@clawops/cli 2.1.3 → 2.2.0

package/dist/{chunk-TYHTISI5.js → chunk-CQOYUWR7.js}

@@ -1,10 +1,39 @@
 #!/usr/bin/env node
+import {
+  migrationQuestion,
+  prepareMigration,
+  runMigration
+} from "./chunk-E6BRQK67.js";
+import {
+  ACTIVATED,
+  ARCHIVE_IS_A_CREDENTIAL,
+  PLUGINS_NOT_CARRIED,
+  activateStaged,
+  activatedLines,
+  activationFailureDetail,
+  createBackup,
+  defaultBackupFilename,
+  nothingChanged,
+  stageRestore
+} from "./chunk-PCSX6Y3U.js";
+import {
+  checkStackDelete,
+  deleteStackFromConfig,
+  forgetNotice
+} from "./chunk-LV7UO5CG.js";
 import {
   applyPlan
-} from "./chunk-7T4CIT7C.js";
+} from "./chunk-AX65JMDZ.js";
+import {
+  resolveConn
+} from "./chunk-SX75L2T3.js";
+import {
+  DEFAULT_AGENT_LOG_LIMIT,
+  readAgentActivity
+} from "./chunk-27335SIH.js";
 import {
   generatePlan
-} from "./chunk-PTCVFLZ3.js";
+} from "./chunk-66R52R7K.js";
 import {
   extractBaseOutputs
 } from "./chunk-3QJBNAHW.js";
@@ -12,39 +41,44 @@ import {
   atomicWriteConfig,
   readRemoteConfig,
   restartGateway
-} from "./chunk-2I7KCMXZ.js";
+} from "./chunk-UAJJEDCJ.js";
 import {
   validatePlan
-} from "./chunk-XFN3YDZE.js";
+} from "./chunk-PASAVVNS.js";
 import {
   buildContext
 } from "./chunk-AVERNLUY.js";
 import {
   acquireSession,
   drainPool
-} from "./chunk-2Z7J3ERQ.js";
+} from "./chunk-TYNMOYVM.js";
 import {
+  AUDIT_CLEAN_MESSAGE,
+  AUDIT_FIX_HINT,
+  NO_SECRETS_MESSAGE,
+  SET_SECRET_HINT,
+  auditSecrets,
+  currentGatewayVersion,
+  deleteConfirmQuestion,
+  deletePreparedSecret,
   formatUptime,
+  gatewayStatus,
   gatherSnapshot,
-  runDiagnostics
-} from "./chunk-CPCO6UJK.js";
+  listSecrets,
+  prepareSecretDelete,
+  resolveUpdateVersion,
+  runDiagnostics,
+  updateGateway
+} from "./chunk-OUQVKIIA.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
-} from "./chunk-NUL5F6YV.js";
+} from "./chunk-SOZ62ZXW.js";
 import {
   execPrivileged
-} from "./chunk-NUDIHZEH.js";
-import {
-  STATE_DIR_HOST_LINUX,
-  gatewayRunCommand
-} from "./chunk-GIEVAGEK.js";
-import {
-  IMAGE_INSPECT_CMD,
-  imageForRestart
-} from "./chunk-VOEJYRIK.js";
+} from "./chunk-WPZIJONN.js";
 import {
   getConfig,
   getConfigDir
@@ -56,7 +90,7 @@ import {
 
