clawdlets 0.3.4 → 0.4.1

package/dist/main.mjs

@@ -10,22 +10,28 @@ import { applyOpenTofuVars, destroyOpenTofuVars } from "@clawdlets/core/lib/open
 import { resolveGitRev } from "@clawdlets/core/lib/git";
 import { capture, run } from "@clawdlets/core/lib/run";
 import { checkGithubRepoVisibility, tryParseGithubFlakeUri } from "@clawdlets/core/lib/github";
-import { loadDeployCreds } from "@clawdlets/core/lib/deploy-creds";
+import { loadDeployCreds, renderDeployCredsEnvFile } from "@clawdlets/core/lib/deploy-creds";
 import { expandPath } from "@clawdlets/core/lib/path-expand";
-import { buildFleetSecretsPlan } from "@clawdlets/core/lib/fleet-secrets";
+import { buildFleetSecretsPlan } from "@clawdlets/core/lib/fleet-secrets-plan";
 import { withFlakesEnv } from "@clawdlets/core/lib/nix-flakes";
 import { resolveBaseFlake } from "@clawdlets/core/lib/base-flake";
 import { getHostEncryptedAgeKeyFile, getHostExtraFilesDir, getHostExtraFilesKeyPath, getHostExtraFilesSecretsDir, getHostOpenTofuDir, getHostRemoteSecretsDir, getHostSecretsDir, getLocalOperatorAgeKeyPath, getRepoLayout } from "@clawdlets/core/repo-layout";
 import { collectDoctorChecks } from "@clawdlets/core/doctor";
 import { resolveHostNameOrExit } from "@clawdlets/core/lib/host-resolve";
+import { shellQuote, sshCapture, sshRun, validateTargetHost } from "@clawdlets/core/lib/ssh-remote";
+import { BotIdSchema, assertSafeHostName as assertSafeHostName$1, sanitizeOperatorId } from "@clawdlets/shared/lib/identifiers";
+import { loadHostContextOrExit } from "@clawdlets/core/lib/context";
+import { buildClawdbotBotConfig } from "@clawdlets/core/lib/clawdbot-config-invariants";
 import { ensureDir, writeFileAtomic } from "@clawdlets/core/lib/fs-safe";
 import { splitDotPath } from "@clawdlets/core/lib/dot-path";
-import { formatDotenvValue, parseDotenv } from "@clawdlets/core/lib/dotenv-file";
+import { deleteAtPath, getAtPath, setAtPath } from "@clawdlets/core/lib/object-path";
+import { migrateClawdletsConfigToV9 } from "@clawdlets/core/lib/clawdlets-config-migrate";
+import { validateClawdletsConfig } from "@clawdlets/core/lib/clawdlets-config-validate";
+import { applySecretsAutowire, planSecretsAutowire } from "@clawdlets/core/lib/secrets-autowire";
+import { parseDotenv } from "@clawdlets/core/lib/dotenv-file";
 import { looksLikeSshPrivateKey, parseSshPublicKeysFromText } from "@clawdlets/core/lib/ssh";
-import { shellQuote, sshCapture, sshRun, validateTargetHost } from "@clawdlets/core/lib/ssh-remote";
-import { loadHostContextOrExit } from "@clawdlets/core/lib/context";
-import { tmpdir } from "node:os";
-import { downloadTemplate } from "giget";
+import { readKnownHostsFromFile, readSshPublicKeysFromFile } from "@clawdlets/core/lib/ssh-files";
+import { initProject, planProjectInit } from "@clawdlets/core/lib/project-init";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { normalizeTemplateSource } from "@clawdlets/core/lib/template-source";
 import { ageKeygen, agePublicKeyFromIdentityFile } from "@clawdlets/core/lib/age-keygen";
@@ -34,9 +40,10 @@ import { mkpasswdYescryptHash } from "@clawdlets/core/lib/mkpasswd";
 import { getSopsCreationRuleAgeRecipients, upsertSopsCreationRule } from "@clawdlets/core/lib/sops-config";
 import { sopsDecryptYamlFile, sopsEncryptYamlToFile } from "@clawdlets/core/lib/sops";
 import { getHostAgeKeySopsCreationRulePathRegex, getHostSecretsSopsCreationRulePathRegex } from "@clawdlets/core/lib/sops-rules";
-import { sanitizeOperatorId } from "@clawdlets/core/lib/identifiers";
 import { buildSecretsInitTemplate, isPlaceholderSecretValue, listSecretsInitPlaceholders, parseSecretsInitJson, resolveSecretsInitFromJsonArg, validateSecretsInitNonInteractive } from "@clawdlets/core/lib/secrets-init";
-import { readYamlScalarFromMapping } from "@clawdlets/core/lib/yaml-scalar";
+import { readYamlScalarFromMapping, upsertYamlScalarLine } from "@clawdlets/core/lib/yaml-scalar";
+import { mapWithConcurrency } from "@clawdlets/core/lib/concurrency";
+import { assertSecretsAreManaged, buildManagedHostSecretNameAllowlist } from "@clawdlets/core/lib/secrets-allowlist";
 import { createSecretsTar } from "@clawdlets/core/lib/secrets-tar";
 import YAML from "yaml";
 
@@ -703,38 +710,117 @@ const bootstrap = defineCommand({
 });
 
 //#endregion
-//#region src/commands/config.ts
-function getAtPath(obj, parts) {
-	let cur = obj;
-	for (const k of parts) {
-		if (cur == null || typeof cur !== "object") return void 0;
-		cur = cur[k];
-	}
-	return cur;
+//#region src/commands/ssh-target.ts
+function needsSudo(targetHost) {
+	return !/^root@/i.test(targetHost.trim());
 }
-function setAtPath(obj, parts, value) {
-	let cur = obj;
-	for (let i = 0; i < parts.length - 1; i++) {
-		const k = parts[i];
-		if (cur[k] == null || typeof cur[k] !== "object" || Array.isArray(cur[k])) cur[k] = {};
-		cur = cur[k];
-	}
-	cur[parts[parts.length - 1]] = value;
+function requireTargetHost(targetHost, hostName) {
+	const v = targetHost.trim();
+	if (v) return validateTargetHost(v);
+	throw new Error([
+		`missing target host for ${hostName}`,
+		"set it in fleet/clawdlets.json (hosts.<host>.targetHost) or pass --target-host",
+		"recommended: use an SSH config alias (e.g. botsmj)"
+	].join("; "));
 }
-function deleteAtPath(obj, parts) {
-	let cur = obj;
-	for (let i = 0; i < parts.length - 1; i++) {
-		const k = parts[i];
-		if (cur == null || typeof cur !== "object") return false;
-		cur = cur[k];
-	}
-	const last = parts[parts.length - 1];
-	if (cur && typeof cur === "object" && Object.prototype.hasOwnProperty.call(cur, last)) {
-		delete cur[last];
-		return true;
-	}
-	return false;
+
+//#endregion
+//#region src/commands/clawdbot/schema.ts
+function requireBotId$1(value) {
+	const botId = value.trim();
+	if (!BotIdSchema.safeParse(botId).success) throw new Error(`invalid --bot: ${botId}`);
+	return botId;
+}
+function buildGatewaySchemaCommand(params) {
+	const envFile = `/srv/clawdbot/${params.botId}/credentials/gateway.env`;
+	const url = `ws://127.0.0.1:${params.port}`;
+	const script = [
+		"set -euo pipefail",
+		`source ${envFile}`,
+		`clawdbot gateway call config.schema --url ${url} --token \"$CLAWDBOT_GATEWAY_TOKEN\" --json`
+	].join(" && ");
+	return [
+		...params.sudo ? [
+			"sudo",
+			"-u",
+			`bot-${params.botId}`
+		] : [],
+		"bash",
+		"-lc",
+		script
+	].map((a) => shellQuote(a)).join(" ");
 }
+const schemaFetch = defineCommand({
+	meta: {
+		name: "fetch",
+		description: "Fetch live Clawdbot config schema via gateway RPC."
+	},
+	args: {
+		runtimeDir: {
+			type: "string",
+			description: "Runtime directory (default: .clawdlets)."
+		},
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		targetHost: {
+			type: "string",
+			description: "SSH target override (default: from clawdlets.json)."
+		},
+		bot: {
+			type: "string",
+			description: "Bot id (fleet bot id; maps to systemd unit clawdbot-<bot>.service)."
