@clawops/cli 2.2.1 → 2.3.1

package/dist/{chunk-Y3N63PDS.js → chunk-ORBZGTNX.js}

@@ -1,9 +1,13 @@
 #!/usr/bin/env node
+import {
+  DEFAULT_AGENT_LOG_LIMIT,
+  readAgentActivity
+} from "./chunk-27335SIH.js";
 import {
   migrationQuestion,
   prepareMigration,
   runMigration
-} from "./chunk-E6BRQK67.js";
+} from "./chunk-4SEFKZRL.js";
 import {
   ACTIVATED,
   ARCHIVE_IS_A_CREDENTIAL,
@@ -15,43 +19,39 @@ import {
   defaultBackupFilename,
   nothingChanged,
   stageRestore
-} from "./chunk-PCSX6Y3U.js";
+} from "./chunk-66CUJFXK.js";
 import {
   checkStackDelete,
   deleteStackFromConfig,
   forgetNotice
-} from "./chunk-LV7UO5CG.js";
+} from "./chunk-G2ROJXYJ.js";
 import {
   applyPlan
-} from "./chunk-AX65JMDZ.js";
+} from "./chunk-7LLVIQ7G.js";
 import {
   resolveConn
 } from "./chunk-SX75L2T3.js";
 import {
-  DEFAULT_AGENT_LOG_LIMIT,
-  readAgentActivity
-} from "./chunk-27335SIH.js";
-import {
-  generatePlan
-} from "./chunk-T6OCPTTR.js";
+  acquireSession,
+  drainPool
+} from "./chunk-TYNMOYVM.js";
 import {
   extractBaseOutputs
 } from "./chunk-3QJBNAHW.js";
+import {
+  generatePlan
+} from "./chunk-LIAXA43Z.js";
 import {
   atomicWriteConfig,
   readRemoteConfig,
   restartGateway
-} from "./chunk-UAJJEDCJ.js";
+} from "./chunk-AGSNTIYZ.js";
 import {
   validatePlan
-} from "./chunk-PASAVVNS.js";
+} from "./chunk-47CGHUVT.js";
 import {
   buildContext
-} from "./chunk-AVERNLUY.js";
-import {
-  acquireSession,
-  drainPool
-} from "./chunk-TYNMOYVM.js";
+} from "./chunk-SQPHNVCF.js";
 import {
   AUDIT_CLEAN_MESSAGE,
   AUDIT_FIX_HINT,
@@ -69,7 +69,7 @@ import {
   resolveUpdateVersion,
   runDiagnostics,
   updateGateway
-} from "./chunk-OUQVKIIA.js";
+} from "./chunk-PNRFFYOA.js";
 import {
   GATEWAY_LOGS_PROBE,
   chooseLogSource,
@@ -82,7 +82,7 @@ import {
 import {
   getConfig,
   getConfigDir
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import {
   StateError,
   UsageError
@@ -105,10 +105,42 @@ function getSessionId() {
   if (!_sessionId) _sessionId = randomUUID();
   return _sessionId;
 }
-var SENSITIVE_KEYS = ["token", "secret", "key", "password", "connectionstring", "authorization"];
+var SENSITIVE_KEYS = ["token", "secret", "key", "password", "connectionstring", "authorization", "credential"];
 var EXEMPT_KEYS = ["keyname", "keypath", "privateKeyPath", "knownHostsPath"];
 var ARN_RE = /arn:aws:[a-z0-9\-*]+:[a-z0-9\-]*:[0-9]*:[^\s,'"]+/gi;
+function isSensitiveName(name) {
+  const n = name.toLowerCase();
+  const exempt = EXEMPT_KEYS.some((e) => n === e.toLowerCase());
+  return !exempt && SENSITIVE_KEYS.some((s) => n.includes(s));
+}
+function isSecretPath(dotPath) {
+  return dotPath.split(".").some(isSensitiveName);
+}
+function redactConfigValue(dotPath, value) {
+  if (isSecretPath(dotPath)) return "[REDACTED]";
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    return value;
+  }
+  if (parsed === null || typeof parsed !== "object") return value;
+  return JSON.stringify(sanitizeValue(parsed));
+}
+function sanitizeValue(v) {
+  if (Array.isArray(v)) return v.map(sanitizeValue);
+  if (v !== null && typeof v === "object") return sanitize(v);
+  return v;
+}
 function sanitize(args) {
+  if (typeof args["key"] === "string") {
+    const { key, value, ...rest } = args;
+    const out = { ...sanitize(rest), key };
+    if (value !== void 0) {
+      out["value"] = typeof value === "string" ? redactConfigValue(key, value) : "[REDACTED]";
+    }
+    return out;
+  }
   const result = {};
   for (const [k, v] of Object.entries(args)) {
     const kl = k.toLowerCase();
@@ -565,9 +597,10 @@ var clawops_workflow_deploy_appAnnotations = {
 var clawops_workflow_recoverSchema = z.object({
   stackName: z.string().optional().describe("Which stack to diagnose. Omitted = the default stack in ~/.clawops/config.json")
 });
-var clawops_workflow_recoverDescription = `Diagnostic workflow for an unhealthy stack. Internally: status check \u2192
-gateway logs \u2192 agent logs \u2192 systemd service status \u2192 produces a structured
-diagnostic report with suggested remediation.
+var clawops_workflow_recoverDescription = `Diagnostic workflow for an unhealthy stack. Internally: what is deployed
+(clawops_status) \u2192 the stack's failed health checks (clawops_doctor) \u2192 the
+gateway's last 50 log lines (clawops_logs_tail) \u2192 a report with next steps that
+name the tool for each kind of failure. Changes nothing.
 