 // src/mcp/server.ts
 import { createServer } from "http";
-import { randomUUID as randomUUID5, timingSafeEqual } from "crypto";
+import { randomUUID as randomUUID8, timingSafeEqual } from "crypto";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -156,7 +190,7 @@ var clawops_doctorSchema = z.object({
   stackName: z.string().optional().describe("Stack to include remote checks for. Without it, only the local machine is\nchecked \u2014 no SSH connection is made.\n"),
   failuresOnly: z.boolean().optional().default(false).describe("Return only failing and warning checks. Passing checks are counted, not listed.")
 });
-var clawops_doctorDescription = "Run clawops's diagnostics and return the report: Node and Pulumi runtime, config,\nSSH key and known_hosts, cloud credentials per configured provider, and the\nsupported OpenClaw range. With stackName, also contacts the host for container\nstate, the deployed OpenClaw version, a real gateway health probe, whether the\nport is published to the internet, disk usage on the state directory, log\nrotation, and hardening drift.\n\nUse when: something is not working and you do not yet know what; before any\ndeploy, upgrade or migration; or to find out which OpenClaw version a gateway is\nactually running.\n\nDo NOT use when: you already know the problem and want to fix it. This tool only\nreports \u2014 it changes nothing, and never runs `openclaw doctor --fix`. No tool\nrepairs a gateway: `clawops gateway update` is CLI-only, so tell the user to run\nit themselves, after `clawops backup create`.\n\nEvery check carries a status: fail (something is wrong that clawops can name),\nwarn (worth knowing, not broken), info (did not apply). `ok` is false only when\nsomething failed \u2014 a fresh machine with no stacks is full of warnings and healthy.";
+var clawops_doctorDescription = "Run clawops's diagnostics and return the report: Node and Pulumi runtime, config,\nSSH key and known_hosts, cloud credentials per configured provider, and the\nsupported OpenClaw range. With stackName, also contacts the host for container\nstate, the deployed OpenClaw version, a real gateway health probe, whether the\nport is published to the internet, disk usage on the state directory, log\nrotation, and hardening drift.\n\nUse when: something is not working and you do not yet know what; before any\ndeploy, upgrade or migration; or to find out which OpenClaw version a gateway is\nactually running.\n\nDo NOT use when: you already know the problem and want to fix it. This tool only\nreports \u2014 it changes nothing, and never runs `openclaw doctor --fix`. To move a\ngateway to another version, use clawops_gateway_update after clawops_backup_create.\n\nEvery check carries a status: fail (something is wrong that clawops can name),\nwarn (worth knowing, not broken), info (did not apply). `ok` is false only when\nsomething failed \u2014 a fresh machine with no stacks is full of warnings and healthy.";
 var clawops_doctorAnnotations = {
   title: "Run Diagnostics",
   readOnlyHint: true,
@@ -218,7 +252,7 @@ var clawops_config_getAnnotations = {
 var clawops_agents_listSchema = z.object({
   stackName: z.string().optional().describe("Which stack's agents to list. Omitted = the default stack in ~/.clawops/config.json")
 });
-var clawops_agents_listDescription = "List agents currently registered on the remote OpenClaw gateway.\n\nUse when: the user wants to see which agents are running, debug agent\nrouting, or count active workspaces.\n\nDo NOT use when: the user wants one agent's logs \u2014 no tool exposes those; tell\nthe user to run `clawops agents logs <name>`.";
+var clawops_agents_listDescription = "List agents currently registered on the remote OpenClaw gateway.\n\nUse when: the user wants to see which agents are running, debug agent\nrouting, or count active workspaces.\n\nDo NOT use when: the user wants one agent's activity \u2014 that is clawops_agents_logs.";
 var clawops_agents_listAnnotations = {
   title: "List OpenClaw Agents",
   readOnlyHint: true,
@@ -227,6 +261,53 @@ var clawops_agents_listAnnotations = {
   openWorldHint: true,
   toolsets: ["cli", "read"]
 };
+var clawops_agents_logsSchema = z.object({
+  stackName: z.string().optional().describe("Which stack the agent runs on. Omitted = the default stack in ~/.clawops/config.json"),
+  name: z.string().describe("The agent's name, as clawops_agents_list reports it"),
+  limit: z.number().int().optional().default(50).describe("Maximum activity records to return. Omitted = 50"),
+  cursor: z.string().optional().describe("The cursor a previous call returned, to continue from where it stopped. Omitted = the most recent records")
+});
+var clawops_agents_logsDescription = "One agent's recent activity, read from the gateway's audit log, newest last.\nPaginated: pass the returned cursor to continue.\n\nUse when: the user asks what a specific agent did, or why it behaved as it did.\n\nDo NOT use when: the user wants the gateway's own log stream \u2014 that is\nclawops_logs_tail. Do NOT use to find agent names \u2014 that is clawops_agents_list.";
+var clawops_agents_logsAnnotations = {
+  title: "Read One Agent's Activity",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_gateway_statusSchema = z.object({
+  stackName: z.string().optional().describe("Which stack's gateway to inspect. Omitted = the default stack in ~/.clawops/config.json")
+});
+var clawops_gateway_statusDescription = "Whether the OpenClaw gateway container is running, when it started, and which image it\nruns, as docker reports it on the host.\n\nUse when: the user asks whether the gateway is up or which OpenClaw version is deployed.\n\nDo NOT use when: the user wants a full health check \u2014 clawops_doctor probes the gateway\nitself rather than the container. Do NOT use to change anything; this only reads.";
+var clawops_gateway_statusAnnotations = {
+  title: "Gateway Container Status",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli", "read"]
+};
+var clawops_secret_listSchema = z.object({});
+var clawops_secret_listDescription = "List the secrets clawops stores locally, by name and status. Never returns a value.\n\nUse when: the user asks which secrets are set, or before a deploy that references one.\n\nDo NOT use when: the user wants to set or rotate a secret. No tool does that, because the\nvalue would pass through the conversation (R6): ask the user to run\n`clawops secret set <NAME>` or `clawops secret rotate <NAME>` in a terminal.";
+var clawops_secret_listAnnotations = {
+  title: "List Stored Secrets",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+  toolsets: ["cli", "read"]
+};
+var clawops_secret_auditSchema = z.object({});
+var clawops_secret_auditDescription = "Report secrets that stacks reference but clawops does not have, and `$secret:` references\nthat cannot be resolved. Never returns a value.\n\nUse when: a deploy or config change fails on a missing secret, or before applying a plan\nwhose config references secrets.\n\nDo NOT use when: the user wants to set the missing secret \u2014 ask them to run\n`clawops secret set <NAME>` in a terminal; no tool takes a secret value (R6).";
+var clawops_secret_auditAnnotations = {
+  title: "Audit Secret References",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+  toolsets: ["cli", "read"]
+};
 var clawops_upSchema = z.object({
   stackName: z.string().optional().describe("Name for the stack to provision, and the name every later command refers to it by. Omitted = the default stack in ~/.clawops/config.json"),
   provider: z.enum(["aws", "gcp", "azure", "local"]).optional().describe("Defaults to provider configured for this stack"),
@@ -251,7 +332,7 @@ var clawops_destroySchema = z.object({
   stackName: z.string().describe("The stack to destroy. Required, and worth repeating back to the user before calling: this deletes every resource it provisioned"),
   yes: z.boolean().optional().default(false).describe("Skip elicitation; CI/scripted use only")
 });
-var clawops_destroyDescription = "Destroy a clawops stack. Removes ALL provisioned resources. Triggers\nelicitation confirmation showing the resource diff before execution\n(R19). Cannot be undone.\n\nUse when: the user explicitly asks to destroy, tear down, delete, or\nremove a stack. Always confirm the stack name.\n\nDo NOT use when: the user wants to stop the gateway temporarily \u2014 that is not\na destroy, and no tool stops a gateway; clawops_gateway_restart is the only\ngateway tool. Do NOT use when in doubt about which stack; list first with\nclawops_stacks_list.";
