@clawops/cli 2.1.1 → 2.1.3

package/dist/{chunk-OFTAXLOY.js → chunk-TYHTISI5.js}

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-R3DTA35B.js";
+} from "./chunk-7T4CIT7C.js";
+import {
+  generatePlan
+} from "./chunk-PTCVFLZ3.js";
 import {
   extractBaseOutputs
 } from "./chunk-3QJBNAHW.js";
@@ -10,24 +13,21 @@ import {
   readRemoteConfig,
   restartGateway
 } from "./chunk-2I7KCMXZ.js";
-import {
-  generatePlan
-} from "./chunk-YEBFVLOE.js";
 import {
   validatePlan
 } from "./chunk-XFN3YDZE.js";
+import {
+  buildContext
+} from "./chunk-AVERNLUY.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-2Z7J3ERQ.js";
-import {
-  buildContext
-} from "./chunk-QDNFADJI.js";
 import {
   formatUptime,
   gatherSnapshot,
   runDiagnostics
-} from "./chunk-GFUK6KDR.js";
+} from "./chunk-CPCO6UJK.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
@@ -48,7 +48,7 @@ import {
 import {
   getConfig,
   getConfigDir
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   StateError,
   UsageError
@@ -141,8 +141,9 @@ function withAudit(toolName, handler) {
 // src/mcp/tools/_generated.ts
 import { z } from "zod";
 var clawops_statusSchema = z.object({
-  stackName: z.string().optional()
+  stackName: z.string().optional().describe("Stack name. Defaults to active stack from config.")
 });
+var clawops_statusDescription = "Get what is deployed for a clawops-managed stack: public IP, gateway URL,\nSSH user, or that nothing is deployed yet. Reads stack outputs; does not\ncontact the host.\n\nUse when: the user asks what exists for a stack, or where to reach it.\n\nDo NOT use when: the user asks whether the gateway is actually WORKING \u2014\nthat needs the host, so use clawops_doctor. Also not for live logs (use\nclawops_logs_tail) or config values (use clawops_config_get).";
 var clawops_statusAnnotations = {
   title: "Get Stack Status",
   readOnlyHint: true,
@@ -152,9 +153,10 @@ var clawops_statusAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_doctorSchema = z.object({
-  stackName: z.string().optional(),
-  failuresOnly: z.boolean().optional().default(false)
+  stackName: z.string().optional().describe("Stack to include remote checks for. Without it, only the local machine is\nchecked \u2014 no SSH connection is made.\n"),
+  failuresOnly: z.boolean().optional().default(false).describe("Return only failing and warning checks. Passing checks are counted, not listed.")
 });
+var clawops_doctorDescription = "Run clawops's diagnostics and return the report: Node and Pulumi runtime, config,\nSSH key and known_hosts, cloud credentials per configured provider, and the\nsupported OpenClaw range. With stackName, also contacts the host for container\nstate, the deployed OpenClaw version, a real gateway health probe, whether the\nport is published to the internet, disk usage on the state directory, log\nrotation, and hardening drift.\n\nUse when: something is not working and you do not yet know what; before any\ndeploy, upgrade or migration; or to find out which OpenClaw version a gateway is\nactually running.\n\nDo NOT use when: you already know the problem and want to fix it. This tool only\nreports \u2014 it changes nothing, and never runs `openclaw doctor --fix`. No tool\nrepairs a gateway: `clawops gateway update` is CLI-only, so tell the user to run\nit themselves, after `clawops backup create`.\n\nEvery check carries a status: fail (something is wrong that clawops can name),\nwarn (worth knowing, not broken), info (did not apply). `ok` is false only when\nsomething failed \u2014 a fresh machine with no stacks is full of warnings and healthy.";
 var clawops_doctorAnnotations = {
   title: "Run Diagnostics",
   readOnlyHint: true,
@@ -164,10 +166,11 @@ var clawops_doctorAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_logs_tailSchema = z.object({
-  stackName: z.string().optional(),
-  tailLines: z.number().int().optional().default(100),
-  sinceMin: z.number().int().optional()
+  stackName: z.string().optional().describe("Which stack's gateway to read. Omitted = the default stack in ~/.clawops/config.json"),
+  tailLines: z.number().int().optional().default(100).describe("How many of the most recent lines to return. Keep it small; output is trimmed to 8KB regardless"),
+  sinceMin: z.number().int().optional().describe("Lines since N minutes ago")
 });
+var clawops_logs_tailDescription = "Tail recent gateway logs from a clawops-managed instance.\n\nUse when: the user wants to investigate recent activity or errors, or\nasks \"what's been happening\" on the gateway.\n\nDo NOT use when: the user wants real-time streaming logs (those are not\nwell-suited to tool calls; suggest the user run `clawops logs -f` directly\nin their terminal). Do NOT use for instance-level system logs: no tool runs\narbitrary remote commands, so tell the user to run `clawops ssh --command\n'journalctl ...'` themselves.";
 var clawops_logs_tailAnnotations = {
   title: "Tail Gateway Logs",
   readOnlyHint: true,
@@ -177,9 +180,10 @@ var clawops_logs_tailAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_monitorSchema = z.object({
-  stackName: z.string().optional(),
-  tailLines: z.number().int().optional().default(5)
+  stackName: z.string().optional().describe("Stack name. Defaults to active stack."),
+  tailLines: z.number().int().optional().default(5).describe("Log lines to include in snapshot.")
