@clawops/cli 2.1.3 → 2.2.0

package/dist/cli.js

@@ -5,39 +5,51 @@ import {
   writeAppConfigs
 } from "./chunk-OIGTOLB3.js";
 import {
+  AUDIT_CLEAN_MESSAGE,
+  AUDIT_FIX_HINT,
+  NO_SECRETS_MESSAGE,
+  SET_SECRET_HINT,
+  auditIssuesHeadline,
+  auditSecrets,
+  deleteConfirmQuestion,
+  deletePreparedSecret,
+  dockerRunCmd,
+  formatAuditIssue,
+  gatewayStatus,
+  listSecrets,
   monitor_default,
-  runDiagnostics
-} from "./chunk-CPCO6UJK.js";
+  prepareSecretDelete,
+  resolveSecretPath,
+  resolveUpdateVersion,
+  runDiagnostics,
+  secretsDir,
+  updateGateway
+} from "./chunk-OUQVKIIA.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
-} from "./chunk-NUL5F6YV.js";
-import "./chunk-3OLUJPCB.js";
+} from "./chunk-SOZ62ZXW.js";
+import "./chunk-6ZFIFDBJ.js";
+import "./chunk-Z3XLWZWF.js";
 import {
   execPrivileged,
-  execPrivilegedWithInput,
   streamPrivileged
-} from "./chunk-NUDIHZEH.js";
-import "./chunk-CHNSL3TC.js";
+} from "./chunk-WPZIJONN.js";
+import "./chunk-YPVWF7IA.js";
 import {
   resolveSpecDir
 } from "./chunk-JW5A7E3X.js";
-import {
-  interpretProbe,
-  probeCommand
-} from "./chunk-LT4XMO5D.js";
+import "./chunk-LT4XMO5D.js";
 import "./chunk-VUFMZEIM.js";
 import {
-  CONFIG_FILENAME,
-  CONTAINER_UID,
   PUBLISH_INSPECT_CMD,
   STATE_DIR_HOST_LINUX,
   configPathForOS,
   gatewayRunCommand,
   publishForRestart
-} from "./chunk-GIEVAGEK.js";
+} from "./chunk-N5ZYUTZS.js";
 import {
   GATEWAY_PORT,
   IMAGE_INSPECT_CMD,
@@ -67,8 +79,7 @@ import {
 } from "./chunk-755X5OGS.js";
 import {
   getConfigDir,
-  requireConfig,
-  setConfig
+  requireConfig
 } from "./chunk-GFIR2IIJ.js";
 import {
   ClawopsError,
@@ -192,7 +203,7 @@ var up_default = defineCommand2({
     "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
@@ -205,7 +216,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-3PBVY7MA.js");
+      const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
       const gatewayPort = parseGatewayPort(args["gateway-port"]);
       const abortController2 = new AbortController();
       process3.on("SIGINT", () => abortController2.abort());
@@ -245,8 +256,8 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const { generatePlan } = await import("./generate-NE54BATS.js");
-    const { applyPlan } = await import("./apply-JARPVA5Y.js");
+    const { generatePlan } = await import("./generate-4YYNW3IU.js");
+    const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const isDryRun = Boolean(args["dry-run"]);
@@ -326,9 +337,9 @@ function strArg(value) {
   return typeof value === "string" ? value : void 0;
 }
 async function applyLocalConfigOverlay(opts) {
-  const { connect } = await import("./ssh-VAI5DU5M.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -376,7 +387,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -440,7 +451,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -540,8 +551,8 @@ var plan_default = defineCommand5({
     "private-only": { type: "boolean", description: "Close public SSH and gateway access; reach the stack over its tailnet. Needs `clawops harden --tailscale` first, and checks the tailnet answers before planning" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { generatePlan } = await import("./generate-NE54BATS.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { generatePlan } = await import("./generate-4YYNW3IU.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
@@ -566,7 +577,7 @@ var plan_default = defineCommand5({
     let network = resolved;
     if (args["private-only"]) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-EKAQSDXP.js");
+      const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[ctx.stackName]?.tailscale, ctx.stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -656,8 +667,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-JXKN5WD6.js");
-    const { applyPlan } = await import("./apply-JARPVA5Y.js");
+    const { validatePlan } = await import("./validate-DZE6LFEB.js");
+    const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -783,7 +794,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -876,8 +887,8 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
     let conn;
     if (ctx.adapter.name === "local") {
@@ -963,9 +974,9 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+    const { acquireSession } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
     const stack = await ctx.getStack();
     const outputMap = await stack.outputs();
@@ -1032,25 +1043,10 @@ var logs_default = defineCommand10({
     json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    if (!outputs["publicIp"]) {
-      failure("Stack has no outputs. Run `clawops up` first.");
-      process12.exit(4);
-    }
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const conn = await connFor(ctx);
     const tailLines = typeof args.tail === "string" ? parseInt(args.tail, 10) : 100;
     const follow = Boolean(args.follow);
     const since = typeof args.since === "string" ? args.since : void 0;
@@ -1092,12 +1088,33 @@ var logs_default = defineCommand10({
     }
   }
 });
+async function connFor(ctx) {
+  if (ctx.adapter.name === "local") {
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    return resolveConn(ctx);
+  }
+  const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
+  const stack = await ctx.getStack();
+  const outputMap = await stack.outputs();
+  const outputs = Object.fromEntries(
+    Object.entries(outputMap).map(([k, v]) => [k, v.value])
+  );
+  if (!outputs["publicIp"]) {
+    failure("Stack has no outputs. Run `clawops up` first.");
+    process12.exit(4);
+  }
+  return ctx.adapter.getConnectionInfo({
+    ...extractBaseOutputs(outputs),
+    privateKeyPath: ctx.config.ssh.keyPath,
+    knownHostsPath: ctx.config.ssh.knownHostsPath
+  });
+}
 
 // src/cli/commands/config.ts
 import { defineCommand as defineCommand11 } from "citty";
 import process13 from "process";
 var OPENCLAW_CONFIG = configPathForOS("Linux");
-function dockerRunCmd(image) {
+function dockerRunCmd2(image) {
   return gatewayRunCommand({ image, stateDir: STATE_DIR_HOST_LINUX });
 }
 function getPath(obj, dotKey) {
@@ -1138,9 +1155,8 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
       failure("Usage: clawops config <get [key] | set key value | unset key | validate>");
@@ -1155,17 +1171,8 @@ var config_default = defineCommand11({
       process13.exit(2);
     }
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    const conn = await resolveConn(ctx);
     const abortController = new AbortController();
     process13.on("SIGINT", () => abortController.abort());
     process13.on("SIGTERM", () => abortController.abort());