+var clawops_destroyDescription = "Destroy a clawops stack. Removes ALL provisioned resources. Triggers\nelicitation confirmation showing the resource diff before execution\n(R19). Cannot be undone.\n\nUse when: the user explicitly asks to destroy, tear down, delete, or\nremove a stack. Always confirm the stack name.\n\nDo NOT use when: the user wants to stop the gateway temporarily \u2014 that is not\na destroy, and no tool stops a gateway; clawops_gateway_restart restarts it. Do NOT use when in doubt about which stack; list first with\nclawops_stacks_list.";
 var clawops_destroyAnnotations = {
   title: "Destroy Stack (DESTRUCTIVE)",
   readOnlyHint: false,
@@ -347,6 +428,89 @@ var clawops_gateway_restartAnnotations = {
   openWorldHint: true,
   toolsets: ["cli"]
 };
+var clawops_gateway_updateSchema = z.object({
+  stackName: z.string().optional().describe("Which stack's gateway to update. Omitted = the default stack in ~/.clawops/config.json"),
+  version: z.string().describe("A concrete OpenClaw version to move to, e.g. 2026.9.2. Moving tags are refused"),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation. Only when the user has already approved this specific update")
+});
+var clawops_gateway_updateDescription = "Move the gateway to a different OpenClaw version: pull the image and restart the gateway\non it. Every agent on the host restarts with it.\n\nUse when: the user asks to upgrade or downgrade OpenClaw on a running stack, naming a\nversion.\n\nDo NOT use when: the user has not named a concrete version \u2014 moving tags such as\n`latest` are refused, as the CLI refuses them. Do NOT use without a backup the user can\nreturn to: suggest clawops_backup_create first.";
+var clawops_gateway_updateAnnotations = {
+  title: "Update OpenClaw Version",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_backup_createSchema = z.object({
+  stackName: z.string().optional().describe("Which stack to back up. Omitted = the default stack in ~/.clawops/config.json"),
+  out: z.string().optional().describe("Absolute local path to write the archive to. Omitted = a timestamped file under ~/.clawops/backups")
+});
+var clawops_backup_createDescription = "Take a backup of the gateway's state (config, database, sessions, transcripts and\ninstalled plugins) and download it to a local archive. Live state is not changed.\n\nUse when: the user asks for a backup, and before anything that replaces state: a\nversion update, a migration, a restore, or a plan that replaces the instance.\n\nDo NOT use when: the user wants to back up cloud infrastructure \u2014 Pulumi state and plans\ncover that, not this.";
+var clawops_backup_createAnnotations = {
+  title: "Back Up Gateway State",
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_backup_restoreSchema = z.object({
+  stackName: z.string().optional().describe("Which stack to restore onto. Omitted = the default stack in ~/.clawops/config.json"),
+  file: z.string().describe("Absolute local path to the backup archive, as clawops_backup_create wrote it"),
+  activate: z.boolean().optional().default(false).describe("Put the restored state into service. Omitted = expand into a staging directory and touch nothing live"),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation. Only when the user has already approved this specific restore")
+});
+var clawops_backup_restoreDescription = "Verify a backup archive and expand it on the host beside the live state, never over it.\nWith activate: true, also put it into service: stop the gateway, swap the restored state\nin (keeping the state it replaces), restart, and roll back if the gateway does not answer.\n\nUse when: the user asks to restore or recover from a backup, naming the archive.\n\nDo NOT use when: the gateway is merely unhealthy \u2014 clawops_workflow_recover diagnoses that\nwithout discarding state. Restoring is time travel: everything since the backup is lost,\nand channel credentials may need relinking.";
+var clawops_backup_restoreAnnotations = {
+  title: "Restore Gateway State (DESTRUCTIVE with activate)",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_migrateSchema = z.object({
+  stackName: z.string().optional().describe("Which stack to migrate. Omitted = the default stack in ~/.clawops/config.json"),
+  openclawVersion: z.string().optional().describe("The OpenClaw 2.x version to migrate to. Omitted = the version this clawops release defaults to"),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation. Only when the user has already approved this migration")
+});
+var clawops_migrateDescription = "Move a deployment from OpenClaw 1.x onto the 2.0 runtime contract: state ownership,\nconfig, and the gateway's run command, in the order a real migration showed works.\n\nUse when: a stack still runs OpenClaw 1.x and the user wants it on 2.x. clawops_doctor\nand clawops_gateway_status say which line a stack runs.\n\nDo NOT use when: the stack is already on 2.x \u2014 use clawops_gateway_update to change\nversions within 2.x. Take a backup first with clawops_backup_create.";
+var clawops_migrateAnnotations = {
+  title: "Migrate 1.x to 2.0 (DESTRUCTIVE)",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true,
+  toolsets: ["cli"]
+};
+var clawops_stacks_deleteSchema = z.object({
+  name: z.string().describe("The stack to remove from config, as clawops_stacks_list reports it"),
+  force: z.boolean().optional().default(false).describe("Skip the safety checks: allow deleting the default stack, or one still deployed. Omitted = refuse both"),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation. Only when the user has already approved this deletion")
+});
+var clawops_stacks_deleteDescription = "Remove a stack from ~/.clawops/config.json. This forgets the stack; it does not tear\ndown its infrastructure, and it refuses a stack that is still deployed unless forced.\n\nUse when: the user wants to stop tracking a stack whose resources are already gone.\n\nDo NOT use when: the user wants the infrastructure removed \u2014 that is clawops_destroy,\nfirst. Forcing the delete of a deployed stack leaves resources running and billing that\nclawops can no longer see.";
+var clawops_stacks_deleteAnnotations = {
+  title: "Forget a Stack (DESTRUCTIVE)",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: false,
+  toolsets: ["admin"]
+};
+var clawops_secret_deleteSchema = z.object({
+  name: z.string().describe("The secret's name, as clawops_secret_list reports it"),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation. Only when the user has already approved this deletion")
+});
+var clawops_secret_deleteDescription = "Delete a locally stored secret by name. Warns when a stack still references it.\n\nUse when: the user asks to remove a secret they no longer use.\n\nDo NOT use when: the user wants to replace a value \u2014 ask them to run\n`clawops secret rotate <NAME>`; no tool takes a secret value (R6).";
+var clawops_secret_deleteAnnotations = {
+  title: "Delete a Stored Secret (DESTRUCTIVE)",
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: false,
+  toolsets: ["cli"]
+};
 var clawops_initSchema = z.object({
   provider: z.enum(["aws", "gcp", "azure", "local"]).describe("Which cloud this stack deploys to, or 'local' for a machine you already have"),
   stackName: z.string().optional().describe('Name for the stack, used by every later call. Omitted = "default"'),
@@ -438,6 +602,10 @@ var TOOLSETS = {
     "clawops_monitor",
     "clawops_config_get",
     "clawops_agents_list",
+    "clawops_agents_logs",
+    "clawops_gateway_status",
+    "clawops_secret_list",
+    "clawops_secret_audit",
     "clawops_up",
     "clawops_destroy",
     "clawops_apply",
@@ -446,6 +614,11 @@ var TOOLSETS = {
     "clawops_config_unset",
     "clawops_config_validate",
     "clawops_gateway_restart",
+    "clawops_gateway_update",
+    "clawops_backup_create",
+    "clawops_backup_restore",
+    "clawops_migrate",
+    "clawops_secret_delete",
     "clawops_init",
     "clawops_harden",
     "clawops_task_status"
@@ -462,13 +635,18 @@ var TOOLSETS = {
     "clawops_stacks_list",
     "clawops_config_get",
     "clawops_agents_list",
+    "clawops_agents_logs",
+    "clawops_gateway_status",
+    "clawops_secret_list",
+    "clawops_secret_audit",
     "clawops_plan",
     "clawops_config_validate",
     "clawops_workflow_recover",
     "clawops_task_status"
   ],
   admin: [
-    "clawops_stacks_list"
+    "clawops_stacks_list",
+    "clawops_stacks_delete"
   ]
 };
 
