@clawops/cli 2.2.1 → 2.3.1

package/README.md

@@ -14,7 +14,7 @@ and Cursor drive them through typed MCP tools with explicit safety controls.
 
 ---
 
-**What's new:** [2.0.1 and 2.0 release notes](#whats-new-in-201) below, and the full history
+**What's new:** [2.3.1 release notes](#whats-new-in-231) below, and the full history
 in [CHANGELOG.md](CHANGELOG.md).
 
 ---
@@ -262,7 +262,7 @@ clawops down --yes          # Destroy local-provider stack
 
 | Command | Description |
 |---|---|
-| `setup` | First-run wizard: guided LLM, integrations, and deploy-plan generation |
+| `setup` | First-run wizard: guided LLM, integrations, spending limits, and deploy-plan generation |
 | `init` | Register a stack in `~/.clawops/config.json` without provisioning. Additive, existing stacks are kept; `--force` is needed only to overwrite one |
 | `up` | Provision or update stack (`--dry-run` for preview, `--gateway-port` for a non-default port) |
 | `down` | Destroy local-provider stack (requires `--yes`; `--dry-run` shows current outputs) |
@@ -397,7 +397,7 @@ Do not bind to a non-loopback address without additional authentication controls
 | `clawops_harden` | cli | Apply hardening modules; join or leave a tailnet (elicits confirmation) |
 | `clawops_init` | cli | Register a stack and write `~/.clawops/config.json` (no cloud resources) |
 | `clawops_workflow_deploy_app` | workflow | End-to-end deploy: plan → confirm → apply → status |
-| `clawops_workflow_recover` | workflow | Diagnostic workflow for an unhealthy stack |
+| `clawops_workflow_recover` | workflow | Diagnose an unhealthy stack: status, failed health checks, recent logs, and which tool fixes what |
 | `clawops_task_status` | cli | Poll a long-running task |
 
 Tools in the `read` toolset are also available in `--read-only` mode; the table's Toolset column shows the primary toolset. All other toolsets require full mode.
@@ -442,6 +442,24 @@ Config lives at `~/.clawops/config.json` (override with `$CLAWOPS_HOME`).
 | Azure | `AZURE_CLIENT_ID` / `AZURE_CLIENT_SECRET` or `az login` |
 | Local | SSH host + key configured in `stacks[name].localOpts` |
 
+### Spending limits
+
+An optional `policy` block limits what clawops will deploy from this machine, whichever tool asks:
+
+```json
+"policy": {
+  "allowedInstanceTypes": { "aws": ["micro", "small"] },
+  "maxStacks": 3
+}
+```
+
+`plan`, `apply` and `up` refuse a server size outside `allowedInstanceTypes` for that provider
+(a clawops size or the provider's own type; `small` and `t3.small` are the same on AWS), and
+`init` refuses a new stack beyond `maxStacks`. Every MCP tool that deploys is held to the same
+limits, in the same words, and no tool can change them. `clawops setup` asks whether to set
+them, then offers only the sizes you allowed. The limit lives here rather than in the plan
+because a plan is what an agent writes.
+
 ---
 
