@clawops/cli 2.1.2 → 2.2.0

package/dist/cli.js

@@ -5,38 +5,51 @@ import {
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
 import {
+  AUDIT_CLEAN_MESSAGE,
+  AUDIT_FIX_HINT,
+  NO_SECRETS_MESSAGE,
+  SET_SECRET_HINT,
+  auditIssuesHeadline,
+  auditSecrets,
+  deleteConfirmQuestion,
+  deletePreparedSecret,
+  dockerRunCmd,
+  formatAuditIssue,
+  gatewayStatus,
+  listSecrets,
   monitor_default,
-  runDiagnostics
-} from "./chunk-GFUK6KDR.js";
+  prepareSecretDelete,
+  resolveSecretPath,
+  resolveUpdateVersion,
+  runDiagnostics,
+  secretsDir,
+  updateGateway
+} from "./chunk-OUQVKIIA.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
-} from "./chunk-NUL5F6YV.js";
-import "./chunk-3OLUJPCB.js";
+} from "./chunk-SOZ62ZXW.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-Z3XLWZWF.js";
 import {
   execPrivileged,
-  execPrivilegedWithInput,
   streamPrivileged
-} from "./chunk-NUDIHZEH.js";
+} from "./chunk-WPZIJONN.js";
+import "./chunk-YPVWF7IA.js";
 import {
   resolveSpecDir
 } from "./chunk-JW5A7E3X.js";
+import "./chunk-LT4XMO5D.js";
+import "./chunk-VUFMZEIM.js";
 import {
-  interpretProbe,
-  probeCommand
-} from "./chunk-LT4XMO5D.js";
-import "./chunk-BELTQGHT.js";
-import {
-  CONFIG_FILENAME,
-  CONTAINER_UID,
   PUBLISH_INSPECT_CMD,
   STATE_DIR_HOST_LINUX,
   configPathForOS,
   gatewayRunCommand,
   publishForRestart
-} from "./chunk-GIEVAGEK.js";
+} from "./chunk-N5ZYUTZS.js";
 import {
   GATEWAY_PORT,
   IMAGE_INSPECT_CMD,
@@ -58,110 +71,28 @@ import {
 } from "./chunk-Q7NQY5HV.js";
 import "./chunk-N4WZLWJ4.js";
 import {
-  getConfig,
+  SUPPORTED_PROVIDERS,
+  deriveStateBucket,
+  initStack,
+  resolveScopeAccount,
+  validateStateBucket
+} from "./chunk-755X5OGS.js";
+import {
   getConfigDir,
-  requireConfig,
-  setConfig
-} from "./chunk-64PONSA5.js";
+  requireConfig
+} from "./chunk-GFIR2IIJ.js";
 import {
   ClawopsError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
-import "./chunk-VUFMZEIM.js";
 
 // src/cli/index.ts
 import { defineCommand as defineCommand24, runMain } from "citty";
 
 // src/cli/commands/init.ts
 import { defineCommand } from "citty";
-import { spawnSync } from "child_process";
-import { writeFileSync, mkdirSync, existsSync } from "fs";
 import path from "path";
 import process2 from "process";
-
-// src/providers/state-bucket.ts
-function deriveStateBucket(provider, scope) {
-  if (provider === "azure") {
-    return { ok: true, name: "clawops-state" };
-  }
-  if (!scope.account) {
-    return {
-      ok: false,
-      needs: provider === "aws" ? "an AWS account id \u2014 set AWS_PROFILE, or run `aws sso login --profile <name>`" : "a GCP project \u2014 run `gcloud config set project <id>`, or set GOOGLE_CLOUD_PROJECT"
-    };
-  }
-  if (provider === "gcp") return { ok: true, name: `clawops-state-${scope.account}` };
-  if (!scope.region) return { ok: false, needs: "a region" };
-  return { ok: true, name: `clawops-state-${scope.account}-${scope.region}` };
-}
-function stateUrlFor(provider, bucket) {
-  const verdict = validateStateBucket(provider, bucket);
-  if (verdict !== true) throw new Error(`Not a usable ${provider} state backend name: ${verdict}`);
-  const scheme = provider === "aws" ? "s3://" : provider === "gcp" ? "gs://" : "azblob://";
-  return provider === "azure" ? `${scheme}${bucket}` : `${scheme}${bucket}/clawops`;
-}
-var IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
-function validateStateBucket(provider, name) {
-  const n = name.trim();
-  if (n === "") return "Required";
-  if (n !== name) return "No leading or trailing spaces";
-  if (n.length < 3) return `Too short \u2014 ${labelFor(provider)} names are at least 3 characters`;
-  const dotted = provider === "gcp" && n.includes(".");
-  const max = dotted ? 222 : 63;
-  if (n.length > max) return `Too long \u2014 ${labelFor(provider)} names are at most ${max} characters`;
-  if (dotted && n.split(".").some((part) => part.length > 63)) {
-    return "Each dot-separated part of a Cloud Storage name is at most 63 characters";
-  }
-  if (n !== n.toLowerCase()) return "Lowercase only";
-  if (provider === "azure") {
-    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(n)) {
-      return "Letters, digits and single hyphens only, starting and ending with a letter or digit";
-    }
-    return true;
-  }
-  if (!/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/.test(n)) {
-    return "Letters, digits, dots, hyphens and underscores only, starting and ending with a letter or digit";
-  }
-  if (n.includes("..")) return "No consecutive dots";
-  if (IPV4.test(n)) return "Cannot be formatted as an IP address";
-  if (provider === "aws") {
-    if (n.startsWith("xn--")) return 'Cannot start with "xn--"';
-    if (n.startsWith("sthree-")) return 'Cannot start with "sthree-"';
-    if (n.endsWith("-s3alias")) return 'Cannot end with "-s3alias"';
-    if (n.endsWith("--ol-s3")) return 'Cannot end with "--ol-s3"';
-    if (n.includes("_")) return "Underscores are not allowed in S3 bucket names";
-    return true;
-  }
-  if (n.startsWith("goog")) return 'Cannot start with "goog"';
-  if (n.includes("google")) return 'Cannot contain "google"';
-  return true;
-}
-function labelFor(provider) {
-  if (provider === "aws") return "S3 bucket";
-  if (provider === "gcp") return "Cloud Storage bucket";
-  return "blob container";
-}
-async function resolveScopeAccount(provider, signal) {
-  if (provider === "azure") return void 0;
-  try {
-    if (provider === "aws") {
-      const { callerAccount } = await import("./preflight-TFD4N5ZU.js");
-      return await callerAccount(signal);
-    }
-    const { resolveProjectId } = await import("./preflight-IE2YWBAC.js");
-    return resolveProjectId();
-  } catch {
-    return void 0;
-  }
-}
-
-// src/cli/commands/init.ts
-var SUPPORTED_PROVIDERS = ["gcp", "aws", "azure", "local"];
-var PROVIDER_DEFAULTS = {
-  gcp: { region: "us-central1", credEnv: "GOOGLE_APPLICATION_CREDENTIALS", stateScheme: "gs://" },
-  aws: { region: "us-east-1", credEnv: "AWS_PROFILE", stateScheme: "s3://" },
-  azure: { region: "eastus", credEnv: "AZURE_CLIENT_ID", stateScheme: "azblob://" }
-};
 var init_default = defineCommand({
   meta: {
     name: "init",
@@ -183,8 +114,6 @@ var init_default = defineCommand({
   async run({ args }) {
     const nonInteractive = Boolean(args["non-interactive"]);
     const providerArg = typeof args.provider === "string" ? args.provider : null;
-    const stackName = typeof args.stack === "string" ? args.stack : "default";
-    const forceOverwrite = Boolean(args.force);
     if (nonInteractive && !providerArg) {
       throw new UsageError(
         "--non-interactive requires --provider. Example: clawops init --provider gcp --non-interactive"
@@ -196,107 +125,42 @@ var init_default = defineCommand({
         `Unsupported provider: ${provider}. Supported: ${SUPPORTED_PROVIDERS.join(", ")}`
       );
     }
-    const existing = getConfig();
-    if (existing?.stacks[stackName] && !forceOverwrite) {
-      failure(
-        `Stack "${stackName}" already exists in ${path.join(getConfigDir(), "config.json")} (${existing.stacks[stackName].stateUrl}). Use --force to overwrite its settings, or pass a different --stack name to add another one.`
-      );
-      process2.exit(1);
-    }
-    const configDir = getConfigDir();
-    mkdirSync(configDir, { recursive: true });
-    const keyPath = typeof args["key-path"] === "string" ? args["key-path"] : path.join(configDir, "id_ed25519");
-    const knownHostsPath = path.join(configDir, "known_hosts");
-    if (!existsSync(keyPath)) {
-      if (typeof args["key-path"] === "string") {
-        throw new UsageError(`SSH key not found at ${keyPath}`);
-      }
-      info("Generating SSH key pair...");
-      const gen = spawnSync(
-        "ssh-keygen",
-        ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops", "-q"],
-        { stdio: ["ignore", "pipe", "pipe"] }
-      );
-      if (gen.error || gen.status !== 0) {
-        const reason = gen.error?.message ?? gen.stderr?.toString().trim() ?? `exit ${gen.status}`;
-        throw new UsageError(
-          `Could not generate an SSH key: ${reason}
-Generate one yourself and point clawops at it:
-  ssh-keygen -t ed25519 -f ${keyPath} -N '' -C clawops
-  clawops init --key-path ${keyPath}`
-        );
+    const result = await initStack({
+      provider,
+      stackName: typeof args.stack === "string" ? args.stack : void 0,
+      stateUrl: typeof args.state === "string" ? args.state : void 0,
+      region: typeof args.region === "string" ? args.region : void 0,
+      force: Boolean(args.force),
+      keyPath: typeof args["key-path"] === "string" ? args["key-path"] : void 0,
+      host: typeof args.host === "string" ? args.host : void 0,
+      sshUser: typeof args["ssh-user"] === "string" ? args["ssh-user"] : void 0,
+      sshPort: typeof args["ssh-port"] === "string" ? parseInt(args["ssh-port"], 10) : void 0
+    });
+    if (!result.ok) {
+      if (result.reason.includes("already exists")) {
+        failure(result.reason.replace("Pass force", "Use --force"));
+        process2.exit(1);
       }
-      success(`SSH key pair written to ${keyPath} (and ${keyPath}.pub)`);
-    } else {
-      info(`Using existing SSH key at ${keyPath}`);
-    }
-    if (!existsSync(knownHostsPath)) {
-      writeFileSync(knownHostsPath, "", "utf-8");
+      throw new UsageError(result.reason);
     }
-    let config;
-    if (provider === "local") {
-      const host = typeof args.host === "string" ? args.host : "";
-      if (!host) {
-        throw new UsageError("--host is required for the local provider");
-      }
-      const sshUser = typeof args["ssh-user"] === "string" ? args["ssh-user"] : "root";
-      const sshPort = typeof args["ssh-port"] === "string" ? parseInt(args["ssh-port"], 10) : 22;
-      config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
-        provider,
-        stateUrl: "file://~/.clawops/state",
-        credentialsRef: { source: "file", envVars: [] },
-        localOpts: { host, sshUser, sshPort, sshKeyPath: keyPath }
-      });
-    } else {
-      const defaults = PROVIDER_DEFAULTS[provider];
-      const region = typeof args.region === "string" ? args.region : defaults.region;
-      let stateUrl;
-      if (typeof args.state === "string") {
-        stateUrl = args.state;
-      } else {
-        const account = await resolveScopeAccount(provider);
-        const derived = deriveStateBucket(provider, { account, region });
-        if (!derived.ok) {
-          throw new UsageError(
-            `Could not name a state backend for ${provider}: clawops needs ${derived.needs}.
