@clawops/cli 2.2.0 → 2.3.0

package/dist/cli.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-import {
-  MCP_APPS,
-  buildMcpEntry,
-  writeAppConfigs
-} from "./chunk-OIGTOLB3.js";
 import {
   AUDIT_CLEAN_MESSAGE,
   AUDIT_FIX_HINT,
@@ -24,25 +19,36 @@ import {
   runDiagnostics,
   secretsDir,
   updateGateway
-} from "./chunk-OUQVKIIA.js";
+} from "./chunk-PNRFFYOA.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
   containerLogsCommand,
   gatewayLogsCommand
 } from "./chunk-SOZ62ZXW.js";
-import "./chunk-6ZFIFDBJ.js";
+import {
+  MCP_APPS,
+  buildMcpEntry,
+  writeAppConfigs
+} from "./chunk-OIGTOLB3.js";
 import "./chunk-Z3XLWZWF.js";
+import "./chunk-6ZFIFDBJ.js";
+import {
+  SUPPORTED_PROVIDERS,
+  deriveStateBucket,
+  initStack,
+  resolveScopeAccount,
+  validateStateBucket
+} from "./chunk-FGY262WZ.js";
+import "./chunk-LT4XMO5D.js";
 import {
   execPrivileged,
   streamPrivileged
 } from "./chunk-WPZIJONN.js";
-import "./chunk-YPVWF7IA.js";
 import {
   resolveSpecDir
 } from "./chunk-JW5A7E3X.js";
-import "./chunk-LT4XMO5D.js";
-import "./chunk-VUFMZEIM.js";
+import "./chunk-HSGKK3RF.js";
 import {
   PUBLISH_INSPECT_CMD,
   STATE_DIR_HOST_LINUX,
@@ -70,21 +76,15 @@ import {
   warn
 } from "./chunk-Q7NQY5HV.js";
 import "./chunk-N4WZLWJ4.js";
-import {
-  SUPPORTED_PROVIDERS,
-  deriveStateBucket,
-  initStack,
-  resolveScopeAccount,
-  validateStateBucket
-} from "./chunk-755X5OGS.js";
 import {
   getConfigDir,
   requireConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import {
   ClawopsError,
   UsageError
 } from "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
 