 ## Known limitations
@@ -576,7 +594,7 @@ pnpm dev doctor        # verify toolchain
 ```bash
 pnpm dev                   # run CLI from src/ via tsx
 pnpm build                 # tsup → dist/
-pnpm test                  # vitest (2091 tests, ~13s)
+pnpm test                  # vitest (2122 tests, ~13s)
 pnpm test:changed          # vitest --changed (fast edit loop)
 pnpm test:integration      # Docker-based SSH integration tests
 pnpm test:e2e:local        # builds, then bootstrap, the host-touching MCP tools and a 1.x migration, in systemd containers
@@ -635,6 +653,47 @@ Use `pnpm changeset` to record a release note before merging a `feat` or `fix`.
 
 ---
 
+## What's new in 2.3.1
+
+A security fix. **Upgrade if you set gateway config through MCP.**
+
+- **Before:** `clawops_config_set` wrote the value you set to the audit log
+  (`~/.clawops/mcp-audit.log`) in clear and redacted the config path instead. Setting
+  `models.providers.openai.apiKey` through an agent therefore logged the API key. The
+  confirmation prompt showed the value too.
+- **Now:** the value is redacted whenever its path names a secret, and secret fields inside a
+  JSON object value are redacted one by one. Paths are logged as written. See
+  [redaction](docs/security/redaction.md#config-paths-and-values).
+- **Existing logs are not rewritten.** If you used `clawops_config_set` for a secret before
+  2.3.1, check your audit log and rotate that secret.
+
+## What's new in 2.3
+
+Spending limits that an agent cannot lift, and a run of fixes from the backlog.
+
+### Spending limits
+
+- An optional `policy` block in `~/.clawops/config.json` limits the server sizes clawops may
+  deploy on each provider and the number of deployments it may manage. `plan`, `apply` and `up`
+  refuse a size outside the list; `init` refuses a stack beyond the cap.
+- Every MCP tool that deploys is held to the same limits, in the same words, and no tool can
+  change them. Confirmation is something an agent can answer for itself; this is not.
+- `clawops setup` asks whether to set them, then offers only the sizes you allowed. See
+  [Spending limits](#spending-limits).
+
+### Fixes
+
+- **The setup wizard's plan asked the cloud for a machine called `small`.** It wrote the clawops
+  size where the provider's own type belongs. It now maps it, as `clawops plan` does.
+- **`clawops_workflow_recover` runs the stack's health checks, and recommends only real tools.** It
+  ran two of the four steps it described and finished by suggesting `clawops refresh`, which does
+  not exist.
+- **The MCP audit log redacts credential arguments.** `GOOGLE_APPLICATION_CREDENTIALS` was named
+  sensitive in `spec/errors.yaml` and logged in the clear. A test now fails when the spec and the
+  code disagree on an error class, its exit code, or a redaction pattern (#185).
+
+---
+
 ## What's new in 2.2
 
 Recovery is a flag, agents can reach every command they need, and SSH failures say what failed.

package/dist/{apply-F5SQ2ZOS.js → apply-TXPUNOGW.js}

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import {
   applyPlan
-} from "./chunk-AX65JMDZ.js";
+} from "./chunk-7LLVIQ7G.js";
 import "./chunk-BOPSG2LI.js";
-import "./chunk-UAJJEDCJ.js";
-import "./chunk-PASAVVNS.js";
-import "./chunk-55UMO37O.js";
+import "./chunk-CHPMOE4T.js";
 import "./chunk-AEEMRFZV.js";
-import "./chunk-AVERNLUY.js";
+import "./chunk-AGSNTIYZ.js";
+import "./chunk-47CGHUVT.js";
+import "./chunk-SQPHNVCF.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-WPZIJONN.js";
-import "./chunk-YPVWF7IA.js";
 import "./chunk-JW5A7E3X.js";
-import "./chunk-VUFMZEIM.js";
+import "./chunk-HSGKK3RF.js";
 import "./chunk-N5ZYUTZS.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
 import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-RDUKRIRC.js";
-import "./chunk-GFIR2IIJ.js";
+import "./chunk-U3NRKBDW.js";
+import "./chunk-GYMAC4MW.js";
 import "./chunk-KGXPLI7W.js";