-Authenticate and run this again, or name the backend yourself:
-  clawops init --provider ${provider} --state ${defaults.stateScheme}your-bucket/clawops`
-          );
-        }
-        stateUrl = stateUrlFor(provider, derived.name);
-      }
-      config = merge(existing, stackName, provider, keyPath, knownHostsPath, {
-        provider,
-        stateUrl,
-        region,
-        credentialsRef: { source: "env", envVars: [defaults.credEnv] }
-      });
+    if (result.keyGenerated) success(`SSH key pair written to ${result.keyPath} (and ${result.keyPath}.pub)`);
+    else info(`Using existing SSH key at ${result.keyPath}`);
+    if (result.provider !== "local") {
       process2.stdout.write("\n");
       info(
-        `State backend: ${stateUrl}
-  clawops doctor --provider ${provider} checks it exists, and clawops setup offers to create it.`
+        `State backend: ${result.stateUrl}
+  clawops doctor --provider ${result.provider} checks it exists, and clawops setup offers to create it.`
       );
       process2.stdout.write("\n");
-      success(`Provider: ${provider}  Region: ${region}  Stack: ${stackName}`);
-      setConfig(config);
-      success(`Config written to ${path.join(configDir, "config.json")}`);
+      success(`Provider: ${result.provider}  Region: ${result.region}  Stack: ${result.stackName}`);
+      success(`Config written to ${path.join(getConfigDir(), "config.json")}`);
       return;
     }
-    setConfig(config);
-    success(`Config written to ${path.join(configDir, "config.json")}`);
+    success(`Config written to ${result.configPath}`);
     process2.stdout.write("\n");
-    success(`Provider: ${provider}  Stack: ${stackName}`);
+    success(`Provider: ${result.provider}  Stack: ${result.stackName}`);
   }
 });
-function merge(existing, stackName, provider, keyPath, knownHostsPath, stack) {
-  return {
-    ...existing ?? {},
-    version: 1,
-    defaults: { stack: stackName, provider },
-    stacks: { ...existing?.stacks ?? {}, [stackName]: stack },
-    ssh: { keyPath, knownHostsPath }
-  };
-}
 
 // src/cli/commands/up.ts
 import { defineCommand as defineCommand2 } from "citty";
@@ -339,7 +203,7 @@ var up_default = defineCommand2({
     "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
@@ -352,7 +216,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
+      const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
       const gatewayPort = parseGatewayPort(args["gateway-port"]);
       const abortController2 = new AbortController();
       process3.on("SIGINT", () => abortController2.abort());
@@ -392,8 +256,8 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const { generatePlan } = await import("./generate-Q2BGVMH7.js");
-    const { applyPlan } = await import("./apply-HJ5GAKHW.js");
+    const { generatePlan } = await import("./generate-4YYNW3IU.js");
+    const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const isDryRun = Boolean(args["dry-run"]);
@@ -473,9 +337,9 @@ function strArg(value) {
   return typeof value === "string" ? value : void 0;
 }
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-VAI5DU5M.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -523,7 +387,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -587,7 +451,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -643,7 +507,7 @@ var status_default = defineCommand4({
 // src/cli/commands/plan.ts
 import { defineCommand as defineCommand5 } from "citty";
 import process7 from "process";
-import { writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync } from "fs";
 import { isAbsolute } from "path";
 function disruptionWarnings(diff) {
   const out = [];
@@ -687,8 +551,8 @@ var plan_default = defineCommand5({
     "private-only": { type: "boolean", description: "Close public SSH and gateway access; reach the stack over its tailnet. Needs `clawops harden --tailscale` first, and checks the tailnet answers before planning" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { generatePlan } = await import("./generate-Q2BGVMH7.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { generatePlan } = await import("./generate-4YYNW3IU.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
@@ -713,7 +577,7 @@ var plan_default = defineCommand5({
     let network = resolved;
     if (args["private-only"]) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-6YP2QKFM.js");
+      const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[ctx.stackName]?.tailscale, ctx.stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -741,7 +605,7 @@ var plan_default = defineCommand5({
     }
     const planJson = JSON.stringify(plan, null, 2);
     if (outPath) {
-      writeFileSync2(outPath, planJson + "\n", "utf-8");
+      writeFileSync(outPath, planJson + "\n", "utf-8");
       success(`Plan written to ${outPath}`);
     } else {
       process7.stdout.write(planJson + "\n");
@@ -803,8 +667,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-JXKN5WD6.js");
-    const { applyPlan } = await import("./apply-HJ5GAKHW.js");
+    const { validatePlan } = await import("./validate-DZE6LFEB.js");
+    const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -930,7 +794,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -1023,8 +887,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -1110,9 +974,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+    const { acquireSession } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -1179,25 +1043,10 @@ var logs_default = defineCommand10({
     json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    if (!outputs["publicIp"]) {
-      failure("Stack has no outputs. Run `clawops up` first.");
-      process12.exit(4);
-    }
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const conn = await connFor(ctx);
     const tailLines = typeof args.tail === "string" ? parseInt(args.tail, 10) : 100;
     const follow = Boolean(args.follow);
     const since = typeof args.since === "string" ? args.since : void 0;
@@ -1239,12 +1088,33 @@ var logs_default = defineCommand10({
     }
   }
 });
+async function connFor(ctx) {
+  if (ctx.adapter.name === "local") {
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    return resolveConn(ctx);
+  }
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const stack = await ctx.getStack();
+  const outputMap = await stack.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  if (!outputs["publicIp"]) {
+    failure("Stack has no outputs. Run `clawops up` first.");
+    process12.exit(4);
+  }
+  return ctx.adapter.getConnectionInfo({
+    ...extractBaseOutputs(outputs),
+    privateKeyPath: ctx.config.ssh.keyPath,
+    knownHostsPath: ctx.config.ssh.knownHostsPath
+  });
+}
 
 // src/cli/commands/config.ts
 import { defineCommand as defineCommand11 } from "citty";
 import process13 from "process";
 var OPENCLAW_CONFIG = configPathForOS("Linux");
-function dockerRunCmd(image) {
+function dockerRunCmd2(image) {
   return gatewayRunCommand({ image, stateDir: STATE_DIR_HOST_LINUX });
 }
 function getPath(obj, dotKey) {
@@ -1285,9 +1155,8 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1302,17 +1171,8 @@ var config_default = defineCommand11({
       process13.exit(2);
     }
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    const conn = await resolveConn(ctx);
     const abortController = new AbortController();
     process13.on("SIGINT", () => abortController.abort());
     process13.on("SIGTERM", () => abortController.abort());
@@ -1375,7 +1235,7 @@ var config_default = defineCommand11({
         process13.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
         return;
       }
-      const { atomicWriteConfig } = await import("./remote-config-3HZLUWEA.js");
+      const { atomicWriteConfig } = await import("./remote-config-OZYBMBSK.js");
       try {
         await atomicWriteConfig(session, cfg, abortController.signal);
       } catch (err) {
@@ -1391,7 +1251,7 @@ var config_default = defineCommand11({
           abortController.signal
         );
         const image = imgResult.stdout.trim();
-        const restartResult = await execPrivileged(session, dockerRunCmd(image), abortController.signal);
+        const restartResult = await execPrivileged(session, dockerRunCmd2(image), abortController.signal);
         if (restartResult.code !== 0) {
           failure(`Restart failed: ${restartResult.stderr}`);
           process13.exit(1);
@@ -1420,9 +1280,8 @@ var agents_default = defineCommand12({
     cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, name] = args._ ?? [];
     if (action === "restart") {
       failure(
@@ -1439,17 +1298,8 @@ var agents_default = defineCommand12({
       process14.exit(2);
     }
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    const conn = await resolveConn(ctx);
     const abortController = new AbortController();
     process14.on("SIGINT", () => abortController.abort());
     process14.on("SIGTERM", () => abortController.abort());
@@ -1495,22 +1345,23 @@ var agents_default = defineCommand12({
           );
         }
       } else {
-        const { agentAuditCommand } = await import("./logs-5A7YYA53.js");
-        const limit = typeof args.limit === "string" ? parseInt(args.limit, 10) : 50;
-        const result = await execPrivileged(
+        const { readAgentActivityRaw, DEFAULT_AGENT_LOG_LIMIT } = await import("./agent-activity-25FAWLAI.js");
+        const limit = typeof args.limit === "string" ? parseInt(args.limit, 10) : DEFAULT_AGENT_LOG_LIMIT;
+        const result = await readAgentActivityRaw(
           session,
-          agentAuditCommand({ agentId: name, limit, cursor: typeof args.cursor === "string" ? args.cursor : void 0 }),
+          { agentId: name, limit, ...typeof args.cursor === "string" ? { cursor: args.cursor } : {} },
           abortController.signal
         );
-        if (result.code !== 0) {
-          failure(`Cannot read activity for "${name}": ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
+        if (!result.ok) {
+          failure(result.error);
           process14.exitCode = 1;
           return;
         }
         if (args.json) {
-          process14.stdout.write(result.stdout);
+          process14.stdout.write(result.value);
         } else {
-          renderAgentRuns(name, result.stdout);
+          const { parseAgentActivity } = await import("./agent-activity-25FAWLAI.js");