@@ -1228,7 +1235,7 @@ var config_default = defineCommand11({
         process13.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
         return;
       }
-      const { atomicWriteConfig } = await import("./remote-config-3HZLUWEA.js");
+      const { atomicWriteConfig } = await import("./remote-config-OZYBMBSK.js");
       try {
         await atomicWriteConfig(session, cfg, abortController.signal);
       } catch (err) {
@@ -1244,7 +1251,7 @@ var config_default = defineCommand11({
           abortController.signal
         );
         const image = imgResult.stdout.trim();
-        const restartResult = await execPrivileged(session, dockerRunCmd(image), abortController.signal);
+        const restartResult = await execPrivileged(session, dockerRunCmd2(image), abortController.signal);
         if (restartResult.code !== 0) {
           failure(`Restart failed: ${restartResult.stderr}`);
           process13.exit(1);
@@ -1273,9 +1280,8 @@ var agents_default = defineCommand12({
     cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, name] = args._ ?? [];
     if (action === "restart") {
       failure(
@@ -1292,17 +1298,8 @@ var agents_default = defineCommand12({
       process14.exit(2);
     }
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    const conn = await resolveConn(ctx);
     const abortController = new AbortController();
     process14.on("SIGINT", () => abortController.abort());
     process14.on("SIGTERM", () => abortController.abort());
@@ -1348,22 +1345,23 @@ var agents_default = defineCommand12({
           );
         }
       } else {
-        const { agentAuditCommand } = await import("./logs-5A7YYA53.js");
-        const limit = typeof args.limit === "string" ? parseInt(args.limit, 10) : 50;
-        const result = await execPrivileged(
+        const { readAgentActivityRaw, DEFAULT_AGENT_LOG_LIMIT } = await import("./agent-activity-25FAWLAI.js");
+        const limit = typeof args.limit === "string" ? parseInt(args.limit, 10) : DEFAULT_AGENT_LOG_LIMIT;
+        const result = await readAgentActivityRaw(
           session,
-          agentAuditCommand({ agentId: name, limit, cursor: typeof args.cursor === "string" ? args.cursor : void 0 }),
+          { agentId: name, limit, ...typeof args.cursor === "string" ? { cursor: args.cursor } : {} },
           abortController.signal
         );
-        if (result.code !== 0) {
-          failure(`Cannot read activity for "${name}": ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
+        if (!result.ok) {
+          failure(result.error);
           process14.exitCode = 1;
           return;
         }
         if (args.json) {
-          process14.stdout.write(result.stdout);
+          process14.stdout.write(result.value);
         } else {
-          renderAgentRuns(name, result.stdout);
+          const { parseAgentActivity } = await import("./agent-activity-25FAWLAI.js");
+          renderAgentRuns(name, parseAgentActivity(name, result.value));
         }
       }
     } finally {
@@ -1372,16 +1370,14 @@ var agents_default = defineCommand12({
     }
   }
 });
-function renderAgentRuns(agentId, stdout) {
-  let page;
-  try {
-    page = JSON.parse(stdout.trim() || "{}");
-  } catch {
-    failure(`Cannot read activity for "${agentId}": unexpected output: ${stdout.trim().slice(0, 200)}`);
+function renderAgentRuns(agentId, parsed) {
+  if (!parsed.ok) {
+    failure(parsed.error);
     process14.exitCode = 1;
     return;
   }
-  const records = page.records ?? [];
+  const page = parsed.value;
+  const records = page.records;
   if (records.length === 0) {
     info(`No recorded activity for agent "${agentId}".`);
     return;
@@ -1401,99 +1397,6 @@ function renderAgentRuns(agentId, stdout) {
 // src/cli/commands/migrate.ts
 import { defineCommand as defineCommand13 } from "citty";
 import process15 from "process";
-
-// src/openclaw/migrate.ts
-async function migrate(steps) {
-  const sourceImage = await steps.inspectSource();
-  if (!sourceImage) {
-    return {
-      kind: "nothing-to-migrate",
-      reason: "No running OpenClaw container was found, so there is no 1.x state to extract. If this deployment was restarted on a clawops release before 2.0, its state was already lost \u2014 clawops mounted none, so every container replacement discarded it. Deploy fresh with `clawops up`."
-    };
-  }
-  const identityBefore = await steps.deviceId();
-  const backup = await steps.backup();
-  if (!backup.ok) {
-    return {
-      kind: "refused",
-      reason: `Refusing to migrate without a verified backup: ${backup.detail}
-This replaces the running container, and the state it extracts is the only copy.`
-    };
-  }
-  const extracted = await steps.extract();
-  if (!extracted.ok) {
-    return {
-      kind: "failed",
-      reason: "Could not extract state from the running container; it has not been touched.",
-      backupDetail: backup.detail
-    };
-  }
-  await steps.chown();
-  await steps.removeSource();
-  await steps.writeConfig();
-  await steps.start();
-  let restarts = 0;
-  let gate = await steps.gate();
-  if (!gate.ok) {
-    await steps.start();
-    restarts = 1;
-    gate = await steps.gate();
-  }
-  if (!gate.ok) {
-    return {
-      kind: "failed",
-      reason: gate.reason ?? "the gateway did not start after migration",
-      backupDetail: backup.detail
-    };
-  }
-  const identityAfter = await steps.deviceId();
-  const identity = identityBefore === void 0 || identityAfter === void 0 ? "unknown" : identityBefore === identityAfter ? "preserved" : "changed";
-  return { kind: "migrated", entries: extracted.entries, identity, restarts };
-}
-function describeMigration(o) {
-  switch (o.kind) {
-    case "migrated": {
-      const lines = [
-        `Migrated to the 2.0 runtime contract. Carried over: ${o.entries.join(", ") || "(nothing)"}.`
-      ];
-      if (o.restarts > 0) {
-        lines.push(
-          "The gateway needed a second start to finish its state-schema migration, which is expected for a 1.x database."
-        );
-      }
-      if (o.identity === "preserved") {
-        lines.push("Device identity preserved \u2014 paired devices do not need re-pairing.");
-      } else if (o.identity === "changed") {
-        lines.push(
-          "Device identity CHANGED. Paired devices and nodes must be re-paired \u2014 check `openclaw devices list` on the host for what was paired."
-        );
-      } else {
-        lines.push(
-          "Device identity could not be compared, so pairings may or may not have carried over. Check `openclaw devices list` before relying on them."
