@clawops/cli 2.1.1 → 2.1.3

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
 import {
   monitor_default,
   runDiagnostics
-} from "./chunk-GFUK6KDR.js";
+} from "./chunk-CPCO6UJK.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
@@ -20,6 +20,7 @@ import {
   execPrivilegedWithInput,
   streamPrivileged
 } from "./chunk-NUDIHZEH.js";
+import "./chunk-CHNSL3TC.js";
 import {
   resolveSpecDir
 } from "./chunk-JW5A7E3X.js";
@@ -27,7 +28,7 @@ import {
   interpretProbe,
   probeCommand
 } from "./chunk-LT4XMO5D.js";
-import "./chunk-BELTQGHT.js";
+import "./chunk-VUFMZEIM.js";
 import {
   CONFIG_FILENAME,
   CONTAINER_UID,
@@ -58,110 +59,29 @@ import {
 } from "./chunk-Q7NQY5HV.js";
 import "./chunk-N4WZLWJ4.js";
 import {
-  getConfig,
+  SUPPORTED_PROVIDERS,
+  deriveStateBucket,
+  initStack,
+  resolveScopeAccount,
+  validateStateBucket
+} from "./chunk-755X5OGS.js";
+import {
   getConfigDir,
   requireConfig,
   setConfig
-} from "./chunk-64PONSA5.js";
+} from "./chunk-GFIR2IIJ.js";
 import {
   ClawopsError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
-import "./chunk-VUFMZEIM.js";
 
 // src/cli/index.ts
 import { defineCommand as defineCommand24, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
-import { spawnSync } from "child_process";
-import { writeFileSync, mkdirSync, existsSync } from "fs";
 import path from "path";
 import process2 from "process";
-
-// src/providers/state-bucket.ts
-function deriveStateBucket(provider, scope) {
-  if (provider === "azure") {
-    return { ok: true, name: "clawops-state" };
-  }
-  if (!scope.account) {
-    return {
-      ok: false,
-      needs: provider === "aws" ? "an AWS account id \u2014 set AWS_PROFILE, or run `aws sso login --profile <name>`" : "a GCP project \u2014 run `gcloud config set project <id>`, or set GOOGLE_CLOUD_PROJECT"
-    };
-  }
-  if (provider === "gcp") return { ok: true, name: `clawops-state-${scope.account}` };
-  if (!scope.region) return { ok: false, needs: "a region" };
-  return { ok: true, name: `clawops-state-${scope.account}-${scope.region}` };
-}
-function stateUrlFor(provider, bucket) {
-  const verdict = validateStateBucket(provider, bucket);
-  if (verdict !== true) throw new Error(`Not a usable ${provider} state backend name: ${verdict}`);
-  const scheme = provider === "aws" ? "s3://" : provider === "gcp" ? "gs://" : "azblob://";
-  return provider === "azure" ? `${scheme}${bucket}` : `${scheme}${bucket}/clawops`;
-}
-var IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
-function validateStateBucket(provider, name) {
-  const n = name.trim();
-  if (n === "") return "Required";
-  if (n !== name) return "No leading or trailing spaces";
-  if (n.length < 3) return `Too short \u2014 ${labelFor(provider)} names are at least 3 characters`;
-  const dotted = provider === "gcp" && n.includes(".");
-  const max = dotted ? 222 : 63;
-  if (n.length > max) return `Too long \u2014 ${labelFor(provider)} names are at most ${max} characters`;
-  if (dotted && n.split(".").some((part) => part.length > 63)) {
-    return "Each dot-separated part of a Cloud Storage name is at most 63 characters";
-  }
-  if (n !== n.toLowerCase()) return "Lowercase only";
-  if (provider === "azure") {
-    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(n)) {
-      return "Letters, digits and single hyphens only, starting and ending with a letter or digit";
-    }
-    return true;
-  }
-  if (!/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/.test(n)) {
-    return "Letters, digits, dots, hyphens and underscores only, starting and ending with a letter or digit";
-  }
-  if (n.includes("..")) return "No consecutive dots";
-  if (IPV4.test(n)) return "Cannot be formatted as an IP address";
-  if (provider === "aws") {
-    if (n.startsWith("xn--")) return 'Cannot start with "xn--"';
-    if (n.startsWith("sthree-")) return 'Cannot start with "sthree-"';
-    if (n.endsWith("-s3alias")) return 'Cannot end with "-s3alias"';
-    if (n.endsWith("--ol-s3")) return 'Cannot end with "--ol-s3"';
-    if (n.includes("_")) return "Underscores are not allowed in S3 bucket names";
-    return true;
-  }
-  if (n.startsWith("goog")) return 'Cannot start with "goog"';
-  if (n.includes("google")) return 'Cannot contain "google"';
-  return true;
-}
-function labelFor(provider) {
-  if (provider === "aws") return "S3 bucket";