 // src/cli/index.ts
 import { defineCommand as defineCommand24, runMain } from "citty";
@@ -203,7 +203,7 @@ var up_default = defineCommand2({
     "publish-gateway": { type: "string", description: 'loopback (default) or all. "all" serves plaintext HTTP \u2014 put TLS in front of it' }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
     const ctx = buildContext(args);
     const requestedVersion = typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : await defaultOpenclawVersion();
@@ -216,7 +216,7 @@ var up_default = defineCommand2({
         );
       }
       const { localOpts } = stackConfig;
-      const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
+      const { localBootstrap } = await import("./bootstrap-L3P5E4D7.js");
       const gatewayPort = parseGatewayPort(args["gateway-port"]);
       const abortController2 = new AbortController();
       process3.on("SIGINT", () => abortController2.abort());
@@ -256,8 +256,8 @@ var up_default = defineCommand2({
       }
       return;
     }
-    const { generatePlan } = await import("./generate-4YYNW3IU.js");
-    const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
+    const { generatePlan } = await import("./generate-OJ5UWTLV.js");
+    const { applyPlan } = await import("./apply-ODV3NOJJ.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const isDryRun = Boolean(args["dry-run"]);
@@ -339,7 +339,7 @@ function strArg(value) {
 async function applyLocalConfigOverlay(opts) {
   const { connect } = await import("./ssh-HOM7GF3M.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-V2WXIXIF.js");
   let overlay;
   try {
     overlay = JSON.parse(readFileSync(opts.configPath, "utf-8"));
@@ -387,7 +387,7 @@ var down_default = defineCommand3({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const ctx = buildContext(args);
     if (args["dry-run"]) {
       info(`Dry run \u2014 would destroy stack "${ctx.stackName}"`);
@@ -451,7 +451,7 @@ var status_default = defineCommand4({
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       const state = ctx.localState;
@@ -551,8 +551,8 @@ var plan_default = defineCommand5({
     "private-only": { type: "boolean", description: "Close public SSH and gateway access; reach the stack over its tailnet. Needs `clawops harden --tailscale` first, and checks the tailnet answers before planning" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
-    const { generatePlan } = await import("./generate-4YYNW3IU.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
+    const { generatePlan } = await import("./generate-OJ5UWTLV.js");
     const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
     const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
     const ctx = buildContext(args);
@@ -577,7 +577,7 @@ var plan_default = defineCommand5({
     let network = resolved;
     if (args["private-only"]) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
+      const { probeSsh } = await import("./tailscale-cutover-XTMGDM5H.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[ctx.stackName]?.tailscale, ctx.stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -667,8 +667,8 @@ var apply_default = defineCommand6({
     "dry-run": { type: "boolean", description: "Validate plan and show diff without applying" }
   },
   async run({ args }) {
-    const { validatePlan } = await import("./validate-DZE6LFEB.js");
-    const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
+    const { validatePlan } = await import("./validate-CRXX7OYF.js");
+    const { applyPlan } = await import("./apply-ODV3NOJJ.js");
     const planPath = args._?.[0];
     if (!planPath) {
       throw new UsageError("Usage: clawops apply <plan.json>");
@@ -794,7 +794,7 @@ var destroy_default = defineCommand7({
     "dry-run": { type: "boolean", description: "Show what would be destroyed without destroying" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const ctx = buildContext(args);
     if (ctx.adapter.name === "local") {
       throw new UsageError(
@@ -887,7 +887,7 @@ var ssh_default = defineCommand8({