-        );
-      }
-      lines.push("Your 1.x config was NOT applied \u2014 it never took effect on 1.x either. Review it");
-      lines.push("and set what you need with `clawops config set`.");
-      return lines.join("\n");
-    }
-    case "nothing-to-migrate":
-      return o.reason;
-    case "refused":
-      return o.reason;
-    case "failed":
-      return `Migration failed: ${o.reason}
-A verified backup was taken first: ${o.backupDetail}
-Restore it with \`clawops backup restore --file <archive>\` before retrying.`;
-  }
-}
-
-// src/cli/commands/migrate.ts
-var SYNTHESISED_CONFIG = JSON.stringify({
-  meta: { lastTouchedVersion: "2026.9.2" },
-  gateway: { mode: "local", port: GATEWAY_PORT, auth: { mode: "token" } },
-  models: {},
-  channels: {}
-});
 var migrate_default = defineCommand13({
   meta: {
     name: "migrate",
@@ -1505,120 +1408,41 @@ var migrate_default = defineCommand13({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
-    const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
-    const requested = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0;
-    const target = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
-    const targetImage = `ghcr.io/openclaw/openclaw:${target}`;
-    const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputs = Object.fromEntries(
-      Object.entries(await stack.outputs()).map(([k, v]) => [k, v.value])
-    );
-    const conn = ctx.adapter.getConnectionInfo({
-      ...extractBaseOutputs(outputs),
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
+    const { prepareMigration, runMigration, migrationQuestion } = await import("./migrate-flow-24XA4GZL.js");
+    const target = await prepareMigration({
+      stack: typeof args.stack === "string" ? args.stack : void 0,
+      openclawVersion: typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0
     });
+    if (!args.yes) {
+      const inquirer = (await import("inquirer")).default;
+      const { confirmed } = await inquirer.prompt([{
+        type: "confirm",
+        name: "confirmed",
+        message: migrationQuestion(target),
+        default: false
+      }]);
+      if (!confirmed) {
+        info("Aborted. Nothing was changed.");
+        return;
+      }
+    }
     const ac = new AbortController();
     process15.on("SIGINT", () => ac.abort());
-    const { session, release } = await acquireSession({
-      host: conn.host,
-      port: conn.port,
-      user: conn.user,
-      privateKeyPath: conn.privateKeyPath,
-      knownHostsPath: conn.knownHostsPath,
-      signal: ac.signal
-    });
-    const spin = spinner("Inspecting the deployment...");
-    const run = (cmd) => execPrivileged(session, cmd, ac.signal);
-    const archive = "/tmp/clawops-premigration.tar.gz";
-    const configPath = `${STATE_DIR_HOST_LINUX}/${CONFIG_FILENAME}`;
-    const steps = {
-      inspectSource: async () => {
-        const r = await run(`docker inspect openclaw --format '{{.Config.Image}}'`);
-        const image = r.stdout.trim();
-        return r.code === 0 && image.includes(":") ? image : void 0;
-      },
-      backup: async () => {
-        spin.text = "Taking a verified backup...";
-        const r = await run(
-          `docker exec openclaw openclaw backup create --output ${archive} --verify --json`
-        );
-        return r.code === 0 ? { ok: true, detail: `${archive} on the host (verified)` } : { ok: false, detail: (r.stderr || r.stdout).slice(0, 200) };
-      },
-      extract: async () => {
-        spin.text = "Extracting state from the running container...";
-        const mk = await run(`mkdir -p ${STATE_DIR_HOST_LINUX}`);
-        if (mk.code !== 0) return { ok: false, entries: [] };
-        const cp = await run(`docker cp openclaw:/home/node/.openclaw/. ${STATE_DIR_HOST_LINUX}/`);
-        if (cp.code !== 0) return { ok: false, entries: [] };
-        const ls = await run(`ls ${STATE_DIR_HOST_LINUX}`);
-        return { ok: true, entries: ls.stdout.trim().split(/\s+/).filter(Boolean) };
-      },
-      chown: async () => {
-        await run(`chown -R ${CONTAINER_UID}:${CONTAINER_UID} ${STATE_DIR_HOST_LINUX}`);
-      },
-      removeSource: async () => {
-        spin.text = "Stopping the 1.x container...";
-        await run("docker stop openclaw 2>/dev/null || true");
-        await run("docker rm   openclaw 2>/dev/null || true");
-      },
-      writeConfig: async () => {
-        const b64 = Buffer.from(SYNTHESISED_CONFIG, "utf-8").toString("base64");
-        await run(
-          `echo '${b64}' | base64 -d > ${configPath} && chown ${CONTAINER_UID}:${CONTAINER_UID} ${configPath}`
-        );
-      },
-      start: async () => {
-        spin.text = "Starting the 2.0 gateway...";
-        await run(gatewayRunCommand({ image: targetImage, stateDir: STATE_DIR_HOST_LINUX }));
-      },
-      gate: async () => {
-        spin.text = "Waiting for the gateway to start...";
-        let last;
-        for (let i = 0; i < 15; i++) {
-          if (ac.signal.aborted) return { ok: false, reason: "aborted" };
-          const r = await run(probeCommand("started", GATEWAY_PORT));
-          const v = interpretProbe("started", r.stdout);
-          if (v.ok) return { ok: true };
-          last = v.reason;
-          await new Promise((res) => setTimeout(res, 2e3));
-        }
-        return { ok: false, reason: last ?? "no response" };
-      },
-      deviceId: async () => {
-        const file = await run(
-          `docker exec openclaw sh -c 'cat ~/.openclaw/identity/device.json 2>/dev/null' || cat ${STATE_DIR_HOST_LINUX}/identity/device.json 2>/dev/null || true`
-        );
-        try {
-          const parsed = JSON.parse(file.stdout.trim());
-          return parsed.deviceId;
-        } catch {
-          return void 0;
-        }
-      }
-    };
+    let spin;
     try {
-      const outcome = await migrate(steps);
-      spin.stop();
-      const report = describeMigration(outcome);
-      if (outcome.kind === "migrated") {
-        success(report.split("\n")[0]);
-        for (const line2 of report.split("\n").slice(1)) {
-          if (/CHANGED|could not be compared/.test(line2)) warn(line2);
-          else info(line2);
+      const result = await runMigration(target, {
+        signal: ac.signal,
+        onStep: (text) => {
+          if (spin) spin.text = text;
+          else spin = spinner(text);
         }
-        info(`Pre-migration backup: ${archive}`);
-      } else {
-        failure(report);
-        process15.exit(outcome.kind === "nothing-to-migrate" ? 0 : 1);
-      }
+      });
+      spin?.stop();
+      const render2 = { success, info, warn, failure };
+      for (const line2 of result.lines) render2[line2.level](line2.text);
+      if (result.outcome.kind !== "migrated") process15.exit(result.exitCode);
     } finally {
-      release();
-      drainPool();
+      spin?.stop();
     }
   }
 });
@@ -1626,13 +1450,6 @@ var migrate_default = defineCommand13({
 // src/cli/commands/gateway.ts
 import { defineCommand as defineCommand14 } from "citty";
 import process16 from "process";
-function dockerRunCmd2(version, publish = "loopback") {
-  return gatewayRunCommand({
-    image: `ghcr.io/openclaw/openclaw:${version}`,
-    stateDir: STATE_DIR_HOST_LINUX,
-    publish
-  });
-}
 var gateway_default = defineCommand14({
   meta: {
     name: "gateway",
@@ -1644,26 +1461,16 @@ var gateway_default = defineCommand14({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
       failure("Usage: clawops gateway <status | restart | update [version]>");