 });
+var clawops_monitorDescription = "Take a live snapshot of a running clawops stack: gateway health, container\nstatus, resource usage (CPU, memory, disk), and recent log lines.\n\nUse when: the user wants to know if the gateway is running, how much\nmemory or CPU it is using, what recent log activity looks like, or\nwants a quick health overview richer than clawops_status.\n\nDo NOT use when: the user wants real-time streaming logs (use\nclawops_logs_tail or suggest `clawops logs -f`). Do NOT use for\nconfiguration queries (use clawops_config_get).";
 var clawops_monitorAnnotations = {
   title: "Monitor Stack Health",
   readOnlyHint: true,
@@ -189,6 +193,7 @@ var clawops_monitorAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_stacks_listSchema = z.object({});
+var clawops_stacks_listDescription = 'List all clawops-managed stacks across all configured providers.\n\nUse when: the user wants an overview of their deployments, asks "what\nstacks do I have", or wants to compare stacks before an operation.\n\nDo NOT use when: the user named a specific stack \u2014 use clawops_status\ndirectly with that name.';
 var clawops_stacks_listAnnotations = {
   title: "List Stacks",
   readOnlyHint: true,
@@ -198,9 +203,10 @@ var clawops_stacks_listAnnotations = {
   toolsets: ["admin", "read"]
 };
 var clawops_config_getSchema = z.object({
-  stackName: z.string().optional(),
-  key: z.string().optional()
+  stackName: z.string().optional().describe("Which stack's gateway config to read. Omitted = the default stack in ~/.clawops/config.json"),
+  key: z.string().optional().describe("Dot-path config key, e.g., gateway.auth.mode. Omit to dump the full config.")
 });
+var clawops_config_getDescription = "Read a configuration value from the remote OpenClaw gateway.\n\nUse when: the user wants to inspect current OpenClaw config (e.g., which\nmodel provider is active, which channels are enabled).\n\nDo NOT use when: the user wants to change the config \u2014 use\nclawops_config_set instead.";
 var clawops_config_getAnnotations = {
   title: "Get OpenClaw Config Value",
   readOnlyHint: true,
@@ -210,8 +216,9 @@ var clawops_config_getAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_agents_listSchema = z.object({
-  stackName: z.string().optional()
+  stackName: z.string().optional().describe("Which stack's agents to list. Omitted = the default stack in ~/.clawops/config.json")
 });
+var clawops_agents_listDescription = "List agents currently registered on the remote OpenClaw gateway.\n\nUse when: the user wants to see which agents are running, debug agent\nrouting, or count active workspaces.\n\nDo NOT use when: the user wants one agent's logs \u2014 no tool exposes those; tell\nthe user to run `clawops agents logs <name>`.";
 var clawops_agents_listAnnotations = {
   title: "List OpenClaw Agents",
   readOnlyHint: true,
@@ -221,16 +228,17 @@ var clawops_agents_listAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_upSchema = z.object({
-  stackName: z.string().optional(),
-  provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
-  region: z.string().optional(),
-  instanceType: z.string().optional().default("small"),
-  sshCidr: z.string().optional(),
-  gatewayCidr: z.string().optional(),
-  publishGateway: z.enum(["loopback", "all"]).optional(),
-  openclawVersion: z.string().optional(),
-  dryRun: z.boolean().optional().default(false)
+  stackName: z.string().optional().describe("Name for the stack to provision, and the name every later command refers to it by. Omitted = the default stack in ~/.clawops/config.json"),
+  provider: z.enum(["aws", "gcp", "azure", "local"]).optional().describe("Defaults to provider configured for this stack"),
+  region: z.string().optional().describe("Cloud region to deploy into, in the provider's own spelling (us-east-1, us-central1, eastus). Omitted = the region recorded for the stack"),
+  instanceType: z.string().optional().default("small").describe("A clawops size (micro|small|medium|large|gpu) or a provider-native machine type.\nNot an enum: Azure offers SKU families per subscription, and an account offered\nnone of the five sizes clawops names would otherwise have no way to deploy.\n"),
+  sshCidr: z.string().optional().describe("CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for the caller's own\naddress. Omitted means none, and nothing will be able to connect \u2014 including\nevery clawops day-two command.\n"),
+  gatewayCidr: z.string().optional().describe("CIDR(s) allowed to reach the gateway port. Requires publishGateway=all."),
+  publishGateway: z.enum(["loopback", "all"]).optional().describe("Which interface the gateway binds. 'all' serves plaintext HTTP."),
+  openclawVersion: z.string().optional().describe("semver or 'stable'/'dev'"),
+  dryRun: z.boolean().optional().default(false).describe("Show what would be created and change nothing. Use this first when the user has not yet approved a spend")
 });
+var clawops_upDescription = 'Provision and deploy a clawops stack. Idempotent \u2014 re-running with no spec\nchange produces no diff. Long-running (median 3min, p99 8min) so emits\nprogress notifications per R12.\n\nUse when: the user explicitly asks to deploy, provision, create, or "spin\nup" a stack. Always after the user has reviewed a plan\n(clawops_plan first when in doubt).\n\nDo NOT use when: the user has not yet generated a plan and is in\nexploratory/discovery mode \u2014 use clawops_plan first. Do NOT use for an\nexisting stack you only need to update; refresh first.';