     command: { type: "string", description: "Remote command to run (instead of interactive shell)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
     let conn;
@@ -974,7 +974,7 @@ var tunnel_default = defineCommand9({
     "no-open": { type: "boolean", description: "Do not open browser after tunnel is ready" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const { acquireSession } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
@@ -1043,7 +1043,7 @@ var logs_default = defineCommand10({
     json: { type: "boolean", description: "Emit the gateway's structured JSON log lines" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ctx = buildContext(args);
     const conn = await connFor(ctx);
@@ -1155,7 +1155,7 @@ var config_default = defineCommand11({
     "dry-run": { type: "boolean", description: "Show what would change without writing" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, key, value] = args._ ?? [];
     if (!action || !["get", "set", "unset", "validate"].includes(action)) {
@@ -1235,7 +1235,7 @@ var config_default = defineCommand11({
         process13.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
         return;
       }
-      const { atomicWriteConfig } = await import("./remote-config-OZYBMBSK.js");
+      const { atomicWriteConfig } = await import("./remote-config-V2WXIXIF.js");
       try {
         await atomicWriteConfig(session, cfg, abortController.signal);
       } catch (err) {
@@ -1280,7 +1280,7 @@ var agents_default = defineCommand12({
     cursor: { type: "string", description: "Continue from a previous `logs` result cursor" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, name] = args._ ?? [];
     if (action === "restart") {
@@ -1408,7 +1408,7 @@ var migrate_default = defineCommand13({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const { prepareMigration, runMigration, migrationQuestion } = await import("./migrate-flow-24XA4GZL.js");
+    const { prepareMigration, runMigration, migrationQuestion } = await import("./migrate-flow-4XQUUFMH.js");
     const target = await prepareMigration({
       stack: typeof args.stack === "string" ? args.stack : void 0,
       openclawVersion: typeof args["openclaw-version"] === "string" ? args["openclaw-version"] : void 0
@@ -1461,7 +1461,7 @@ var gateway_default = defineCommand14({
     json: { type: "boolean", description: "Emit JSON (for status)" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const [action, versionArg] = args._ ?? [];
     if (!action || !["status", "restart", "update"].includes(action)) {
@@ -1571,7 +1571,7 @@ var backup_default = defineCommand15({
     activate: { type: "boolean", description: "[restore] Put the restored state into service: stop the gateway, swap it in, restart, and roll back if it does not come up" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const action = args.action;
     if (action !== "create" && action !== "restore") {
@@ -1622,7 +1622,7 @@ var backup_default = defineCommand15({
       signal: abortController.signal
     });
     try {
-      const flows = await import("./backup-flows-NDP5JTR3.js");
+      const flows = await import("./backup-flows-THPX2D7S.js");
       if (action === "create") {
         const outPath = typeof args.out === "string" ? args.out : flows.defaultBackupFilename();
         info(`Writing backup to ${outPath}...`);
@@ -1769,7 +1769,7 @@ var stacks_default = defineCommand16({
       failure("Usage: clawops stacks delete <name>");
       process18.exit(2);
     }
-    const { checkStackDelete, deleteStackFromConfig, forgetNotice } = await import("./stack-delete-NTIGKWUF.js");
+    const { checkStackDelete, deleteStackFromConfig, forgetNotice } = await import("./stack-delete-SNPMLWMD.js");
     const check = await checkStackDelete(name, { force: !!args.force });
     if (!check.ok) {
       if (check.refusal === "deployed") {
@@ -1887,7 +1887,7 @@ var serveCmd = defineCommand18({
     inspector: { type: "boolean", description: "Enable MCP inspector" }
   },
   async run({ args }) {
-    const { serveMcp } = await import("./server-E3YA32ND.js");
+    const { serveMcp } = await import("./server-YH2JWZ2Q.js");
     await serveMcp({