       process16.exit(2);
     }
     const ctx = buildContext(args);
-    const stack = await ctx.getStack();
-    const outputMap = await stack.outputs();
-    const outputs = Object.fromEntries(
-      Object.entries(outputMap).map(([k, v]) => [k, v.value])
-    );
-    const base = extractBaseOutputs(outputs);
-    const conn = ctx.adapter.getConnectionInfo({
-      ...base,
-      privateKeyPath: ctx.config.ssh.keyPath,
-      knownHostsPath: ctx.config.ssh.knownHostsPath
-    });
+    const { resolveConn } = await import("./conn-M2V5HBPJ.js");
+    const conn = await resolveConn(ctx);
     const abortController = new AbortController();
     process16.on("SIGINT", () => abortController.abort());
     process16.on("SIGTERM", () => abortController.abort());
@@ -1677,25 +1484,12 @@ var gateway_default = defineCommand14({
     });
     try {
       if (action === "status") {
-        const { inspectContainer } = await import("./docker-3PDO4TS7.js");
-        const inspected = await inspectContainer(
-          session,
-          "openclaw",
-          '{"status":"{{.State.Status}}","started":"{{.State.StartedAt}}","image":"{{.Config.Image}}"}',
-          abortController.signal
-        );
-        let status = { status: "unknown", started: "", image: "" };
-        if (inspected.kind === "ok") {
-          try {
-            status = JSON.parse(inspected.value);
-          } catch {
-          }
-        } else if (inspected.kind === "missing") {
-          status = { status: "not running", started: "", image: "" };
-        } else {
-          failure(`Could not ask docker about the gateway: ${inspected.detail}`);
+        const inspected = await gatewayStatus(session, abortController.signal);
+        if (!inspected.ok) {
+          failure(inspected.error);
           process16.exit(1);
         }
+        const status = inspected.value;
         if (args.json) {
           printJson(jsonOk(status));
         } else {
@@ -1723,7 +1517,7 @@ var gateway_default = defineCommand14({
         const spin = spinner("Restarting gateway...");
         const result = await execPrivileged(
           session,
-          dockerRunCmd2(version, publish),
+          dockerRunCmd(version, publish),
           abortController.signal
         );
         spin.stop();
@@ -1733,121 +1527,23 @@ var gateway_default = defineCommand14({
         }
         success(`Gateway restarted (${version}).`);
       } else {
-        const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
-        const requested = versionArg ?? args.channel;
-        const version = requested ? await guardOpenclawVersion(requested) : await defaultOpenclawVersion();
+        const target = await resolveUpdateVersion(versionArg ?? args.channel);
+        if (!target.ok) throw new UsageError(target.error);
+        const version = target.value;
         const spin = spinner(`Updating gateway to ${version}...`);
-        const targetImage = `ghcr.io/openclaw/openclaw:${version}`;
-        const pullResult = await execPrivileged(
-          session,
-          `docker pull ${targetImage}`,
-          abortController.signal
-        );
-        if (pullResult.code !== 0) {
-          spin.stop();
-          failure(`Pull failed: ${pullResult.stderr}`);
-          process16.exit(1);
-        }
-        spin.text = "Checking state compatibility...";
-        const {
-          snapshotCommand,
-          snapshotPathFrom,
-          preflightCommand,
-          parsePreflight,
-          judgePreflight
-        } = await import("./upgrade-ULD4KFYC.js");
-        const cur = imageForRestart(
-          (await execPrivileged(session, IMAGE_INSPECT_CMD, abortController.signal)).stdout
-        );
-        const snapRepo = `${STATE_DIR_HOST_LINUX}/snapshots`;
-        const snapOut = await execPrivileged(
-          session,
-          snapshotCommand(cur.ok ? cur.value : targetImage, STATE_DIR_HOST_LINUX, snapRepo),
-          abortController.signal
-        );
-        const snapPath = snapshotPathFrom(snapOut.stdout);
-        if (!snapPath) {
-          spin.stop();
-          failure(
-            "Could not snapshot the state database before upgrading, so neither the compatibility check nor a rollback point is available.\n" + (snapOut.stderr || snapOut.stdout).slice(0, 300)
-          );
-          process16.exit(1);
-        }
-        const pre = await execPrivileged(
-          session,
-          preflightCommand(targetImage, STATE_DIR_HOST_LINUX, `${snapPath}/database.sqlite`),
-          abortController.signal
-        );
-        const report = parsePreflight(pre.stdout);
-        const verdict = report ? judgePreflight(report) : { ok: false, reason: `preflight produced no readable report: ${pre.stderr.slice(0, 200)}` };
-        if (!verdict.ok) {
-          spin.stop();
-          failure(`Refusing to upgrade to ${version}: ${verdict.reason}`);
-          info(`A snapshot of the current state was kept at ${snapPath}.`);
-          process16.exit(1);
-        }
-        if (verdict.ok && verdict.note) info(verdict.note);
-        spin.text = `Updating gateway to ${version}...`;
-        const pubU = await execPrivileged(session, PUBLISH_INSPECT_CMD, abortController.signal);
-        const runResult = await execPrivileged(
-          session,
-          dockerRunCmd2(version, publishForRestart(pubU.stdout)),
-          abortController.signal
-        );
-        if (runResult.code !== 0) {
-          spin.stop();
-          failure(`Start failed: ${runResult.stderr}`);
-          info(`State snapshot from before the upgrade: ${snapPath}`);
-          process16.exit(1);
-        }
-        spin.text = "Waiting for the gateway to start...";
-        const { probeCommand: probeCommand2, interpretProbe: interpretProbe2 } = await import("./health-5CCOXYGG.js");
-        const { repairCommand, describeOutcome } = await import("./upgrade-ULD4KFYC.js");
-        const publish = publishForRestart(pubU.stdout);
-        const gate = async () => {
-          let last;
-          for (let i = 0; i < 15; i++) {
-            if (abortController.signal.aborted) return { ok: false, reason: "aborted" };
-            const r = await execPrivileged(
-              session,
-              probeCommand2("started", GATEWAY_PORT),
-              abortController.signal
-            );
-            const v = interpretProbe2("started", r.stdout);
-            if (v.ok) return { ok: true };
-            last = v.reason;
-            await new Promise((res) => setTimeout(res, 2e3));
-          }
-          return { ok: false, reason: last ?? "no response" };
-        };
-        const { resolveUpgrade } = await import("./upgrade-ULD4KFYC.js");
-        const outcome = await resolveUpgrade(
-          {
-            gate,
-            repair: async () => {
-              spin.text = "Gateway did not start; attempting one-shot repair...";
-              await execPrivileged(
-                session,
-                repairCommand(targetImage, STATE_DIR_HOST_LINUX),
-                abortController.signal
-              );
-            },
-            run: async (v) => {
-              await execPrivileged(session, dockerRunCmd2(v, publish), abortController.signal);
-            }
+        const result = await updateGateway(session, version, {
+          signal: abortController.signal,
+          onProgress: (text) => {
+            spin.text = text;
           },
-          {
-            version,
-            previousVersion: cur.ok ? versionOf(cur.value) : void 0,