+		},
+		sshTty: {
+			type: "boolean",
+			description: "Allocate SSH TTY.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const ctx = loadHostContextOrExit({
+			cwd: process$1.cwd(),
+			runtimeDir: args.runtimeDir,
+			hostArg: args.host
+		});
+		if (!ctx) return;
+		const { hostName, hostCfg, config: config$1 } = ctx;
+		const targetHost = requireTargetHost(String(args.targetHost || hostCfg.targetHost || ""), hostName);
+		const botId = requireBotId$1(String(args.bot || ""));
+		const gateway = buildClawdbotBotConfig({
+			config: config$1,
+			bot: botId
+		}).invariants?.gateway || {};
+		const port = typeof gateway.port === "number" ? gateway.port : Number(gateway.port || 0);
+		if (!Number.isFinite(port) || port <= 0) throw new Error(`invalid gateway port for bot ${botId}`);
+		await sshRun(targetHost, buildGatewaySchemaCommand({
+			botId,
+			port,
+			sudo: needsSudo(targetHost)
+		}), { tty: Boolean(args.sshTty) });
+	}
+});
+const clawdbotSchema = defineCommand({
+	meta: {
+		name: "schema",
+		description: "Clawdbot config schema helpers."
+	},
+	subCommands: { fetch: schemaFetch }
+});
+
+//#endregion
+//#region src/commands/clawdbot.ts
+const clawdbot = defineCommand({
+	meta: {
+		name: "clawdbot",
+		description: "Clawdbot gateway helpers."
+	},
+	subCommands: { schema: clawdbotSchema }
+});
+
+//#endregion
+//#region src/commands/config.ts
 const init = defineCommand({
 	meta: {
 		name: "init",
@@ -793,14 +879,261 @@ const show$1 = defineCommand({
 const validate = defineCommand({
 	meta: {
 		name: "validate",
-		description: "Validate fleet/clawdlets.json schema."
+		description: "Validate fleet/clawdlets.json + rendered Clawdbot config."
 	},
-	args: {},
-	async run() {
-		loadClawdletsConfig({ repoRoot: findRepoRoot(process$1.cwd()) });
+	args: {
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		strict: {
+			type: "boolean",
+			description: "Fail on warnings (inline secrets, invariant overrides).",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const { config } = loadClawdletsConfig({ repoRoot: findRepoRoot(process$1.cwd()) });
+		const resolved = resolveHostName({
+			config,
+			host: args.host
+		});
+		if (!resolved.ok) {
+			const tips = resolved.tips.length > 0 ? `; ${resolved.tips.join("; ")}` : "";
+			throw new Error(`${resolved.message}${tips}`);
+		}
+		const res = validateClawdletsConfig({
+			config,
+			hostName: resolved.host,
+			strict: Boolean(args.strict)
+		});
+		for (const w of res.warnings) console.error(`warn: ${w}`);
+		if (!res.ok) {
+			for (const e of res.errors) console.error(`error: ${e}`);
+			throw new Error("config validation failed");
+		}
 		console.log("ok");
 	}
 });
+const wireSecrets = defineCommand({
+	meta: {
+		name: "wire-secrets",
+		description: "Autowire missing secretEnv mappings."
+	},
+	args: {
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		bot: {
+			type: "string",
+			description: "Only wire secrets for this bot id."
+		},
+		scope: {
+			type: "string",
+			description: "Override scope (bot|fleet)."
+		},
+		only: {
+			type: "string",
+			description: "Only wire a specific ENV_VAR (comma-separated)."
+		},
+		write: {
+			type: "boolean",
+			description: "Apply changes to fleet/clawdlets.json.",
+			default: false
+		},
+		json: {
+			type: "boolean",
+			description: "Output JSON summary.",
+			default: false
+		},
+		yes: {
+			type: "boolean",
+			description: "Skip confirmation (non-interactive).",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const repoRoot = findRepoRoot(process$1.cwd());
+		const { configPath, config } = loadClawdletsConfigRaw({ repoRoot });
+		const validated = ClawdletsConfigSchema.parse(config);
+		const resolved = resolveHostName({
+			config: validated,
+			host: args.host
+		});
+		if (!resolved.ok) {
+			const tips = resolved.tips.length > 0 ? `; ${resolved.tips.join("; ")}` : "";
+			throw new Error(`${resolved.message}${tips}`);
+		}
+		const scopeRaw = String(args.scope || "").trim();
+		const scope = scopeRaw ? scopeRaw === "bot" || scopeRaw === "fleet" ? scopeRaw : null : null;
+		if (scopeRaw && !scope) throw new Error(`invalid --scope: ${scopeRaw} (expected bot|fleet)`);
+		const onlyEnvVars = String(args.only || "").split(",").map((s) => s.trim()).filter(Boolean);
+		const plan = planSecretsAutowire({
+			config: validated,
+			hostName: resolved.host,
+			scope: scope ?? void 0,
+			bot: args.bot ? String(args.bot).trim() : void 0,
+			onlyEnvVars
+		});
+		if (plan.updates.length === 0) {
+			if (args.json) console.log(JSON.stringify({
+				ok: true,
+				updates: []
+			}, null, 2));
+			else console.log("ok: no missing secretEnv mappings");
+			return;
+		}
+		const summary = plan.updates.map((u) => ({
+			bot: u.bot,
+			envVar: u.envVar,
+			scope: u.scope,
+			secretName: u.secretName
+		}));
+		if (!args.write) {
+			if (args.json) {
+				console.log(JSON.stringify({
+					ok: true,
+					write: false,
+					updates: summary
+				}, null, 2));
+				return;
+			}
+			console.log(`planned: update ${path.relative(repoRoot, configPath)}`);
+			for (const entry of summary) {
+				const target = entry.scope === "fleet" ? `fleet.secretEnv.${entry.envVar}` : `fleet.bots.${entry.bot}.profile.secretEnv.${entry.envVar}`;
+				console.log(`- ${target} = ${entry.secretName}`);
+			}
+			console.log("run with --write to apply changes");
+			return;
+		}
+		const next = applySecretsAutowire({
+			config: validated,
+			plan
+		});
+		const validation = validateClawdletsConfig({
+			config: next,
+			hostName: resolved.host
+		});
+		if (!validation.ok) {
+			for (const e of validation.errors) console.error(`error: ${e}`);
+			throw new Error("autowire failed: validation errors");
+		}
+		await writeClawdletsConfig({
+			configPath,
+			config: next
+		});
+		if (args.json) {
+			console.log(JSON.stringify({
+				ok: true,
+				write: true,
+				updates: summary
+			}, null, 2));
+			return;
+		}
+		console.log(`ok: updated ${path.relative(repoRoot, configPath)}`);
+		for (const entry of summary) {
+			const target = entry.scope === "fleet" ? `fleet.secretEnv.${entry.envVar}` : `fleet.bots.${entry.bot}.profile.secretEnv.${entry.envVar}`;
+			console.log(`- ${target} = ${entry.secretName}`);
+		}
+	}
+});
+const deriveAllowlist = defineCommand({
+	meta: {
+		name: "derive-allowlist",
+		description: "Derive per-bot secretEnvAllowlist from current config."
+	},
+	args: {
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		bot: {
+			type: "string",
+			description: "Only derive allowlist for this bot id."