       port: args.http ? Number(args.http) : void 0,
       bind: args.bind,
@@ -1965,11 +1965,11 @@ var wireCmd = defineCommand18({
     rewire: { type: "boolean", description: "Replace an existing clawops entry" }
   },
   async run({ args }) {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-    const { wireGatewayMcp } = await import("./mcp-wire-BXF4DJFT.js");
-    const { MCP_HTTP_PORT } = await import("./server-E3YA32ND.js");
+    const { wireGatewayMcp } = await import("./mcp-wire-HSGZFOG5.js");
+    const { MCP_HTTP_PORT } = await import("./server-YH2JWZ2Q.js");
     const ac = new AbortController();
     process20.on("SIGINT", () => {
       ac.abort();
@@ -2180,6 +2180,18 @@ var setup_default = defineCommand19({
       }]);
       localSudoPassword = sudoPass;
     }
+    const { promptSpendingPolicy, allowedChoices, savePolicy } = await import("./setup-policy-OK5PGWP7.js");
+    const { getConfig: readConfig } = await import("./store-BTQOOIJH.js");
+    const configBefore = readConfig();
+    const pendingPolicy = await promptSpendingPolicy({
+      provider: provider === "local" ? void 0 : provider,
+      choices: provider === "local" ? [] : instanceChoices(provider),
+      current: configBefore?.policy,
+      stackCount: Object.keys(configBefore?.stacks ?? {}).length,
+      inquirer
+    });
+    let policySaved = pendingPolicy ? await savePolicy(pendingPolicy) : true;
+    const sizeChoices = provider === "local" ? [] : await allowedChoices(provider, instanceChoices(provider), pendingPolicy ?? configBefore?.policy);
     process21.stdout.write("\n");
     const sshCidrDefault = provider === "local" ? void 0 : await detectSshCidrDefault();
     const scopeAccount = provider === "local" ? void 0 : await resolveScopeAccount(provider);
@@ -2209,7 +2221,7 @@ var setup_default = defineCommand19({
           type: "list",
           name: "instanceSize",
           message: "Server size: (bigger = faster, but costs more per month)",
-          choices: instanceChoices(provider)
+          choices: sizeChoices
         },
         stateBucketQuestion(provider, scopeAccount),
         {
@@ -2237,6 +2249,12 @@ var setup_default = defineCommand19({
         default: "latest"
       }
     ]);
+    {
+      const { stackCapRefusal } = await import("./policy-4FFK7REN.js");
+      const { getConfig } = await import("./store-BTQOOIJH.js");
+      const overCap = stackCapRefusal(getConfig(), stackAnswers.stackName);
+      if (overCap) throw new UsageError(overCap);
+    }
     if (provider !== "local") {
       await runAccountPreflight({
         provider,
@@ -2412,6 +2430,11 @@ var setup_default = defineCommand19({
         failure(`Cannot read SSH public key at ${stackAnswers.sshKeyPath ?? ""}`);
         process21.exit(1);
       }
+      const { nativeInstanceType } = await import("./generate-OJ5UWTLV.js");
+      const instanceType = await nativeInstanceType(provider, stackAnswers.instanceSize);
+      const { enforceInstanceType } = await import("./policy-4FFK7REN.js");
+      const { getConfig: currentConfig } = await import("./store-BTQOOIJH.js");
+      await enforceInstanceType(currentConfig(), provider, instanceType);
       const plan = {
         apiVersion: "clawops.dev/v1",
         kind: "DeployPlan",
@@ -2424,7 +2447,7 @@ var setup_default = defineCommand19({
           provider,
           region: stackAnswers.region,
           stackName: stackAnswers.stackName,
-          instanceType: stackAnswers.instanceSize,
+          instanceType,
           openclaw: {
             version: stackAnswers.openclawVersion,
             config: openclawConfigOverlay,
@@ -2513,7 +2536,19 @@ var setup_default = defineCommand19({
       info("After deployment, run this command on the server (or locally if Ollama is local):");
       info(`  ollama pull ${selectedModel.id}${selectedModel.pullSuffix}`);
     }
-    if (dryRun) return;
+    const finishPolicy = async () => {
+      if (!pendingPolicy || policySaved) return;
+      policySaved = await savePolicy(pendingPolicy);
+      if (!policySaved) {
+        warn(