-            snapshotPath: snapPath
-          }
-        );
+          onNote: (text) => info(text)
+        });
         spin.stop();
-        const message = describeOutcome(outcome, version);
-        if (outcome.kind === "started" || outcome.kind === "repaired") {
-          success(message);
+        if (result.ok) {
+          success(result.message);
         } else {
-          failure(message);
+          failure(result.message);
+          if (result.hint) info(result.hint);
           process16.exit(1);
         }
       }
@@ -1860,24 +1556,23 @@ var gateway_default = defineCommand14({
 
 // src/cli/commands/backup.ts
 import { defineCommand as defineCommand15 } from "citty";
-import { createWriteStream } from "fs";
-import { pipeline } from "stream/promises";
 import process17 from "process";
 var backup_default = defineCommand15({
   meta: {
     name: "backup",
-    description: "Create an OpenClaw backup (restore is unavailable on this release line)"
+    description: "Create an OpenClaw backup, or restore one into a staging directory"
   },
   args: {
-    action: { type: "positional", description: "Action: create (restore returns in clawops 2.x)", required: true },
+    action: { type: "positional", description: "Action: create | restore", required: true },
     out: { type: "string", description: "[create] Local path to write the backup archive" },
-    file: { type: "string", description: "[restore] Local backup archive (restore is unavailable)" },
+    file: { type: "string", description: "[restore] Local backup archive to verify and expand on the host" },
     stack: { type: "string", description: "Target stack name" },
-    yes: { type: "boolean", description: "[restore] Skip confirmation prompt" }
+    yes: { type: "boolean", description: "[restore] Skip confirmation prompt" },
+    activate: { type: "boolean", description: "[restore] Put the restored state into service: stop the gateway, swap it in, restart, and roll back if it does not come up" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
       throw new UsageError(`Unknown action: ${action}. Use "create" or "restore"`);
@@ -1927,86 +1622,91 @@ var backup_default = defineCommand15({
       signal: abortController.signal
     });
     try {
+      const flows = await import("./backup-flows-NDP5JTR3.js");
       if (action === "create") {
-        const outPath = typeof args.out === "string" ? args.out : `openclaw-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.tar.gz`;
+        const outPath = typeof args.out === "string" ? args.out : flows.defaultBackupFilename();
         info(`Writing backup to ${outPath}...`);
         const spin = spinner("Creating backup on remote host...");
-        const remoteArchive = "/tmp/clawops-backup.tar.gz";
-        const createResult = await execPrivileged(
-          session,
-          `docker exec openclaw sh -lc 'rm -f ${remoteArchive} && openclaw backup create --output ${remoteArchive} --verify --json'`,
-          abortController.signal
-        );
-        if (createResult.code !== 0) {
-          spin.stop();
-          throw new Error(`Backup failed on the remote host: ${createResult.stderr.slice(0, 300)}`);
-        }
-        const backupStream = await streamPrivileged(
-          session,
-          `docker exec openclaw cat ${remoteArchive}`,
-          abortController.signal
-        );
+        const created = await flows.createBackup(session, {
+          outPath,
+          signal: abortController.signal,
+          onPhase: (phase) => {
+            if (phase === "downloading") spin.stop();
+          }
+        });
         spin.stop();
-        const fileStream = createWriteStream(outPath, { mode: 384 });
-        await pipeline(backupStream, fileStream);
-        await execPrivileged(
-          session,
-          `docker exec openclaw rm -f ${remoteArchive}`,
-          abortController.signal
-        );
+        if (!created.ok) throw new Error(created.reason);
         success(`Backup saved to ${outPath}`);
-        info("Saved with mode 0600. The archive contains the state database \u2014 OAuth tokens,");
-        info("secrets and device credentials, unencrypted. Treat it as a credential.");
+        for (const line2 of flows.ARCHIVE_IS_A_CREDENTIAL) info(line2);
       } else {
         const file = typeof args.file === "string" ? args.file : void 0;
         if (!file) {
           throw new UsageError("Usage: clawops backup restore --file <archive.tar.gz>");
         }
-        const { createReadStream } = await import("fs");
-        const remoteArchive = "/tmp/clawops-restore.tar.gz";
-        const staging = `/tmp/clawops-restored-${Date.now()}`;
-        const spin = spinner("Uploading archive...");
-        const uploadResult = await execPrivilegedWithInput(
-          session,
-          `docker exec -i openclaw sh -c 'cat > ${remoteArchive}'`,
-          createReadStream(file),
-          abortController.signal
-        );
-        if (uploadResult.code !== 0) {
-          spin.stop();
-          throw new Error(`Could not upload the archive: ${uploadResult.stderr.slice(0, 300)}`);
+        let spin;
+        const staged = await flows.stageRestore(session, {
+          file,
+          signal: abortController.signal,
+          onPhase: (phase) => {
+            if (phase === "uploading") spin = spinner("Uploading archive...");
+            else if (spin) spin.text = "Verifying and restoring to a staging directory...";
+          }
+        });
+        spin?.stop();
+        if (staged.unparsedReport !== void 0) info(staged.unparsedReport);
+        if (!staged.ok) {
+          if (staged.kind === "refused") throw new UsageError(staged.reason);
+          if (staged.kind === "failed") throw new Error(staged.reason);
+          failure(staged.reason);
+          if (staged.stagingOnHost) info(flows.nothingChanged(staged.stagingOnHost));
+          process17.exit(1);
         }
-        spin.text = "Verifying and restoring to a staging directory...";
-        const restore = await execPrivileged(
-          session,
-          `docker exec openclaw openclaw backup restore ${remoteArchive} --target ${staging} --json`,
-          abortController.signal
-        );
-        await execPrivileged(
-          session,
-          `docker exec openclaw rm -f ${remoteArchive}`,
-          abortController.signal
-        );
-        spin.stop();
-        if (restore.code !== 0) {
-          throw new Error(`Restore failed: ${(restore.stderr || restore.stdout).slice(0, 400)}`);
+        const { stagingOnHost, stateDir } = staged;
+        success(`Archive verified and expanded to ${stagingOnHost} on the host.`);
+        if (staged.entryCount !== void 0) info(`${staged.entryCount} entries restored.`);
+        for (const w of staged.warnings) warn(w);
+        if (!args.activate) {
+          info("");
+          info("Nothing has been activated. Re-run with --activate to put this state into");
+          info("service, or adopt it by hand:");
+          info("  1. clawops ssh --command 'sudo docker stop openclaw'");
+          info(`  2. replace the contents of ${stateDir} with those of`);
+          info(`     ${staged.statePath}`);
+          info(`     (the archive holds ${staged.stateDirInArchive} under payload/posix, not a`);
+          info("      drop-in state directory \u2014 moving the bundle itself stops the gateway)");
+          info("  3. clawops gateway restart");
+          for (const line2 of flows.PLUGINS_NOT_CARRIED) info(line2);