@@ -505,34 +683,6 @@ function text(t) {
 }
 
 // src/mcp/tools/_conn.ts
-async function resolveConn(ctx) {
-  if (ctx.adapter.name === "local") {
-    const state = ctx.localState;
-    if (!state) throw new StateError("Stack has no local state \u2014 run `clawops up` first.");
-    return {
-      host: state.sshHost,
-      port: state.sshPort,
-      user: state.sshUser,
-      privateKeyPath: state.privateKeyPath,
-      knownHostsPath: state.knownHostsPath
-    };
-  }
-  const { extractBaseOutputs: extractBaseOutputs2 } = await import("./outputs-DJHBY7EE.js");
-  const stack = await ctx.getStack();
-  const outputMap = await stack.outputs();
-  const outputs = Object.fromEntries(
-    Object.entries(outputMap).map(([k, v]) => [k, v.value])
-  );
-  if (!outputs["publicIp"]) {
-    throw new StateError("Stack has no outputs \u2014 run `clawops up` first.");
-  }
-  const base = extractBaseOutputs2(outputs);
-  return ctx.adapter.getConnectionInfo({
-    ...base,
-    privateKeyPath: ctx.config.ssh.keyPath,
-    knownHostsPath: ctx.config.ssh.knownHostsPath
-  });
-}
 function errText(message) {
   return { content: [{ type: "text", text: message }], isError: true };
 }
@@ -606,22 +756,6 @@ ${result.stdout}`;
   }
 }
 
-// src/mcp/tools/cli/stacks.ts
-async function handleStacksList(_input, _server) {
-  const config = getConfig();
-  if (!config) {
-    return { content: [{ type: "text", text: JSON.stringify({ stacks: [] }) }] };
-  }
-  const stacks = Object.entries(config.stacks).map(([name, cfg]) => ({
-    name,
-    provider: cfg.provider,
-    region: cfg.region,
-    stateUrl: cfg.stateUrl,
-    isDefault: name === config.defaults.stack
-  }));
-  return { content: [{ type: "text", text: JSON.stringify({ stacks }, null, 2) }] };
-}
-
 // src/mcp/tools/_confirm.ts
 async function confirmDestructive(server, opts) {
   const capabilities = server.server.getClientCapabilities();
@@ -645,6 +779,40 @@ async function confirmDestructive(server, opts) {
   return { confirmed: true };
 }
 