+          "Spending limits were not saved: there is no ~/.clawops/config.json yet. Run `clawops setup` again after your first deployment to set them."
+        );
+      }
+    };
+    if (dryRun) {
+      await finishPolicy();
+      return;
+    }
     if (provider === "local") {
       const { deployNow } = await inquirer.prompt([{
         type: "confirm",
@@ -2552,7 +2587,7 @@ var setup_default = defineCommand19({
           inquirer
         });
       } else {
-        const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
+        const { getConfigDir: getConfigDir2 } = await import("./store-BTQOOIJH.js");
         const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
         process21.stdout.write("\n");
         info("To deploy later, run these two commands:");
@@ -2569,7 +2604,7 @@ var setup_default = defineCommand19({
         default: false
       }]);
       if (applyNow) {
-        const { applyPlan } = await import("./apply-F5SQ2ZOS.js");
+        const { applyPlan } = await import("./apply-ODV3NOJJ.js");
         const plan = JSON.parse(readFileSync3(outputPath, "utf-8"));
         try {
           await applyPlan(plan, {
@@ -2594,16 +2629,20 @@ var setup_default = defineCommand19({
 To deploy later:  clawops apply ${outputPath}`);
       }
     }
+    await finishPolicy();
   }
 });
 async function runLocalDeploy(opts) {
-  const { setConfig, getConfig, getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
-  const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
+  const { setConfig, getConfig, getConfigDir: getConfigDir2 } = await import("./store-BTQOOIJH.js");
+  const { localBootstrap } = await import("./bootstrap-L3P5E4D7.js");
   const { connect } = await import("./ssh-HOM7GF3M.js");
-  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
+  const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-V2WXIXIF.js");
   const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const existing = getConfig();
+  const { stackCapRefusal } = await import("./policy-4FFK7REN.js");
+  const overCap = stackCapRefusal(existing, opts.stackName);
+  if (overCap) throw new UsageError(overCap);
   const stackEntry = {
     provider: "local",
     stateUrl: "file://~/.clawops/state",
@@ -3072,8 +3111,8 @@ async function maybeWireGatewayMcp(opts) {
   const { wireGateway } = await inquirerPromptWire(opts.inquirer);
   if (!wireGateway) return;
   const { connect } = await import("./ssh-HOM7GF3M.js");
-  const { getConfigDir: getConfigDir2 } = await import("./store-YOLQYXMB.js");
-  const { wireGatewayMcp } = await import("./mcp-wire-BXF4DJFT.js");
+  const { getConfigDir: getConfigDir2 } = await import("./store-BTQOOIJH.js");
+  const { wireGatewayMcp } = await import("./mcp-wire-HSGZFOG5.js");
   const knownHostsPath = path2.join(getConfigDir2(), "known_hosts");
   const spin = spinner("Wiring gateway MCP client...");
   const session = await connect({
@@ -3192,8 +3231,8 @@ function instanceChoices(provider) {
   return table[provider] ?? [];
 }
 async function maybeHarden(opts) {
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-UHAOVQMZ.js");
-  const { getConfig } = await import("./store-YOLQYXMB.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-7O553IOK.js");
+  const { getConfig } = await import("./store-BTQOOIJH.js");
   const config = getConfig();
   if (!config) return;
   const availableModules = resolveModules(MODULE_CATALOG, void 0, opts.provider);
@@ -3216,7 +3255,7 @@ async function maybeHarden(opts) {
   const modules = availableModules.filter((m) => selectedIds.includes(m.id));
   process21.stdout.write("\nApplying hardening modules...\n\n");
   try {
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
     const ctx = buildContext({ stack: opts.stackName });
     const stackObj = await ctx.getStack();
@@ -3470,7 +3509,7 @@ var rotateCmd = defineCommand20({
     spawnSync2("chmod", ["700", secretsDir()], { stdio: "ignore" });
     writeFileSync3(target, value.trim(), { encoding: "utf-8", mode: 384 });
     success(`Secret "${name}" updated.`);
-    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const { getConfig } = await import("./store-BTQOOIJH.js");