+		},
+		write: {
+			type: "boolean",
+			description: "Apply changes to fleet/clawdlets.json.",
+			default: false
+		},
+		json: {
+			type: "boolean",
+			description: "Output JSON summary.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const repoRoot = findRepoRoot(process$1.cwd());
+		const { configPath, config } = loadClawdletsConfigRaw({ repoRoot });
+		const validated = ClawdletsConfigSchema.parse(config);
+		const resolved = resolveHostName({
+			config: validated,
+			host: args.host
+		});
+		if (!resolved.ok) {
+			const tips = resolved.tips.length > 0 ? `; ${resolved.tips.join("; ")}` : "";
+			throw new Error(`${resolved.message}${tips}`);
+		}
+		const plan = buildFleetSecretsPlan({
+			config: validated,
+			hostName: resolved.host
+		});
+		const botArg = args.bot ? String(args.bot).trim() : "";
+		const bots = botArg ? [botArg] : validated.fleet.botOrder || [];
+		if (bots.length === 0) throw new Error("fleet.botOrder is empty (set bots in fleet/clawdlets.json)");
+		const updates = bots.map((bot$1) => {
+			const envVars = plan.byBot?.[bot$1]?.envVarsRequired;
+			if (!envVars) throw new Error(`unknown bot id: ${bot$1}`);
+			return {
+				bot: bot$1,
+				allowlist: envVars
+			};
+		});
+		if (!args.write) {
+			if (args.json) {
+				console.log(JSON.stringify({
+					ok: true,
+					write: false,
+					updates
+				}, null, 2));
+				return;
+			}
+			console.log(`planned: update ${path.relative(repoRoot, configPath)}`);
+			for (const entry of updates) console.log(`- fleet.bots.${entry.bot}.profile.secretEnvAllowlist = ${JSON.stringify(entry.allowlist)}`);
+			console.log("run with --write to apply changes");
+			return;
+		}
+		const next = structuredClone(validated);
+		for (const entry of updates) {
+			if (!next.fleet.bots[entry.bot]) next.fleet.bots[entry.bot] = {};
+			if (!next.fleet.bots[entry.bot].profile) next.fleet.bots[entry.bot].profile = {};
+			next.fleet.bots[entry.bot].profile.secretEnvAllowlist = entry.allowlist;
+		}
+		const validation = validateClawdletsConfig({
+			config: next,
+			hostName: resolved.host
+		});
+		if (!validation.ok) {
+			for (const e of validation.errors) console.error(`error: ${e}`);
+			throw new Error("allowlist derive failed: validation errors");
+		}
+		await writeClawdletsConfig({
+			configPath,
+			config: next
+		});
+		if (args.json) {
+			console.log(JSON.stringify({
+				ok: true,
+				write: true,
+				updates
+			}, null, 2));
+			return;
+		}
+		console.log(`ok: updated ${path.relative(repoRoot, configPath)}`);
+		for (const entry of updates) console.log(`- fleet.bots.${entry.bot}.profile.secretEnvAllowlist = ${JSON.stringify(entry.allowlist)}`);
+	}
+});
 const get = defineCommand({
 	meta: {
 		name: "get",
@@ -882,6 +1215,56 @@ const set$2 = defineCommand({
 		}
 	}
 });
+const migrate = defineCommand({
+	meta: {
+		name: "migrate",
+		description: "Migrate fleet/clawdlets.json to a new schema version."
+	},
+	args: {
+		to: {
+			type: "string",
+			description: "Target schema version (only v9 supported).",
+			default: "v9"
+		},
+		"dry-run": {
+			type: "boolean",
+			description: "Print planned write without writing.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const repoRoot = findRepoRoot(process$1.cwd());
+		const configPath = getRepoLayout(repoRoot).clawdletsConfigPath;
+		if (!fs.existsSync(configPath)) throw new Error(`missing config: ${configPath}`);
+		const rawText = fs.readFileSync(configPath, "utf8");
+		let parsed;
+		try {
+			parsed = JSON.parse(rawText);
+		} catch {
+			throw new Error(`invalid JSON: ${configPath}`);
+		}
+		const to = String(args.to || "v9").trim().toLowerCase();
+		if (to !== "v9" && to !== "9") throw new Error(`unsupported --to: ${to} (expected v9)`);
+		const res = migrateClawdletsConfigToV9(parsed);
+		if (!res.changed) {
+			console.log("ok: already schemaVersion 9");
+			return;
+		}
+		const validated = ClawdletsConfigSchema.parse(res.migrated);
+		if (args["dry-run"]) {
+			console.log(`planned: write ${path.relative(repoRoot, configPath)}`);
+			for (const w of res.warnings) console.log(`warn: ${w}`);
+			return;
+		}
+		await ensureDir(path.dirname(configPath));
+		await writeClawdletsConfig({
+			configPath,
+			config: validated
+		});
+		console.log(`ok: migrated to schemaVersion 9: ${path.relative(repoRoot, configPath)}`);
+		for (const w of res.warnings) console.log(`warn: ${w}`);
+	}
+});
 const config = defineCommand({
 	meta: {
 		name: "config",
@@ -892,7 +1275,10 @@ const config = defineCommand({
 		show: show$1,
 		validate,
 		get,
-		set: set$2
+		set: set$2,
+		migrate,
+		"wire-secrets": wireSecrets,
+		"derive-allowlist": deriveAllowlist
 	}
 });
 
@@ -998,18 +1384,6 @@ function resolveEnvFilePath(params) {
 		origin: "default"
 	};
 }
-function renderEnvFile(keys) {
-	return [
-		"# clawdlets deploy creds (local-only; never commit)",
-		"# Used by: bootstrap, infra, lockdown, doctor",
-		"",
-		`HCLOUD_TOKEN=${formatDotenvValue(keys.HCLOUD_TOKEN)}`,
-		`GITHUB_TOKEN=${formatDotenvValue(keys.GITHUB_TOKEN)}`,
-		`NIX_BIN=${formatDotenvValue(keys.NIX_BIN)}`,
-		`SOPS_AGE_KEY_FILE=${formatDotenvValue(keys.SOPS_AGE_KEY_FILE)}`,
-		""
-	].join("\n");
-}
 function readEnvFileOrEmpty(filePath) {
 	if (!fs.existsSync(filePath)) return {
 		text: "",
@@ -1059,7 +1433,7 @@ const envInit = defineCommand({
 			NIX_BIN: String(existing.NIX_BIN || "nix").trim() || "nix",
 			SOPS_AGE_KEY_FILE: String(existing.SOPS_AGE_KEY_FILE || "").trim()
 		};
-		await writeFileAtomic(resolved.path, renderEnvFile(keys), { mode: 384 });
+		await writeFileAtomic(resolved.path, renderDeployCredsEnvFile(keys), { mode: 384 });
 		console.log(`ok: wrote ${path.relative(repoRoot, resolved.path) || resolved.path}`);
 		if (resolved.origin === "explicit") console.log(`note: you must pass --env-file ${resolved.path} to deploy commands to use it`);
 		else console.log("next: edit this file and set HCLOUD_TOKEN (required)");
@@ -1125,24 +1499,6 @@ function parseBoolOrUndefined(v) {
 	if (s === "false" || s === "0" || s === "no") return false;
 	throw new Error(`invalid boolean: ${String(v)} (use true/false)`);
 }
-function readSshPublicKeysFromFile(filePath) {
-	const stat = fs.statSync(filePath);
-	if (!stat.isFile()) throw new Error(`not a file: ${filePath}`);
-	if (stat.size > 64 * 1024) throw new Error(`ssh key file too large (>64KB): ${filePath}`);
-	const raw = fs.readFileSync(filePath, "utf8");
-	if (looksLikeSshPrivateKey(raw)) throw new Error(`refusing to read ssh private key (expected .pub): ${filePath}`);
-	const keys = parseSshPublicKeysFromText(raw);
-	if (keys.length === 0) throw new Error(`no ssh public keys found in file: ${filePath}`);
-	return keys;
-}
-function readKnownHostsFromFile(filePath) {
-	const stat = fs.statSync(filePath);
-	if (!stat.isFile()) throw new Error(`not a file: ${filePath}`);
-	if (stat.size > 256 * 1024) throw new Error(`known_hosts file too large (>256KB): ${filePath}`);
-	const lines = fs.readFileSync(filePath, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
-	if (lines.length === 0) throw new Error(`no known_hosts entries found in file: ${filePath}`);
-	return lines;
-}
 function toStringArray(v) {
 	if (v == null) return [];
 	if (Array.isArray(v)) return v.map((x) => String(x));
@@ -1480,10 +1836,6 @@ const set = defineCommand({
 			type: "string",
 			description: "Enable codex (true/false)."
 		},
-		"guild-id": {
-			type: "string",
-			description: "Discord guild ID."
-		},
 		"restic-enable": {
 			type: "string",
 			description: "Enable restic backups (true/false)."