 var clawops_upAnnotations = {
   title: "Provision and Deploy Stack",
   readOnlyHint: false,
@@ -240,9 +248,10 @@ var clawops_upAnnotations = {
   toolsets: ["cli"]
 };
 var clawops_destroySchema = z.object({
-  stackName: z.string(),
-  yes: z.boolean().optional().default(false)
+  stackName: z.string().describe("The stack to destroy. Required, and worth repeating back to the user before calling: this deletes every resource it provisioned"),
+  yes: z.boolean().optional().default(false).describe("Skip elicitation; CI/scripted use only")
 });
+var clawops_destroyDescription = "Destroy a clawops stack. Removes ALL provisioned resources. Triggers\nelicitation confirmation showing the resource diff before execution\n(R19). Cannot be undone.\n\nUse when: the user explicitly asks to destroy, tear down, delete, or\nremove a stack. Always confirm the stack name.\n\nDo NOT use when: the user wants to stop the gateway temporarily \u2014 that is not\na destroy, and no tool stops a gateway; clawops_gateway_restart is the only\ngateway tool. Do NOT use when in doubt about which stack; list first with\nclawops_stacks_list.";
 var clawops_destroyAnnotations = {
   title: "Destroy Stack (DESTRUCTIVE)",
   readOnlyHint: false,
@@ -252,9 +261,10 @@ var clawops_destroyAnnotations = {
   toolsets: ["cli"]
 };
 var clawops_applySchema = z.object({
-  planPath: z.string(),
-  yes: z.boolean().optional().default(false)
+  planPath: z.string().describe("Absolute path to plan JSON (R7)"),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation and apply immediately. Only when the user has already approved this specific plan")
 });
+var clawops_applyDescription = "Apply a previously-generated Maker plan (deploy-plan.schema.json).\nDeterministic \u2014 the plan describes exactly what will be created.\n\nUse when: the user has a plan file path and wants to apply it. This is\nthe agent-friendly path for any deploy/destroy operation.\n\nDo NOT use when: there's no plan file \u2014 generate one first with\nclawops_plan.";
 var clawops_applyAnnotations = {
   title: "Apply Maker Plan",
   readOnlyHint: false,
@@ -264,17 +274,18 @@ var clawops_applyAnnotations = {
   toolsets: ["cli"]
 };
 var clawops_planSchema = z.object({
-  stackName: z.string().optional(),
-  provider: z.enum(["aws", "gcp", "azure", "local"]).optional(),
-  region: z.string().optional(),
-  instanceType: z.string().optional(),
-  openclawVersion: z.string().optional(),
-  sshCidr: z.string().optional(),
-  gatewayCidr: z.string().optional(),
-  publishGateway: z.enum(["loopback", "all"]).optional(),
-  privateOnly: z.boolean().optional(),
-  outPath: z.string().optional()
+  stackName: z.string().optional().describe("Which stack the plan is for. Omitted = the default stack in ~/.clawops/config.json"),
+  provider: z.enum(["aws", "gcp", "azure", "local"]).optional().describe("Cloud to plan against. Omitted = the provider recorded for the stack. 'local' has no plan/apply path and is refused"),
+  region: z.string().optional().describe("Cloud region, in the provider's own spelling (us-east-1, us-central1, eastus). Omitted = the region recorded for the stack"),
+  instanceType: z.string().optional().describe("A clawops alias (micro|small|medium|large|gpu) or a machine type the cloud names itself, e.g. t3.small"),
+  openclawVersion: z.string().optional().describe("semver, or 'stable'/'dev'"),
+  sshCidr: z.string().optional().describe("CIDR(s) allowed to reach SSH, comma-separated, or 'auto' for this machine. Omitted = none, and nothing will be able to connect"),
+  gatewayCidr: z.string().optional().describe("CIDR(s) allowed to reach the gateway port, or 'auto'. Requires publishGateway=all"),
+  publishGateway: z.enum(["loopback", "all"]).optional().describe("Which interface the gateway binds. loopback (default) keeps it off the network"),
+  privateOnly: z.boolean().optional().describe("Close public SSH and gateway access; reach the stack over its tailnet. Requires a verified tailnet address (clawops_harden with tailscale), and refuses unless that address answers SSH now"),
+  outPath: z.string().optional().describe("Absolute path to write plan; if omitted, plan returned inline")
 });
+var clawops_planDescription = "Generate a Maker deploy plan (does NOT apply). Plan is JSON conforming to\ndeploy-plan.schema.json \u2014 review before applying.\n\nUse when: the user wants to see what would be created before committing,\nor you (the agent) need a reviewable artifact for the user to approve.\n\nDo NOT use when: the user has explicitly asked to deploy and you already\nhave their approval \u2014 go directly to clawops_up.";
 var clawops_planAnnotations = {
   title: "Generate Deploy Plan",
   readOnlyHint: true,
@@ -284,11 +295,12 @@ var clawops_planAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_config_setSchema = z.object({
-  stackName: z.string().optional(),
-  key: z.string(),
-  value: z.string(),
-  restart: z.boolean().optional().default(false)
+  stackName: z.string().optional().describe("Which stack's gateway config to write. Omitted = the default stack in ~/.clawops/config.json"),
+  key: z.string().describe("Dotted path into the gateway config, e.g. models.provider or channels.slack.enabled"),
+  value: z.string().describe("Stringified; JSON for complex values"),
+  restart: z.boolean().optional().default(false).describe("Restart the gateway so the change takes effect. Without it the value is written and the running gateway keeps the old one")