     const cfg = getConfig();
     const targetStack = args.stack ?? cfg?.defaults?.stack;
     if (!targetStack) {
@@ -3487,11 +3526,11 @@ var rotateCmd = defineCommand20({
     }
     info(`Re-applying config overlay to stack "${targetStack}"\u2026`);
     try {
-      const { buildContext } = await import("./context-EHSLWKSH.js");
-      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-OZYBMBSK.js");
+      const { buildContext } = await import("./context-4KTM4DKH.js");
+      const { readRemoteConfig, atomicWriteConfig, restartGateway, deepMerge } = await import("./remote-config-V2WXIXIF.js");
       const { resolveSecrets } = await import("./secrets-SVZWNAPK.js");
       const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
-      const { localStateToConnectionInfo } = await import("./state-AKZP2S4T.js");
+      const { localStateToConnectionInfo } = await import("./state-KG6K5QZC.js");
       const ctx = buildContext({ stack: targetStack });
       let conn;
       if (ctx.adapter.name === "local") {
@@ -3641,7 +3680,7 @@ import { accessSync, constants } from "fs";
 import { execSync as execSync2 } from "child_process";
 var ISSUES_URL = `${REPO_URL}/issues/new`;
 var BODY_CAP = 2e3;
-var VERSION = true ? "2.2.0" : "dev";
+var VERSION = true ? "2.3.0" : "dev";
 async function collectContext() {
   const nodeVersion = process23.version;
   const os2 = `${process23.platform} ${process23.arch}`;
@@ -3649,7 +3688,7 @@ async function collectContext() {
   let stackCount = 0;
   let sshKey = "unknown";
   try {
-    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const { getConfig } = await import("./store-BTQOOIJH.js");
     const config = getConfig();
     if (config) {
       const stacks = Object.values(config.stacks);
@@ -3760,9 +3799,9 @@ var harden_default = defineCommand23({
     "tailscale-revert": { type: "boolean", description: "Take the host off its tailnet and go back to its public address. A private-only stack must be reopened with a plan first" }
   },
   async run({ args }) {
-    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-UHAOVQMZ.js");
-    const { buildContext } = await import("./context-EHSLWKSH.js");
-    const { getConfig } = await import("./store-YOLQYXMB.js");
+    const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary } = await import("./harden-7O553IOK.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
+    const { getConfig } = await import("./store-BTQOOIJH.js");
     if (args.list) {
       process24.stdout.write("\nAvailable hardening modules:\n\n");
       for (const mod of MODULE_CATALOG) {
@@ -3784,7 +3823,7 @@ var harden_default = defineCommand23({
     const ctx = buildContext({ stack: args.stack });
     const provider = ctx.adapter.name;
     if (args["tailscale-revert"]) {
-      const { revertTailnet } = await import("./flows-6B2I6TRW.js");
+      const { revertTailnet } = await import("./flows-6YEJGHCK.js");
       const override = config.stacks[ctx.stackName]?.tailscale;
       if (override && args.yes !== true) {
         const { createInterface: createInterface3 } = await import("readline/promises");
@@ -3807,7 +3846,7 @@ var harden_default = defineCommand23({
       else success(outcome.message);
       return;
     }
-    const { makeTailscaleModule } = await import("./harden-UHAOVQMZ.js");
+    const { makeTailscaleModule } = await import("./harden-7O553IOK.js");
     const forStack = makeTailscaleModule(ctx.stackName);
     const resolved = resolveModules(MODULE_CATALOG, args.options, provider).map(
       (m) => m.id === "tailscale" ? forStack : m
@@ -3891,7 +3930,7 @@ var harden_default = defineCommand23({
       success("Hardening complete.");
     }
     if (args.tailscale && !args["dry-run"]) {
-      const { cutOverToTailnet } = await import("./flows-6B2I6TRW.js");
+      const { cutOverToTailnet } = await import("./flows-6YEJGHCK.js");
       process24.stdout.write("\nVerifying the tailnet address before using it...\n");
       const outcome = await cutOverToTailnet(ctx, conn, config);
       if (!outcome.ok) {
@@ -3928,7 +3967,7 @@ function resolveArgv(argv2, stdinIsTty) {
 }
 