+          renderAgentRuns(name, parseAgentActivity(name, result.value));
         }
       }
     } finally {
@@ -1519,16 +1370,14 @@ var agents_default = defineCommand12({
     }
   }
 });
-function renderAgentRuns(agentId, stdout) {
-  let page;
-  try {
-    page = JSON.parse(stdout.trim() || "{}");
-  } catch {
-    failure(`Cannot read activity for "${agentId}": unexpected output: ${stdout.trim().slice(0, 200)}`);
+function renderAgentRuns(agentId, parsed) {
+  if (!parsed.ok) {
+    failure(parsed.error);
     process14.exitCode = 1;
     return;
   }
-  const records = page.records ?? [];
+  const page = parsed.value;
+  const records = page.records;
   if (records.length === 0) {
     info(`No recorded activity for agent "${agentId}".`);
     return;
@@ -1548,99 +1397,6 @@ function renderAgentRuns(agentId, stdout) {
 // src/cli/commands/migrate.ts
 import { defineCommand as defineCommand13 } from "citty";
 import process15 from "process";
-
-// src/openclaw/migrate.ts
-async function migrate(steps) {
-  const sourceImage = await steps.inspectSource();
-  if (!sourceImage) {
-    return {
-      kind: "nothing-to-migrate",
-      reason: "No running OpenClaw container was found, so there is no 1.x state to extract. If this deployment was restarted on a clawops release before 2.0, its state was already lost \u2014 clawops mounted none, so every container replacement discarded it. Deploy fresh with `clawops up`."
-    };
-  }
-  const identityBefore = await steps.deviceId();
-  const backup = await steps.backup();
-  if (!backup.ok) {
-    return {
-      kind: "refused",
-      reason: `Refusing to migrate without a verified backup: ${backup.detail}
-This replaces the running container, and the state it extracts is the only copy.`
-    };
-  }
-  const extracted = await steps.extract();
-  if (!extracted.ok) {
-    return {
-      kind: "failed",
-      reason: "Could not extract state from the running container; it has not been touched.",
-      backupDetail: backup.detail
-    };
-  }
-  await steps.chown();
-  await steps.removeSource();
-  await steps.writeConfig();
-  await steps.start();
-  let restarts = 0;
-  let gate = await steps.gate();
-  if (!gate.ok) {
-    await steps.start();
-    restarts = 1;
-    gate = await steps.gate();
-  }
-  if (!gate.ok) {
-    return {
-      kind: "failed",
-      reason: gate.reason ?? "the gateway did not start after migration",
-      backupDetail: backup.detail
-    };
-  }
-  const identityAfter = await steps.deviceId();
-  const identity = identityBefore === void 0 || identityAfter === void 0 ? "unknown" : identityBefore === identityAfter ? "preserved" : "changed";
-  return { kind: "migrated", entries: extracted.entries, identity, restarts };
-}
-function describeMigration(o) {
-  switch (o.kind) {
-    case "migrated": {
-      const lines = [
-        `Migrated to the 2.0 runtime contract. Carried over: ${o.entries.join(", ") || "(nothing)"}.`
-      ];
-      if (o.restarts > 0) {
-        lines.push(
-          "The gateway needed a second start to finish its state-schema migration, which is expected for a 1.x database."
-        );
-      }
-      if (o.identity === "preserved") {
-        lines.push("Device identity preserved \u2014 paired devices do not need re-pairing.");
-      } else if (o.identity === "changed") {
-        lines.push(
-          "Device identity CHANGED. Paired devices and nodes must be re-paired \u2014 check `openclaw devices list` on the host for what was paired."
-        );
-      } else {
-        lines.push(
-          "Device identity could not be compared, so pairings may or may not have carried over. Check `openclaw devices list` before relying on them."
-        );
-      }
-      lines.push("Your 1.x config was NOT applied \u2014 it never took effect on 1.x either. Review it");
-      lines.push("and set what you need with `clawops config set`.");
-      return lines.join("\n");
-    }
-    case "nothing-to-migrate":
-      return o.reason;
-    case "refused":
-      return o.reason;
-    case "failed":
-      return `Migration failed: ${o.reason}
-A verified backup was taken first: ${o.backupDetail}
-Restore it with \`clawops backup restore --file <archive>\` before retrying.`;
-  }
-}
-
-// src/cli/commands/migrate.ts
-var SYNTHESISED_CONFIG = JSON.stringify({
-  meta: { lastTouchedVersion: "2026.9.2" },
-  gateway: { mode: "local", port: GATEWAY_PORT, auth: { mode: "token" } },
-  models: {},
-  channels: {}
-});
 var migrate_default = defineCommand13({
   meta: {
     name: "migrate",
@@ -1652,120 +1408,41 @@ var migrate_default = defineCommand13({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
-    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
-    const requested = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0;
-    const target = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
-    const targetImage = `ghcr.io/openclaw/openclaw:${target}`;
-    const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputs = Object.fromEntries(
-      Object.entries(await stack.outputs()).map(([k, v]) => [k, v.value])
-    );
-    const conn = ctx.adapter.getConnectionInfo({
-      ...extractBaseOutputs(outputs),
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
+    const { prepareMigration, runMigration, migrationQuestion } = await import("./migrate-flow-24XA4GZL.js");
+    const target = await prepareMigration({
+      stack: typeof args.stack === "string" ? args.stack : void 0,
+      openclawVersion: typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0
     });
+    if (!args.yes) {
+      const inquirer = (await import("inquirer")).default;
+      const { confirmed } = await inquirer.prompt([{
+        type: "confirm",
+        name: "confirmed",
+        message: migrationQuestion(target),
+        default: false
+      }]);
+      if (!confirmed) {
+        info("Aborted. Nothing was changed.");
+        return;
+      }
+    }
     const ac = new AbortController();
     process15.on("SIGINT", () => ac.abort());
-    const { session, release } = await acquireSession({
-      host: conn.host,
-      port: conn.port,
-      user: conn.user,
-      privateKeyPath: conn.privateKeyPath,
-      knownHostsPath: conn.knownHostsPath,
-      signal: ac.signal
-    });
-    const spin = spinner("Inspecting the deployment...");
-    const run = (cmd) => execPrivileged(session, cmd, ac.signal);
-    const archive = "/tmp/clawops-premigration.tar.gz";
-    const configPath = `${STATE_DIR_HOST_LINUX}/${CONFIG_FILENAME}`;
-    const steps = {
-      inspectSource: async () => {
-        const r = await run(`docker inspect openclaw --format '{{.Config.Image}}'`);
-        const image = r.stdout.trim();
-        return r.code === 0 && image.includes(":") ? image : void 0;
-      },
-      backup: async () => {
-        spin.text = "Taking a verified backup...";
-        const r = await run(
-          `docker exec openclaw openclaw backup create --output ${archive} --verify --json`
-        );
-        return r.code === 0 ? { ok: true, detail: `${archive} on the host (verified)` } : { ok: false, detail: (r.stderr || r.stdout).slice(0, 200) };
-      },
-      extract: async () => {
-        spin.text = "Extracting state from the running container...";
-        const mk = await run(`mkdir -p ${STATE_DIR_HOST_LINUX}`);
-        if (mk.code !== 0) return { ok: false, entries: [] };
-        const cp = await run(`docker cp openclaw:/home/node/.openclaw/. ${STATE_DIR_HOST_LINUX}/`);
-        if (cp.code !== 0) return { ok: false, entries: [] };
-        const ls = await run(`ls ${STATE_DIR_HOST_LINUX}`);
-        return { ok: true, entries: ls.stdout.trim().split(/\s+/).filter(Boolean) };
-      },
-      chown: async () => {
-        await run(`chown -R ${CONTAINER_UID}:${CONTAINER_UID} ${STATE_DIR_HOST_LINUX}`);
-      },
-      removeSource: async () => {
-        spin.text = "Stopping the 1.x container...";
-        await run("docker stop openclaw 2>/dev/null || true");
-        await run("docker rm   openclaw 2>/dev/null || true");
-      },
-      writeConfig: async () => {
-        const b64 = Buffer.from(SYNTHESISED_CONFIG, "utf-8").toString("base64");
-        await run(
-          `echo '${b64}' | base64 -d > ${configPath} && chown ${CONTAINER_UID}:${CONTAINER_UID} ${configPath}`
-        );
-      },
-      start: async () => {
-        spin.text = "Starting the 2.0 gateway...";
-        await run(gatewayRunCommand({ image: targetImage, stateDir: STATE_DIR_HOST_LINUX }));
-      },
-      gate: async () => {
-        spin.text = "Waiting for the gateway to start...";
-        let last;
-        for (let i = 0; i < 15; i++) {
-          if (ac.signal.aborted) return { ok: false, reason: "aborted" };
-          const r = await run(probeCommand("started", GATEWAY_PORT));
-          const v = interpretProbe("started", r.stdout);
-          if (v.ok) return { ok: true };
-          last = v.reason;
-          await new Promise((res) => setTimeout(res, 2e3));
-        }
-        return { ok: false, reason: last ?? "no response" };
-      },
-      deviceId: async () => {
-        const file = await run(
-          `docker exec openclaw sh -c 'cat ~/.openclaw/identity/device.json 2>/dev/null' || cat ${STATE_DIR_HOST_LINUX}/identity/device.json 2>/dev/null || true`
-        );
-        try {
-          const parsed = JSON.parse(file.stdout.trim());
-          return parsed.deviceId;
-        } catch {
-          return void 0;
-        }
-      }
-    };
+    let spin;
     try {
-      const outcome = await migrate(steps);
-      spin.stop();
-      const report = describeMigration(outcome);
-      if (outcome.kind === "migrated") {
-        success(report.split("\n")[0]);
-        for (const line2 of report.split("\n").slice(1)) {
-          if (/CHANGED|could not be compared/.test(line2)) warn(line2);
-          else info(line2);
+      const result = await runMigration(target, {
+        signal: ac.signal,
+        onStep: (text) => {
+          if (spin) spin.text = text;
+          else spin = spinner(text);
         }
-        info(`Pre-migration backup: ${archive}`);
-      } else {
-        failure(report);
-        process15.exit(outcome.kind === "nothing-to-migrate" ? 0 : 1);
-      }
+      });
+      spin?.stop();
+      const render2 = { success, info, warn, failure };