 });
+var clawops_config_setDescription = "Set a configuration value on the remote OpenClaw gateway. Optionally\nrestarts the gateway after.\n\nUse when: the user wants to change OpenClaw configuration (model\nprovider, channel auth, gateway port).\n\nDo NOT use when: the user is reading config \u2014 use clawops_config_get.\nDo NOT bulk-edit; one key at a time so changes are auditable (R21).";
 var clawops_config_setAnnotations = {
   title: "Set OpenClaw Config Value",
   readOnlyHint: false,
@@ -298,10 +310,11 @@ var clawops_config_setAnnotations = {
   toolsets: ["cli"]
 };
 var clawops_config_unsetSchema = z.object({
-  stackName: z.string().optional(),
-  key: z.string(),
-  restart: z.boolean().optional().default(false)
+  stackName: z.string().optional().describe("Which stack's gateway config to write. Omitted = the default stack in ~/.clawops/config.json"),
+  key: z.string().describe("Dot-path config key to remove"),
+  restart: z.boolean().optional().default(false).describe("Restart the gateway so the removal takes effect. Without it the key is removed and the running gateway keeps the old value")
 });
+var clawops_config_unsetDescription = "Remove a configuration key from the remote OpenClaw gateway config, reverting\nit to the OpenClaw default.\n\nUse when: the user wants to delete a config key entirely (e.g., remove a\nchannel, clear an override).\n\nDo NOT use when: the user wants to set the key to a new value \u2014 use\nclawops_config_set instead.";
 var clawops_config_unsetAnnotations = {
   title: "Unset OpenClaw Config Key",
   readOnlyHint: false,
@@ -311,8 +324,9 @@ var clawops_config_unsetAnnotations = {
   toolsets: ["cli"]
 };
 var clawops_config_validateSchema = z.object({
-  stackName: z.string().optional()
+  stackName: z.string().optional().describe("Which stack's deployed config to validate. Omitted = the default stack in ~/.clawops/config.json")
 });
+var clawops_config_validateDescription = "Validate the remote OpenClaw gateway config against the known schema. Checks\nfor structural errors (wrong types, unknown top-level keys) that would cause\nOpenClaw to fail on startup.\n\nUse when: the user wants to verify config before restarting the gateway, or\nafter editing openclaw.json manually.\n\nDo NOT use when: the user wants to change config \u2014 use clawops_config_set.";
 var clawops_config_validateAnnotations = {
   title: "Validate OpenClaw Config",
   readOnlyHint: true,
@@ -322,8 +336,9 @@ var clawops_config_validateAnnotations = {
   toolsets: ["cli", "read"]
 };
 var clawops_gateway_restartSchema = z.object({
-  stackName: z.string().optional()
+  stackName: z.string().optional().describe("Which stack's gateway to restart. Omitted = the default stack in ~/.clawops/config.json")
 });
+var clawops_gateway_restartDescription = "Restart the OpenClaw gateway daemon on the remote instance.\n\nUse when: a gateway-wide config change requires reload, or the gateway is\nreported as unresponsive.\n\nNote: OpenClaw 2.0 removed per-agent restart; `gateway restart` is the only\nrestart it offers, and it affects every agent on the host. Brief downtime (~10s).";
 var clawops_gateway_restartAnnotations = {
   title: "Restart Gateway Daemon",
   readOnlyHint: false,
@@ -332,14 +347,34 @@ var clawops_gateway_restartAnnotations = {
   openWorldHint: true,
   toolsets: ["cli"]
 };
+var clawops_initSchema = z.object({
+  provider: z.enum(["aws", "gcp", "azure", "local"]).describe("Which cloud this stack deploys to, or 'local' for a machine you already have"),
+  stackName: z.string().optional().describe('Name for the stack, used by every later call. Omitted = "default"'),
+  stateUrl: z.string().optional().describe("Where Pulumi state lives, e.g. s3://bucket/clawops, gs://bucket/clawops, azblob://container. Omitted = clawops names one from the cloud account it can see, which needs credentials"),
+  region: z.string().optional().describe("Cloud region in the provider's own spelling. Omitted = us-east-1 (aws), us-central1 (gcp), eastus (azure)"),
+  host: z.string().optional().describe("[local only] Hostname or IP of the machine to manage. Required when provider is local"),
+  sshUser: z.string().optional().describe("[local only] SSH login user. Omitted = root"),
+  sshPort: z.number().int().optional().describe("[local only] SSH port. Omitted = 22"),
+  force: z.boolean().optional().describe("Overwrite a stack that already exists. Refused without it, because replacing a state backend orphans the state it points at")
+});
+var clawops_initDescription = "Register a stack and write ~/.clawops/config.json: the provider, the state backend, the\nregion, and an SSH key pair generated if one is not already there. Nothing is provisioned\nand nothing is charged; this only creates local configuration.\n\nUse when: any other clawops tool reports that there is no config, or the user wants to add\na second stack alongside the ones they have. This is the first call on a machine that has\nnever run clawops \u2014 a fresh container, a new laptop, a sandbox.\n\nAdding a stack is additive and safe: existing stacks are kept. Overwriting one needs\nforce: true, because changing a state backend orphans the Pulumi state it points at \u2014 the\ninfrastructure stays up and clawops can no longer see or destroy it.\n\nFor aws, gcp and azure, stateUrl can be omitted and clawops names a bucket from the\naccount it can see; that needs cloud credentials in the environment, so in a sandbox pass\nstateUrl explicitly. The local provider needs host instead, and no cloud account at all.\n\nDo NOT use when: the user wants to deploy \u2014 that is clawops_up, after this. Credentials\nare never passed here: clawops reads them from the environment (R6).";
