((conn2) => probeSsh(conn2, opts?.signal)));
   await writeStackConfig(stack, plan);
   if (plan.metadata.stackVersion !== void 0) {

package/dist/{chunk-QDNFADJI.js → chunk-AVERNLUY.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
+import {
+  getProvider
+} from "./chunk-VUFMZEIM.js";
 import {
   readLocalState
-} from "./chunk-ELU3XQEA.js";
+} from "./chunk-RDUKRIRC.js";
 import {
   getConfigDir,
   requireConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
-import {
-  getProvider
-} from "./chunk-VUFMZEIM.js";
 
 // src/cli/context.ts
 function buildContext(args) {
@@ -41,7 +41,7 @@ function buildContext(args) {
           `Stack "${stackName}" not found in config. Run \`clawops init\` or use \`--stack\` to specify a different stack.`
         );
       }
-      const { getOrCreateStack } = await import("./automation-MKCJ46I6.js");
+      const { getOrCreateStack } = await import("./automation-NBYQ6MFZ.js");
       stackCache = await getOrCreateStack({
         stack: stackName,
         stateUrl: stackConfig.stateUrl,

package/dist/{chunk-GFUK6KDR.js → chunk-CPCO6UJK.js}

@@ -146,8 +146,8 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext } = await import("./context-7VI3R6EK.js");
-  const { getConfig } = await import("./store-OVB3DAJR.js");
+  const { buildContext } = await import("./context-WOKSKAIA.js");
+  const { getConfig } = await import("./store-YOLQYXMB.js");
   const config = getConfig();
   if (!config) return [];
   return Promise.all(
@@ -215,7 +215,7 @@ function renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete) {
   return lines.join("\n");
 }
 async function deleteFromRegistry(name) {
-  const { requireConfig, setConfig } = await import("./store-OVB3DAJR.js");
+  const { requireConfig, setConfig } = await import("./store-YOLQYXMB.js");
   const config = requireConfig();
   const newStacks = { ...config.stacks };
   delete newStacks[name];
@@ -373,7 +373,7 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
@@ -508,7 +508,7 @@ import { accessSync, mkdirSync, readFileSync, constants } from "fs";
 import ssh2 from "ssh2";
 import path from "path";
 async function runDiagnostics(opts = {}, deps = {}) {
-  const { getConfig, getConfigDir } = await import("./store-OVB3DAJR.js");
+  const { getConfig, getConfigDir } = await import("./store-YOLQYXMB.js");
   const config = getConfig();
   const sections = [];
   sections.push({ title: "Runtime", checks: await runtimeChecks(getConfigDir()) });
@@ -808,8 +808,8 @@ async function deployedVersionCheck(image, deployedVersion) {
 }
 async function hardeningChecks(conn, stack, signal) {
   try {
-    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-3KKCR7BL.js");
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-RUOUA5BV.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const provider = buildContext({ stack }).adapter.name;
     const modules = resolveModules(MODULE_CATALOG, void 0, provider);
     const checks = [];
@@ -831,8 +831,8 @@ async function hardeningChecks(conn, stack, signal) {
   }
 }
 async function defaultOpenSession(stack, signal) {
-  const { getConfig } = await import("./store-OVB3DAJR.js");
-  const { buildContext } = await import("./context-7VI3R6EK.js");
+  const { getConfig } = await import("./store-YOLQYXMB.js");
+  const { buildContext } = await import("./context-WOKSKAIA.js");
   const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
   const { acquireSession } = await import("./pool-PIIKJ4L2.js");
   const config = getConfig();

package/dist/{chunk-64PONSA5.js → chunk-GFIR2IIJ.js}

@@ -76,7 +76,9 @@ function getConfig() {
 function requireConfig() {
   const cfg = getConfig();
   if (!cfg) {
-    throw new UsageError("No config found. Run `clawops init` first.");
+    throw new UsageError(
+      `No clawops config at ${getConfigPath()}. Create one with \`clawops init\` in a terminal, or by calling the clawops_init tool. Either way it registers a stack \u2014 a provider and a state backend \u2014 and generates an SSH key; nothing is provisioned and nothing is charged.`
+    );
   }
   return cfg;
 }

package/dist/{chunk-YEBFVLOE.js → chunk-PTCVFLZ3.js}

@@ -5,10 +5,10 @@ import {
 import {
   buildContext,
   loadAdapterModule
-} from "./chunk-QDNFADJI.js";
+} from "./chunk-AVERNLUY.js";
 import {
   getConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   StateError,
   UsageError
@@ -71,7 +71,7 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-SAUDFQLG.js");
+  const { version } = await import("./package-MF5LPITL.js");
   const config = getConfig();
   const instanceType = await resolveInstanceType(intent);
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
@@ -123,7 +123,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     );
   }
   try {
-    const { writeStackConfig } = await import("./stack-config-LUTS2XAD.js");
+    const { writeStackConfig } = await import("./stack-config-ICQ5YHUL.js");
     await writeStackConfig(stack, plan);
     const outputLines = [];
     const preview = await stack.preview({

package/dist/{chunk-ELU3XQEA.js → chunk-RDUKRIRC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 
 // src/providers/local/state.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";