-  if (provider === "gcp") return "Cloud Storage bucket";
-  return "blob container";
-}
-async function resolveScopeAccount(provider, signal) {
-  if (provider === "azure") return void 0;
-  try {
-    if (provider === "aws") {
-      const { callerAccount } = await import("./preflight-TFD4N5ZU.js");
-      return await callerAccount(signal);
-    }
-    const { resolveProjectId } = await import("./preflight-IE2YWBAC.js");
-    return resolveProjectId();
-  } catch {
-    return void 0;
-  }
-}
-
-// src/cli/commands/init.ts
-var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
-var PROVIDER_DEFAULTS = {
-  gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
-  aws: { region: "us-east-1", credEnv: "AWS_PROFILE", stateScheme: "s3://" },
-  azure: { region: "eastus", credEnv: "AZURE_CLIENT_ID", stateScheme: "azblob://" }
-};
 var init_default = defineCommand({
   meta: {
     name: "init",
@@ -183,8 +103,6 @@ var init_default = defineCommand({
   async run({ args }) {
     const nonInteractive = Boolean(args["non-interactive"]);
     const providerArg = typeof args.provider === "string" ? args.provider : null;
-    const stackName = typeof args.stack === "string" ? args.stack : "default";
-    const forceOverwrite = Boolean(args.force);
     if (nonInteractive && !providerArg) {
       throw new UsageError(
         "--non-interactive requires --provider. Example: clawops init --provider gcp --non-interactive"
@@ -196,107 +114,42 @@ var init_default = defineCommand({
         `Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`
       );
     }
-    const existing = getConfig();
-    if (existing?.stacks[stackName] && !forceOverwrite) {
-      failure(
-        `Stack "${stackName}" already exists in ${path.join(getConfigDir(), "config.json")} (${existing.stacks[stackName].stateUrl}). Use --force to overwrite its settings, or pass a different --stack name to add another one.`
-      );
-      process2.exit(1);
-    }
-    const configDir = getConfigDir();
-    mkdirSync(configDir, { recursive: true });
-    const keyPath = typeof args["key-path"] === "string" ? args["key-path"] : path.join(configDir, "id_ed25519");
-    const knownHostsPath = path.join(configDir, "known_hosts");
-    if (!existsSync(keyPath)) {
-      if (typeof args["key-path"] === "string") {
-        throw new UsageError(`SSH key not found at ${keyPath}`);
-      }
-      info("Generating SSH key pair...");
-      const gen = spawnSync(
-        "ssh-keygen",
-        ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops", "-q"],
-        { stdio: ["ignore", "pipe", "pipe"] }
-      );
-      if (gen.error || gen.status !== 0) {
-        const reason = gen.error?.message ?? gen.stderr?.toString().trim() ?? `exit ${gen.status}`;
-        throw new UsageError(
-          `Could not generate an SSH key: ${reason}
-Generate one yourself and point clawops at it:
-  ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops
-  clawops init --key-path ${keyPath}`
-        );
+    const result = await initStack({
+      provider,
+      stackName: typeof args.stack === "string" ? args.stack : void 0,
+      stateUrl: typeof args.state === "string" ? args.state : void 0,
+      region: typeof args.region === "string" ? args.region : void 0,
+      force: Boolean(args.force),
+      keyPath: typeof args["key-path"] === "string" ? args["key-path"] : void 0,
+      host: typeof args.host === "string" ? args.host : void 0,
+      sshUser: typeof args["ssh-user"] === "string" ? args["ssh-user"] : void 0,
+      sshPort: typeof args["ssh-port"] === "string" ? parseInt(args["ssh-port"], 10) : void 0
+    });
+    if (!result.ok) {
+      if (result.reason.includes("already exists")) {
+        failure(result.reason.replace("Pass force", "Use --force"));
+        process2.exit(1);
       }
-      success(`SSH key pair written to ${keyPath} (and ${keyPath}.pub)`);
-    } else {
-      info(`Using existing SSH key at ${keyPath}`);
+      throw new UsageError(result.reason);
     }
-    if (!existsSync(knownHostsPath)) {
-      writeFileSync(knownHostsPath, "", "utf-8");
-    }
-    let config;
-    if (provider === "local") {
-      const host = typeof args.host === "string" ? args.host : "";
-      if (!host) {
-        throw new UsageError("--host is required for the local provider");
-      }
-      const sshUser = typeof args["ssh-user"] === "string" ? args["ssh-user"] : "root";