 Use when: the user reports any "not working" symptom and you don't know
 where to start. Best entry point for troubleshooting.
@@ -835,7 +868,7 @@ async function handleConfigGet(input, _server) {
 }
 async function handleConfigSet(input, server) {
   const confirmation = await confirmDestructive(server, {
-    message: `Set ${input.key} = ${input.value} on stack "${input.stackName ?? "default"}"?`,
+    message: `Set ${input.key} = ${redactConfigValue(input.key, input.value)} on stack "${input.stackName ?? "default"}"?`,
     title: "Confirm config change",
     what: "changing gateway configuration"
   });
@@ -1155,7 +1188,7 @@ async function handleUp(input, server) {
       );
     }
     const { localOpts } = stackConfig;
-    const { localBootstrap } = await import("./bootstrap-32TZXVDF.js");
+    const { localBootstrap } = await import("./bootstrap-L3P5E4D7.js");
     const ac = new AbortController();
     const state = await localBootstrap({
       host: localOpts.host,
@@ -1178,8 +1211,8 @@ async function handleUp(input, server) {
   const progressToken = void 0;
   const emit = makeProgressEmitter(server, progressToken);
   startTask(taskId, `clawops_up stack=${ctx.stackName}`);
-  const { generatePlan: generatePlan2 } = await import("./generate-4JWTMOLQ.js");
-  const { applyPlan: applyPlan2 } = await import("./apply-F5SQ2ZOS.js");
+  const { generatePlan: generatePlan2 } = await import("./generate-XJWEQKT6.js");
+  const { applyPlan: applyPlan2 } = await import("./apply-TXPUNOGW.js");
   const { resolveNetworkFlags } = await import("./network-args-PYJRJBYO.js");
   const { detectEgressIp } = await import("./firewall-5VKZ4WBH.js");
   const network = await resolveNetworkFlags(
@@ -1294,7 +1327,7 @@ async function handlePlan(input, _server) {
     let network = resolved;
     if (input.privateOnly) {
       const { privateOnlyNetwork, assertTailnetReachable } = await import("./private-only-DIA26I2E.js");
-      const { probeSsh } = await import("./tailscale-cutover-V42HO5UM.js");
+      const { probeSsh } = await import("./tailscale-cutover-XTMGDM5H.js");
       network = privateOnlyNetwork(flags, resolved, ctx.config.stacks[stackName]?.tailscale, stackName);
       await assertTailnetReachable(ctx, (conn) => probeSsh(conn));
     }
@@ -1331,7 +1364,7 @@ async function handleHarden(input, server) {
       "tailscale and tailscaleRevert do the opposite of each other; pass one, not both."
     );
   }
-  const { getConfig: getConfig2 } = await import("./store-YOLQYXMB.js");
+  const { getConfig: getConfig2 } = await import("./store-BTQOOIJH.js");
   const config = getConfig2();
   if (!config) {
     return errText(
@@ -1350,12 +1383,12 @@ async function handleHarden(input, server) {
       return okText(confirmation.reason);
     }
   }
-  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-6B2I6TRW.js");
+  const { revertTailnet, cutOverToTailnet, connectionFor } = await import("./flows-6YEJGHCK.js");
   if (input.tailscaleRevert) {
     const outcome = await revertTailnet(ctx, config);
     return outcome.ok ? okText(outcome.message) : errText(outcome.reason);
   }
-  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-UHAOVQMZ.js");
+  const { MODULE_CATALOG, resolveModules, runHardening, formatHardenSummary, makeTailscaleModule } = await import("./harden-7O553IOK.js");
   const forStack = makeTailscaleModule(ctx.stackName);
   const resolved = resolveModules(MODULE_CATALOG, input.options, ctx.adapter.name).map(
     (m) => m.id === "tailscale" ? forStack : m
@@ -1399,7 +1432,7 @@ async function handleHarden(input, server) {
 