+      for (const line2 of result.lines) render2[line2.level](line2.text);
+      if (result.outcome.kind !== "migrated") process15.exit(result.exitCode);
     } finally {
-      release();
-      drainPool();
+      spin?.stop();
     }
   }
 });
@@ -1773,13 +1450,6 @@ var migrate_default = defineCommand13({
 // src/cli/commands/gateway.ts
 import { defineCommand as defineCommand14 } from "citty";
 import process16 from "process";
-function dockerRunCmd2(version, publish = "loopback") {
-  return gatewayRunCommand({
-    image: `ghcr.io/openclaw/openclaw:${version}`,
-    stateDir: STATE_DIR_HOST_LINUX,
-    publish
-  });
-}
 var gateway_default = defineCommand14({
   meta: {
     name: "gateway",
@@ -1791,26 +1461,16 @@ var gateway_default = defineCommand14({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
       process16.exit(2);
     }
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    const conn = await resolveConn(ctx);
     const abortController = new AbortController();
     process16.on("SIGINT", () => abortController.abort());
     process16.on("SIGTERM", () => abortController.abort());
@@ -1824,25 +1484,12 @@ var gateway_default = defineCommand14({
     });
     try {
       if (action === "status") {
-        const { inspectContainer } = await import("./docker-3PDO4TS7.js");
-        const inspected = await inspectContainer(
-          session,
-          "openclaw",
-          '{"status":"{{.State.Status}}","started":"{{.State.StartedAt}}","image":"{{.Config.Image}}"}',
-          abortController.signal
-        );
-        let status = { status: "unknown", started: "", image: "" };
-        if (inspected.kind === "ok") {
-          try {
-            status = JSON.parse(inspected.value);
-          } catch {
-          }
-        } else if (inspected.kind === "missing") {
-          status = { status: "not running", started: "", image: "" };
-        } else {
-          failure(`Could not ask docker about the gateway: ${inspected.detail}`);
+        const inspected = await gatewayStatus(session, abortController.signal);
+        if (!inspected.ok) {
+          failure(inspected.error);
           process16.exit(1);
         }
+        const status = inspected.value;
         if (args.json) {
           printJson(jsonOk(status));
         } else {
@@ -1870,7 +1517,7 @@ var gateway_default = defineCommand14({
         const spin = spinner("Restarting gateway...");
         const result = await execPrivileged(
           session,
-          dockerRunCmd2(version, publish),
+          dockerRunCmd(version, publish),
           abortController.signal
         );
         spin.stop();
@@ -1880,121 +1527,23 @@ var gateway_default = defineCommand14({
         }
         success(`Gateway restarted (${version}).`);
       } else {
-        const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
-        const requested = versionArg ?? args.channel;
-        const version = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
+        const target = await resolveUpdateVersion(versionArg ?? args.channel);
+        if (!target.ok) throw new UsageError(target.error);
+        const version = target.value;
         const spin = spinner(`Updating gateway to ${version}...`);
-        const targetImage = `ghcr.io/openclaw/openclaw:${version}`;
-        const pullResult = await execPrivileged(
-          session,
-          `docker pull ${targetImage}`,
-          abortController.signal
-        );
-        if (pullResult.code !== 0) {
-          spin.stop();
-          failure(`Pull failed: ${pullResult.stderr}`);
-          process16.exit(1);
-        }
-        spin.text = "Checking state compatibility...";
-        const {
-          snapshotCommand,
-          snapshotPathFrom,
-          preflightCommand,
-          parsePreflight,
-          judgePreflight
-        } = await import("./upgrade-ULD4KFYC.js");
-        const cur = imageForRestart(
-          (await execPrivileged(session, IMAGE_INSPECT_CMD, abortController.signal)).stdout
-        );
-        const snapRepo = `${STATE_DIR_HOST_LINUX}/snapshots`;
-        const snapOut = await execPrivileged(
-          session,
-          snapshotCommand(cur.ok ? cur.value : targetImage, STATE_DIR_HOST_LINUX, snapRepo),
-          abortController.signal
-        );
-        const snapPath = snapshotPathFrom(snapOut.stdout);
-        if (!snapPath) {
-          spin.stop();
-          failure(
-            "Could not snapshot the state database before upgrading, so neither the compatibility check nor a rollback point is available.\n" + (snapOut.stderr || snapOut.stdout).slice(0, 300)
-          );
-          process16.exit(1);
-        }
-        const pre = await execPrivileged(
-          session,
-          preflightCommand(targetImage, STATE_DIR_HOST_LINUX, `${snapPath}/database.sqlite`),
-          abortController.signal
-        );
-        const report = parsePreflight(pre.stdout);
-        const verdict = report ? judgePreflight(report) : { ok: false, reason: `preflight produced no readable report: ${pre.stderr.slice(0, 200)}` };
-        if (!verdict.ok) {
-          spin.stop();
-          failure(`Refusing to upgrade to ${version}: ${verdict.reason}`);
-          info(`A snapshot of the current state was kept at ${snapPath}.`);
-          process16.exit(1);
-        }
-        if (verdict.ok && verdict.note) info(verdict.note);
-        spin.text = `Updating gateway to ${version}...`;
-        const pubU = await execPrivileged(session, PUBLISH_INSPECT_CMD, abortController.signal);
-        const runResult = await execPrivileged(
-          session,
-          dockerRunCmd2(version, publishForRestart(pubU.stdout)),
-          abortController.signal
-        );
-        if (runResult.code !== 0) {
-          spin.stop();
-          failure(`Start failed: ${runResult.stderr}`);
-          info(`State snapshot from before the upgrade: ${snapPath}`);
-          process16.exit(1);
-        }
-        spin.text = "Waiting for the gateway to start...";
-        const { probeCommand: probeCommand2, interpretProbe: interpretProbe2 } = await import("./health-5CCOXYGG.js");
-        const { repairCommand, describeOutcome } = await import("./upgrade-ULD4KFYC.js");
-        const publish = publishForRestart(pubU.stdout);
-        const gate = async () => {
-          let last;
-          for (let i = 0; i < 15; i++) {
-            if (abortController.signal.aborted) return { ok: false, reason: "aborted" };
-            const r = await execPrivileged(
-              session,
-              probeCommand2("started", GATEWAY_PORT),
-              abortController.signal
-            );
-            const v = interpretProbe2("started", r.stdout);
-            if (v.ok) return { ok: true };
-            last = v.reason;
-            await new Promise((res) => setTimeout(res, 2e3));
-          }
-          return { ok: false, reason: last ?? "no response" };
-        };
-        const { resolveUpgrade } = await import("./upgrade-ULD4KFYC.js");
-        const outcome = await resolveUpgrade(
-          {
-            gate,
-            repair: async () => {
-              spin.text = "Gateway did not start; attempting one-shot repair...";
-              await execPrivileged(
-                session,
-                repairCommand(targetImage, STATE_DIR_HOST_LINUX),
-                abortController.signal
-              );
-            },
-            run: async (v) => {
-              await execPrivileged(session, dockerRunCmd2(v, publish), abortController.signal);
-            }
+        const result = await updateGateway(session, version, {
+          signal: abortController.signal,
+          onProgress: (text) => {
+            spin.text = text;
           },
-          {
-            version,
-            previousVersion: cur.ok ? versionOf(cur.value) : void 0,
-            snapshotPath: snapPath
-          }
-        );
+          onNote: (text) => info(text)
+        });
         spin.stop();
-        const message = describeOutcome(outcome, version);
-        if (outcome.kind === "started" || outcome.kind === "repaired") {
-          success(message);
+        if (result.ok) {
+          success(result.message);
         } else {
-          failure(message);
+          failure(result.message);
+          if (result.hint) info(result.hint);
           process16.exit(1);
         }
       }
@@ -2007,24 +1556,23 @@ var gateway_default = defineCommand14({
 
 // src/cli/commands/backup.ts
 import { defineCommand as defineCommand15 } from "citty";
-import { createWriteStream } from "fs";
-import { pipeline } from "stream/promises";
 import process17 from "process";
 var backup_default = defineCommand15({
   meta: {
     name: "backup",
-    description: "Create an OpenClaw backup (restore is unavailable on this release line)"
+    description: "Create an OpenClaw backup, or restore one into a staging directory"
   },
   args: {
-    action: { type: "positional", description: "Action: create (restore returns in clawops 2.x)", required: true },
+    action: { type: "positional", description: "Action: create | restore", required: true },
     out: { type: "string", description: "[create] Local path to write the backup archive" },
-    file: { type: "string", description: "[restore] Local backup archive (restore is unavailable)" },
+    file: { type: "string", description: "[restore] Local backup archive to verify and expand on the host" },
     stack: { type: "string", description: "Target stack name" },
-    yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
+    yes: { type: "boolean", description: "[restore] Skip confirmation prompt" },
+    activate: { type: "boolean", description: "[restore] Put the restored state into service: stop the gateway, swap it in, restart, and roll back if it does not come up" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -2074,86 +1622,91 @@ var backup_default = defineCommand15({
       signal: abortController.signal
     });
     try {
+      const flows = await import("./backup-flows-NDP5JTR3.js");
       if (action === "create") {
-        const outPath = typeof args.out === "string" ? args.out : `openclaw-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.tar.gz`;
+        const outPath = typeof args.out === "string" ? args.out : flows.defaultBackupFilename();
         info(`Writing backup to ${outPath}...`);