-      const sshPort = typeof args["ssh-port"] === "string" ? parseInt(args["ssh-port"], 10) : 22;
-      config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
-        provider,
-        stateUrl: "file://~/.clawops/state",
-        credentialsRef: { source: "file", envVars: [] },
-        localOpts: { host, sshUser, sshPort, sshKeyPath: keyPath }
-      });
-    } else {
-      const defaults = PROVIDER_DEFAULTS[provider];
-      const region = typeof args.region === "string" ? args.region : defaults.region;
-      let stateUrl;
-      if (typeof args.state === "string") {
-        stateUrl = args.state;
-      } else {
-        const account = await resolveScopeAccount(provider);
-        const derived = deriveStateBucket(provider, { account, region });
-        if (!derived.ok) {
-          throw new UsageError(
-            `Could not name a state backend for ${provider}: clawops needs ${derived.needs}.
-Authenticate and run this again, or name the backend yourself:
-  clawops init --provider ${provider} --state ${defaults.stateScheme}your-bucket/clawops`
-          );
-        }
-        stateUrl = stateUrlFor(provider, derived.name);
-      }
-      config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
-        provider,
-        stateUrl,
-        region,
-        credentialsRef: { source: "env", envVars: [defaults.credEnv] }
-      });
+    if (result.keyGenerated) success(`SSH key pair written to ${result.keyPath} (and ${result.keyPath}.pub)`);
+    else info(`Using existing SSH key at ${result.keyPath}`);
+    if (result.provider !== "local") {
       process2.stdout.write("\n");
       info(
-        `State backend: ${stateUrl}
-  clawops doctor --provider ${provider} checks it exists, and clawops setup offers to create it.`
+        `State backend: ${result.stateUrl}
+  clawops doctor --provider ${result.provider} checks it exists, and clawops setup offers to create it.`
       );
       process2.stdout.write("\n");
-      success(`Provider: ${provider}  Region: ${region}  Stack: ${stackName}`);
-      setConfig(config);
-      success(`Config written to ${path.join(configDir, "config.json")}`);
+      success(`Provider: ${result.provider}  Region: ${result.region}  Stack: ${result.stackName}`);
+      success(`Config written to ${path.join(getConfigDir(), "config.json")}`);
       return;
     }
-    setConfig(config);
-    success(`Config written to ${path.join(configDir, "config.json")}`);
+    success(`Config written to ${result.configPath}`);
     process2.stdout.write("\n");
-    success(`Provider: ${provider}  Stack: ${stackName}`);
+    success(`Provider: ${result.provider}  Stack: ${result.stackName}`);
   }
 });
-function merge(existing, stackName, provider, keyPath, knownHostsPath, stack) {
-  return {
-    ...existing ?? {},
-    version: 1,
-    defaults: { stack: stackName, provider },
-    stacks: { ...existing?.stacks ?? {}, [stackName]: stack },
-    ssh: { keyPath, knownHostsPath }
-  };
-}
 
 // src/cli/commands/up.ts
 import { defineCommand as defineCommand2 } from "citty";
@@ -339,7 +192,7 @@ var up_default = defineCommand2({
     "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
@@ -352,7 +205,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
+      const { localBootstrap } = await import("./bootstrap-3PBVY7MA.js");
       const gatewayPort = parseGatewayPort(args["gateway-port"]);
       const abortController2 = new AbortController();
       process3.on("SIGINT", () => abortController2.abort());
@@ -392,8 +245,8 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const { generatePlan } = await import("./generate-JNJ63ZYZ.js");
-    const { applyPlan } = await import("./apply-HJ5GAKHW.js");
+    const { generatePlan } = await import("./generate-NE54BATS.js");
+    const { applyPlan } = await import("./apply-JARPVA5Y.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const isDryRun = Boolean(args["dry-run"]);
@@ -523,7 +376,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -587,7 +440,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -643,7 +496,7 @@ var status_default = defineCommand4({
 // src/cli/commands/plan.ts
 import { defineCommand as defineCommand5 } from "citty";
 import process7 from "process";
-import { writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync } from "fs";
 import { isAbsolute } from "path";