+import "./chunk-VUFMZEIM.js";
 export {
   applyPlan
 };

package/dist/{automation-NBYQ6MFZ.js → automation-VDKLZMJI.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-V25QRZRB.js";
 import {
   getConfigDir
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/pulumi/automation.ts

package/dist/{backup-flows-NDP5JTR3.js → backup-flows-THPX2D7S.js}

@@ -10,7 +10,7 @@ import {
   defaultBackupFilename,
   nothingChanged,
   stageRestore
-} from "./chunk-PCSX6Y3U.js";
+} from "./chunk-66CUJFXK.js";
 import "./chunk-WPZIJONN.js";
 import "./chunk-N5ZYUTZS.js";
 import "./chunk-VOEJYRIK.js";

package/dist/{bootstrap-32TZXVDF.js → bootstrap-L3P5E4D7.js}

@@ -14,8 +14,8 @@ import {
 import "./chunk-EI7CQQ7D.js";
 import {
   writeLocalState
-} from "./chunk-RDUKRIRC.js";
-import "./chunk-GFIR2IIJ.js";
+} from "./chunk-U3NRKBDW.js";
+import "./chunk-GYMAC4MW.js";
 import {
   ProviderError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-PASAVVNS.js → chunk-47CGHUVT.js}

@@ -44,7 +44,7 @@ async function validatePlanConfig(plan) {
   ]);
   const { loadVersionSpec } = await import("./versions-W5LRQCAJ.js");
   const spec = loadVersionSpec(yaml);
-  const { deepMerge } = await import("./remote-config-OZYBMBSK.js");
+  const { deepMerge } = await import("./remote-config-V2WXIXIF.js");
   const merged = deepMerge(
     { gateway: { mode: "local" } },
     overlay

package/dist/{chunk-E6BRQK67.js → chunk-4SEFKZRL.js}

@@ -136,7 +136,7 @@ var SYNTHESISED_CONFIG = JSON.stringify({
   channels: {}
 });
 async function prepareMigration(args) {
-  const { buildContext } = await import("./context-EHSLWKSH.js");
+  const { buildContext } = await import("./context-4KTM4DKH.js");
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
   const version = args.openclawVersion ? await guardOpenclawVersion(args.openclawVersion) : await defaultOpenclawVersion();
   const ctx = buildContext({ stack: args.stack });

package/dist/{chunk-PCSX6Y3U.js → chunk-66CUJFXK.js}

@@ -230,8 +230,8 @@ async function stageRestore(session, opts) {
 async function activateStaged(session, staged, opts = {}) {
   const { signal } = opts;
   const hostExec = (command) => execPrivileged(session, command, signal);
-  const { restartGateway } = await import("./remote-config-OZYBMBSK.js");
-  const { waitForGateway } = await import("./ready-IJEUBFVX.js");
+  const { restartGateway } = await import("./remote-config-V2WXIXIF.js");
+  const { waitForGateway } = await import("./ready-4H3NNEYQ.js");
   opts.onPhase?.("activating");
   const chown = await hostExec(`chown -R ${CONTAINER_UID}:${CONTAINER_UID} ${staged.statePath}`);
   if (chown.code !== 0) {

package/dist/{chunk-AX65JMDZ.js → chunk-7LLVIQ7G.js}

@@ -2,21 +2,21 @@
 import {
   resolveSecrets
 } from "./chunk-BOPSG2LI.js";
+import {
+  writeStackConfig
+} from "./chunk-CHPMOE4T.js";
 import {
   atomicWriteConfig,
   deepMerge,
   readRemoteConfig,
   restartGateway
-} from "./chunk-UAJJEDCJ.js";
+} from "./chunk-AGSNTIYZ.js";
 import {
   validatePlan
-} from "./chunk-PASAVVNS.js";
-import {
-  writeStackConfig
-} from "./chunk-55UMO37O.js";
+} from "./chunk-47CGHUVT.js";
 import {
   buildContext
-} from "./chunk-AVERNLUY.js";
+} from "./chunk-SQPHNVCF.js";
 import {
   saveOverlay
 } from "./chunk-6ZFIFDBJ.js";
@@ -26,7 +26,7 @@ import {
 import {
   getConfig,
   setConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
@@ -48,13 +48,16 @@ ${validation.errors.join("\n")}`
   }
   const { guardOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
   await guardOpenclawVersion(plan.spec.openclaw.version);
+  const { enforceInstanceType } = await import("./policy-AZGFCQNV.js");
+  const { getConfig: getConfig2 } = await import("./store-BTQOOIJH.js");
+  await enforceInstanceType(getConfig2(), plan.spec.provider, plan.spec.instanceType);
   const ctx = buildContext({
     stack: plan.spec.stackName,
     provider: plan.spec.provider
   });