 // src/mcp/tools/cli/init.ts
 async function handleInit(input, _server) {
-  const { initStack } = await import("./init-HOPXDNWY.js");
+  const { initStack } = await import("./init-DYOLZX65.js");
   const result = await initStack({
     provider: input.provider,
     stackName: input.stackName,
@@ -1865,39 +1898,39 @@ Changes: ${diffLine}. This will provision cloud resources and may incur costs.`,
 }
 
 // src/mcp/tools/workflow/recover.ts
-async function handleWorkflowRecover(input, server) {
-  const parts = [`## Diagnostic Report \u2014 stack: ${input.stackName ?? "default"}
-`];
-  try {
-    const statusResult = await handleStatus({ stackName: input.stackName }, server);
-    const statusText = statusResult.content.filter((c) => c.type === "text").map((c) => c.text).join("");
-    parts.push(`### Status
-\`\`\`json
-${statusText}
-\`\`\``);
-  } catch (err) {
-    parts.push(`### Status
-Error: ${err instanceof Error ? err.message : String(err)}`);
-  }
+function textOf(result) {
+  return result.content.filter((c) => c.type === "text").map((c) => c.text).join("");
+}
+async function section(title, fence, run) {
   try {
-    const logsResult = await handleLogsTail({ stackName: input.stackName, tailLines: 50 }, server);
-    const logsText = logsResult.content.filter((c) => c.type === "text").map((c) => c.text).join("");
-    parts.push(`### Recent Logs (last 50 lines)
-\`\`\`
-${logsText}
-\`\`\``);
+    const result = await run();
+    return result.isError ? `### ${title}
+Error: ${textOf(result)}` : `### ${title}
+\`\`\`${fence}
+${textOf(result)}
+\`\`\``;
   } catch (err) {
-    parts.push(`### Recent Logs
-Error: ${err instanceof Error ? err.message : String(err)}`);
+    return `### ${title}
+Error: ${err instanceof Error ? err.message : String(err)}`;
   }
+}
+async function handleWorkflowRecover(input, server) {
+  const stack = input.stackName ?? "default";
+  const parts = [`## Diagnostic Report \u2014 stack: ${stack}
+`];
+  parts.push(await section("Status", "json", () => handleStatus({ stackName: input.stackName }, server)));
+  parts.push(await section("Failed health checks", "json", () => handleDoctor({ stackName: input.stackName, failuresOnly: true }, server)));
+  parts.push(await section("Recent Logs (last 50 lines)", "", () => handleLogsTail({ stackName: input.stackName, tailLines: 50 }, server)));
   parts.push(
     `### Next Steps
-- If gateway is not running: try \`clawops_gateway_restart\`
-- If bootstrap failed: run \`clawops_up\` again (idempotent)
-- If stack is not deployed: run \`clawops_workflow_deploy_app\`
-- For Pulumi drift: run \`clawops refresh\` from the CLI`
+- Gateway not running, or not answering: \`clawops_gateway_restart\`
+- Gateway fails on its current version: \`clawops_gateway_update\` to a version that worked, or \`clawops_backup_restore\` with \`activate\` if the state is at fault
+- Host not set up, or set up only partly: \`clawops_up\` again (it is idempotent)
+- Infrastructure differs from what was deployed: \`clawops_plan\`, review, then \`clawops_apply\`
+- Nothing deployed yet: \`clawops_workflow_deploy_app\``
   );
-  return { content: [{ type: "text", text: parts.join("\n\n") }] };
+  const { content } = trimForMcp(parts.join("\n\n"), stack);
+  return { content: [{ type: "text", text: content }] };
 }
 