 function disruptionWarnings(diff) {
   const out = [];
@@ -687,8 +540,8 @@ var plan_default = defineCommand5({
     "private-only": { type: "boolean", description: "Close public SSH and gateway access; reach the stack over its tailnet. Needs `clawops harden --tailscale` first, and checks the tailnet answers before planning" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { generatePlan } = await import("./generate-JNJ63ZYZ.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { generatePlan } = await import("./generate-NE54BATS.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
@@ -713,7 +566,7 @@ var plan_default = defineCommand5({
     let network = resolved;
     if (args["private-only"]) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+      const { probeSsh } = await import("./tailscale-cutover-EKAQSDXP.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[ctx.stackName]?.tailscale, ctx.stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -741,7 +594,7 @@ var plan_default = defineCommand5({
     }
     const planJson = JSON.stringify(plan, null, 2);
     if (outPath) {
-      writeFileSync2(outPath, planJson + "\n", "utf-8");
+      writeFileSync(outPath, planJson + "\n", "utf-8");
       success(`Plan written to ${outPath}`);
     } else {
       process7.stdout.write(planJson + "\n");
@@ -804,7 +657,7 @@ var apply_default = defineCommand6({
   },
   async run({ args }) {
     const { validatePlan } = await import("./validate-JXKN5WD6.js");
-    const { applyPlan } = await import("./apply-HJ5GAKHW.js");
+    const { applyPlan } = await import("./apply-JARPVA5Y.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -930,7 +783,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -1023,7 +876,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
     let conn;
@@ -1110,7 +963,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
@@ -1179,7 +1032,7 @@ var logs_default = defineCommand10({
     json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const ctx = buildContext(args);
@@ -1285,7 +1138,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, key, value] = args._ ?? [];
@@ -1420,7 +1273,7 @@ var agents_default = defineCommand12({
     cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, name] = args._ ?? [];
@@ -1652,7 +1505,7 @@ var migrate_default = defineCommand13({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
@@ -1791,7 +1644,7 @@ var gateway_default = defineCommand14({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const [action, versionArg] = args._ ?? [];
@@ -2023,7 +1876,7 @@ var backup_default = defineCommand15({
     yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -2234,7 +2087,7 @@ var stacks_default = defineCommand16({
     let isDeployed = false;
     if (!args.force) {
       try {
-        const { buildContext } = await import("./context-7VI3R6EK.js");
+        const { buildContext } = await import("./context-WOKSKAIA.js");
         const ctx = buildContext({ stack: name });
         if (ctx.adapter.name === "local") {
           isDeployed = !!ctx.localState;
@@ -2375,7 +2228,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-RHON6QMN.js");
+    const { serveMcp } = await import("./server-OXWHBTXK.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -2453,11 +2306,11 @@ var wireCmd = defineCommand18({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-B57DUNOD.js");
-    const { MCP_HTTP_PORT } = await import("./server-RHON6QMN.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-FIO5DFBY.js");
+    const { MCP_HTTP_PORT } = await import("./server-OXWHBTXK.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -2557,8 +2410,8 @@ import { defineCommand as defineCommand19 } from "citty";
 import process21 from "process";
 import os from "os";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { execSync, spawnSync as spawnSync2, spawn as spawn2 } from "child_process";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync, mkdirSync } from "fs";
+import { execSync, spawnSync, spawn as spawn2 } from "child_process";
 import path2 from "path";
 var setup_default = defineCommand19({
   meta: {
@@ -2617,7 +2470,7 @@ var setup_default = defineCommand19({
     } else {
       provider = "local";
       info("We'll connect to your server over SSH to install and configure OpenClaw.\n");
-      if (!existsSync2(localKeyPath)) {