@@ -1512,7 +1864,6 @@ const set = defineCommand({
 			const v = parseBool(args["restic-enable"]);
 			if (v !== void 0) next.fleet.backups.restic.enable = v;
 		}
-		if (args["guild-id"] !== void 0) next.fleet.guildId = String(args["guild-id"]).trim();
 		if (args["restic-repository"] !== void 0) next.fleet.backups.restic.repository = String(args["restic-repository"]).trim();
 		await writeClawdletsConfig({
 			configPath,
@@ -2203,90 +2554,6 @@ function requireTtyIfInteractive(interactive) {
 	if (!interactive) return;
 	if (!process$1.stdout.isTTY) throw new Error("--interactive requires a TTY");
 }
-function applySubs(s, subs) {
-	let out = s;
-	for (const [k, v] of Object.entries(subs)) out = out.split(k).join(v);
-	return out;
-}
-function isProbablyText(file) {
-	const base = path.basename(file);
-	if (base === "Justfile" || base === "_gitignore") return true;
-	const ext = path.extname(file).toLowerCase();
-	return [
-		".md",
-		".nix",
-		".tf",
-		".hcl",
-		".json",
-		".yaml",
-		".yml",
-		".txt",
-		".lock",
-		".gitignore"
-	].includes(ext);
-}
-async function copyTree(params) {
-	const entries = await fs.promises.readdir(params.srcDir, { withFileTypes: true });
-	for (const ent of entries) {
-		const srcName = ent.name;
-		const srcPath = path.join(params.srcDir, srcName);
-		const renamed = srcName === "_gitignore" ? ".gitignore" : applySubs(srcName, params.subs);
-		const destPath = path.join(params.destDir, renamed);
-		if (ent.isDirectory()) {
-			await ensureDir(destPath);
-			await copyTree({
-				srcDir: srcPath,
-				destDir: destPath,
-				subs: params.subs
-			});
-			continue;
-		}
-		if (!ent.isFile()) continue;
-		const buf = await fs.promises.readFile(srcPath);
-		if (!isProbablyText(srcName)) {
-			await ensureDir(path.dirname(destPath));
-			await fs.promises.writeFile(destPath, buf);
-			continue;
-		}
-		await writeFileAtomic(destPath, applySubs(buf.toString("utf8"), params.subs));
-	}
-}
-async function dirHasAnyFiles(dir) {
-	try {
-		return (await fs.promises.readdir(dir)).length > 0;
-	} catch {
-		return false;
-	}
-}
-async function ensureHookExecutables(repoRoot) {
-	const hooksDir = path.join(repoRoot, ".githooks");
-	try {
-		const entries = await fs.promises.readdir(hooksDir, { withFileTypes: true });
-		let hasHooks = false;
-		for (const ent of entries) {
-			if (!ent.isFile()) continue;
-			const p$1 = path.join(hooksDir, ent.name);
-			await fs.promises.chmod(p$1, 493);
-			hasHooks = true;
-		}
-		return hasHooks;
-	} catch {
-		return false;
-	}
-}
-async function findTemplateRoot(dir) {
-	const direct = path.join(dir, "fleet", "clawdlets.json");
-	if (fs.existsSync(direct)) return dir;
-	const entries = await fs.promises.readdir(dir, { withFileTypes: true });
-	const candidates = [];
-	for (const ent of entries) {
-		if (!ent.isDirectory()) continue;
-		const candidate = path.join(dir, ent.name);
-		if (fs.existsSync(path.join(candidate, "fleet", "clawdlets.json"))) candidates.push(candidate);
-	}
-	if (candidates.length === 1) return candidates[0];
-	throw new Error(`template root missing fleet/clawdlets.json (searched: ${dir})`);
-}
 const projectInit = defineCommand({
 	meta: {
 		name: "init",
@@ -2337,8 +2604,7 @@ const projectInit = defineCommand({
 		if (!dirRaw) throw new Error("missing --dir");
 		const destDir = path.resolve(process$1.cwd(), dirRaw);
 		const host$1 = String(args.host || "clawdbot-fleet-host").trim() || "clawdbot-fleet-host";
-		assertSafeHostName(host$1);
-		const projectName = path.basename(destDir);
+		assertSafeHostName$1(host$1);
 		if (interactive) {
 			p.intro("clawdlets project init");
 			const ok = await p.confirm({
@@ -2362,97 +2628,24 @@ const projectInit = defineCommand({
 			templatePath: args.templatePath,
 			templateRef: args.templateRef
 		});
-		if (fs.existsSync(destDir) && await dirHasAnyFiles(destDir)) throw new Error(`target dir not empty: ${destDir}`);
-		const subs = {
-			"__PROJECT_NAME__": projectName,
-			"clawdbot-fleet-host": host$1,
-			"clawdbot_fleet_host": host$1.replace(/-/g, "_")
-		};
-		const tempDir = await fs.promises.mkdtemp(path.join(tmpdir(), "clawdlets-template-"));
-		let templateDir = tempDir;
-		try {
-			templateDir = await findTemplateRoot((await downloadTemplate(templateSpec.spec, {
-				dir: tempDir,
-				force: true,
-				auth: String(process$1.env["GITHUB_TOKEN"] || process$1.env["CLAWDLETS_TEMPLATE_TOKEN"] || "").trim() || void 0
-			})).dir || tempDir);
-		} catch (e) {
-			await fs.promises.rm(tempDir, {
-				recursive: true,
-				force: true
-			});
-			throw e;
-		}
-		const planned = [];
-		const walk = async (srcDir, rel) => {
-			const entries = await fs.promises.readdir(srcDir, { withFileTypes: true });
-			for (const ent of entries) {
-				const srcName = ent.name;
-				const mapped = srcName === "_gitignore" ? ".gitignore" : applySubs(srcName, subs);
-				const nextRel = path.join(rel, mapped);
-				if (ent.isDirectory()) await walk(path.join(srcDir, srcName), nextRel);
-				else if (ent.isFile()) planned.push(nextRel);
-			}
-		};
-		await walk(templateDir, ".");
 		if (args.dryRun) {
-			p.note(planned.sort().join("\n"), "Planned files");
+			const list$2 = (await planProjectInit({
+				destDir,
+				host: host$1,
+				templateSpec: templateSpec.spec
+			})).plannedFiles.join("\n");
+			p.note(list$2, "Planned files");
 			p.outro("dry-run");
-			await fs.promises.rm(tempDir, {
-				recursive: true,
-				force: true
-			});
 			return;
 		}
-		await ensureDir(destDir);
-		await copyTree({
-			srcDir: templateDir,
+		const result = await initProject({
 			destDir,
-			subs
+			host: host$1,
+			templateSpec: templateSpec.spec,
+			gitInit: args.gitInit
 		});
-		await fs.promises.rm(tempDir, {
-			recursive: true,
-			force: true
-		});
-		const hasHooks = await ensureHookExecutables(destDir);
-		{
-			const configPath = path.join(destDir, "fleet", "clawdlets.json");
-			const raw = await fs.promises.readFile(configPath, "utf8");
-			const parsed = JSON.parse(raw);
-			const hostCfg = parsed?.hosts?.[host$1];
-			if (hostCfg && typeof hostCfg === "object") {
-				hostCfg.cache = hostCfg.cache && typeof hostCfg.cache === "object" ? hostCfg.cache : {};
-				hostCfg.cache.garnix = hostCfg.cache.garnix && typeof hostCfg.cache.garnix === "object" ? hostCfg.cache.garnix : {};
-				hostCfg.cache.garnix.private = hostCfg.cache.garnix.private && typeof hostCfg.cache.garnix.private === "object" ? hostCfg.cache.garnix.private : {};
-				hostCfg.cache.garnix.private.enable = false;
-				await writeFileAtomic(configPath, `${JSON.stringify(parsed, null, 2)}\n`);
-			}
-		}
-		if (args.gitInit) try {
-			await capture("git", ["--version"], { cwd: destDir });
-			await run("git", ["init"], { cwd: destDir });
-			if (hasHooks) await run("git", [
-				"config",
-				"core.hooksPath",
-				".githooks"
-			], { cwd: destDir });
-		} catch {
-			if (interactive) p.note("git not available; skipped `git init`", "gitInit");
-		}
-		const next = [
-			"next:",
-			`- cd ${destDir}`,
-			"- create a git repo + set origin (recommended; enables blank base flake)",
-			"- clawdlets env init  # set HCLOUD_TOKEN in .clawdlets/env (required for provisioning)",
-			`- clawdlets host set --host ${host$1} --admin-cidr <your-ip>/32 --disk-device /dev/sda --add-ssh-key-file $HOME/.ssh/id_ed25519.pub`,
-			`- clawdlets host set --host ${host$1} --ssh-exposure bootstrap`,
-			`- clawdlets secrets init --host ${host$1}`,