+var clawops_initAnnotations = {
+  title: "Initialise clawops Config",
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: false,
+  toolsets: ["cli"]
+};
 var clawops_hardenSchema = z.object({
-  stackName: z.string().optional(),
-  options: z.string().optional(),
-  dryRun: z.boolean().optional().default(false),
-  tailscale: z.boolean().optional().default(false),
-  tailscaleRevert: z.boolean().optional().default(false),
-  yes: z.boolean().optional().default(false)
+  stackName: z.string().optional().describe("Which stack to harden. Omitted = the default stack in ~/.clawops/config.json"),
+  options: z.string().optional().describe("Comma-separated module IDs; default is every defaultOn module for the provider"),
+  dryRun: z.boolean().optional().default(false).describe("Report the current state, change nothing"),
+  tailscale: z.boolean().optional().default(false).describe("Join the tailnet, verify this machine reaches the host there, then use that address"),
+  tailscaleRevert: z.boolean().optional().default(false).describe("Leave the tailnet and go back to the public address"),
+  yes: z.boolean().optional().default(false).describe("Skip elicitation; CI/scripted use only")
 });
+var clawops_hardenDescription = "Apply security hardening to a deployed stack: SSH, UFW, fail2ban,\nunattended-upgrades, the Docker socket, and per-cloud checks. Optionally join\nthe stack to a Tailscale network and reach it there instead of over the public\ninternet.\n\nUse when: the user asks to harden, secure, or lock down a stack; asks what the\nhardening report says (with dryRun: true, which changes nothing); or asks to put\na stack on their tailnet.\n\ntailscale: true installs Tailscale, joins the tailnet as clawops-<stack>, and\nthen moves clawops onto that address \u2014 but only after opening an SSH session to\nit, against host keys pinned over the connection already trusted. If that fails,\nnothing is recorded and the public address stays in use. The auth key comes from\n`clawops secret set TAILSCALE_AUTH_KEY` and is never passed through this tool\n(R6).\n\ntailscaleRevert: true takes the host back off the tailnet, over its public\naddress. On a private-only stack it refuses and names the plan/apply commands\nthat reopen SSH first \u2014 relay them rather than trying to work around it.\n\nTo close the public ports afterwards, plan with privateOnly: true and apply that\nplan; this tool does not change firewall rules.\n\nDo NOT use when: the user wants to know whether a stack is healthy \u2014 that is\nclawops_doctor. Do NOT pass tailscale and tailscaleRevert together.";
 var clawops_hardenAnnotations = {
   title: "Harden Stack",
   readOnlyHint: false,
@@ -349,11 +384,12 @@ var clawops_hardenAnnotations = {
   toolsets: ["cli"]
 };
 var clawops_workflow_deploy_appSchema = z.object({
-  provider: z.enum(["aws", "gcp", "azure", "local"]),
-  region: z.string().optional(),
-  stackName: z.string().optional().default("default"),
-  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional().default("small")
+  provider: z.enum(["aws", "gcp", "azure", "local"]).describe("Cloud to deploy to. Omitted = the default provider in ~/.clawops/config.json"),
+  region: z.string().optional().describe("Cloud region, in the provider's own spelling (us-east-1, us-central1, eastus). Omitted = the provider's default"),
+  stackName: z.string().optional().default("default").describe("Name for the new stack. Omitted = the default stack name in ~/.clawops/config.json"),
+  instanceType: z.enum(["micro", "small", "medium", "large", "gpu"]).optional().default("small").describe("Machine size: a clawops alias (micro|small|medium|large|gpu) or a type the cloud names itself, e.g. t3.small")
 });
+var clawops_workflow_deploy_appDescription = 'Single-tool workflow that takes a user from "I want to deploy OpenClaw\nto <provider>" to a verified, healthy gateway. Internally: plan \u2192 user\nconfirms (elicitation) \u2192 up \u2192 wait for healthy \u2192 return URL.\n\nUse when: the user expresses end-to-end deployment intent ("deploy to\nAWS", "spin up an OpenClaw on GCP for me").\n\nDo NOT use when: the user is mid-deployment and only needs one step\n(e.g., they already have a plan; use clawops_apply). Do NOT use for\ndestroying or updating \u2014 separate workflows.';
 var clawops_workflow_deploy_appAnnotations = {
   title: "Deploy OpenClaw (End-to-End Workflow)",
   readOnlyHint: false,
@@ -363,8 +399,17 @@ var clawops_workflow_deploy_appAnnotations = {
   toolsets: ["workflow"]
 };
 var clawops_workflow_recoverSchema = z.object({
-  stackName: z.string().optional()
+  stackName: z.string().optional().describe("Which stack to diagnose. Omitted = the default stack in ~/.clawops/config.json")
 });
+var clawops_workflow_recoverDescription = `Diagnostic workflow for an unhealthy stack. Internally: status check \u2192
+gateway logs \u2192 agent logs \u2192 systemd service status \u2192 produces a structured
+diagnostic report with suggested remediation.
+
+Use when: the user reports any "not working" symptom and you don't know
+where to start. Best entry point for troubleshooting.