+      if (!existsSync(localKeyPath)) {
         info(`No SSH key found at ${localKeyPath}.`);
         const { genKey } = await inquirer.prompt([{
           type: "confirm",
@@ -2653,7 +2506,7 @@ var setup_default = defineCommand19({
           name: "keyPath",
           message: `SSH private key file: (the key file on your computer used to log in \u2014 e.g. ~/.ssh/id_ed25519)`,
           default: localKeyPath,
-          validate: (v) => existsSync2(v.trim()) || `File not found: ${v.trim()}`
+          validate: (v) => existsSync(v.trim()) || `File not found: ${v.trim()}`
         }
       ]);
       localHost = localAnswers.host;
@@ -2875,10 +2728,10 @@ var setup_default = defineCommand19({
     }
     const gatewayToken = randomBytes(24).toString("hex");
     const secretsDir2 = path2.join(os.homedir(), ".clawops", "secrets");
-    mkdirSync2(secretsDir2, { recursive: true });
-    spawnSync2("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    mkdirSync(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
     const tokenPath = path2.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
-    writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
+    writeFileSync2(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
       models: builtModelConfig,
       gateway: { auth: { mode: "token", token: gatewayToken } }
@@ -2889,7 +2742,7 @@ var setup_default = defineCommand19({
     let outputPath;
     if (provider === "local") {
       outputPath = path2.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
-      writeFileSync3(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
+      writeFileSync2(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
       process21.stdout.write("\n");
       success(`Config file saved to ${outputPath}`);
     } else {
@@ -2935,7 +2788,7 @@ var setup_default = defineCommand19({
         }
       };
       outputPath = path2.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
-      writeFileSync3(outputPath, JSON.stringify(plan, null, 2), "utf-8");
+      writeFileSync2(outputPath, JSON.stringify(plan, null, 2), "utf-8");
       process21.stdout.write("\n");
       success(`Deployment plan saved to ${outputPath}`);
     }
@@ -3040,7 +2893,7 @@ var setup_default = defineCommand19({
           inquirer
         });
       } else {
-        const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
+        const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
         const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
         process21.stdout.write("\n");
         info("To deploy later, run these two commands:");
@@ -3057,7 +2910,7 @@ var setup_default = defineCommand19({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-HJ5GAKHW.js");
+        const { applyPlan } = await import("./apply-JARPVA5Y.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -3085,13 +2938,13 @@ To deploy later:  clawops apply ${outputPath}`);
   }
 });
 async function runLocalDeploy(opts) {
-  const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
-  const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
+  const { setConfig: setConfig2, getConfig, getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
+  const { localBootstrap } = await import("./bootstrap-3PBVY7MA.js");
   const { connect } = await import("./ssh-VAI5DU5M.js");
   const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
-  const existing = getConfig2();
+  const existing = getConfig();
   const stackEntry = {
     provider: "local",
     stateUrl: "file://~/.clawops/state",
@@ -3229,7 +3082,7 @@ ${cfg.loginHint}`);
   }]);
   if (runNow) {
     process21.stdout.write("\n");
-    const result = spawnSync2(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
+    const result = spawnSync(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
     if (result.error) {
       failure(`Could not launch ${cliName} \u2014 is it installed? (${result.error.message})`);
       info(`Install guide: ${cliInstallUrl(provider)}`);
@@ -3273,10 +3126,10 @@ async function promptSecret(name, label, envDefault, inquirer) {
       message: `Paste your ${label}: (input is hidden)`,
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
-    mkdirSync2(secretsDir2, { recursive: true });
-    spawnSync2("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    mkdirSync(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