-			`- clawdlets doctor --host ${host$1}`,
-			`- clawdlets bootstrap --host ${host$1}`,
-			`- clawdlets host set --host ${host$1} --target-host <ssh-alias|user@host>`,
-			`- clawdlets host set --host ${host$1} --ssh-exposure tailnet`,
-			`- clawdlets lockdown --host ${host$1}`
-		].join("\n");
+		if (!result.gitInitialized && interactive) p.note("git not available; skipped `git init`", "gitInit");
+		const next = result.nextSteps.join("\n");
 		if (interactive) p.outro(next);
 		else console.log(next);
 	}
@@ -2465,35 +2658,6 @@ const project = defineCommand({
 	subCommands: { init: projectInit }
 });
 
-//#endregion
-//#region src/commands/ssh-target.ts
-function needsSudo(targetHost) {
-	return !/^root@/i.test(targetHost.trim());
-}
-function requireTargetHost(targetHost, hostName) {
-	const v = targetHost.trim();
-	if (v) return validateTargetHost(v);
-	throw new Error([
-		`missing target host for ${hostName}`,
-		"set it in fleet/clawdlets.json (hosts.<host>.targetHost) or pass --target-host",
-		"recommended: use an SSH config alias (e.g. botsmj)"
-	].join("; "));
-}
-
-//#endregion
-//#region src/commands/secrets/common.ts
-function quoteYamlString(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\t/g, "\\t").replace(/"/g, "\\\"")}"`;
-}
-function upsertYamlScalarLine(params) {
-	const { text, key, value } = params;
-	const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	const rx = new RegExp(`^\\s*${escaped}\\s*:\\s*.*$`, "m");
-	const line = `${key}: ${quoteYamlString(value)}`;
-	if (rx.test(text)) return text.replace(rx, line);
-	return `${text.trimEnd()}\n${line}\n`;
-}
-
 //#endregion
 //#region src/commands/secrets/init.ts
 function wantsInteractive(flag) {
@@ -2554,6 +2718,11 @@ const secretsInit = defineCommand({
 			type: "boolean",
 			description: "Print actions without writing.",
 			default: false
+		},
+		autowire: {
+			type: "boolean",
+			description: "Autowire missing secretEnv mappings before init.",
+			default: false
 		}
 	},
 	async run({ args }) {
@@ -2564,7 +2733,7 @@ const secretsInit = defineCommand({
 			hostArg: a.host
 		});
 		if (!ctx) return;
-		const { layout, config: clawdletsConfig, hostName, hostCfg } = ctx;
+		let { layout, config: clawdletsConfig, hostName, hostCfg } = ctx;
 		const hasTty = Boolean(process$1.stdin.isTTY && process$1.stdout.isTTY);
 		let interactive = wantsInteractive(Boolean(a.interactive));
 		if (!interactive && hasTty && !a.fromJson) interactive = true;
@@ -2577,34 +2746,51 @@ const secretsInit = defineCommand({
 		const extraFilesKeyPath = getHostExtraFilesKeyPath(layout, hostName);
 		const extraFilesSecretsDir = getHostExtraFilesSecretsDir(layout, hostName);
 		const localSecretsDir = getHostSecretsDir(layout, hostName);
-		const bots = clawdletsConfig.fleet.botOrder;
-		if (bots.length === 0) throw new Error("fleet.botOrder is empty (set bots in fleet/clawdlets.json)");
-		const requiresTailscaleAuthKey = String(hostCfg.tailnet?.mode || "none") === "tailscale";
+		if (clawdletsConfig.fleet.botOrder.length === 0) throw new Error("fleet.botOrder is empty (set bots in fleet/clawdlets.json)");
 		const garnixPrivate = hostCfg.cache?.garnix?.private;
 		const garnixPrivateEnabled = Boolean(garnixPrivate?.enable);
 		const garnixNetrcSecretName = garnixPrivateEnabled ? String(garnixPrivate?.netrcSecret || "garnix_netrc").trim() : "";
 		const garnixNetrcPath = garnixPrivateEnabled ? String(garnixPrivate?.netrcPath || "/etc/nix/netrc").trim() : "";
 		if (garnixPrivateEnabled && !garnixNetrcSecretName) throw new Error("cache.garnix.private.netrcSecret must be set when private cache is enabled");
-		const secretsPlan = buildFleetSecretsPlan({
+		let secretsPlan = buildFleetSecretsPlan({
 			config: clawdletsConfig,
 			hostName
 		});
-		if (secretsPlan.missingSecretConfig.length > 0) {
+		if (secretsPlan.missingSecretConfig.length > 0) if (a.autowire) {
+			const plan = planSecretsAutowire({
+				config: clawdletsConfig,
+				hostName
+			});
+			if (plan.updates.length === 0) {
+				const first = secretsPlan.missingSecretConfig[0];
+				throw new Error(first.kind === "envVar" ? `missing secretEnv mapping for envVar=${first.envVar} (bot=${first.bot}); run: clawdlets config wire-secrets --write` : `invalid secret file config: scope=${first.scope} id=${first.fileId} targetPath=${first.targetPath} (${first.message})`);
+			}
+			const nextConfig = applySecretsAutowire({
+				config: clawdletsConfig,
+				plan
+			});
+			await writeClawdletsConfig({
+				configPath: layout.clawdletsConfigPath,
+				config: nextConfig
+			});
+			clawdletsConfig = nextConfig;
+			secretsPlan = buildFleetSecretsPlan({
+				config: clawdletsConfig,
+				hostName
+			});
+		} else {
 			const first = secretsPlan.missingSecretConfig[0];
-			if (first.kind === "discord") throw new Error(`missing discordTokenSecret for bot=${first.bot} (set fleet.bots.${first.bot}.profile.discordTokenSecret)`);
-			throw new Error(`missing modelSecrets entry for provider=${first.provider} (bot=${first.bot}, model=${first.model}); set fleet.modelSecrets.${first.provider}`);
+			if (first.kind === "envVar") throw new Error(`missing secretEnv mapping for envVar=${first.envVar} (bot=${first.bot}); set fleet.secretEnv.${first.envVar} or fleet.bots.${first.bot}.profile.secretEnv.${first.envVar} (or run: clawdlets config wire-secrets --write)`);
+			throw new Error(`invalid secret file config: scope=${first.scope} id=${first.fileId} targetPath=${first.targetPath} (${first.message})`);
 		}
-		const requiredSecretNames = new Set(secretsPlan.secretNamesRequired);
-		const discordSecretByName = /* @__PURE__ */ new Map();
-		for (const [bot$1, secretName] of Object.entries(secretsPlan.discordSecretsByBot)) if (secretName) discordSecretByName.set(secretName, bot$1);
-		const discordBotsRequired = bots.filter((b) => {
-			const secretName = secretsPlan.discordSecretsByBot[b] || "";
-			return secretName && requiredSecretNames.has(secretName);
-		});
-		const requiredExtraSecretNames = new Set([...requiredSecretNames, ...garnixPrivateEnabled ? [garnixNetrcSecretName] : []]);
-		const templateExtraSecrets = {};
-		for (const secretName of secretsPlan.secretNamesAll) templateExtraSecrets[secretName] = requiredSecretNames.has(secretName) ? "<REPLACE_WITH_SECRET>" : "<OPTIONAL>";
-		if (garnixPrivateEnabled) templateExtraSecrets[garnixNetrcSecretName] = "<REPLACE_WITH_NETRC>";
+		const requiresTailscaleAuthKey = new Set(secretsPlan.hostSecretNamesRequired).has("tailscale_auth_key");
+		const skipHostNames = new Set(["admin_password_hash", "tailscale_auth_key"]);
+		const requiredSecrets = new Set((secretsPlan.required || []).map((spec) => spec.name).filter((name) => !skipHostNames.has(name)));
+		const optionalSecrets = new Set((secretsPlan.optional || []).map((spec) => spec.name).filter((name) => !skipHostNames.has(name)));
+		const templateSecretNames = Array.from(new Set([...Array.from(requiredSecrets), ...Array.from(optionalSecrets)])).sort();
+		const templateSecrets = {};
+		for (const secretName of templateSecretNames) if (garnixPrivateEnabled && secretName === garnixNetrcSecretName) templateSecrets[secretName] = "<REPLACE_WITH_NETRC>";
+		else templateSecrets[secretName] = requiredSecrets.has(secretName) ? "<REPLACE_WITH_SECRET>" : "<OPTIONAL>";
 		const defaultSecretsJsonPath = path.join(layout.runtimeDir, "secrets.json");
 		const defaultSecretsJsonDisplay = path.relative(process$1.cwd(), defaultSecretsJsonPath) || defaultSecretsJsonPath;