+
+Do NOT use when: the user has already identified the problem and asks for
+a specific fix.`;
 var clawops_workflow_recoverAnnotations = {
   title: "Recover/Diagnose Stack",
   readOnlyHint: true,
@@ -374,8 +419,9 @@ var clawops_workflow_recoverAnnotations = {
   toolsets: ["workflow", "read"]
 };
 var clawops_task_statusSchema = z.object({
-  taskId: z.string()
+  taskId: z.string().describe("The taskId returned by a long-running tool such as clawops_up, clawops_apply or clawops_destroy")
 });
+var clawops_task_statusDescription = "Poll the status of a long-running clawops task (returned by clawops_up,\nclawops_destroy, clawops_apply, etc.). Per R12 streaming model.\n\nUse when: the user is waiting on a long-running deploy/destroy and wants\nprogress, OR you need to check whether a previously-started operation\nfinished.\n\nDo NOT use when: there is no active taskId \u2014 start the operation first.";
 var clawops_task_statusAnnotations = {
   title: "Get Task Status",
   readOnlyHint: true,
@@ -400,6 +446,7 @@ var TOOLSETS = {
     "clawops_config_unset",
     "clawops_config_validate",
     "clawops_gateway_restart",
+    "clawops_init",
     "clawops_harden",
     "clawops_task_status"
   ],
@@ -575,6 +622,29 @@ async function handleStacksList(_input, _server) {
   return { content: [{ type: "text", text: JSON.stringify({ stacks }, null, 2) }] };
 }
 
+// src/mcp/tools/_confirm.ts
+async function confirmDestructive(server, opts) {
+  const capabilities = server.server.getClientCapabilities();
+  if (!capabilities?.elicitation) {
+    return {
+      confirmed: false,
+      reason: `This client cannot show a confirmation prompt, and ${opts.what} is not something clawops will do unconfirmed. Ask the user to confirm, then call this tool again with \`yes: true\`. (The client did not declare the MCP elicitation capability.)`
+    };
+  }
+  const elicit = await server.server.elicitInput({
+    message: opts.message,
+    requestedSchema: {
+      type: "object",
+      properties: { confirmed: { type: "boolean", title: opts.title } },
+      required: ["confirmed"]
+    }
+  });
+  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
+    return { confirmed: false, reason: `Cancelled \u2014 ${opts.what} did not run. Nothing was changed.` };
+  }
+  return { confirmed: true };
+}
+
 // src/mcp/tools/cli/config.ts
 async function handleConfigGet(input, _server) {
   const ac = new AbortController();
@@ -596,16 +666,13 @@ async function handleConfigGet(input, _server) {
   }
 }
 async function handleConfigSet(input, server) {
-  const elicit = await server.server.elicitInput({
+  const confirmation = await confirmDestructive(server, {
     message: `Set ${input.key} = ${input.value} on stack "${input.stackName ?? "default"}"?`,
-    requestedSchema: {
-      type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm config change" } },
-      required: ["confirmed"]
-    }
+    title: "Confirm config change",
+    what: "changing gateway configuration"
   });
-  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Config change cancelled.");
+  if (!confirmation.confirmed) {
+    return okText(confirmation.reason);
   }
   const ac = new AbortController();
   const ctx = buildContext({ stack: input.stackName });
@@ -645,16 +712,13 @@ async function handleConfigSet(input, server) {
   }
 }
 async function handleConfigUnset(input, server) {
-  const elicit = await server.server.elicitInput({
+  const confirmation = await confirmDestructive(server, {
     message: `Remove config key "${input.key}" on stack "${input.stackName ?? "default"}"?`,
-    requestedSchema: {
-      type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm key removal" } },
-      required: ["confirmed"]
-    }
+    title: "Confirm key removal",
+    what: "changing gateway configuration"
   });
-  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Config unset cancelled.");
+  if (!confirmation.confirmed) {
+    return okText(confirmation.reason);
   }
   const ac = new AbortController();
   const ctx = buildContext({ stack: input.stackName });
@@ -759,16 +823,13 @@ async function handleAgentsList(input, _server) {
 
 // src/mcp/tools/cli/gateway.ts
 async function handleGatewayRestart(input, server) {
-  const elicit = await server.server.elicitInput({
+  const confirmation = await confirmDestructive(server, {
     message: `Restart the OpenClaw gateway on stack "${input.stackName ?? "default"}"? This will briefly interrupt connections.`,
-    requestedSchema: {
-      type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm restart" } },
-      required: ["confirmed"]
-    }
+    title: "Confirm restart",
+    what: "restarting the gateway"
   });
-  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Gateway restart cancelled.");
+  if (!confirmation.confirmed) {
+    return okText(confirmation.reason);
   }
   const ctx = buildContext({ stack: input.stackName });
   const conn = await resolveConn(ctx);
@@ -828,16 +889,13 @@ function makeProgressEmitter(server, progressToken) {
 // src/mcp/tools/cli/up.ts
 async function handleUp(input, server) {
   if (!input.dryRun) {
-    const elicit = await server.server.elicitInput({
+    const confirmation = await confirmDestructive(server, {
       message: `Deploy stack "${input.stackName ?? "default"}" (provider: ${input.provider ?? "from config"}, instance: ${input.instanceType})? This will provision cloud resources.`,
-      requestedSchema: {
-        type: "object",
-        properties: { confirmed: { type: "boolean", title: "Confirm deployment" } },
-        required: ["confirmed"]
-      }
+      title: "Confirm deployment",
+      what: "provisioning cloud resources"
     });
-    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-      return okText("Deployment cancelled.");
+    if (!confirmation.confirmed) {
+      return okText(confirmation.reason);
     }
   }
   const ctx = buildContext({ stack: input.stackName, provider: input.provider });
@@ -850,7 +908,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
+    const { localBootstrap } = await import("./bootstrap-3PBVY7MA.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -873,8 +931,8 @@ async function handleUp(input, server) {
   const progressToken = void 0;
   const emit = makeProgressEmitter(server, progressToken);
   startTask(taskId, `clawops_up stack=${ctx.stackName}`);
-  const { generatePlan: generatePlan2 } = await import("./generate-JNJ63ZYZ.js");
-  const { applyPlan: applyPlan2 } = await import("./apply-HJ5GAKHW.js");
+  const { generatePlan: generatePlan2 } = await import("./generate-NE54BATS.js");
+  const { applyPlan: applyPlan2 } = await import("./apply-JARPVA5Y.js");
   const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
   const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
   const network = await resolveNetworkFlags(
@@ -926,16 +984,13 @@ async function handleUp(input, server) {
 import { randomUUID as randomUUID3 } from "crypto";
 async function handleDestroy(input, server) {
   if (!input.yes) {
-    const elicit = await server.server.elicitInput({
+    const confirmation = await confirmDestructive(server, {
       message: `DESTROY stack "${input.stackName}"? This permanently deletes all provisioned resources and cannot be undone.`,
-      requestedSchema: {
-        type: "object",
-        properties: { confirmed: { type: "boolean", title: "Confirm destruction (irreversible)" } },
-        required: ["confirmed"]
-      }
+      title: "Confirm destruction (irreversible)",
+      what: "destroying a stack"
     });
-    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-      return okText("Destruction cancelled.");
+    if (!confirmation.confirmed) {
+      return okText(confirmation.reason);
     }
   }
   const ctx = buildContext({ stack: input.stackName });
@@ -992,7 +1047,7 @@ async function handlePlan(input, _server) {
     let network = resolved;
     if (input.privateOnly) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+      const { probeSsh } = await import("./tailscale-cutover-EKAQSDXP.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[stackName]?.tailscale, stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -1029,30 +1084,31 @@ async function handleHarden(input, server) {
       "tailscale and tailscaleRevert do the opposite of each other; pass one, not both."