     const secretPath2 = path2.join(secretsDir2, name);
-    writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    writeFileSync2(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret saved to ${secretPath2}  (chmod 600)`);
     return { name, source: "file", ref: secretPath2 };
   }
@@ -3293,7 +3146,7 @@ async function promptSecret(name, label, envDefault, inquirer) {
     type: "input",
     name: "filePath",
     message: `File path: (full path to the file containing your ${label})`,
-    validate: (v) => existsSync2(v.trim()) || `File not found: ${v.trim()}`
+    validate: (v) => existsSync(v.trim()) || `File not found: ${v.trim()}`
   }]);
   return { name, source: "file", ref: filePath };
 }
@@ -3451,7 +3304,7 @@ async function startDockerAndWait(inquirer) {
     await pollUntilDockerReady("Waiting for Docker daemon...");
   } else if (choice === "systemctl") {
     const spin = spinner("Running: sudo systemctl start docker...");
-    const res = spawnSync2("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
+    const res = spawnSync("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
     if (res.status !== 0) {
       spin.fail("systemctl start docker failed.");
       throw new Error("systemctl start docker failed");
@@ -3459,18 +3312,18 @@ async function startDockerAndWait(inquirer) {
     spin.succeed("Docker service started.");
     await pollUntilDockerReady("Waiting for Docker daemon to be reachable...");
   } else if (choice === "desktop") {
-    const backendRunning = spawnSync2("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
+    const backendRunning = spawnSync("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
     if (backendRunning) {
       const killSpin = spinner("Docker Desktop is stuck \u2014 force-restarting...");
       for (const pat of ["com.docker.backend", "com.docker.virtualization", "com.docker.build", "Docker Desktop"]) {
-        spawnSync2("pkill", ["-9", "-f", pat], { stdio: "ignore" });
+        spawnSync("pkill", ["-9", "-f", pat], { stdio: "ignore" });
       }
       await new Promise((r) => setTimeout(r, 2e3));
       killSpin.succeed("Old Docker processes cleared.");
     }
     const openSpin = spinner("Launching Docker Desktop...");
-    let opened = spawnSync2("open", ["-a", "Docker"], { stdio: "ignore" });
-    if (opened.status !== 0) opened = spawnSync2("open", ["/Applications/Docker.app"], { stdio: "ignore" });
+    let opened = spawnSync("open", ["-a", "Docker"], { stdio: "ignore" });
+    if (opened.status !== 0) opened = spawnSync("open", ["/Applications/Docker.app"], { stdio: "ignore" });
     if (opened.status !== 0) {
       openSpin.fail("Could not open Docker Desktop \u2014 is it installed in /Applications?");
       throw new Error("Failed to open Docker Desktop");
@@ -3479,7 +3332,7 @@ async function startDockerAndWait(inquirer) {
     await pollUntilDockerReady("Waiting for Docker engine to start...");
   } else if (choice === "colima") {
     const spin = spinner("Running: colima start...");
-    const res = spawnSync2("colima", ["start"], { stdio: "pipe" });
+    const res = spawnSync("colima", ["start"], { stdio: "pipe" });
     if (res.status !== 0) {
       spin.fail("colima start failed \u2014 is Colima installed? (brew install colima docker)");
       throw new Error("colima start failed");
@@ -3491,12 +3344,12 @@ async function startDockerAndWait(inquirer) {
 var LOCALHOST_ALIASES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
 async function ensureAuthorizedKey(keyPath, host, inquirer) {
   const pubKeyPath = `${keyPath}.pub`;
-  if (!existsSync2(pubKeyPath)) return;
+  if (!existsSync(pubKeyPath)) return;
   const pubKey = readFileSync3(pubKeyPath, "utf-8").trim();
   const isLocal = LOCALHOST_ALIASES.has(host.toLowerCase());
   const authorizedKeysPath = path2.join(os.homedir(), ".ssh", "authorized_keys");
   if (isLocal) {
-    const existing = existsSync2(authorizedKeysPath) ? readFileSync3(authorizedKeysPath, "utf-8") : "";
+    const existing = existsSync(authorizedKeysPath) ? readFileSync3(authorizedKeysPath, "utf-8") : "";
     if (existing.includes(pubKey)) {
       success("SSH public key is already in authorized_keys.");
       return;
@@ -3509,10 +3362,10 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       default: true
     }]);
     if (addKey) {
-      mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