+// src/mcp/tools/cli/stacks.ts
+async function handleStacksList(_input, _server) {
+  const config = getConfig();
+  if (!config) {
+    return { content: [{ type: "text", text: JSON.stringify({ stacks: [] }) }] };
+  }
+  const stacks = Object.entries(config.stacks).map(([name, cfg]) => ({
+    name,
+    provider: cfg.provider,
+    region: cfg.region,
+    stateUrl: cfg.stateUrl,
+    isDefault: name === config.defaults.stack
+  }));
+  return { content: [{ type: "text", text: JSON.stringify({ stacks }, null, 2) }] };
+}
+async function handleStacksDelete(input, server) {
+  const force = input.force === true;
+  const check = await checkStackDelete(input.name, { force });
+  if (!check.ok) return errText(check.reason);
+  if (!input.yes) {
+    const consequence = force ? "force skips the still-deployed check: if this stack is still deployed, its resources stay running and billing, and clawops can no longer see them." : check.warnings.length > 0 ? `${check.warnings.join(" ")} If it is still deployed, its resources stay running and billing.` : "clawops sees no deployment for it, so nothing should be left running.";
+    const confirmation = await confirmDestructive(server, {
+      message: `Forget stack "${input.name}"? This removes it from ~/.clawops/config.json; it does NOT tear down its infrastructure. ${consequence}` + (check.isDefault ? " It is the default stack, so another stack becomes the default." : ""),
+      title: "Confirm forgetting the stack",
+      what: `forgetting stack "${input.name}"`
+    });
+    if (!confirmation.confirmed) return okText(confirmation.reason);
+  }
+  const deleted = deleteStackFromConfig(input.name);
+  const lines = [...check.warnings, forgetNotice(input.name), deleted.message];
+  if (deleted.newDefaultMessage) lines.push(deleted.newDefaultMessage);
+  return okText(lines.join("\n"));
+}
+
 // src/mcp/tools/cli/config.ts
 async function handleConfigGet(input, _server) {
   const ac = new AbortController();
@@ -820,39 +988,34 @@ async function handleAgentsList(input, _server) {
     drainPool();
   }
 }
-
-// src/mcp/tools/cli/gateway.ts
-async function handleGatewayRestart(input, server) {
-  const confirmation = await confirmDestructive(server, {
-    message: `Restart the OpenClaw gateway on stack "${input.stackName ?? "default"}"? This will briefly interrupt connections.`,
-    title: "Confirm restart",
-    what: "restarting the gateway"
-  });
-  if (!confirmation.confirmed) {
-    return okText(confirmation.reason);
+async function handleAgentsLogs(input, _server) {
+  if (input.name.trim() === "") {
+    return errText("name is required: the agent name, as clawops_agents_list reports it.");
   }
   const ctx = buildContext({ stack: input.stackName });
   const conn = await resolveConn(ctx);
   const { session, release } = await acquireSession(conn);
   try {
-    const imgResult = await execPrivileged(session, IMAGE_INSPECT_CMD);
-    const image = imageForRestart(imgResult.stdout);
-    if (!image.ok) return errText(image.error);
-    const result = await execPrivileged(
-      session,
-      gatewayRunCommand({ image: image.value, stateDir: STATE_DIR_HOST_LINUX })
-    );
-    if (result.code !== 0) {
-      return errText(`Gateway restart failed: ${result.stderr}`);
-    }
-    return okText("Gateway restarted successfully.");
+    const page = await readAgentActivity(session, {
+      agentId: input.name,
+      limit: input.limit ?? DEFAULT_AGENT_LOG_LIMIT,
+      ...input.cursor ? { cursor: input.cursor } : {}
+    });
+    if (!page.ok) return errText(page.error);
+    const body = {
+      agent: input.name,
+      ...page.value.cursor ? { cursor: page.value.cursor } : {},
+      count: page.value.records.length,
+      records: page.value.records
+    };
+    return okText(trimForMcp(JSON.stringify(body, null, 2), ctx.stackName).content);
   } finally {
     release();
     drainPool();
   }
 }
 
-// src/mcp/tools/cli/up.ts
+// src/mcp/tools/cli/gateway.ts
 import { randomUUID as randomUUID2 } from "crypto";
 
 // src/mcp/progress.ts
@@ -886,7 +1049,91 @@ function makeProgressEmitter(server, progressToken) {
   };
 }
 
+// src/mcp/tools/cli/gateway.ts
+async function handleGatewayRestart(input, server) {
+  const confirmation = await confirmDestructive(server, {
+    message: `Restart the OpenClaw gateway on stack "${input.stackName ?? "default"}"? This will briefly interrupt connections.`,
+    title: "Confirm restart",
+    what: "restarting the gateway"
+  });
+  if (!confirmation.confirmed) {
+    return okText(confirmation.reason);
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    await restartGateway(session);
+    return okText("Gateway restarted.");
+  } catch (e) {
+    return errText(e.message);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleGatewayStatus(input, _server) {
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    const status = await gatewayStatus(session);
+    if (!status.ok) return errText(status.error);
+    return okText(trimForMcp(JSON.stringify(status.value, null, 2), ctx.stackName).content);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleGatewayUpdate(input, server) {
+  if (input.version.trim() === "") {
+    return errText("version is required: name the concrete OpenClaw version to move to, e.g. 2026.9.2.");
+  }
+  const target = await resolveUpdateVersion(input.version);
+  if (!target.ok) return errText(target.error);
+  const version = target.value;
+  const ctx = buildContext({ stack: input.stackName });
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession(conn);
+  try {
+    if (!input.yes) {
+      const current = await currentGatewayVersion(session).catch(() => void 0);
+      const confirmation = await confirmDestructive(server, {
+        message: `Update the OpenClaw gateway on stack "${ctx.stackName}" ${current ? `from ${current} ` : ""}to ${version}? Every agent on the host restarts with it. A snapshot of the state database is taken first.`,
+        title: "Confirm update",
+        what: `updating the gateway to ${version}`
+      });
+      if (!confirmation.confirmed) return okText(confirmation.reason);
+    }
+    const taskId = randomUUID2();
+    const emit = makeProgressEmitter(server, void 0);
+    startTask(taskId, `clawops_gateway_update stack=${ctx.stackName} version=${version}`);
+    const notes = [];
+    try {
+      emit(`Updating gateway to ${version}...`);
+      const result = await updateGateway(session, version, {
+        onProgress: emit,
+        onNote: (text4) => {
+          notes.push(text4);
+          emit(text4);
+        }
+      });
+      const text3 = [result.message, ...result.ok ? [] : result.hint ? [result.hint] : [], ...notes].join("\n");
+      updateTask(taskId, result.ok ? "completed" : "failed", result.ok ? text3 : void 0, result.ok ? void 0 : text3);
+      const { content } = trimForMcp(text3, ctx.stackName);
+      return result.ok ? okText(content) : errText(content);
+    } catch (e) {
+      updateTask(taskId, "failed", void 0, e instanceof Error ? e.message : String(e));
+      throw e;
+    }
+  } finally {
+    release();
+    drainPool();
+  }
+}
+
 // src/mcp/tools/cli/up.ts
+import { randomUUID as randomUUID3 } from "crypto";
 async function handleUp(input, server) {
   if (!input.dryRun) {
     const confirmation = await confirmDestructive(server, {
@@ -908,7 +1155,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-3PBVY7MA.js");
+    const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -927,12 +1174,12 @@ async function handleUp(input, server) {
   if (!validation.ok) {
     return errText(`Provider config invalid: ${validation.errors.join("; ")}`);
   }
-  const taskId = randomUUID2();
+  const taskId = randomUUID3();
   const progressToken = void 0;
   const emit = makeProgressEmitter(server, progressToken);
   startTask(taskId, `clawops_up stack=${ctx.stackName}`);
-  const { generatePlan: generatePlan2 } = await import("./generate-NE54BATS.js");
-  const { applyPlan: applyPlan2 } = await import("./apply-JARPVA5Y.js");
+  const { generatePlan: generatePlan2 } = await import("./generate-4YYNW3IU.js");
+  const { applyPlan: applyPlan2 } = await import("./apply-F5SQ2ZOS.js");
   const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
   const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
   const network = await resolveNetworkFlags(
@@ -981,7 +1228,7 @@ async function handleUp(input, server) {
 }
 