 		let fromJson = resolveSecretsInitFromJsonArg({
@@ -2617,8 +2803,6 @@ const secretsInit = defineCommand({
 			if (!a.allowPlaceholders) {
 				const placeholders = listSecretsInitPlaceholders({
 					input: parseSecretsInitJson(fs.readFileSync(defaultSecretsJsonPath, "utf8")),
-					bots,
-					discordBots: discordBotsRequired,
 					requiresTailscaleAuthKey
 				});
 				if (placeholders.length > 0) {
@@ -2630,10 +2814,8 @@ const secretsInit = defineCommand({
 			}
 		} else {
 			const template = buildSecretsInitTemplate({
-				bots,
-				discordBots: discordBotsRequired,
 				requiresTailscaleAuthKey,
-				secrets: templateExtraSecrets
+				secrets: templateSecrets
 			});
 			if (!a.dryRun) {
 				await ensureDir(path.dirname(defaultSecretsJsonPath));
@@ -2816,41 +2998,21 @@ const secretsInit = defineCommand({
 			adminPassword: "",
 			adminPasswordHash: "",
 			tailscaleAuthKey: "",
-			secrets: {},
-			discordTokens: {}
+			secrets: {}
 		};
 		if (interactive) {
-			const discordSecretNames = new Set(Object.values(secretsPlan.discordSecretsByBot).filter(Boolean));
-			const requiredExtraSecrets = Array.from(requiredExtraSecretNames).filter((s) => !discordSecretNames.has(s)).sort();
-			const discordTokenBots = [];
-			const seenDiscordSecrets = /* @__PURE__ */ new Set();
-			for (const bot$1 of bots) {
-				const secretName = secretsPlan.discordSecretsByBot[bot$1] || "";
-				if (!secretName) continue;
-				if (!requiredSecretNames.has(secretName)) continue;
-				if (seenDiscordSecrets.has(secretName)) continue;
-				seenDiscordSecrets.add(secretName);
-				discordTokenBots.push({
-					bot: bot$1,
-					secretName
-				});
-			}
+			const requiredSecretsToPrompt = Array.from(requiredSecrets).sort();
 			const allSteps = [
 				{ kind: "adminPassword" },
 				...requiresTailscaleAuthKey ? [{ kind: "tailscaleAuthKey" }] : [],
-				...requiredExtraSecrets.map((secretName) => garnixPrivateEnabled && secretName === garnixNetrcSecretName ? {
+				...requiredSecretsToPrompt.map((secretName) => garnixPrivateEnabled && secretName === garnixNetrcSecretName ? {
 					kind: "garnixNetrcFile",
 					secretName,
 					netrcPath: garnixNetrcPath || "/etc/nix/netrc"
 				} : {
 					kind: "secret",
 					secretName
-				}),
-				...discordTokenBots.map((b) => ({
-					kind: "discordToken",
-					bot: b.bot,
-					secretName: b.secretName
-				}))
+				})
 			];
 			for (let i = 0; i < allSteps.length;) {
 				const step = allSteps[i];
@@ -2862,7 +3024,6 @@ const secretsInit = defineCommand({
 					placeholder: `${layout.runtimeDir}/garnix.netrc`
 				});
 				else if (step.kind === "secret") v = await p.password({ message: `Secret value (${step.secretName}) (required)` });
-				else v = await p.password({ message: `Discord token for ${step.bot} (${step.secretName}) (required)` });
 				if (p.isCancel(v)) {
 					if (await navOnCancel({
 						flow: flowSecrets,
@@ -2891,10 +3052,6 @@ const secretsInit = defineCommand({
 						values.secrets[step.secretName] = netrc;
 					}
 				} else if (step.kind === "secret") values.secrets[step.secretName] = s;
-				else {
-					values.discordTokens[step.bot] = s;
-					values.secrets[step.secretName] = s;
-				}
 				i += 1;
 			}
 		} else {
@@ -2902,19 +3059,35 @@ const secretsInit = defineCommand({
 			values.adminPasswordHash = input.adminPasswordHash;
 			values.tailscaleAuthKey = input.tailscaleAuthKey || "";
 			values.secrets = input.secrets || {};
-			values.discordTokens = input.discordTokens || {};
 		}
-		const secretsToWrite = secretsPlan.secretNamesAll;
-		const requiredSecrets = Array.from(new Set([
-			...requiresTailscaleAuthKey ? ["tailscale_auth_key"] : [],
-			"admin_password_hash",
-			...garnixPrivateEnabled ? [garnixNetrcSecretName] : [],
-			...secretsToWrite
-		]));
+		assertSecretsAreManaged({
+			allowlist: buildManagedHostSecretNameAllowlist({
+				config: clawdletsConfig,
+				host: hostName
+			}),
+			secrets: values.secrets
+		});
+		const secretsToWrite = Array.from(new Set([...secretsPlan.hostSecretNamesRequired, ...secretsPlan.secretNamesAll])).sort();
 		const isOptionalMarker = (v) => String(v || "").trim() === "<OPTIONAL>";
+		const requiredSecretNamesForValue = new Set([...secretsPlan.hostSecretNamesRequired, ...secretsPlan.secretNamesRequired]);
+		const needsExistingValue = (secretName) => {
+			if (secretName === "tailscale_auth_key") return !values.tailscaleAuthKey.trim();
+			if (secretName === "admin_password_hash") return !values.adminPasswordHash.trim() && !values.adminPassword.trim();
+			const vv = values.secrets?.[secretName]?.trim() || "";
+			const required = requiredSecretNamesForValue.has(secretName);
+			if (vv && !(required && (isOptionalMarker(vv) || isPlaceholderSecretValue(vv)))) return false;
+			return true;
+		};
+		const secretsNeedingExisting = secretsToWrite.filter(needsExistingValue);
+		const existingPairs = secretsNeedingExisting.length > 0 ? await mapWithConcurrency({
+			items: secretsNeedingExisting,
+			concurrency: 4,
+			fn: async (secretName) => [secretName, await readExistingScalar(secretName)]
+		}) : [];
+		const existingBySecret = new Map(existingPairs);
 		const resolvedValues = {};
-		for (const secretName of requiredSecrets) {
-			const existing = await readExistingScalar(secretName);
+		for (const secretName of secretsToWrite) {
+			const existing = existingBySecret.get(secretName) ?? null;
 			if (secretName === "tailscale_auth_key") {
 				if (values.tailscaleAuthKey.trim()) resolvedValues[secretName] = values.tailscaleAuthKey.trim();
 				else if (existing && !isPlaceholderSecretValue(existing)) resolvedValues[secretName] = existing;
@@ -2928,20 +3101,9 @@ const secretsInit = defineCommand({
 				else resolvedValues[secretName] = existing ?? "<FILL_ME>";
 				continue;
 			}
-			if (discordSecretByName.has(secretName)) {
-				const bot$1 = discordSecretByName.get(secretName) || "";
-				const required$1 = requiredSecretNames.has(secretName);
-				const vv$1 = (bot$1 ? values.discordTokens[bot$1]?.trim() : "") || values.secrets?.[secretName]?.trim() || "";
-				if (vv$1) resolvedValues[secretName] = vv$1;
-				else if (existing) resolvedValues[secretName] = existing;
-				else if (!required$1) resolvedValues[secretName] = "<OPTIONAL>";
-				else if (a.allowPlaceholders) resolvedValues[secretName] = "<FILL_ME>";
-				else throw new Error(`missing discord token for ${bot$1 || secretName} (provide it in --from-json.discordTokens or pass --allow-placeholders)`);
-				continue;
-			}
 			const vv = values.secrets?.[secretName]?.trim() || "";
-			const required = requiredExtraSecretNames.has(secretName);
-			if (vv && !(required && isOptionalMarker(vv))) {
+			const required = requiredSecretNamesForValue.has(secretName);
+			if (vv && !(required && (isOptionalMarker(vv) || isPlaceholderSecretValue(vv)))) {
 				resolvedValues[secretName] = vv;
 				continue;
 			}
@@ -2959,7 +3121,7 @@ const secretsInit = defineCommand({
 		if (!a.dryRun) {
 			await ensureDir(localSecretsDir);
 			await ensureDir(extraFilesSecretsDir);
-			for (const secretName of requiredSecrets) {
+			for (const secretName of secretsToWrite) {
 				const outPath = path.join(localSecretsDir, `${secretName}.yaml`);
 				await sopsEncryptYamlToFile({
 					plaintextYaml: upsertYamlScalarLine({
@@ -3130,7 +3292,7 @@ const secretsVerify = defineCommand({
 			hostArg: args.host
 		});
 		if (!ctx) return;