         const spin = spinner("Creating backup on remote host...");
-        const remoteArchive = "/tmp/clawops-backup.tar.gz";
-        const createResult = await execPrivileged(
-          session,
-          `docker exec openclaw sh -lc 'rm -f ${remoteArchive} && openclaw backup create --output ${remoteArchive} --verify --json'`,
-          abortController.signal
-        );
-        if (createResult.code !== 0) {
-          spin.stop();
-          throw new Error(`Backup failed on the remote host: ${createResult.stderr.slice(0, 300)}`);
-        }
-        const backupStream = await streamPrivileged(
-          session,
-          `docker exec openclaw cat ${remoteArchive}`,
-          abortController.signal
-        );
+        const created = await flows.createBackup(session, {
+          outPath,
+          signal: abortController.signal,
+          onPhase: (phase) => {
+            if (phase === "downloading") spin.stop();
+          }
+        });
         spin.stop();
-        const fileStream = createWriteStream(outPath, { mode: 384 });
-        await pipeline(backupStream, fileStream);
-        await execPrivileged(
-          session,
-          `docker exec openclaw rm -f ${remoteArchive}`,
-          abortController.signal
-        );
+        if (!created.ok) throw new Error(created.reason);
         success(`Backup saved to ${outPath}`);
-        info("Saved with mode 0600. The archive contains the state database \u2014 OAuth tokens,");
-        info("secrets and device credentials, unencrypted. Treat it as a credential.");
+        for (const line2 of flows.ARCHIVE_IS_A_CREDENTIAL) info(line2);
       } else {
         const file = typeof args.file === "string" ? args.file : void 0;
         if (!file) {
           throw new UsageError("Usage: clawops backup restore --file <archive.tar.gz>");
         }
-        const { createReadStream } = await import("fs");
-        const remoteArchive = "/tmp/clawops-restore.tar.gz";
-        const staging = `/tmp/clawops-restored-${Date.now()}`;
-        const spin = spinner("Uploading archive...");
-        const uploadResult = await execPrivilegedWithInput(
-          session,
-          `docker exec -i openclaw sh -c 'cat > ${remoteArchive}'`,
-          createReadStream(file),
-          abortController.signal
-        );
-        if (uploadResult.code !== 0) {
-          spin.stop();
-          throw new Error(`Could not upload the archive: ${uploadResult.stderr.slice(0, 300)}`);
+        let spin;
+        const staged = await flows.stageRestore(session, {
+          file,
+          signal: abortController.signal,
+          onPhase: (phase) => {
+            if (phase === "uploading") spin = spinner("Uploading archive...");
+            else if (spin) spin.text = "Verifying and restoring to a staging directory...";
+          }
+        });
+        spin?.stop();
+        if (staged.unparsedReport !== void 0) info(staged.unparsedReport);
+        if (!staged.ok) {
+          if (staged.kind === "refused") throw new UsageError(staged.reason);
+          if (staged.kind === "failed") throw new Error(staged.reason);
+          failure(staged.reason);
+          if (staged.stagingOnHost) info(flows.nothingChanged(staged.stagingOnHost));
+          process17.exit(1);
         }
-        spin.text = "Verifying and restoring to a staging directory...";
-        const restore = await execPrivileged(
-          session,
-          `docker exec openclaw openclaw backup restore ${remoteArchive} --target ${staging} --json`,
-          abortController.signal
-        );
-        await execPrivileged(
-          session,
-          `docker exec openclaw rm -f ${remoteArchive}`,
-          abortController.signal
-        );
-        spin.stop();
-        if (restore.code !== 0) {
-          throw new Error(`Restore failed: ${(restore.stderr || restore.stdout).slice(0, 400)}`);
+        const { stagingOnHost, stateDir } = staged;
+        success(`Archive verified and expanded to ${stagingOnHost} on the host.`);
+        if (staged.entryCount !== void 0) info(`${staged.entryCount} entries restored.`);
+        for (const w of staged.warnings) warn(w);
+        if (!args.activate) {
+          info("");
+          info("Nothing has been activated. Re-run with --activate to put this state into");
+          info("service, or adopt it by hand:");
+          info("  1. clawops ssh --command 'sudo docker stop openclaw'");
+          info(`  2. replace the contents of ${stateDir} with those of`);
+          info(`     ${staged.statePath}`);
+          info(`     (the archive holds ${staged.stateDirInArchive} under payload/posix, not a`);
+          info("      drop-in state directory \u2014 moving the bundle itself stops the gateway)");
+          info("  3. clawops gateway restart");
+          for (const line2 of flows.PLUGINS_NOT_CARRIED) info(line2);
+          return;
         }
-        let report = {};
-        try {
-          report = JSON.parse(restore.stdout.trim());
-        } catch {
-          info(restore.stdout);
+        if (!args.yes) {
+          const { createInterface: createInterface3 } = await import("readline/promises");
+          const rl = createInterface3({ input: process17.stdin, output: process17.stdout });
+          const answer = await rl.question(
+            `Stop the gateway and put this restored state into service? The state it replaces is kept alongside it, and clawops puts it back if the gateway does not come up. [y/N] `
+          );
+          rl.close();
+          if (!answer.toLowerCase().startsWith("y")) {
+            info(`Aborted. The restored state is at ${stagingOnHost}; nothing was changed.`);
+            return;
+          }
         }
-        success(`Archive verified and restored to ${staging} on the host.`);
-        if (report.entryCount !== void 0) info(`${report.entryCount} entries restored.`);
-        for (const w of report.warnings ?? []) warn(w);
-        info("");
-        info("Nothing has been activated. To adopt the restored state:");
-        info("  1. clawops ssh --command 'sudo docker stop openclaw'");
-        info(`  2. replace the state directory contents with ${staging}`);
-        info("  3. clawops gateway restart");
-        info("Provider plugins are not carried in the archive; re-run `clawops apply` to");
-        info("reinstall them, or the gateway starts without its model providers.");
+        const activating = spinner("Activating the restored state...");
+        const outcome = await flows.activateStaged(session, staged, {
+          signal: abortController.signal,
+          onPhase: (phase) => {
+            if (phase === "restarting") activating.text = "Restarting the gateway...";
+            else if (phase === "waiting") activating.text = "Waiting for the gateway to answer...";
+            else if (phase === "done") activating.stop();
+          }
+        });
+        activating.stop();
+        if (!outcome.ok) {
+          failure(outcome.reason);
+          for (const line2 of flows.activationFailureDetail(outcome)) info(line2);
+          process17.exit(1);
+        }
+        success(flows.ACTIVATED);
+        for (const line2 of flows.activatedLines(outcome.preserved)) info(line2);
       }
     } finally {
       release();
@@ -2182,16 +1735,16 @@ var stacks_default = defineCommand16({
       process18.exit(2);
     }
     if (action === "list") {
-      const config2 = requireConfig();
-      const defaultStack = config2.defaults.stack;
-      const rows = Object.entries(config2.stacks).map(([n, s]) => [
+      const config = requireConfig();
+      const defaultStack = config.defaults.stack;
+      const rows = Object.entries(config.stacks).map(([n, s]) => [
         n === defaultStack ? `${n} *` : n,
         s.provider,
         s.region ?? "\u2014",
         s.stateUrl
       ]);
       if (args.json) {
-        const data = Object.entries(config2.stacks).map(([n, s]) => ({
+        const data = Object.entries(config.stacks).map(([n, s]) => ({
           name: n,
           provider: s.provider,
           region: s.region ?? null,
@@ -2216,49 +1769,17 @@ var stacks_default = defineCommand16({
       failure("Usage: clawops stacks delete <name>");
       process18.exit(2);
     }
-    const config = requireConfig();
-    if (!(name in config.stacks)) {
-      throw new UsageError(`Stack "${name}" not found in config.`);
-    }
-    const stackNames = Object.keys(config.stacks);
-    if (stackNames.length === 1) {
-      throw new UsageError(
-        `Cannot delete the only remaining stack "${name}". Add another stack first or run \`clawops destroy\` to tear down resources.`
-      );
-    }
-    if (name === config.defaults.stack && !args.force) {
-      throw new UsageError(
-        `"${name}" is the default stack. Use --force to delete it (clawops will switch the default to another stack).`
-      );
-    }
-    let isDeployed = false;
-    if (!args.force) {
-      try {
-        const { buildContext } = await import("./context-7VI3R6EK.js");
-        const ctx = buildContext({ stack: name });
-        if (ctx.adapter.name === "local") {
-          isDeployed = !!ctx.localState;
-        } else {
-          const stack = await ctx.getStack();
-          const outputMap = await stack.outputs();
-          const outputs = Object.fromEntries(
-            Object.entries(outputMap).map(([k, v]) => [k, v.value])
-          );
-          isDeployed = !!outputs["publicIp"];
-        }
-      } catch {
-        warn(`Could not verify deployment status for "${name}" \u2014 proceeding anyway.`);
+    const { checkStackDelete, deleteStackFromConfig, forgetNotice } = await import("./stack-delete-NTIGKWUF.js");
+    const check = await checkStackDelete(name, { force: !!args.force });
+    if (!check.ok) {
+      if (check.refusal === "deployed") {
+        failure(check.reason);
+        process18.exit(1);
       }
+      throw new UsageError(check.reason);
     }
-    if (isDeployed) {
-      failure(
-        `Stack "${name}" is still deployed. Run \`clawops down --stack ${name}\` first to destroy cloud resources, or pass --force to remove from registry only.`
-      );
-      process18.exit(1);
-    }
-    warn(
-      `This removes "${name}" from clawops config only. Cloud resources are NOT destroyed. Run \`clawops destroy --stack ` + name + "` first if you want to remove cloud resources."