   const stack = await ctx.getStack();
   const { guardPrivateOnlyApply } = await import("./private-only-DIA26I2E.js");
-  const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
+  const { probeSsh } = await import("./tailscale-cutover-XTMGDM5H.js");
   await guardPrivateOnlyApply(plan, ctx, opts?.probeTailnet ?? ((conn2) => probeSsh(conn2, opts?.signal)));
   await writeStackConfig(stack, plan);
   if (plan.metadata.stackVersion !== void 0) {
@@ -93,7 +96,7 @@ The diff you reviewed may no longer reflect what will be applied.
     signal: opts?.signal,
     onProgress: (line) => reportProgress(opts, line)
   });
-  const { waitForGateway } = await import("./ready-IJEUBFVX.js");
+  const { waitForGateway } = await import("./ready-4H3NNEYQ.js");
   try {
     await waitForGateway(readySession, {
       signal: opts?.signal,

package/dist/{chunk-55UMO37O.js → chunk-CHPMOE4T.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VOEJYRIK.js";
 import {
   getConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";

package/dist/{chunk-LV7UO5CG.js → chunk-G2ROJXYJ.js}

@@ -2,7 +2,7 @@
 import {
   requireConfig,
   setConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 
 // src/config/stack-delete.ts
 function forgetNotice(name) {
@@ -47,7 +47,7 @@ async function checkStackDelete(name, opts) {
   return { ok: true, name, isDefault, warnings };
 }
 async function isStackDeployed(name) {
-  const { buildContext } = await import("./context-EHSLWKSH.js");
+  const { buildContext } = await import("./context-4KTM4DKH.js");
   const ctx = buildContext({ stack: name });
   if (ctx.adapter.name === "local") return !!ctx.localState;
   const stack = await ctx.getStack();

package/dist/{chunk-GFIR2IIJ.js → chunk-GYMAC4MW.js}

@@ -10,46 +10,64 @@ import { randomUUID } from "crypto";
 import os from "os";
 import path from "path";
 import process from "process";
+import { z as z2 } from "zod";
+
+// src/config/policy-schema.ts
 import { z } from "zod";
-var CredentialsRefSchema = z.object({
-  source: z.enum(["env", "cli-profile", "file", "instance-metadata"]),
-  envVars: z.array(z.string()).optional(),
-  profileName: z.string().optional()
+var PolicySchema = z.object({
+  /**
+   * Per provider, the instance types clawops may deploy. A clawops size (`micro`, `small`,
+   * `medium`, `large`) or a provider-native type; sizes are compared after the provider maps
+   * them, so `small` and `t3.small` are the same entry on AWS. A provider with no entry is
+   * unrestricted.
+   */
+  allowedInstanceTypes: z.record(z.array(z.string()).min(1)).optional(),
+  /** How many stacks this config may hold. Absent = no cap. */
+  maxStacks: z.number().int().positive().optional()
+});
+
+// src/config/store.ts
+var CredentialsRefSchema = z2.object({
+  source: z2.enum(["env", "cli-profile", "file", "instance-metadata"]),
+  envVars: z2.array(z2.string()).optional(),
+  profileName: z2.string().optional()
 });
-var LocalOptsSchema = z.object({
-  host: z.string(),
-  sshUser: z.string(),
-  sshPort: z.number(),
-  sshKeyPath: z.string()
+var LocalOptsSchema = z2.object({
+  host: z2.string(),
+  sshUser: z2.string(),
+  sshPort: z2.number(),
+  sshKeyPath: z2.string()
 });
-var TailscaleOverrideSchema = z.object({
-  ip: z.string(),
-  hostname: z.string().optional(),
+var TailscaleOverrideSchema = z2.object({
+  ip: z2.string(),
+  hostname: z2.string().optional(),
   /** When the address was verified, ISO 8601. */
-  verifiedAt: z.string(),
+  verifiedAt: z2.string(),
   /** Set once --private-only has closed the public ports, so revert knows to reopen them. */
-  privateOnly: z.boolean().optional()
+  privateOnly: z2.boolean().optional()
 });
-var StackConfigSchema = z.object({
-  provider: z.string(),
-  stateUrl: z.string(),
-  region: z.string().optional(),
+var StackConfigSchema = z2.object({
+  provider: z2.string(),
+  stateUrl: z2.string(),
+  region: z2.string().optional(),