 // src/mcp/tools/registry.ts
@@ -2232,7 +2265,7 @@ function bearerFrom(header) {
   return match?.[1]?.trim();
 }
 async function serveMcp(opts) {
-  const { version } = await import("./package-ESYPCIES.js");
+  const { version } = await import("./package-HRMX7K3C.js");
   const makeServer = () => {
     const server = new McpServer({ name: "clawops", version });
     registerTools(server, opts);

package/dist/{chunk-OUQVKIIA.js → chunk-PNRFFYOA.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import {
-  listOverlays
-} from "./chunk-6ZFIFDBJ.js";
 import {
   inspectContainer
 } from "./chunk-Z3XLWZWF.js";
 import {
-  execPrivileged
-} from "./chunk-WPZIJONN.js";
+  listOverlays
+} from "./chunk-6ZFIFDBJ.js";
 import {
   interpretProbe,
   probeCommand
 } from "./chunk-LT4XMO5D.js";
+import {
+  execPrivileged
+} from "./chunk-WPZIJONN.js";
 import {
   PUBLISH_INSPECT_CMD,
   STATE_DIR_CONTAINER,
@@ -158,8 +158,8 @@ function renderSnapshot(snap, opts) {
   return lines.join("\n");
 }
 async function probeEntries() {
-  const { buildContext } = await import("./context-EHSLWKSH.js");
-  const { getConfig } = await import("./store-YOLQYXMB.js");
+  const { buildContext } = await import("./context-4KTM4DKH.js");
+  const { getConfig } = await import("./store-BTQOOIJH.js");
   const config = getConfig();
   if (!config) return [];
   return Promise.all(
@@ -227,7 +227,7 @@ function renderMenu(entries, selectedIdx, showAll, noColor, confirmDelete) {
   return lines.join("\n");
 }
 async function deleteFromRegistry(name) {
-  const { requireConfig, setConfig } = await import("./store-YOLQYXMB.js");
+  const { requireConfig, setConfig } = await import("./store-BTQOOIJH.js");
   const config = requireConfig();
   const newStacks = { ...config.stacks };
   delete newStacks[name];
@@ -385,7 +385,7 @@ var monitor_default = defineCommand({
     const tailLines = Math.max(1, parseInt(String(args.tail ?? "10"), 10) || 10);
     const isTTY = Boolean(process.stdout.isTTY);
     const noColor = Boolean(args["no-color"]) || !isTTY;
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const { acquireSession, drainPool } = await import("./pool-NT4XBSUT.js");
     const ac = new AbortController();
     process.on("SIGINT", () => ac.abort());
@@ -718,7 +718,7 @@ import { accessSync, mkdirSync, readFileSync, constants } from "fs";
 import ssh2 from "ssh2";
 import path from "path";
 async function runDiagnostics(opts = {}, deps = {}) {
-  const { getConfig, getConfigDir } = await import("./store-YOLQYXMB.js");
+  const { getConfig, getConfigDir } = await import("./store-BTQOOIJH.js");
   const config = getConfig();
   const sections = [];
   sections.push({ title: "Runtime", checks: await runtimeChecks(getConfigDir()) });
@@ -1018,8 +1018,8 @@ async function deployedVersionCheck(image, deployedVersion) {
 }
 async function hardeningChecks(conn, stack, signal) {
   try {
-    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-UHAOVQMZ.js");
-    const { buildContext } = await import("./context-EHSLWKSH.js");
+    const { MODULE_CATALOG, resolveModules, withRemoteExec } = await import("./harden-7O553IOK.js");
+    const { buildContext } = await import("./context-4KTM4DKH.js");
     const provider = buildContext({ stack }).adapter.name;
     const modules = resolveModules(MODULE_CATALOG, void 0, provider);
     const checks = [];
@@ -1041,8 +1041,8 @@ async function hardeningChecks(conn, stack, signal) {
   }
 }
 async function defaultOpenSession(stack, signal) {
-  const { getConfig } = await import("./store-YOLQYXMB.js");
-  const { buildContext } = await import("./context-EHSLWKSH.js");
+  const { getConfig } = await import("./store-BTQOOIJH.js");
+  const { buildContext } = await import("./context-4KTM4DKH.js");
   const { extractBaseOutputs } = await import("./outputs-DJHBY7EE.js");
   const { acquireSession } = await import("./pool-NT4XBSUT.js");
   const config = getConfig();