+          return;
         }
-        let report = {};
-        try {
-          report = JSON.parse(restore.stdout.trim());
-        } catch {
-          info(restore.stdout);
+        if (!args.yes) {
+          const { createInterface: createInterface3 } = await import("readline/promises");
+          const rl = createInterface3({ input: process17.stdin, output: process17.stdout });
+          const answer = await rl.question(
+            `Stop the gateway and put this restored state into service? The state it replaces is kept alongside it, and clawops puts it back if the gateway does not come up. [y/N] `
+          );
+          rl.close();
+          if (!answer.toLowerCase().startsWith("y")) {
+            info(`Aborted. The restored state is at ${stagingOnHost}; nothing was changed.`);
+            return;
+          }
         }
-        success(`Archive verified and restored to ${staging} on the host.`);
-        if (report.entryCount !== void 0) info(`${report.entryCount} entries restored.`);
-        for (const w of report.warnings ?? []) warn(w);
-        info("");
-        info("Nothing has been activated. To adopt the restored state:");
-        info("  1. clawops ssh --command 'sudo docker stop openclaw'");
-        info(`  2. replace the state directory contents with ${staging}`);
-        info("  3. clawops gateway restart");
-        info("Provider plugins are not carried in the archive; re-run `clawops apply` to");
-        info("reinstall them, or the gateway starts without its model providers.");
+        const activating = spinner("Activating the restored state...");
+        const outcome = await flows.activateStaged(session, staged, {
+          signal: abortController.signal,
+          onPhase: (phase) => {
+            if (phase === "restarting") activating.text = "Restarting the gateway...";
+            else if (phase === "waiting") activating.text = "Waiting for the gateway to answer...";
+            else if (phase === "done") activating.stop();
+          }
+        });
+        activating.stop();
+        if (!outcome.ok) {
+          failure(outcome.reason);
+          for (const line2 of flows.activationFailureDetail(outcome)) info(line2);
+          process17.exit(1);
+        }
+        success(flows.ACTIVATED);
+        for (const line2 of flows.activatedLines(outcome.preserved)) info(line2);
       }
     } finally {
       release();
@@ -2035,16 +1735,16 @@ var stacks_default = defineCommand16({
       process18.exit(2);
     }
     if (action === "list") {
-      const config2 = requireConfig();
-      const defaultStack = config2.defaults.stack;
-      const rows = Object.entries(config2.stacks).map(([n, s]) => [
+      const config = requireConfig();
+      const defaultStack = config.defaults.stack;
+      const rows = Object.entries(config.stacks).map(([n, s]) => [
         n === defaultStack ? `${n} *` : n,
         s.provider,
         s.region ?? "\u2014",
         s.stateUrl
       ]);
       if (args.json) {
-        const data = Object.entries(config2.stacks).map(([n, s]) => ({
+        const data = Object.entries(config.stacks).map(([n, s]) => ({
           name: n,
           provider: s.provider,
           region: s.region ?? null,
@@ -2069,49 +1769,17 @@ var stacks_default = defineCommand16({
       failure("Usage: clawops stacks delete <name>");
       process18.exit(2);
     }
-    const config = requireConfig();
-    if (!(name in config.stacks)) {
-      throw new UsageError(`Stack "${name}" not found in config.`);
-    }
-    const stackNames = Object.keys(config.stacks);
-    if (stackNames.length === 1) {
-      throw new UsageError(
-        `Cannot delete the only remaining stack "${name}". Add another stack first or run \`clawops destroy\` to tear down resources.`
-      );
-    }
-    if (name === config.defaults.stack && !args.force) {
-      throw new UsageError(
-        `"${name}" is the default stack. Use --force to delete it (clawops will switch the default to another stack).`
-      );
-    }
-    let isDeployed = false;
-    if (!args.force) {
-      try {
-        const { buildContext } = await import("./context-WOKSKAIA.js");
-        const ctx = buildContext({ stack: name });
-        if (ctx.adapter.name === "local") {
-          isDeployed = !!ctx.localState;
-        } else {
-          const stack = await ctx.getStack();
-          const outputMap = await stack.outputs();
-          const outputs = Object.fromEntries(
-            Object.entries(outputMap).map(([k, v]) => [k, v.value])
-          );
-          isDeployed = !!outputs["publicIp"];
-        }
-      } catch {
-        warn(`Could not verify deployment status for "${name}" \u2014 proceeding anyway.`);
+    const { checkStackDelete, deleteStackFromConfig, forgetNotice } = await import("./stack-delete-NTIGKWUF.js");
+    const check = await checkStackDelete(name, { force: !!args.force });
+    if (!check.ok) {
+      if (check.refusal === "deployed") {
+        failure(check.reason);
+        process18.exit(1);
       }
+      throw new UsageError(check.reason);
     }
-    if (isDeployed) {
-      failure(
-        `Stack "${name}" is still deployed. Run \`clawops down --stack ${name}\` first to destroy cloud resources, or pass --force to remove from registry only.`
-      );
-      process18.exit(1);
-    }
-    warn(
-      `This removes "${name}" from clawops config only. Cloud resources are NOT destroyed. Run \`clawops destroy --stack ` + name + "` first if you want to remove cloud resources."
-    );
+    for (const w of check.warnings) warn(w);
+    warn(forgetNotice(name));
     if (!args.yes) {
       const confirmed = await confirm(`Delete stack "${name}" from config?`);
       if (!confirmed) {
@@ -2119,18 +1787,9 @@ var stacks_default = defineCommand16({
         return;
       }
     }
-    const updated = { ...config };
-    const newStacks = { ...config.stacks };
-    delete newStacks[name];
-    updated.stacks = newStacks;
-    if (name === config.defaults.stack) {
-      updated.defaults = { ...config.defaults, stack: Object.keys(newStacks)[0] };
-    }
-    setConfig(updated);
-    success(`Stack "${name}" removed from config.`);
-    if (name === config.defaults.stack) {
-      info(`Default stack switched to "${updated.defaults.stack}".`);
-    }
+    const deleted = deleteStackFromConfig(name);
+    success(deleted.message);
+    if (deleted.newDefaultMessage) info(deleted.newDefaultMessage);
   }
 });
 async function confirm(message) {
@@ -2228,7 +1887,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-OXWHBTXK.js");
+    const { serveMcp } = await import("./server-E3YA32ND.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -2306,11 +1965,11 @@ var wireCmd = defineCommand18({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
-    const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-FIO5DFBY.js");
-    const { MCP_HTTP_PORT } = await import("./server-OXWHBTXK.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-BXF4DJFT.js");
+    const { MCP_HTTP_PORT } = await import("./server-E3YA32ND.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -2910,7 +2569,7 @@ var setup_default = defineCommand19({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-JARPVA5Y.js");
+        const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2938,10 +2597,10 @@ To deploy later:  clawops apply ${outputPath}`);
   }
 });
 async function runLocalDeploy(opts) {
-  const { setConfig: setConfig2, getConfig, getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