   credentialsRef: CredentialsRefSchema,
   localOpts: LocalOptsSchema.optional(),
   tailscale: TailscaleOverrideSchema.optional()
 });
-var ClawopsConfigSchema = z.object({
-  version: z.literal(1),
-  defaults: z.object({
-    stack: z.string(),
-    provider: z.string()
+var ClawopsConfigSchema = z2.object({
+  version: z2.literal(1),
+  defaults: z2.object({
+    stack: z2.string(),
+    provider: z2.string()
   }),
-  stacks: z.record(StackConfigSchema),
-  ssh: z.object({
-    keyPath: z.string(),
-    knownHostsPath: z.string()
+  stacks: z2.record(StackConfigSchema),
+  ssh: z2.object({
+    keyPath: z2.string(),
+    knownHostsPath: z2.string()
   }),
-  mcp: z.object({ auditLogPath: z.string() }).optional()
+  mcp: z2.object({ auditLogPath: z2.string() }).optional(),
+  /** The operator's spending policy; see ./policy.ts. */
+  policy: PolicySchema.optional()
 });
 function getConfigDir() {
   return process.env["CLAWOPS_HOME"] ?? path.join(os.homedir(), ".clawops");
@@ -92,6 +110,7 @@ function setConfig(config) {
 }
 
 export {
+  PolicySchema,
   getConfigDir,
   getConfigPath,
   getConfig,

package/dist/{chunk-T6OCPTTR.js → chunk-LIAXA43Z.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-POYS3EVQ.js";
 import {
   validatePlan
-} from "./chunk-PASAVVNS.js";
+} from "./chunk-47CGHUVT.js";
 import {
   buildContext,
   loadAdapterModule
-} from "./chunk-AVERNLUY.js";
+} from "./chunk-SQPHNVCF.js";
 import {
   getConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import {
   StateError,
   UsageError
@@ -62,9 +62,12 @@ async function resolveInstanceType(intent) {
       `[clawops] note: "${requested}" is not a clawops size (${INSTANCE_ALIASES.join(", ")}), so it is passed to ${intent.provider} as written.
 `
     );
-    return requested;
   }
-  const adapter = await loadAdapterModule(intent.provider);
+  return nativeInstanceType(intent.provider, requested);
+}
+async function nativeInstanceType(provider, requested) {
+  if (!isInstanceAlias(requested)) return requested;
+  const adapter = await loadAdapterModule(provider);
   return adapter.normalizeInstanceType(requested);
 }
 var parseDiffForTest = parseDiff;
@@ -74,9 +77,11 @@ async function generatePlan(intent, _opts) {
       "plan/apply is not supported for the local provider. Use `clawops up` directly."
     );
   }
-  const { version } = await import("./package-ESYPCIES.js");
+  const { version } = await import("./package-HRMX7K3C.js");
   const config = getConfig();
   const instanceType = await resolveInstanceType(intent);
+  const { enforceInstanceType } = await import("./policy-AZGFCQNV.js");
+  await enforceInstanceType(config, intent.provider, instanceType);
   const { guardOpenclawVersion, defaultOpenclawVersion } = await import("./version-guard-XVYW5WFJ.js");
   const openclawVersion = await guardOpenclawVersion(
     intent.openclawVersion ?? await defaultOpenclawVersion()
@@ -126,7 +131,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     );
   }
   try {
-    const { writeStackConfig } = await import("./stack-config-ICQ5YHUL.js");
+    const { writeStackConfig } = await import("./stack-config-3E7KWFPI.js");
     await writeStackConfig(stack, plan);
     const outputLines = [];
     const preview = await stack.preview({
@@ -154,7 +159,7 @@ A plan is only as good as the state it was computed against, so this is not a pl
     throw new Error(`Generated plan failed schema validation:
 ${validation.errors.join("\n")}`);
   }
-  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-DZE6LFEB.js");
+  const { validatePlanConfig, validatePlanNetwork } = await import("./validate-CRXX7OYF.js");
   const cfgCheck = await validatePlanConfig(plan);
   for (const w of cfgCheck.warnings) process.stderr.write(`[clawops] warning: ${w}
 `);
@@ -186,6 +191,7 @@ function expandHome(p) {
 export {
   INSTANCE_ALIASES,
   isInstanceAlias,
+  nativeInstanceType,
   parseDiffForTest,
   generatePlan,
   planId