+      mkdirSync(path2.join(os.homedir(), ".ssh"), { recursive: true });
       const entry = existing.endsWith("\n") || existing === "" ? pubKey + "\n" : "\n" + pubKey + "\n";
-      writeFileSync3(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
-      spawnSync2("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
+      writeFileSync2(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
+      spawnSync("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
       success("Public key added to ~/.ssh/authorized_keys.");
     } else {
       info("SSH will likely fail. Add this line to ~/.ssh/authorized_keys manually:");
@@ -3527,8 +3380,8 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
 }
 async function generateSshKey() {
   const keyPath = path2.join(os.homedir(), ".ssh", "id_ed25519");
-  mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
-  const result = spawnSync2("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
+  mkdirSync(path2.join(os.homedir(), ".ssh"), { recursive: true });
+  const result = spawnSync("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
@@ -3543,7 +3396,7 @@ function detectSshKey() {
   const candidates = ["id_ed25519", "id_ecdsa", "id_rsa", "id_dsa"];
   for (const name of candidates) {
     const p = path2.join(os.homedir(), ".ssh", name);
-    if (existsSync2(p)) return p;
+    if (existsSync(p)) return p;
   }
   return path2.join(os.homedir(), ".ssh", "id_ed25519");
 }
@@ -3560,8 +3413,8 @@ async function maybeWireGatewayMcp(opts) {
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
   const { connect } = await import("./ssh-VAI5DU5M.js");
-  const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-B57DUNOD.js");
+  const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-FIO5DFBY.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3680,9 +3533,9 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-3KKCR7BL.js");
-  const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
-  const config = getConfig2();
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-RUOUA5BV.js");
+  const { getConfig } = await import("./store-YOLQYXMB.js");
+  const config = getConfig();
   if (!config) return;
   const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
   if (availableModules.length === 0) return;
@@ -3704,7 +3557,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3827,8 +3680,8 @@ async function runAccountPreflight(opts) {
 
 // src/cli/commands/secret.ts
 import { defineCommand as defineCommand20 } from "citty";
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync3, statSync } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync, mkdirSync as mkdirSync2, statSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
 import path3 from "path";
 import os2 from "os";
 import process22 from "process";
@@ -3840,7 +3693,7 @@ function secretPath(name) {
   return path3.join(secretsDir(), name);
 }
 function listSecretNames() {
-  if (!existsSync3(secretsDir())) return [];
+  if (!existsSync2(secretsDir())) return [];
   return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
 }
 var listCmd = defineCommand20({
@@ -3904,9 +3757,9 @@ var setCmd = defineCommand20({
       }]);
       value = secretValue;
     }
-    mkdirSync3(secretsDir(), { recursive: true });
-    spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
-    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync3(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
     info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
   }
@@ -3923,7 +3776,7 @@ var deleteCmd = defineCommand20({
       process22.exit(2);
     }
     const p = secretPath(name);
-    if (!existsSync3(p)) {
+    if (!existsSync2(p)) {
       failure(`Secret "${name}" not found at ${p}`);
       process22.exit(1);
     }
@@ -3975,12 +3828,12 @@ var rotateCmd = defineCommand20({
       }]);
       value = secretValue;
     }
-    mkdirSync3(secretsDir(), { recursive: true });
-    spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
-    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync3(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
-    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
-    const cfg = getConfig2();
+    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const cfg = getConfig();
     const targetStack = args.stack ?? cfg?.defaults?.stack;