 // src/mcp/tools/cli/destroy.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 async function handleDestroy(input, server) {
   if (!input.yes) {
     const confirmation = await confirmDestructive(server, {
@@ -997,7 +1244,7 @@ async function handleDestroy(input, server) {
   if (ctx.adapter.name === "local") {
     return errText("Local provider stacks are destroyed with `clawops down --destroy` via SSH. Use clawops_up with the local provider instead.");
   }
-  const taskId = randomUUID3();
+  const taskId = randomUUID4();
   const emit = makeProgressEmitter(server, void 0);
   startTask(taskId, `clawops_destroy stack=${input.stackName}`);
   try {
@@ -1047,7 +1294,7 @@ async function handlePlan(input, _server) {
     let network = resolved;
     if (input.privateOnly) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-EKAQSDXP.js");
+      const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[stackName]?.tailscale, stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -1103,12 +1350,12 @@ async function handleHarden(input, server) {
       return okText(confirmation.reason);
     }
   }
-  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-HGJIA6EL.js");
+  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-6B2I6TRW.js");
   if (input.tailscaleRevert) {
     const outcome = await revertTailnet(ctx, config);
     return outcome.ok ? okText(outcome.message) : errText(outcome.reason);
   }
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-RUOUA5BV.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-UHAOVQMZ.js");
   const forStack = makeTailscaleModule(ctx.stackName);
   const resolved = resolveModules(MODULE_CATALOG, input.options, ctx.adapter.name).map(
     (m) => m.id === "tailscale" ? forStack : m
@@ -1178,7 +1425,7 @@ async function handleInit(input, _server) {
 
 // src/mcp/tools/cli/apply.ts
 import { readFileSync } from "fs";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 async function handleApply(input, server) {
   let plan;
   try {
@@ -1208,7 +1455,7 @@ This will provision cloud resources and may incur costs.`,
       return okText(confirmation.reason);
     }
   }
-  const taskId = randomUUID4();
+  const taskId = randomUUID5();
   const emit = makeProgressEmitter(server, void 0);
   startTask(taskId, `clawops_apply stack=${plan.spec.stackName}`);
   try {
@@ -1248,7 +1495,7 @@ async function handleTaskStatus(input, _server) {
 
 // src/mcp/tools/cli/monitor.ts
 async function handleMonitor(input, _server) {
-  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-PIIKJ4L2.js");
+  const { acquireSession: acquireSession2, drainPool: drainPool2 } = await import("./pool-NT4XBSUT.js");
   const ctx = buildContext({ stack: input.stackName });
   const tailLines = input.tailLines ?? 5;
   let conn;
@@ -1302,6 +1549,255 @@ function text2(t) {
   return { content: [{ type: "text", text: t }] };
 }
 