package/dist/{chunk-755X5OGS.js → chunk-Q56AM57B.js}

@@ -3,7 +3,7 @@ import {
   getConfig,
   getConfigDir,
   setConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 
 // src/config/init.ts
 import { spawnSync } from "child_process";
@@ -109,6 +109,9 @@ async function initStack(opts) {
       reason: `Stack "${stackName}" already exists in ${path.join(getConfigDir(), "config.json")} (${existing.stacks[stackName].stateUrl}). Pass force to overwrite its settings, or use a different stack name to add another one.`
     };
   }
+  const { stackCapRefusal } = await import("./policy-AZGFCQNV.js");
+  const overCap = stackCapRefusal(existing, stackName);
+  if (overCap) return { ok: false, reason: overCap };
   const configDir = getConfigDir();
   mkdirSync(configDir, { recursive: true });
   const keyPath = opts.keyPath ?? path.join(configDir, "id_ed25519");

package/dist/{chunk-4MHDW2NB.js → chunk-QRF4OWG4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 
 // src/config/secrets.ts
 import { readFileSync, existsSync } from "fs";

package/dist/{chunk-AVERNLUY.js → chunk-SQPHNVCF.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import {
-  getProvider
-} from "./chunk-VUFMZEIM.js";
 import {
   readLocalState
-} from "./chunk-RDUKRIRC.js";
+} from "./chunk-U3NRKBDW.js";
 import {
   getConfigDir,
   requireConfig
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 import {
   UsageError
 } from "./chunk-KGXPLI7W.js";
+import {
+  getProvider
+} from "./chunk-VUFMZEIM.js";
 
 // src/cli/context.ts
 function buildContext(args) {
@@ -41,7 +41,7 @@ function buildContext(args) {
           `Stack "${stackName}" not found in config. Run \`clawops init\` or use \`--stack\` to specify a different stack.`
         );
       }
-      const { getOrCreateStack } = await import("./automation-NBYQ6MFZ.js");
+      const { getOrCreateStack } = await import("./automation-VDKLZMJI.js");
       stackCache = await getOrCreateStack({
         stack: stackName,
         stateUrl: stackConfig.stateUrl,

package/dist/{chunk-RDUKRIRC.js → chunk-U3NRKBDW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getConfigDir
-} from "./chunk-GFIR2IIJ.js";
+} from "./chunk-GYMAC4MW.js";
 
 // src/providers/local/state.ts
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";