-    );
+    for (const w of check.warnings) warn(w);
+    warn(forgetNotice(name));
     if (!args.yes) {
       const confirmed = await confirm(`Delete stack "${name}" from config?`);
       if (!confirmed) {
@@ -2266,18 +1787,9 @@ var stacks_default = defineCommand16({
         return;
       }
     }
-    const updated = { ...config };
-    const newStacks = { ...config.stacks };
-    delete newStacks[name];
-    updated.stacks = newStacks;
-    if (name === config.defaults.stack) {
-      updated.defaults = { ...config.defaults, stack: Object.keys(newStacks)[0] };
-    }
-    setConfig(updated);
-    success(`Stack "${name}" removed from config.`);
-    if (name === config.defaults.stack) {
-      info(`Default stack switched to "${updated.defaults.stack}".`);
-    }
+    const deleted = deleteStackFromConfig(name);
+    success(deleted.message);
+    if (deleted.newDefaultMessage) info(deleted.newDefaultMessage);
   }
 });
 async function confirm(message) {
@@ -2375,7 +1887,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-B7I6HBQH.js");
+    const { serveMcp } = await import("./server-E3YA32ND.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -2453,11 +1965,11 @@ var wireCmd = defineCommand18({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-FQOMM7MK.js");
-    const { MCP_HTTP_PORT } = await import("./server-B7I6HBQH.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-BXF4DJFT.js");
+    const { MCP_HTTP_PORT } = await import("./server-E3YA32ND.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -2557,8 +2069,8 @@ import { defineCommand as defineCommand19 } from "citty";
 import process21 from "process";
 import os from "os";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { execSync, spawnSync as spawnSync2, spawn as spawn2 } from "child_process";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync, mkdirSync } from "fs";
+import { execSync, spawnSync, spawn as spawn2 } from "child_process";
 import path2 from "path";
 var setup_default = defineCommand19({
   meta: {
@@ -2617,7 +2129,7 @@ var setup_default = defineCommand19({
     } else {
       provider = "local";
       info("We'll connect to your server over SSH to install and configure OpenClaw.\n");
-      if (!existsSync2(localKeyPath)) {
+      if (!existsSync(localKeyPath)) {
         info(`No SSH key found at ${localKeyPath}.`);
         const { genKey } = await inquirer.prompt([{
           type: "confirm",
@@ -2653,7 +2165,7 @@ var setup_default = defineCommand19({
           name: "keyPath",
           message: `SSH private key file: (the key file on your computer used to log in \u2014 e.g. ~/.ssh/id_ed25519)`,
           default: localKeyPath,
-          validate: (v) => existsSync2(v.trim()) || `File not found: ${v.trim()}`
+          validate: (v) => existsSync(v.trim()) || `File not found: ${v.trim()}`
         }
       ]);
       localHost = localAnswers.host;
@@ -2875,10 +2387,10 @@ var setup_default = defineCommand19({
     }
     const gatewayToken = randomBytes(24).toString("hex");
     const secretsDir2 = path2.join(os.homedir(), ".clawops", "secrets");
-    mkdirSync2(secretsDir2, { recursive: true });
-    spawnSync2("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    mkdirSync(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
     const tokenPath = path2.join(secretsDir2, `GATEWAY_TOKEN_${stackAnswers.stackName}`);
-    writeFileSync3(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
+    writeFileSync2(tokenPath, gatewayToken, { encoding: "utf-8", mode: 384 });
     const openclawConfigOverlay = {
       models: builtModelConfig,
       gateway: { auth: { mode: "token", token: gatewayToken } }
@@ -2889,7 +2401,7 @@ var setup_default = defineCommand19({
     let outputPath;
     if (provider === "local") {
       outputPath = path2.join(outDir, `openclaw-${stackAnswers.stackName}.json`);
-      writeFileSync3(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
+      writeFileSync2(outputPath, JSON.stringify(openclawConfigOverlay, null, 2), "utf-8");
       process21.stdout.write("\n");
       success(`Config file saved to ${outputPath}`);
     } else {
@@ -2935,7 +2447,7 @@ var setup_default = defineCommand19({
         }
       };
       outputPath = path2.join(outDir, `clawops-${stackAnswers.stackName}-plan.json`);
-      writeFileSync3(outputPath, JSON.stringify(plan, null, 2), "utf-8");
+      writeFileSync2(outputPath, JSON.stringify(plan, null, 2), "utf-8");
       process21.stdout.write("\n");
       success(`Deployment plan saved to ${outputPath}`);
     }
@@ -3040,7 +2552,7 @@ var setup_default = defineCommand19({
           inquirer
         });
       } else {
-        const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
+        const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
         const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
         process21.stdout.write("\n");
         info("To deploy later, run these two commands:");
@@ -3057,7 +2569,7 @@ var setup_default = defineCommand19({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-HJ5GAKHW.js");
+        const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -3085,13 +2597,13 @@ To deploy later:  clawops apply ${outputPath}`);
   }
 });
 async function runLocalDeploy(opts) {
-  const { setConfig: setConfig2, getConfig: getConfig2, getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
-  const { localBootstrap } = await import("./bootstrap-NN647RCY.js");
-  const { connect } = await import("./ssh-VAI5DU5M.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
+  const { setConfig, getConfig, getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
+  const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
-  const existing = getConfig2();
+  const existing = getConfig();
   const stackEntry = {
     provider: "local",
     stateUrl: "file://~/.clawops/state",
@@ -3104,7 +2616,7 @@ async function runLocalDeploy(opts) {
     stacks: { [opts.stackName]: stackEntry },
     ssh: { keyPath: opts.keyPath, knownHostsPath }
   };
-  setConfig2(newConfig);
+  setConfig(newConfig);
   success(`Deployment "${opts.stackName}" registered  (~/.clawops/config.json)`);
   await checkDockerPreflight({ host: opts.host, port: opts.port, user: opts.user, keyPath: opts.keyPath, knownHostsPath, signal: opts.signal, inquirer: opts.inquirer });
   const STAGES = [
@@ -3169,7 +2681,7 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-PIIKJ4L2.js");
+  const { drainPool } = await import("./pool-NT4XBSUT.js");
   drainPool();
   const tokenPath = path2.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
@@ -3229,7 +2741,7 @@ ${cfg.loginHint}`);
   }]);
   if (runNow) {
     process21.stdout.write("\n");
-    const result = spawnSync2(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
+    const result = spawnSync(cfg.loginCmd[0], cfg.loginCmd.slice(1), { stdio: "inherit" });
     if (result.error) {
       failure(`Could not launch ${cliName} \u2014 is it installed? (${result.error.message})`);
       info(`Install guide: ${cliInstallUrl(provider)}`);
@@ -3273,12 +2785,12 @@ async function promptSecret(name, label, envDefault, inquirer) {
       message: `Paste your ${label}: (input is hidden)`,
       validate: (v) => v.trim() !== "" || "Value cannot be empty"
     }]);
-    mkdirSync2(secretsDir2, { recursive: true });
-    spawnSync2("chmod", ["700", secretsDir2], { stdio: "ignore" });
-    const secretPath2 = path2.join(secretsDir2, name);
-    writeFileSync3(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret saved to ${secretPath2}  (chmod 600)`);
-    return { name, source: "file", ref: secretPath2 };
+    mkdirSync(secretsDir2, { recursive: true });
+    spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
+    const secretPath = path2.join(secretsDir2, name);
+    writeFileSync2(secretPath, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret saved to ${secretPath}  (chmod 600)`);
+    return { name, source: "file", ref: secretPath };
   }
   if (secretSource === "env") {
     const { envVar } = await inquirer.prompt([{
@@ -3293,7 +2805,7 @@ async function promptSecret(name, label, envDefault, inquirer) {
     type: "input",
     name: "filePath",
     message: `File path: (full path to the file containing your ${label})`,
-    validate: (v) => existsSync2(v.trim()) || `File not found: ${v.trim()}`
+    validate: (v) => existsSync(v.trim()) || `File not found: ${v.trim()}`
   }]);
   return { name, source: "file", ref: filePath };
 }
@@ -3307,7 +2819,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+  const { acquireSession } = await import("./pool-NT4XBSUT.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -3354,7 +2866,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+  const { acquireSession } = await import("./pool-NT4XBSUT.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -3451,7 +2963,7 @@ async function startDockerAndWait(inquirer) {
     await pollUntilDockerReady("Waiting for Docker daemon...");
   } else if (choice === "systemctl") {
     const spin = spinner("Running: sudo systemctl start docker...");
-    const res = spawnSync2("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