     );
   }
-  const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
+  const { getConfig: getConfig2 } = await import("./store-YOLQYXMB.js");
   const config = getConfig2();
-  if (!config) return errText("No clawops config found. The user needs to run `clawops init` first.");
+  if (!config) {
+    return errText(
+      "No clawops config on this machine. Call clawops_init first to register a stack; until then every clawops tool will say this."
+    );
+  }
   const ctx = buildContext({ stack: input.stackName });
   if (!input.dryRun && !input.yes) {
     const what = input.tailscaleRevert ? `Take "${ctx.stackName}" off its tailnet and go back to its public address?` : input.tailscale ? `Harden "${ctx.stackName}" and join it to your tailnet? clawops will use the tailnet address afterwards.` : `Apply hardening modules to "${ctx.stackName}"? This changes the running host.`;
-    const elicit = await server.server.elicitInput({
+    const confirmation = await confirmDestructive(server, {
       message: what,
-      requestedSchema: {
-        type: "object",
-        properties: { confirmed: { type: "boolean", title: "Confirm" } },
-        required: ["confirmed"]
-      }
+      title: "Confirm",
+      what: "changing a running host"
     });
-    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-      return okText("Hardening cancelled. Nothing was changed.");
+    if (!confirmation.confirmed) {
+      return okText(confirmation.reason);
     }
   }
-  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-RI7FGHAM.js");
+  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-HGJIA6EL.js");
   if (input.tailscaleRevert) {
     const outcome = await revertTailnet(ctx, config);
     return outcome.ok ? okText(outcome.message) : errText(outcome.reason);
   }
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-3KKCR7BL.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-RUOUA5BV.js");
   const forStack = makeTailscaleModule(ctx.stackName);
   const resolved = resolveModules(MODULE_CATALOG, input.options, ctx.adapter.name).map(
     (m) => m.id === "tailscale" ? forStack : m
@@ -1094,6 +1150,32 @@ async function handleHarden(input, server) {
   return failed.length > 0 ? errText(content) : okText(content);
 }
 
+// src/mcp/tools/cli/init.ts
+async function handleInit(input, _server) {
+  const { initStack } = await import("./init-HOPXDNWY.js");
+  const result = await initStack({
+    provider: input.provider,
+    stackName: input.stackName,
+    stateUrl: input.stateUrl,
+    region: input.region,
+    force: input.force,
+    host: input.host,
+    sshUser: input.sshUser,
+    sshPort: input.sshPort
+  });
+  if (!result.ok) return errText(result.reason);
+  const lines = [
+    `Stack "${result.stackName}" registered for ${result.provider}.`,
+    `Config:        ${result.configPath}`,
+    `State backend: ${result.stateUrl}`,
+    ...result.region ? [`Region:        ${result.region}`] : [],
+    `SSH key:       ${result.keyPath}${result.keyGenerated ? " (generated now)" : " (already existed)"}`,
+    "",
+    "Nothing has been provisioned and nothing is being charged. Deploying from here needs cloud credentials in the environment clawops runs in; clawops_doctor reports which are missing."
+  ];
+  return okText(lines.join("\n"));
+}
+
 // src/mcp/tools/cli/apply.ts
 import { readFileSync } from "fs";
 import { randomUUID as randomUUID4 } from "crypto";
@@ -1115,18 +1197,15 @@ ${validation.errors.join("\n")}`);
   }
   if (!input.yes) {
     const diffLine = plan.diff ? `${plan.diff.create.length} to create, ${plan.diff.update.length} to update, ${plan.diff.delete.length} to delete` : "diff unavailable";
-    const elicit = await server.server.elicitInput({
+    const confirmation = await confirmDestructive(server, {
       message: `Apply plan for stack "${plan.spec.stackName}" (${plan.spec.provider})?
 Changes: ${diffLine}.
 This will provision cloud resources and may incur costs.`,
-      requestedSchema: {
-        type: "object",
-        properties: { confirmed: { type: "boolean", title: "Confirm plan apply" } },
-        required: ["confirmed"]
-      }
+      title: "Confirm plan apply",
+      what: "applying a plan"
     });
-    if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-      return okText("Apply cancelled.");
+    if (!confirmation.confirmed) {
+      return okText(confirmation.reason);
     }
   }
   const taskId = randomUUID4();
@@ -1255,17 +1334,14 @@ Falling back to direct deployment.`);
     );
   }
   const diffLine = plan.diff ? `${plan.diff.create.length} to create, ${plan.diff.update.length} to update, ${plan.diff.delete.length} to delete` : "? changes";
-  const elicit = await server.server.elicitInput({
+  const confirmation = await confirmDestructive(server, {
     message: `Deploy OpenClaw on ${provider} (stack: "${input.stackName}", instance: ${input.instanceType}${input.region ? `, region: ${input.region}` : ""})?