     if (!targetStack) {
       warn("No stack specified and no default stack in config \u2014 skipping re-apply.");
@@ -3996,11 +3849,11 @@ var rotateCmd = defineCommand20({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-7VI3R6EK.js");
+      const { buildContext } = await import("./context-WOKSKAIA.js");
       const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
       const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
-      const { localStateToConnectionInfo } = await import("./state-AOAYLYY5.js");
+      const { localStateToConnectionInfo } = await import("./state-AKZP2S4T.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
       if (ctx.adapter.name === "local") {
@@ -4058,7 +3911,7 @@ var auditCmd = defineCommand20({
       for (const s of overlay.secrets) {
         if (s.source === "file") {
           const ref = s.ref ?? secretPath(s.name);
-          if (!existsSync3(ref)) {
+          if (!existsSync2(ref)) {
             issues.push({ kind: "missing-file", stack: overlay.stackName, secret: s.name, detail: `File not found: ${ref}` });
           }
         } else if (s.source === "env") {
@@ -4183,7 +4036,7 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.1.1" : "dev";
+var VERSION = true ? "2.1.3" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
   const os3 = `${process23.platform} ${process23.arch}`;
@@ -4191,8 +4044,8 @@ async function collectContext() {
   let stackCount = 0;
   let sshKey = "unknown";
   try {
-    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
-    const config = getConfig2();
+    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const config = getConfig();
     if (config) {
       const stacks = Object.values(config.stacks);
       stackCount = stacks.length;
@@ -4302,9 +4155,9 @@ var harden_default = defineCommand23({
     "tailscale-revert": { type: "boolean", description: "Take the host off its tailnet and go back to its public address. A private-only stack must be reopened with a plan first" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-3KKCR7BL.js");
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-RUOUA5BV.js");
+    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { getConfig } = await import("./store-YOLQYXMB.js");
     if (args.list) {
       process24.stdout.write("\nAvailable hardening modules:\n\n");
       for (const mod of MODULE_CATALOG) {
@@ -4318,7 +4171,7 @@ var harden_default = defineCommand23({
       process24.stdout.write("\n");
       return;
     }
-    const config = getConfig2();
+    const config = getConfig();
     if (!config) {
       failure("No clawops config found. Run `clawops init` first.");
       process24.exit(1);
@@ -4326,7 +4179,7 @@ var harden_default = defineCommand23({
     const ctx = buildContext({ stack: args.stack });
     const provider = ctx.adapter.name;
     if (args["tailscale-revert"]) {
-      const { revertTailnet } = await import("./flows-RI7FGHAM.js");
+      const { revertTailnet } = await import("./flows-HGJIA6EL.js");
       const override = config.stacks[ctx.stackName]?.tailscale;
       if (override && args.yes !== true) {
         const { createInterface: createInterface3 } = await import("readline/promises");
@@ -4349,7 +4202,7 @@ var harden_default = defineCommand23({
       else success(outcome.message);
       return;
     }
-    const { makeTailscaleModule } = await import("./harden-3KKCR7BL.js");
+    const { makeTailscaleModule } = await import("./harden-RUOUA5BV.js");
     const forStack = makeTailscaleModule(ctx.stackName);
     const resolved = resolveModules(MODULE_CATALOG, args.options, provider).map(
       (m) => m.id === "tailscale" ? forStack : m
@@ -4433,7 +4286,7 @@ var harden_default = defineCommand23({
       success("Hardening complete.");
     }
     if (args.tailscale && !args["dry-run"]) {
-      const { cutOverToTailnet } = await import("./flows-RI7FGHAM.js");
+      const { cutOverToTailnet } = await import("./flows-HGJIA6EL.js");
       process24.stdout.write("\nVerifying the tailnet address before using it...\n");
       const outcome = await cutOverToTailnet(ctx, conn, config);
       if (!outcome.ok) {
@@ -4470,7 +4323,7 @@ function resolveArgv(argv2, stdinIsTty) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.1.1" : "dev";
+var CLI_VERSION = true ? "2.1.3" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",