-		const { layout, config: config$1, hostName, hostCfg } = ctx;
+		const { layout, config: config$1, hostName } = ctx;
 		const deployCreds = loadDeployCreds({
 			cwd,
 			runtimeDir: args.runtimeDir,
@@ -3149,10 +3311,10 @@ const secretsVerify = defineCommand({
 			config: config$1,
 			hostName
 		});
-		const requiredSecretNames = new Set(secretsPlan.secretNamesRequired);
-		const tailnetMode = String(hostCfg.tailnet?.mode || "none");
-		const requiredSecrets = Array.from(new Set([...tailnetMode === "tailscale" ? ["tailscale_auth_key"] : [], "admin_password_hash"]));
-		const secretNames = secretsPlan.secretNamesAll;
+		const planRequiredNames = (secretsPlan.required || []).map((spec) => spec.name);
+		const planOptionalNames = (secretsPlan.optional || []).map((spec) => spec.name);
+		const requiredSecretNames = new Set(planRequiredNames);
+		const secretNames = Array.from(new Set([...planRequiredNames, ...planOptionalNames])).sort();
 		const optionalSecrets = ["root_password_hash"];
 		const preflight = [];
 		if (!fs.existsSync(operatorKeyPath)) preflight.push({
@@ -3207,14 +3369,11 @@ const secretsVerify = defineCommand({
 		const results = [];
 		const verifyOne = async (secretName, optional, allowOptionalMarker) => {
 			const filePath = path.join(localDir, `${secretName}.yaml`);
-			if (!fs.existsSync(filePath)) {
-				results.push({
-					secret: secretName,
-					status: optional ? "warn" : "missing",
-					detail: `(missing: ${filePath})`
-				});
-				return;
-			}
+			if (!fs.existsSync(filePath)) return {
+				secret: secretName,
+				status: optional ? "warn" : "missing",
+				detail: `(missing: ${filePath})`
+			};
 			try {
 				const decrypted = await sopsDecryptYamlFile({
 					filePath,
@@ -3223,58 +3382,43 @@ const secretsVerify = defineCommand({
 				});
 				const parsed = YAML.parse(decrypted) || {};
 				const keys = Object.keys(parsed).filter((k) => k !== "sops");
-				if (keys.length !== 1 || keys[0] !== secretName) {
-					results.push({
-						secret: secretName,
-						status: "missing",
-						detail: "(invalid: expected exactly 1 key matching filename)"
-					});
-					return;
-				}
+				if (keys.length !== 1 || keys[0] !== secretName) return {
+					secret: secretName,
+					status: "missing",
+					detail: "(invalid: expected exactly 1 key matching filename)"
+				};
 				const v = parsed[secretName];
 				const value = typeof v === "string" ? v : v == null ? "" : String(v);
-				if (!allowOptionalMarker && value.trim() === "<OPTIONAL>") {
-					results.push({
-						secret: secretName,
-						status: "missing",
-						detail: "(placeholder: <OPTIONAL>)"
-					});
-					return;
-				}
-				if (!optional && isPlaceholderSecretValue(value)) {
-					results.push({
-						secret: secretName,
-						status: "missing",
-						detail: `(placeholder: ${value.trim()})`
-					});
-					return;
-				}
-				if (optional && isPlaceholderSecretValue(value)) {
-					results.push({
-						secret: secretName,
-						status: "missing",
-						detail: `(placeholder: ${value.trim()})`
-					});
-					return;
-				}
-				if (!optional && !value.trim()) {
-					results.push({
-						secret: secretName,
-						status: "missing",
-						detail: "(empty)"
-					});
-					return;
-				}
-				results.push({
+				if (!allowOptionalMarker && value.trim() === "<OPTIONAL>") return {
+					secret: secretName,
+					status: "missing",
+					detail: "(placeholder: <OPTIONAL>)"
+				};
+				if (!optional && isPlaceholderSecretValue(value)) return {
+					secret: secretName,
+					status: "missing",
+					detail: `(placeholder: ${value.trim()})`
+				};
+				if (optional && isPlaceholderSecretValue(value)) return {
+					secret: secretName,
+					status: "missing",
+					detail: `(placeholder: ${value.trim()})`
+				};
+				if (!optional && !value.trim()) return {
+					secret: secretName,
+					status: "missing",
+					detail: "(empty)"
+				};
+				return {
 					secret: secretName,
 					status: "ok"
-				});
+				};
 			} catch (e) {
-				results.push({
+				return {
 					secret: secretName,
 					status: "missing",
 					detail: String(e?.message || e)
-				});
+				};
 			}
 		};
 		if (!fs.existsSync(localDir)) results.push({
@@ -3283,9 +3427,20 @@ const secretsVerify = defineCommand({
 			detail: localDir
 		});
 		else {
-			for (const s of requiredSecrets) await verifyOne(s, false, false);
-			for (const s of secretNames) await verifyOne(s, false, !requiredSecretNames.has(s));
-			for (const s of optionalSecrets) await verifyOne(s, true, true);
+			const checked = await mapWithConcurrency({
+				items: [...secretNames.map((s) => ({
+					secretName: s,
+					optional: false,
+					allowOptionalMarker: !requiredSecretNames.has(s)
+				})), ...optionalSecrets.map((s) => ({
+					secretName: s,
+					optional: true,
+					allowOptionalMarker: true
+				}))],
+				concurrency: 4,
+				fn: async (c) => await verifyOne(c.secretName, c.optional, c.allowOptionalMarker)
+			});
+			results.push(...checked);
 		}
 		if (args.json) console.log(JSON.stringify({
 			host: hostName,
@@ -3551,6 +3706,303 @@ const serverGithubSync = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/commands/server/channels.ts
+function requireBotId(value) {
+	const botId = value.trim();
+	if (!BotIdSchema.safeParse(botId).success) throw new Error(`invalid --bot: ${botId}`);
+	return botId;
+}
+function runRemoteClawdbotChannels(params) {
+	const remoteCmd = [
+		...params.sudo ? ["sudo"] : [],
+		"/etc/clawdlets/bin/clawdbot-channels",
+		"--bot",
+		params.botId,
+		...params.args
+	].map((a) => shellQuote(a)).join(" ");
+	return sshRun(params.targetHost, remoteCmd, { tty: params.sshTty });
+}
+const serverChannelsStatus = defineCommand({
+	meta: {
+		name: "status",
+		description: "Run `clawdbot channels status` on the host for a bot."
+	},
+	args: {
+		runtimeDir: {
+			type: "string",
+			description: "Runtime directory (default: .clawdlets)."
+		},
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		targetHost: {
+			type: "string",
+			description: "SSH target override (default: from clawdlets.json)."
+		},
+		bot: {
+			type: "string",
+			description: "Bot id (fleet bot id; maps to systemd unit clawdbot-<bot>.service)."
+		},
+		probe: {
+			type: "boolean",
+			description: "Probe channel credentials.",
+			default: false
+		},
+		timeout: {
+			type: "string",
+			description: "Timeout in ms.",
+			default: "10000"
+		},
+		json: {
+			type: "boolean",
+			description: "Output JSON.",
+			default: false
+		},
+		sshTty: {
+			type: "boolean",
+			description: "Allocate SSH TTY.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const ctx = loadHostContextOrExit({
+			cwd: process$1.cwd(),
+			runtimeDir: args.runtimeDir,
+			hostArg: args.host
+		});
+		if (!ctx) return;
+		const { hostName, hostCfg } = ctx;
+		const targetHost = requireTargetHost(String(args.targetHost || hostCfg.targetHost || ""), hostName);
+		const botId = requireBotId(String(args.bot || ""));
+		await runRemoteClawdbotChannels({
+			targetHost,
+			sudo: needsSudo(targetHost),
+			botId,
+			sshTty: Boolean(args.sshTty),
+			args: [
+				"status",
+				...args.probe ? ["--probe"] : [],
+				...args.timeout ? ["--timeout", String(args.timeout)] : [],
+				...args.json ? ["--json"] : []
+			]
+		});
+	}
+});
+const serverChannelsCapabilities = defineCommand({
+	meta: {
+		name: "capabilities",
+		description: "Run `clawdbot channels capabilities` on the host for a bot."