+    const res = spawnSync("sudo", ["systemctl", "start", "docker"], { stdio: "pipe" });
     if (res.status !== 0) {
       spin.fail("systemctl start docker failed.");
       throw new Error("systemctl start docker failed");
@@ -3459,18 +2971,18 @@ async function startDockerAndWait(inquirer) {
     spin.succeed("Docker service started.");
     await pollUntilDockerReady("Waiting for Docker daemon to be reachable...");
   } else if (choice === "desktop") {
-    const backendRunning = spawnSync2("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
+    const backendRunning = spawnSync("pgrep", ["-f", "com.docker.backend"], { stdio: "ignore" }).status === 0;
     if (backendRunning) {
       const killSpin = spinner("Docker Desktop is stuck \u2014 force-restarting...");
       for (const pat of ["com.docker.backend", "com.docker.virtualization", "com.docker.build", "Docker Desktop"]) {
-        spawnSync2("pkill", ["-9", "-f", pat], { stdio: "ignore" });
+        spawnSync("pkill", ["-9", "-f", pat], { stdio: "ignore" });
       }
       await new Promise((r) => setTimeout(r, 2e3));
       killSpin.succeed("Old Docker processes cleared.");
     }
     const openSpin = spinner("Launching Docker Desktop...");
-    let opened = spawnSync2("open", ["-a", "Docker"], { stdio: "ignore" });
-    if (opened.status !== 0) opened = spawnSync2("open", ["/Applications/Docker.app"], { stdio: "ignore" });
+    let opened = spawnSync("open", ["-a", "Docker"], { stdio: "ignore" });
+    if (opened.status !== 0) opened = spawnSync("open", ["/Applications/Docker.app"], { stdio: "ignore" });
     if (opened.status !== 0) {
       openSpin.fail("Could not open Docker Desktop \u2014 is it installed in /Applications?");
       throw new Error("Failed to open Docker Desktop");
@@ -3479,7 +2991,7 @@ async function startDockerAndWait(inquirer) {
     await pollUntilDockerReady("Waiting for Docker engine to start...");
   } else if (choice === "colima") {
     const spin = spinner("Running: colima start...");
-    const res = spawnSync2("colima", ["start"], { stdio: "pipe" });
+    const res = spawnSync("colima", ["start"], { stdio: "pipe" });
     if (res.status !== 0) {
       spin.fail("colima start failed \u2014 is Colima installed? (brew install colima docker)");
       throw new Error("colima start failed");
@@ -3491,12 +3003,12 @@ async function startDockerAndWait(inquirer) {
 var LOCALHOST_ALIASES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
 async function ensureAuthorizedKey(keyPath, host, inquirer) {
   const pubKeyPath = `${keyPath}.pub`;
-  if (!existsSync2(pubKeyPath)) return;
+  if (!existsSync(pubKeyPath)) return;
   const pubKey = readFileSync3(pubKeyPath, "utf-8").trim();
   const isLocal = LOCALHOST_ALIASES.has(host.toLowerCase());
   const authorizedKeysPath = path2.join(os.homedir(), ".ssh", "authorized_keys");
   if (isLocal) {
-    const existing = existsSync2(authorizedKeysPath) ? readFileSync3(authorizedKeysPath, "utf-8") : "";
+    const existing = existsSync(authorizedKeysPath) ? readFileSync3(authorizedKeysPath, "utf-8") : "";
     if (existing.includes(pubKey)) {
       success("SSH public key is already in authorized_keys.");
       return;
@@ -3509,10 +3021,10 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
       default: true
     }]);
     if (addKey) {
-      mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
+      mkdirSync(path2.join(os.homedir(), ".ssh"), { recursive: true });
       const entry = existing.endsWith("\n") || existing === "" ? pubKey + "\n" : "\n" + pubKey + "\n";
-      writeFileSync3(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
-      spawnSync2("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
+      writeFileSync2(authorizedKeysPath, existing + entry, { encoding: "utf-8", flag: "a" });
+      spawnSync("chmod", ["600", authorizedKeysPath], { stdio: "ignore" });
       success("Public key added to ~/.ssh/authorized_keys.");
     } else {
       info("SSH will likely fail. Add this line to ~/.ssh/authorized_keys manually:");
@@ -3527,8 +3039,8 @@ async function ensureAuthorizedKey(keyPath, host, inquirer) {
 }
 async function generateSshKey() {
   const keyPath = path2.join(os.homedir(), ".ssh", "id_ed25519");
-  mkdirSync2(path2.join(os.homedir(), ".ssh"), { recursive: true });
-  const result = spawnSync2("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
+  mkdirSync(path2.join(os.homedir(), ".ssh"), { recursive: true });
+  const result = spawnSync("ssh-keygen", ["-t", "ed25519", "-f", keyPath, "-N", "", "-C", "clawops"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (result.status !== 0) {
@@ -3543,7 +3055,7 @@ function detectSshKey() {
   const candidates = ["id_ed25519", "id_ecdsa", "id_rsa", "id_dsa"];
   for (const name of candidates) {
     const p = path2.join(os.homedir(), ".ssh", name);
-    if (existsSync2(p)) return p;
+    if (existsSync(p)) return p;
   }
   return path2.join(os.homedir(), ".ssh", "id_ed25519");
 }
@@ -3559,9 +3071,9 @@ async function maybeWireGatewayMcp(opts) {
   process21.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-VAI5DU5M.js");
-  const { getConfigDir: getConfigDir2 } = await import("./store-OVB3DAJR.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-FQOMM7MK.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
+  const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-BXF4DJFT.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3680,9 +3192,9 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-3KKCR7BL.js");
-  const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
-  const config = getConfig2();
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-UHAOVQMZ.js");
+  const { getConfig } = await import("./store-YOLQYXMB.js");
+  const config = getConfig();
   if (!config) return;
   const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
   if (availableModules.length === 0) return;
@@ -3704,7 +3216,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-7VI3R6EK.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3827,21 +3339,16 @@ async function runAccountPreflight(opts) {
 
 // src/cli/commands/secret.ts
 import { defineCommand as defineCommand20 } from "citty";
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync, mkdirSync as mkdirSync3, statSync } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
-import path3 from "path";
-import os2 from "os";
+import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
 import process22 from "process";
-var SECRETS_DIR = path3.join(os2.homedir(), ".clawops", "secrets");
-function secretsDir() {
-  return SECRETS_DIR;
-}
-function secretPath(name) {
-  return path3.join(secretsDir(), name);
-}
-function listSecretNames() {
-  if (!existsSync3(secretsDir())) return [];
-  return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
+function secretPathOrExit(name) {
+  const resolved = resolveSecretPath(name);
+  if (!resolved.ok) {
+    failure(resolved.reason);
+    process22.exit(2);
+  }
+  return resolved.path;
 }
 var listCmd = defineCommand20({
   meta: { name: "list", description: "List all stored secrets and their status" },
@@ -3849,24 +3356,12 @@ var listCmd = defineCommand20({
     json: { type: "boolean", description: "Emit JSON" }
   },
   run({ args }) {
-    const names = listSecretNames();
-    if (names.length === 0) {
-      info("No secrets stored in ~/.clawops/secrets/");
-      info("Run `clawops secret set <name>` to add one.");
+    const rows = listSecrets();
+    if (rows.length === 0) {
+      info(NO_SECRETS_MESSAGE);
+      info(SET_SECRET_HINT);
       return;
     }
-    const rows = names.map((name) => {
-      const p = secretPath(name);
-      try {
-        const stat = statSync(p);
-        const content = readFileSync4(p, "utf-8").trim();
-        const status = content.length > 0 ? "ok" : "empty";
-        const modified = stat.mtime.toISOString().slice(0, 10);
-        return { name, status, source: "file", path: p, modified, resolvable: content.length > 0 };
-      } catch {
-        return { name, status: "unreadable", source: "file", path: p, modified: "\u2014", resolvable: false };
-      }
-    });
     if (args.json) {
       process22.stdout.write(JSON.stringify(rows, null, 2) + "\n");
       return;
@@ -3891,6 +3386,7 @@ var setCmd = defineCommand20({
       failure("Usage: clawops secret set <name>");
       process22.exit(2);
     }
+    const target = secretPathOrExit(name);
     const inquirer = (await import("inquirer")).default;
     let value;
     if (args.value) {
@@ -3904,10 +3400,10 @@ var setCmd = defineCommand20({
       }]);
       value = secretValue;
     }
-    mkdirSync3(secretsDir(), { recursive: true });
-    spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
-    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
+    mkdirSync2(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync3(target, value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" saved to ${target}  (chmod 600)`);
     info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
   }
 });
@@ -3922,23 +3418,18 @@ var deleteCmd = defineCommand20({
       failure("Usage: clawops secret delete <name>");