 Changes: ${diffLine}. This will provision cloud resources and may incur costs.`,
-    requestedSchema: {
-      type: "object",
-      properties: { confirmed: { type: "boolean", title: "Confirm end-to-end deployment" } },
-      required: ["confirmed"]
-    }
+    title: "Confirm end-to-end deployment",
+    what: "provisioning cloud resources"
   });
-  if (elicit.action !== "accept" || !elicit.content?.["confirmed"]) {
-    return okText("Deployment workflow cancelled.");
+  if (!confirmation.confirmed) {
+    return okText(confirmation.reason);
   }
   parts.push("### Step 2: Apply");
   const emit = makeProgressEmitter(server, void 0);
@@ -1329,29 +1405,30 @@ Error: ${err instanceof Error ? err.message : String(err)}`);
 }
 
 // src/mcp/tools/registry.ts
-function makeEntry(schema, annotations, handler) {
-  return { schema, annotations, handler };
+function makeEntry(schema, annotations, handler, description) {
+  return { schema, annotations, handler, description };
 }
 var TOOL_REGISTRY = {
-  clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus),
-  clawops_doctor: makeEntry(clawops_doctorSchema, clawops_doctorAnnotations, handleDoctor),
-  clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail),
-  clawops_monitor: makeEntry(clawops_monitorSchema, clawops_monitorAnnotations, handleMonitor),
-  clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList),
-  clawops_config_get: makeEntry(clawops_config_getSchema, clawops_config_getAnnotations, handleConfigGet),
-  clawops_agents_list: makeEntry(clawops_agents_listSchema, clawops_agents_listAnnotations, handleAgentsList),
-  clawops_up: makeEntry(clawops_upSchema, clawops_upAnnotations, handleUp),
-  clawops_destroy: makeEntry(clawops_destroySchema, clawops_destroyAnnotations, handleDestroy),
-  clawops_apply: makeEntry(clawops_applySchema, clawops_applyAnnotations, handleApply),
-  clawops_plan: makeEntry(clawops_planSchema, clawops_planAnnotations, handlePlan),
-  clawops_harden: makeEntry(clawops_hardenSchema, clawops_hardenAnnotations, handleHarden),
-  clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet),
-  clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset),
-  clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate),
-  clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart),
-  clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp),
-  clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover),
-  clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus)
+  clawops_status: makeEntry(clawops_statusSchema, clawops_statusAnnotations, handleStatus, clawops_statusDescription),
+  clawops_doctor: makeEntry(clawops_doctorSchema, clawops_doctorAnnotations, handleDoctor, clawops_doctorDescription),
+  clawops_logs_tail: makeEntry(clawops_logs_tailSchema, clawops_logs_tailAnnotations, handleLogsTail, clawops_logs_tailDescription),
+  clawops_monitor: makeEntry(clawops_monitorSchema, clawops_monitorAnnotations, handleMonitor, clawops_monitorDescription),
+  clawops_stacks_list: makeEntry(clawops_stacks_listSchema, clawops_stacks_listAnnotations, handleStacksList, clawops_stacks_listDescription),
+  clawops_config_get: makeEntry(clawops_config_getSchema, clawops_config_getAnnotations, handleConfigGet, clawops_config_getDescription),
+  clawops_agents_list: makeEntry(clawops_agents_listSchema, clawops_agents_listAnnotations, handleAgentsList, clawops_agents_listDescription),
+  clawops_up: makeEntry(clawops_upSchema, clawops_upAnnotations, handleUp, clawops_upDescription),
+  clawops_destroy: makeEntry(clawops_destroySchema, clawops_destroyAnnotations, handleDestroy, clawops_destroyDescription),
+  clawops_apply: makeEntry(clawops_applySchema, clawops_applyAnnotations, handleApply, clawops_applyDescription),
+  clawops_plan: makeEntry(clawops_planSchema, clawops_planAnnotations, handlePlan, clawops_planDescription),
+  clawops_init: makeEntry(clawops_initSchema, clawops_initAnnotations, handleInit, clawops_initDescription),
+  clawops_harden: makeEntry(clawops_hardenSchema, clawops_hardenAnnotations, handleHarden, clawops_hardenDescription),
+  clawops_config_set: makeEntry(clawops_config_setSchema, clawops_config_setAnnotations, handleConfigSet, clawops_config_setDescription),
+  clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset, clawops_config_unsetDescription),
+  clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate, clawops_config_validateDescription),
+  clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart, clawops_gateway_restartDescription),
+  clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp, clawops_workflow_deploy_appDescription),
+  clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover, clawops_workflow_recoverDescription),
+  clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus, clawops_task_statusDescription)
 };
 var TOOL_NAMES = Object.keys(TOOL_REGISTRY);
 function resolveEnabledTools(opts) {
@@ -1380,13 +1457,16 @@ function registerTools(server, opts) {
   for (const toolName of enabled) {
     const entry = TOOL_REGISTRY[toolName];
     if (!entry) continue;
-    const { schema, annotations, handler } = entry;
+    const { schema, annotations, handler, description } = entry;
     const { title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint } = annotations;
     const audited = withAudit(toolName, (input) => handler(input, server));
     server.registerTool(
       toolName,
       {
         title,
+        // What a model reads when it picks a tool. Written per R3 to say when to use this one
+        // and when to reach for another; omitted here, every client saw a nameless capability.
+        description,
         inputSchema: schema,
         annotations: { title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint }
       },
@@ -1646,7 +1726,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-SAUDFQLG.js");
+  const { version } = await import("./package-MF5LPITL.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);