-  const { localBootstrap } = await import("./bootstrap-3PBVY7MA.js");
-  const { connect } = await import("./ssh-VAI5DU5M.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
+  const { setConfig, getConfig, getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
+  const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const existing = getConfig();
@@ -2957,7 +2616,7 @@ async function runLocalDeploy(opts) {
     stacks: { [opts.stackName]: stackEntry },
     ssh: { keyPath: opts.keyPath, knownHostsPath }
   };
-  setConfig2(newConfig);
+  setConfig(newConfig);
   success(`Deployment "${opts.stackName}" registered  (~/.clawops/config.json)`);
   await checkDockerPreflight({ host: opts.host, port: opts.port, user: opts.user, keyPath: opts.keyPath, knownHostsPath, signal: opts.signal, inquirer: opts.inquirer });
   const STAGES = [
@@ -3022,7 +2681,7 @@ async function runLocalDeploy(opts) {
     spin2.fail("Configuration failed");
     throw err;
   }
-  const { drainPool } = await import("./pool-PIIKJ4L2.js");
+  const { drainPool } = await import("./pool-NT4XBSUT.js");
   drainPool();
   const tokenPath = path2.join(os.homedir(), ".clawops", "secrets", `GATEWAY_TOKEN_${opts.stackName}`);
   const dashboardUrl = `${state.gatewayUrl}?token=${opts.gatewayToken}`;
@@ -3128,10 +2787,10 @@ async function promptSecret(name, label, envDefault, inquirer) {
     }]);
     mkdirSync(secretsDir2, { recursive: true });
     spawnSync("chmod", ["700", secretsDir2], { stdio: "ignore" });
-    const secretPath2 = path2.join(secretsDir2, name);
-    writeFileSync2(secretPath2, secretValue.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret saved to ${secretPath2}  (chmod 600)`);
-    return { name, source: "file", ref: secretPath2 };
+    const secretPath = path2.join(secretsDir2, name);
+    writeFileSync2(secretPath, secretValue.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret saved to ${secretPath}  (chmod 600)`);
+    return { name, source: "file", ref: secretPath };
   }
   if (secretSource === "env") {
     const { envVar } = await inquirer.prompt([{
@@ -3160,7 +2819,7 @@ var DOCKER_CHECK_CMD = [
   "echo NOT_RUNNING"
 ].join("; ");
 async function checkDockerPreflight(opts) {
-  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+  const { acquireSession } = await import("./pool-NT4XBSUT.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   const spin = spinner("Checking Docker on target host...");
   const timeoutSignal = AbortSignal.timeout(DOCKER_PREFLIGHT_TIMEOUT_MS);
@@ -3207,7 +2866,7 @@ async function checkDockerPreflight(opts) {
 var DOCKER_POLL_MS = 3e3;
 var DOCKER_TIMEOUT_MS = 9e4;
 async function startRemoteDocker(opts, spin) {
-  const { acquireSession } = await import("./pool-PIIKJ4L2.js");
+  const { acquireSession } = await import("./pool-NT4XBSUT.js");
   const { ProviderError } = await import("./errors-OK47MQFD.js");
   spin.text = "Starting Docker on the remote server...";
   const { session, release } = await acquireSession({
@@ -3412,9 +3071,9 @@ async function maybeWireGatewayMcp(opts) {
   process21.stdout.write("\n");
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
-  const { connect } = await import("./ssh-VAI5DU5M.js");
+  const { connect } = await import("./ssh-HOM7GF3M.js");
   const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-FIO5DFBY.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-BXF4DJFT.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3533,7 +3192,7 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-RUOUA5BV.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-UHAOVQMZ.js");
   const { getConfig } = await import("./store-YOLQYXMB.js");
   const config = getConfig();
   if (!config) return;
@@ -3557,7 +3216,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3680,21 +3339,16 @@ async function runAccountPreflight(opts) {
 
 // src/cli/commands/secret.ts
 import { defineCommand as defineCommand20 } from "citty";
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync, mkdirSync as mkdirSync2, statSync } from "fs";
+import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
-import path3 from "path";
-import os2 from "os";
 import process22 from "process";
-var SECRETS_DIR = path3.join(os2.homedir(), ".clawops", "secrets");
-function secretsDir() {
-  return SECRETS_DIR;
-}
-function secretPath(name) {
-  return path3.join(secretsDir(), name);
-}
-function listSecretNames() {
-  if (!existsSync2(secretsDir())) return [];
-  return readdirSync(secretsDir()).filter((f) => !f.startsWith("."));
+function secretPathOrExit(name) {
+  const resolved = resolveSecretPath(name);
+  if (!resolved.ok) {
+    failure(resolved.reason);
+    process22.exit(2);
+  }
+  return resolved.path;
 }
 var listCmd = defineCommand20({
   meta: { name: "list", description: "List all stored secrets and their status" },
@@ -3702,24 +3356,12 @@ var listCmd = defineCommand20({
     json: { type: "boolean", description: "Emit JSON" }
   },
   run({ args }) {
-    const names = listSecretNames();
-    if (names.length === 0) {
-      info("No secrets stored in ~/.clawops/secrets/");
-      info("Run `clawops secret set <name>` to add one.");
+    const rows = listSecrets();
+    if (rows.length === 0) {
+      info(NO_SECRETS_MESSAGE);
+      info(SET_SECRET_HINT);
       return;
     }
-    const rows = names.map((name) => {
-      const p = secretPath(name);
-      try {
-        const stat = statSync(p);
-        const content = readFileSync4(p, "utf-8").trim();
-        const status = content.length > 0 ? "ok" : "empty";
-        const modified = stat.mtime.toISOString().slice(0, 10);
-        return { name, status, source: "file", path: p, modified, resolvable: content.length > 0 };
-      } catch {
-        return { name, status: "unreadable", source: "file", path: p, modified: "\u2014", resolvable: false };
-      }
-    });
     if (args.json) {
       process22.stdout.write(JSON.stringify(rows, null, 2) + "\n");
       return;
@@ -3744,6 +3386,7 @@ var setCmd = defineCommand20({
       failure("Usage: clawops secret set <name>");
       process22.exit(2);
     }
+    const target = secretPathOrExit(name);
     const inquirer = (await import("inquirer")).default;
     let value;
     if (args.value) {
@@ -3759,8 +3402,8 @@ var setCmd = defineCommand20({
     }
     mkdirSync2(secretsDir(), { recursive: true });
     spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
-    writeFileSync3(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
-    success(`Secret "${name}" saved to ${secretPath(name)}  (chmod 600)`);
+    writeFileSync3(target, value.trim(), { encoding: "utf-8", mode: 384 });
+    success(`Secret "${name}" saved to ${target}  (chmod 600)`);
     info("Run `clawops secret rotate <name>` to propagate it to a running stack.");
   }
 });
@@ -3775,23 +3418,18 @@ var deleteCmd = defineCommand20({
       failure("Usage: clawops secret delete <name>");
       process22.exit(2);
     }
-    const p = secretPath(name);
-    if (!existsSync2(p)) {
-      failure(`Secret "${name}" not found at ${p}`);
-      process22.exit(1);
-    }
-    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
-    const referencingStacks = listOverlays().filter((o) => o.secrets.some((s) => s.name === name)).map((o) => o.stackName);
-    if (referencingStacks.length > 0) {
-      warn(`Secret "${name}" is referenced by stack(s): ${referencingStacks.join(", ")}`);
-      warn("Deleting it will leave those stacks with an unresolvable $secret: ref.");