+// src/mcp/tools/cli/backup.ts
+import { randomUUID as randomUUID6 } from "crypto";
+import { mkdirSync as mkdirSync3 } from "fs";
+import path3 from "path";
+function relativePathRefusal(param, value) {
+  return `"${param}" must be an absolute path; got "${value}". The MCP server does not resolve paths against a working directory. Pass the full path, e.g. /Users/me/backups/openclaw.tar.gz.`;
+}
+function capped(text3, stackName, isError = false) {
+  const { content } = trimForMcp(text3, stackName);
+  return isError ? errText(content) : okText(content);
+}
+async function handleBackupCreate(input, server) {
+  if (input.out !== void 0 && !path3.isAbsolute(input.out)) {
+    return errText(relativePathRefusal("out", input.out));
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  let outPath = input.out;
+  if (outPath === void 0) {
+    const dir = path3.join(getConfigDir(), "backups");
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+    outPath = path3.join(dir, defaultBackupFilename());
+  }
+  const taskId = randomUUID6();
+  const emit = makeProgressEmitter(server, void 0);
+  startTask(taskId, `clawops_backup_create stack=${ctx.stackName}`);
+  const ac = new AbortController();
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
+  try {
+    const created = await createBackup(session, {
+      outPath,
+      signal: ac.signal,
+      onPhase: (phase) => emit(phase === "creating" ? "Creating backup on remote host..." : `Downloading to ${outPath}...`)
+    });
+    if (!created.ok) {
+      updateTask(taskId, "failed", void 0, created.reason);
+      return capped(created.reason, ctx.stackName, true);
+    }
+    const summary = [`Backup saved to ${created.path}`, ...ARCHIVE_IS_A_CREDENTIAL].join("\n");
+    updateTask(taskId, "completed", summary);
+    return capped(summary, ctx.stackName);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    updateTask(taskId, "failed", void 0, msg);
+    return errText(`Backup failed: ${msg}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+async function handleBackupRestore(input, server) {
+  if (!path3.isAbsolute(input.file)) {
+    return errText(relativePathRefusal("file", input.file));
+  }
+  const activate = input.activate === true;
+  const stackLabel = input.stackName ?? "default";
+  if (!input.yes) {
+    const confirmation = await confirmDestructive(server, activate ? {
+      message: `ACTIVATE the backup ${input.file} on stack "${stackLabel}"? The gateway is stopped and the restored state put into service. Everything since the backup is lost from the live gateway (the state it replaces is kept alongside it), and channel credentials may need relinking. clawops puts the previous state back if the gateway does not come up.`,
+      title: "Confirm restore and activation",
+      what: "activating a restored backup"
+    } : {
+      message: `Expand the backup ${input.file} onto stack "${stackLabel}", staging only? It is verified and expanded beside the live state; the gateway and its live state are not touched.`,
+      title: "Confirm staging-only restore",
+      what: "restoring a backup to a staging directory"
+    });
+    if (!confirmation.confirmed) return okText(confirmation.reason);
+  }
+  const ctx = buildContext({ stack: input.stackName });
+  const taskId = randomUUID6();
+  const emit = makeProgressEmitter(server, void 0);
+  startTask(taskId, `clawops_backup_restore stack=${ctx.stackName}${activate ? " activate" : ""}`);
+  const fail = (text3) => {
+    updateTask(taskId, "failed", void 0, text3);
+    return capped(text3, ctx.stackName, true);
+  };
+  const ac = new AbortController();
+  const conn = await resolveConn(ctx);
+  const { session, release } = await acquireSession({ ...conn, signal: ac.signal });
+  try {
+    const staged = await stageRestore(session, {
+      file: input.file,
+      signal: ac.signal,
+      onPhase: (phase) => emit(phase === "uploading" ? "Uploading archive..." : "Verifying and restoring to a staging directory...")
+    });
+    const raw = staged.unparsedReport !== void 0 ? [`OpenClaw reported: ${staged.unparsedReport}`] : [];
+    if (!staged.ok) {
+      return fail([
+        staged.reason,
+        ...staged.stagingOnHost ? [nothingChanged(staged.stagingOnHost)] : [],
+        ...raw
+      ].join("\n"));
+    }
+    const lines = [
+      `Archive verified and expanded to ${staged.stagingOnHost} on the host.`,
+      ...staged.entryCount !== void 0 ? [`${staged.entryCount} entries restored.`] : [],
+      ...raw,
+      // Verbatim: rolled-back approvals and channel credentials are the operator's to judge.
+      ...staged.warnings.map((w) => `Warning: ${w}`)
+    ];
+    if (!activate) {
+      lines.push(
+        "",
+        "Nothing has been activated. Call clawops_backup_restore again with activate: true to put",
+        "this state into service. The state to adopt is",
+        `  ${staged.statePath}`,
+        `(the archive holds ${staged.stateDirInArchive} under payload/posix), replacing ${staged.stateDir}.`,
+        ...PLUGINS_NOT_CARRIED
+      );
+      const text4 = lines.join("\n");
+      updateTask(taskId, "completed", text4);
+      return capped(text4, ctx.stackName);
+    }
+    const outcome = await activateStaged(session, staged, {
+      signal: ac.signal,
+      onPhase: (phase) => {
+        if (phase === "activating") emit("Activating the restored state...");
+        else if (phase === "restarting") emit("Restarting the gateway...");
+        else if (phase === "waiting") emit("Waiting for the gateway to answer...");
+      }
+    });
+    if (!outcome.ok) {
+      return fail([...lines, "", outcome.reason, ...activationFailureDetail(outcome)].join("\n"));
+    }
+    lines.push("", ACTIVATED, ...activatedLines(outcome.preserved));
+    const text3 = lines.join("\n");
+    updateTask(taskId, "completed", text3);
+    return capped(text3, ctx.stackName);
+  } catch (err) {
+    return fail(`Restore failed: ${err instanceof Error ? err.message : String(err)}`);
+  } finally {
+    release();
+    drainPool();
+  }
+}
+
+// src/mcp/tools/cli/migrate.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var SYNC_WINDOW = { ms: 1e4 };
+async function handleMigrate(input, server) {
+  let target;
+  try {
+    target = await prepareMigration({ stack: input.stackName, openclawVersion: input.openclawVersion });
+  } catch (err) {
+    if (err instanceof UsageError) return errText(err.message);
+    throw err;
+  }
+  if (!input.yes) {
+    const confirmation = await confirmDestructive(server, {
+      message: migrationQuestion(target),
+      title: `Confirm migrating "${target.stackName}" to ${target.version}`,
+      what: `migrating stack "${target.stackName}"`
+    });
+    if (!confirmation.confirmed) return okText(confirmation.reason);
+  }
+  const taskId = randomUUID7();
+  const emit = makeProgressEmitter(server, void 0);
+  startTask(taskId, `clawops_migrate stack=${target.stackName} target=${target.version}`);