 // src/cli/index.ts
-var CLI_VERSION = true ? "2.2.0" : "dev";
+var CLI_VERSION = true ? "2.3.0" : "dev";
 var main = defineCommand24({
   meta: {
     name: "clawops",

package/dist/{context-EHSLWKSH.js → context-4KTM4DKH.js}

@@ -2,18 +2,18 @@
 import {
   buildContext,
   loadAdapterModule
-} from "./chunk-AVERNLUY.js";
-import "./chunk-YPVWF7IA.js";
-import "./chunk-VUFMZEIM.js";
+} from "./chunk-SQPHNVCF.js";
+import "./chunk-HSGKK3RF.js";
 import "./chunk-N5ZYUTZS.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-RDUKRIRC.js";
-import "./chunk-GFIR2IIJ.js";
+import "./chunk-U3NRKBDW.js";
+import "./chunk-GYMAC4MW.js";
 import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
 export {
   buildContext,
   loadAdapterModule

package/dist/{flows-6B2I6TRW.js → flows-6YEJGHCK.js}

@@ -2,9 +2,9 @@
 
 // src/harden/flows.ts
 async function cutOverToTailnet(ctx, conn, config) {
-  const { withRemoteExec } = await import("./harden-UHAOVQMZ.js");
-  const { verifyTailnetAddress, probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
-  const { setConfig } = await import("./store-YOLQYXMB.js");
+  const { withRemoteExec } = await import("./harden-7O553IOK.js");
+  const { verifyTailnetAddress, probeSsh } = await import("./tailscale-cutover-XTMGDM5H.js");
+  const { setConfig } = await import("./store-BTQOOIJH.js");
   const result = await withRemoteExec(
     conn,
     void 0,
@@ -49,11 +49,11 @@ async function revertTailnet(ctx, config) {
       message: `Stack "${ctx.stackName}" is not using a tailnet address; nothing to revert.`
     };
   }
-  const { buildContext } = await import("./context-EHSLWKSH.js");
+  const { buildContext } = await import("./context-4KTM4DKH.js");
   const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
-  const { probeSsh, leaveTailnet } = await import("./tailscale-cutover-V42HO5UM.js");
-  const { withRemoteExec } = await import("./harden-UHAOVQMZ.js");
-  const { getConfig, setConfig } = await import("./store-YOLQYXMB.js");
+  const { probeSsh, leaveTailnet } = await import("./tailscale-cutover-XTMGDM5H.js");
+  const { withRemoteExec } = await import("./harden-7O553IOK.js");
+  const { getConfig, setConfig } = await import("./store-BTQOOIJH.js");
   const { forgetHost } = await import("./known-hosts-file-I3Q3NBYQ.js");
   const direct = buildContext({ stack: ctx.stackName, ignoreTailnet: true });
   const outputMap = await (await direct.getStack()).outputs();

package/dist/{generate-4YYNW3IU.js → generate-OJ5UWTLV.js}

@@ -3,28 +3,30 @@ import {
   INSTANCE_ALIASES,
   generatePlan,
   isInstanceAlias,
+  nativeInstanceType,
   parseDiffForTest,
   planId
-} from "./chunk-66R52R7K.js";
+} from "./chunk-K7OWMI63.js";
 import "./chunk-POYS3EVQ.js";
-import "./chunk-PASAVVNS.js";
-import "./chunk-AVERNLUY.js";
-import "./chunk-YPVWF7IA.js";
+import "./chunk-47CGHUVT.js";
+import "./chunk-SQPHNVCF.js";
 import "./chunk-JW5A7E3X.js";
-import "./chunk-VUFMZEIM.js";
+import "./chunk-HSGKK3RF.js";
 import "./chunk-N5ZYUTZS.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-RDUKRIRC.js";
-import "./chunk-GFIR2IIJ.js";
+import "./chunk-U3NRKBDW.js";
+import "./chunk-GYMAC4MW.js";
 import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
 export {
   INSTANCE_ALIASES,
   generatePlan,
   isInstanceAlias,
+  nativeInstanceType,
   parseDiffForTest,
   planId
 };

package/dist/{harden-UHAOVQMZ.js → harden-7O553IOK.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import {
-  makeTailscaleModule,
-  tailscaleModule
-} from "./chunk-4MHDW2NB.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-TYNMOYVM.js";
+import {
+  makeTailscaleModule,
+  tailscaleModule
+} from "./chunk-QRF4OWG4.js";
 import "./chunk-4PY6PN4G.js";
 import "./chunk-MC5ATCXS.js";
 import {
@@ -28,7 +28,7 @@ import {
 import {
   resolveProjectId
 } from "./chunk-TC2VYPLH.js";
-import "./chunk-GFIR2IIJ.js";
+import "./chunk-GYMAC4MW.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/harden/types.ts

package/dist/{init-HOPXDNWY.js → init-RVQ72GZ5.js}

@@ -3,8 +3,8 @@ import {
   PROVIDER_DEFAULTS,
   SUPPORTED_PROVIDERS,
   initStack
-} from "./chunk-755X5OGS.js";
-import "./chunk-GFIR2IIJ.js";
+} from "./chunk-FGY262WZ.js";
+import "./chunk-GYMAC4MW.js";
 import "./chunk-KGXPLI7W.js";
 export {
   PROVIDER_DEFAULTS,