+    const prepared = prepareSecretDelete(name);
+    if (!prepared.ok) {
+      failure(prepared.reason);
+      process22.exit(prepared.kind === "invalid-name" ? 2 : 1);
     }
+    for (const line2 of prepared.warnings) warn(line2);
     if (!args.yes) {
       const inquirer = (await import("inquirer")).default;
       const { confirmed } = await inquirer.prompt([{
         type: "confirm",
         name: "confirmed",
-        message: `Delete secret "${name}"?`,
+        message: deleteConfirmQuestion(name),
         default: false
       }]);
       if (!confirmed) {
@@ -3799,8 +3437,7 @@ var deleteCmd = defineCommand20({
         return;
       }
     }
-    unlinkSync(p);
-    success(`Secret "${name}" deleted.`);
+    success(deletePreparedSecret(prepared));
   }
 });
 var rotateCmd = defineCommand20({
@@ -3815,6 +3452,7 @@ var rotateCmd = defineCommand20({
       failure("Usage: clawops secret rotate <name> [--stack <name>]");
       process22.exit(2);
     }
+    const target = secretPathOrExit(name);
     const inquirer = (await import("inquirer")).default;
     let value;
     if (args.value) {
@@ -3830,7 +3468,7 @@ var rotateCmd = defineCommand20({
     }
     mkdirSync2(secretsDir(), { recursive: true });
     spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
-    writeFileSync3(secretPath(name), value.trim(), { encoding: "utf-8", mode: 384 });
+    writeFileSync3(target, value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
     const { getConfig } = await import("./store-YOLQYXMB.js");
     const cfg = getConfig();
@@ -3849,10 +3487,10 @@ var rotateCmd = defineCommand20({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-WOKSKAIA.js");
-      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-3HZLUWEA.js");
+      const { buildContext } = await import("./context-EHSLWKSH.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-      const { acquireSession, drainPool } = await import("./pool-PIIKJ4L2.js");
+      const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
       const { localStateToConnectionInfo } = await import("./state-AKZP2S4T.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
@@ -3893,53 +3531,20 @@ var auditCmd = defineCommand20({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { listOverlays } = await import("./overlay-store-ADZPD7EU.js");
-    const overlays = listOverlays();
-    const issues = [];
-    for (const name of listSecretNames()) {
-      const p = secretPath(name);
-      try {
-        const content = readFileSync4(p, "utf-8").trim();
-        if (content.length === 0) {
-          issues.push({ kind: "empty-secret", secret: name, detail: `File exists but is empty: ${p}` });
-        }
-      } catch {
-        issues.push({ kind: "unreadable-secret", secret: name, detail: `Cannot read: ${p}` });
-      }
-    }
-    for (const overlay of overlays) {
-      for (const s of overlay.secrets) {
-        if (s.source === "file") {
-          const ref = s.ref ?? secretPath(s.name);
-          if (!existsSync2(ref)) {
-            issues.push({ kind: "missing-file", stack: overlay.stackName, secret: s.name, detail: `File not found: ${ref}` });
-          }
-        } else if (s.source === "env") {
-          const envVar = s.ref ?? s.name;
-          if (!process22.env[envVar]) {
-            issues.push({ kind: "missing-env", stack: overlay.stackName, secret: s.name, detail: `Env var not set: ${envVar}` });
-          }
-        } else {
-          issues.push({ kind: "cloud-sm-unresolved", stack: overlay.stackName, secret: s.name, detail: `Source "${s.source}" is not auto-resolved \u2014 set manually` });
-        }
-      }
-    }
+    const { issues } = auditSecrets();
     if (args.json) {
       process22.stdout.write(JSON.stringify({ issues, ok: issues.length === 0 }, null, 2) + "\n");
       return;
     }
     if (issues.length === 0) {
-      success("All secrets are resolvable. No issues found.");
+      success(AUDIT_CLEAN_MESSAGE);
       return;
     }
-    failure(`${issues.length} issue${issues.length === 1 ? "" : "s"} found:
+    failure(`${auditIssuesHeadline(issues.length)}
 `);
-    for (const issue of issues) {
-      const prefix = issue.stack ? `[${issue.stack}] ` : "";
-      warn(`${prefix}${issue.secret}: ${issue.detail}`);
-    }
+    for (const issue of issues) warn(formatAuditIssue(issue));
     process22.stdout.write("\n");
-    info("Run `clawops secret set <name>` to update a missing or empty secret.");
+    info(AUDIT_FIX_HINT);
   }
 });
 var secret_default = defineCommand20({
@@ -4036,10 +3641,10 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.1.3" : "dev";
+var VERSION = true ? "2.2.0" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
-  const os3 = `${process23.platform} ${process23.arch}`;
+  const os2 = `${process23.platform} ${process23.arch}`;
   let provider = "unknown";
   let stackCount = 0;
   let sshKey = "unknown";
@@ -4066,7 +3671,7 @@ async function collectContext() {
   return [
     `**clawops version:** ${VERSION}`,
     `**Node:** ${nodeVersion}`,
-    `**OS:** ${os3}`,
+    `**OS:** ${os2}`,
     `**Provider:** ${provider}`,
     `**Stacks:** ${stackCount}`,
     `**SSH key:** ${sshKey}`
@@ -4155,8 +3760,8 @@ var harden_default = defineCommand23({
     "tailscale-revert": { type: "boolean", description: "Take the host off its tailnet and go back to its public address. A private-only stack must be reopened with a plan first" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-RUOUA5BV.js");
-    const { buildContext } = await import("./context-WOKSKAIA.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-UHAOVQMZ.js");
+    const { buildContext } = await import("./context-EHSLWKSH.js");
     const { getConfig } = await import("./store-YOLQYXMB.js");
     if (args.list) {
       process24.stdout.write("\nAvailable hardening modules:\n\n");
@@ -4179,7 +3784,7 @@ var harden_default = defineCommand23({
     const ctx = buildContext({ stack: args.stack });
     const provider = ctx.adapter.name;
     if (args["tailscale-revert"]) {
-      const { revertTailnet } = await import("./flows-HGJIA6EL.js");
+      const { revertTailnet } = await import("./flows-6B2I6TRW.js");
       const override = config.stacks[ctx.stackName]?.tailscale;
       if (override && args.yes !== true) {
         const { createInterface: createInterface3 } = await import("readline/promises");
@@ -4202,7 +3807,7 @@ var harden_default = defineCommand23({
       else success(outcome.message);
       return;
     }
-    const { makeTailscaleModule } = await import("./harden-RUOUA5BV.js");
+    const { makeTailscaleModule } = await import("./harden-UHAOVQMZ.js");
     const forStack = makeTailscaleModule(ctx.stackName);
     const resolved = resolveModules(MODULE_CATALOG, args.options, provider).map(
       (m) => m.id === "tailscale" ? forStack : m
@@ -4286,7 +3891,7 @@ var harden_default = defineCommand23({
       success("Hardening complete.");
     }
     if (args.tailscale && !args["dry-run"]) {
-      const { cutOverToTailnet } = await import("./flows-HGJIA6EL.js");
+      const { cutOverToTailnet } = await import("./flows-6B2I6TRW.js");
       process24.stdout.write("\nVerifying the tailnet address before using it...\n");
       const outcome = await cutOverToTailnet(ctx, conn, config);
       if (!outcome.ok) {
@@ -4323,7 +3928,7 @@ function resolveArgv(argv2, stdinIsTty) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.1.3" : "dev";
+var CLI_VERSION = true ? "2.2.0" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",