       process22.exit(2);
     }
-    const p = secretPath(name);
-    if (!existsSync3(p)) {
-      failure(`Secret "${name}" not found at ${p}`);
-      process22.exit(1);
-    }
-    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
-    const referencingStacks = listOverlays().filter((o) => o.secrets.some((s) => s.name === name)).map((o) => o.stackName);
-    if (referencingStacks.length > 0) {
-      warn(`Secret "${name}" is referenced by stack(s): ${referencingStacks.join(", ")}`);
-      warn("Deleting it will leave those stacks with an unresolvable $secret: ref.");
+    const prepared = prepareSecretDelete(name);
+    if (!prepared.ok) {
+      failure(prepared.reason);
+      process22.exit(prepared.kind === "invalid-name" ? 2 : 1);
     }
+    for (const line2 of prepared.warnings) warn(line2);
     if (!args.yes) {
       const inquirer = (await import("inquirer")).default;
       const { confirmed } = await inquirer.prompt([{
         type: "confirm",
         name: "confirmed",
-        message: `Delete secret "${name}"?`,
+        message: deleteConfirmQuestion(name),
         default: false
       }]);
       if (!confirmed) {
@@ -3946,8 +3437,7 @@ var deleteCmd = defineCommand20({
         return;
       }
     }
-    unlinkSync(p);
-    success(`Secret "${name}" deleted.`);
+    success(deletePreparedSecret(prepared));
   }
 });
 var rotateCmd = defineCommand20({
@@ -3962,6 +3452,7 @@ var rotateCmd = defineCommand20({
       failure("Usage: clawops secret rotate <name> [--stack <name>]");
       process22.exit(2);
     }
+    const target = secretPathOrExit(name);
     const inquirer = (await import("inquirer")).default;
     let value;
     if (args.value) {
@@ -3975,12 +3466,12 @@ var rotateCmd = defineCommand20({
       }]);
       value = secretValue;
     }
-    mkdirSync3(secretsDir(), { recursive: true });
-    spawnSync3("chmod", ["700", secretsDir()], { stdio: "ignore" });
-    writeFileSync4(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    mkdirSync2(secretsDir(), { recursive: true });
+    spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
+    writeFileSync3(target, value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
-    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
-    const cfg = getConfig2();
+    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const cfg = getConfig();
     const targetStack = args.stack ?? cfg?.defaults?.stack;
     if (!targetStack) {
       warn("No stack specified and no default stack in config \u2014 skipping re-apply.");
@@ -3996,11 +3487,11 @@ var rotateCmd = defineCommand20({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-7VI3R6EK.js");
-      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
+      const { buildContext } = await import("./context-EHSLWKSH.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
-      const { localStateToConnectionInfo } = await import("./state-AOAYLYY5.js");
+      const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
+      const { localStateToConnectionInfo } = await import("./state-AKZP2S4T.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
       if (ctx.adapter.name === "local") {
@@ -4040,53 +3531,20 @@ var auditCmd = defineCommand20({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
-    const overlays = listOverlays();
-    const issues = [];
-    for (const name of listSecretNames()) {
-      const p = secretPath(name);
-      try {
-        const content = readFileSync4(p, "utf-8").trim();
-        if (content.length === 0) {
-          issues.push({ kind: "empty-secret", secret: name, detail: `File exists but is empty: ${p}` });
-        }
-      } catch {
-        issues.push({ kind: "unreadable-secret", secret: name, detail: `Cannot read: ${p}` });
-      }
-    }
-    for (const overlay of overlays) {
-      for (const s of overlay.secrets) {
-        if (s.source === "file") {
-          const ref = s.ref ?? secretPath(s.name);
-          if (!existsSync3(ref)) {
-            issues.push({ kind: "missing-file", stack: overlay.stackName, secret: s.name, detail: `File not found: ${ref}` });
-          }
-        } else if (s.source === "env") {
-          const envVar = s.ref ?? s.name;
-          if (!process22.env[envVar]) {
-            issues.push({ kind: "missing-env", stack: overlay.stackName, secret: s.name, detail: `Env var not set: ${envVar}` });
-          }
-        } else {
-          issues.push({ kind: "cloud-sm-unresolved", stack: overlay.stackName, secret: s.name, detail: `Source "${s.source}" is not auto-resolved \u2014 set manually` });
-        }
-      }
-    }
+    const { issues } = auditSecrets();
     if (args.json) {
       process22.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
       return;
     }
     if (issues.length === 0) {
-      success("All secrets are resolvable. No issues found.");
+      success(AUDIT_CLEAN_MESSAGE);
       return;
     }
-    failure(`${issues.length} issue${issues.length === 1 ? "" : "s"} found:
+    failure(`${auditIssuesHeadline(issues.length)}
 `);
-    for (const issue of issues) {
-      const prefix = issue.stack ? `[${issue.stack}] ` : "";
-      warn(`${prefix}${issue.secret}: ${issue.detail}`);
-    }
+    for (const issue of issues) warn(formatAuditIssue(issue));
     process22.stdout.write("\n");
-    info("Run `clawops secret set <name>` to update a missing or empty secret.");
+    info(AUDIT_FIX_HINT);
   }
 });
 var secret_default = defineCommand20({
@@ -4183,16 +3641,16 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.1.2" : "dev";
+var VERSION = true ? "2.2.0" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
-  const os3 = `${process23.platform} ${process23.arch}`;
+  const os2 = `${process23.platform} ${process23.arch}`;
   let provider = "unknown";
   let stackCount = 0;
   let sshKey = "unknown";
   try {
-    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
-    const config = getConfig2();
+    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const config = getConfig();
     if (config) {
       const stacks = Object.values(config.stacks);
       stackCount = stacks.length;
@@ -4213,7 +3671,7 @@ async function collectContext() {
   return [
     `**clawops version:** ${VERSION}`,
     `**Node:** ${nodeVersion}`,
-    `**OS:** ${os3}`,
+    `**OS:** ${os2}`,
     `**Provider:** ${provider}`,
     `**Stacks:** ${stackCount}`,
     `**SSH key:** ${sshKey}`
@@ -4302,9 +3760,9 @@ var harden_default = defineCommand23({
     "tailscale-revert": { type: "boolean", description: "Take the host off its tailnet and go back to its public address. A private-only stack must be reopened with a plan first" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-3KKCR7BL.js");
-    const { buildContext } = await import("./context-7VI3R6EK.js");
-    const { getConfig: getConfig2 } = await import("./store-OVB3DAJR.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-UHAOVQMZ.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { getConfig } = await import("./store-YOLQYXMB.js");
     if (args.list) {
       process24.stdout.write("\nAvailable hardening modules:\n\n");
       for (const mod of MODULE_CATALOG) {
@@ -4318,7 +3776,7 @@ var harden_default = defineCommand23({
       process24.stdout.write("\n");
       return;
     }
-    const config = getConfig2();
+    const config = getConfig();
     if (!config) {
       failure("No clawops config found. Run `clawops init` first.");
       process24.exit(1);
@@ -4326,7 +3784,7 @@ var harden_default = defineCommand23({
     const ctx = buildContext({ stack: args.stack });
     const provider = ctx.adapter.name;
     if (args["tailscale-revert"]) {
-      const { revertTailnet } = await import("./flows-RI7FGHAM.js");
+      const { revertTailnet } = await import("./flows-6B2I6TRW.js");
       const override = config.stacks[ctx.stackName]?.tailscale;
       if (override && args.yes !== true) {
         const { createInterface: createInterface3 } = await import("readline/promises");
@@ -4349,7 +3807,7 @@ var harden_default = defineCommand23({
       else success(outcome.message);
       return;
     }
-    const { makeTailscaleModule } = await import("./harden-3KKCR7BL.js");
+    const { makeTailscaleModule } = await import("./harden-UHAOVQMZ.js");
     const forStack = makeTailscaleModule(ctx.stackName);
     const resolved = resolveModules(MODULE_CATALOG, args.options, provider).map(
       (m) => m.id === "tailscale" ? forStack : m
@@ -4433,7 +3891,7 @@ var harden_default = defineCommand23({
       success("Hardening complete.");
     }
     if (args.tailscale && !args["dry-run"]) {
-      const { cutOverToTailnet } = await import("./flows-RI7FGHAM.js");
+      const { cutOverToTailnet } = await import("./flows-6B2I6TRW.js");
       process24.stdout.write("\nVerifying the tailnet address before using it...\n");
       const outcome = await cutOverToTailnet(ctx, conn, config);
       if (!outcome.ok) {
@@ -4470,7 +3928,7 @@ function resolveArgv(argv2, stdinIsTty) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.1.2" : "dev";
+var CLI_VERSION = true ? "2.2.0" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",