+  const run = runMigration(target, {
+    onStep: (text3) => {
+      emit(text3);
+      updateTask(taskId, "running", text3);
+    }
+  }).then(
+    (result) => {
+      const text3 = render(result, target.stackName);
+      updateTask(taskId, result.exitCode === 0 ? "completed" : "failed", text3, result.exitCode === 0 ? void 0 : text3);
+      return { kind: "done", result, text: text3 };
+    },
+    (err) => {
+      const msg = err instanceof Error ? err.message : String(err);
+      updateTask(taskId, "failed", void 0, msg);
+      return { kind: "error", err, msg };
+    }
+  );
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve({ kind: "pending" }), SYNC_WINDOW.ms);
+  });
+  const first = await Promise.race([run, timeout]);
+  clearTimeout(timer);
+  if (first.kind === "pending") {
+    return okText(
+      JSON.stringify(
+        {
+          taskId,
+          status: "running",
+          stack: target.stackName,
+          target: target.version,
+          message: "The migration is still running on the host. Poll clawops_task_status with this taskId for the outcome; do not start another migration of this stack meanwhile."
+        },
+        null,
+        2
+      )
+    );
+  }
+  if (first.kind === "error") {
+    if (first.err instanceof UsageError) return errText(first.msg);
+    throw first.err;
+  }
+  return first.result.exitCode === 0 ? okText(first.text) : errText(first.text);
+}
+function render(result, stackName) {
+  const text3 = result.lines.map((l) => l.text).join("\n");
+  return trimForMcp(text3, stackName).content;
+}
+
+// src/mcp/tools/cli/secret.ts
+var RESOURCE_NAME = "secrets";
+function capped2(payload) {
+  const { content } = trimForMcp(JSON.stringify(payload, null, 2), RESOURCE_NAME);
+  return okText(content);
+}
+async function handleSecretList(_input, _server) {
+  const secrets = listSecrets();
+  if (secrets.length === 0) {
+    return capped2({ secrets, message: `${NO_SECRETS_MESSAGE} ${SET_SECRET_HINT}` });
+  }
+  return capped2({ secrets });
+}
+async function handleSecretAudit(_input, _server) {
+  const report = auditSecrets();
+  return capped2({
+    ...report,
+    message: report.ok ? AUDIT_CLEAN_MESSAGE : AUDIT_FIX_HINT
+  });
+}
+async function handleSecretDelete(input, server) {
+  const prepared = prepareSecretDelete(input.name);
+  if (!prepared.ok) return errText(prepared.reason);
+  if (!input.yes) {
+    const confirmation = await confirmDestructive(server, {
+      message: [deleteConfirmQuestion(prepared.name), ...prepared.warnings].join("\n"),
+      title: `Delete secret "${prepared.name}"`,
+      what: `deleting secret "${prepared.name}"`
+    });
+    if (!confirmation.confirmed) {
+      return okText([confirmation.reason, ...prepared.warnings].join("\n"));
+    }
+  }
+  const message = deletePreparedSecret(prepared);
+  return capped2({
+    deleted: prepared.name,
+    message,
+    referencingStacks: prepared.referencingStacks,
+    warnings: prepared.warnings
+  });
+}
+
 // src/mcp/tools/workflow/deploy_app.ts
 async function handleWorkflowDeployApp(input, server) {
   const parts = [`## Deployment Workflow \u2014 ${input.provider} / ${input.stackName}
@@ -1426,6 +1922,16 @@ var TOOL_REGISTRY = {
   clawops_config_unset: makeEntry(clawops_config_unsetSchema, clawops_config_unsetAnnotations, handleConfigUnset, clawops_config_unsetDescription),
   clawops_config_validate: makeEntry(clawops_config_validateSchema, clawops_config_validateAnnotations, handleConfigValidate, clawops_config_validateDescription),
   clawops_gateway_restart: makeEntry(clawops_gateway_restartSchema, clawops_gateway_restartAnnotations, handleGatewayRestart, clawops_gateway_restartDescription),
+  clawops_agents_logs: makeEntry(clawops_agents_logsSchema, clawops_agents_logsAnnotations, handleAgentsLogs, clawops_agents_logsDescription),
+  clawops_gateway_status: makeEntry(clawops_gateway_statusSchema, clawops_gateway_statusAnnotations, handleGatewayStatus, clawops_gateway_statusDescription),
+  clawops_secret_list: makeEntry(clawops_secret_listSchema, clawops_secret_listAnnotations, handleSecretList, clawops_secret_listDescription),
+  clawops_secret_audit: makeEntry(clawops_secret_auditSchema, clawops_secret_auditAnnotations, handleSecretAudit, clawops_secret_auditDescription),
+  clawops_gateway_update: makeEntry(clawops_gateway_updateSchema, clawops_gateway_updateAnnotations, handleGatewayUpdate, clawops_gateway_updateDescription),
+  clawops_backup_create: makeEntry(clawops_backup_createSchema, clawops_backup_createAnnotations, handleBackupCreate, clawops_backup_createDescription),
+  clawops_backup_restore: makeEntry(clawops_backup_restoreSchema, clawops_backup_restoreAnnotations, handleBackupRestore, clawops_backup_restoreDescription),
+  clawops_migrate: makeEntry(clawops_migrateSchema, clawops_migrateAnnotations, handleMigrate, clawops_migrateDescription),
+  clawops_stacks_delete: makeEntry(clawops_stacks_deleteSchema, clawops_stacks_deleteAnnotations, handleStacksDelete, clawops_stacks_deleteDescription),
+  clawops_secret_delete: makeEntry(clawops_secret_deleteSchema, clawops_secret_deleteAnnotations, handleSecretDelete, clawops_secret_deleteDescription),
   clawops_workflow_deploy_app: makeEntry(clawops_workflow_deploy_appSchema, clawops_workflow_deploy_appAnnotations, handleWorkflowDeployApp, clawops_workflow_deploy_appDescription),
   clawops_workflow_recover: makeEntry(clawops_workflow_recoverSchema, clawops_workflow_recoverAnnotations, handleWorkflowRecover, clawops_workflow_recoverDescription),
   clawops_task_status: makeEntry(clawops_task_statusSchema, clawops_task_statusAnnotations, handleTaskStatus, clawops_task_statusDescription)
@@ -1477,7 +1983,7 @@ function registerTools(server, opts) {
 
 // src/mcp/resources.ts
 import { readFileSync as readFileSync2 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 function registerResources(server) {
   server.registerResource(
@@ -1529,7 +2035,7 @@ function registerResources(server) {
     { description: "Full Pulumi output from the last up/destroy run for a stack" },
     async (uri, { name }) => {
       const stackName = Array.isArray(name) ? name[0] : name;
-      const filePath = path3.join(getConfigDir(), "state", `${stackName}.last-run.json`);
+      const filePath = path4.join(getConfigDir(), "state", `${stackName}.last-run.json`);
       let text3;
       try {
         const raw = readFileSync2(filePath, "utf-8");
@@ -1726,7 +2232,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-MF5LPITL.js");
+  const { version } = await import("./package-HYGHRX35.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);
@@ -1794,7 +2300,7 @@ async function handleHttp(req, res, sessions, makeServer, token) {
     return;
   }
   const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: () => randomUUID5(),
+    sessionIdGenerator: () => randomUUID8(),
     onsessioninitialized: (id) => {
       sessions.set(id, transport);
     }