+	},
+	args: {
+		runtimeDir: {
+			type: "string",
+			description: "Runtime directory (default: .clawdlets)."
+		},
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		targetHost: {
+			type: "string",
+			description: "SSH target override (default: from clawdlets.json)."
+		},
+		bot: {
+			type: "string",
+			description: "Bot id (fleet bot id; maps to systemd unit clawdbot-<bot>.service)."
+		},
+		channel: {
+			type: "string",
+			description: "Channel id (discord|telegram|slack|whatsapp|...|all)."
+		},
+		account: {
+			type: "string",
+			description: "Account id (only with --channel)."
+		},
+		target: {
+			type: "string",
+			description: "Channel target for permission audit (Discord channel:<id>)."
+		},
+		timeout: {
+			type: "string",
+			description: "Timeout in ms.",
+			default: "10000"
+		},
+		json: {
+			type: "boolean",
+			description: "Output JSON.",
+			default: false
+		},
+		sshTty: {
+			type: "boolean",
+			description: "Allocate SSH TTY.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const ctx = loadHostContextOrExit({
+			cwd: process$1.cwd(),
+			runtimeDir: args.runtimeDir,
+			hostArg: args.host
+		});
+		if (!ctx) return;
+		const { hostName, hostCfg } = ctx;
+		const targetHost = requireTargetHost(String(args.targetHost || hostCfg.targetHost || ""), hostName);
+		const botId = requireBotId(String(args.bot || ""));
+		await runRemoteClawdbotChannels({
+			targetHost,
+			sudo: needsSudo(targetHost),
+			botId,
+			sshTty: Boolean(args.sshTty),
+			args: [
+				"capabilities",
+				...args.channel ? ["--channel", String(args.channel)] : [],
+				...args.account ? ["--account", String(args.account)] : [],
+				...args.target ? ["--target", String(args.target)] : [],
+				...args.timeout ? ["--timeout", String(args.timeout)] : [],
+				...args.json ? ["--json"] : []
+			]
+		});
+	}
+});
+const serverChannelsLogin = defineCommand({
+	meta: {
+		name: "login",
+		description: "Run `clawdbot channels login` on the host for a bot."
+	},
+	args: {
+		runtimeDir: {
+			type: "string",
+			description: "Runtime directory (default: .clawdlets)."
+		},
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		targetHost: {
+			type: "string",
+			description: "SSH target override (default: from clawdlets.json)."
+		},
+		bot: {
+			type: "string",
+			description: "Bot id (fleet bot id; maps to systemd unit clawdbot-<bot>.service)."
+		},
+		channel: {
+			type: "string",
+			description: "Channel alias (default: whatsapp)."
+		},
+		account: {
+			type: "string",
+			description: "Account id (accountId)."
+		},
+		verbose: {
+			type: "boolean",
+			description: "Verbose connection logs.",
+			default: false
+		},
+		sshTty: {
+			type: "boolean",
+			description: "Allocate SSH TTY.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const ctx = loadHostContextOrExit({
+			cwd: process$1.cwd(),
+			runtimeDir: args.runtimeDir,
+			hostArg: args.host
+		});
+		if (!ctx) return;
+		const { hostName, hostCfg } = ctx;
+		const targetHost = requireTargetHost(String(args.targetHost || hostCfg.targetHost || ""), hostName);
+		const botId = requireBotId(String(args.bot || ""));
+		await runRemoteClawdbotChannels({
+			targetHost,
+			sudo: needsSudo(targetHost),
+			botId,
+			sshTty: Boolean(args.sshTty),
+			args: [
+				"login",
+				...args.channel ? ["--channel", String(args.channel)] : [],
+				...args.account ? ["--account", String(args.account)] : [],
+				...args.verbose ? ["--verbose"] : []
+			]
+		});
+	}
+});
+const serverChannelsLogout = defineCommand({
+	meta: {
+		name: "logout",
+		description: "Run `clawdbot channels logout` on the host for a bot."
+	},
+	args: {
+		runtimeDir: {
+			type: "string",
+			description: "Runtime directory (default: .clawdlets)."
+		},
+		host: {
+			type: "string",
+			description: "Host name (defaults to clawdlets.json defaultHost / sole host)."
+		},
+		targetHost: {
+			type: "string",
+			description: "SSH target override (default: from clawdlets.json)."
+		},
+		bot: {
+			type: "string",
+			description: "Bot id (fleet bot id; maps to systemd unit clawdbot-<bot>.service)."
+		},
+		channel: {
+			type: "string",
+			description: "Channel alias (default: whatsapp)."
+		},
+		account: {
+			type: "string",
+			description: "Account id (accountId)."
+		},
+		sshTty: {
+			type: "boolean",
+			description: "Allocate SSH TTY.",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const ctx = loadHostContextOrExit({
+			cwd: process$1.cwd(),
+			runtimeDir: args.runtimeDir,
+			hostArg: args.host
+		});
+		if (!ctx) return;
+		const { hostName, hostCfg } = ctx;
+		const targetHost = requireTargetHost(String(args.targetHost || hostCfg.targetHost || ""), hostName);
+		const botId = requireBotId(String(args.bot || ""));
+		await runRemoteClawdbotChannels({
+			targetHost,
+			sudo: needsSudo(targetHost),
+			botId,
+			sshTty: Boolean(args.sshTty),
+			args: [
+				"logout",
+				...args.channel ? ["--channel", String(args.channel)] : [],
+				...args.account ? ["--account", String(args.account)] : []
+			]
+		});
+	}
+});
+const serverChannels = defineCommand({
+	meta: {
+		name: "channels",
+		description: "Operate Clawdbot channels over SSH (status/login/logout/capabilities)."
+	},
+	subCommands: {
+		status: serverChannelsStatus,
+		capabilities: serverChannelsCapabilities,
+		login: serverChannelsLogin,
+		logout: serverChannelsLogout
+	}
+});
+
 //#endregion
 //#region src/lib/deploy-manifest.ts
 const REV_RE = /^[0-9a-f]{40}$/;
@@ -4099,35 +4551,67 @@ const serverAudit = defineCommand({
 			label: "fleet bots list",
 			detail: "(empty)"
 		});
-		for (const bot$1 of bots) {
-			const unit = normalizeClawdbotUnit(`clawdbot-${String(bot$1).trim()}`);
-			const show$2 = await must(`systemctl show ${unit}`, [
-				...sudo ? ["sudo"] : [],
-				"systemctl",
-				"show",
-				shellQuote(unit)
-			].join(" "));
-			if (!show$2) continue;
-			const parsed = parseSystemctlShow(show$2);
-			const loadState = parsed.LoadState || "";
-			const activeState = parsed.ActiveState || "";
-			const subState = parsed.SubState || "";
-			if (loadState && loadState !== "loaded") add$3({
-				status: "missing",
-				label: `${unit} load state`,
-				detail: `LoadState=${loadState}`
-			});
-			else if (activeState === "active" && subState === "running") add$3({
-				status: "ok",
-				label: `${unit} state`,
-				detail: `${activeState}/${subState}`
-			});
-			else add$3({
-				status: "missing",
-				label: `${unit} state`,
-				detail: `${activeState || "?"}/${subState || "?"}`
-			});
-		}
+		const botChecks = await mapWithConcurrency({
+			items: bots,
+			concurrency: 4,
+			fn: async (bot$1) => {
+				const out = [];
+				const mustBot = async (label, cmd) => {
+					const captured = await trySshCapture(targetHost, cmd, { tty: sudo && args.sshTty });
+					if (!captured.ok) {
+						out.push({
+							status: "missing",
+							label,
+							detail: captured.out
+						});
+						return null;
+					}
+					return captured.out;
+				};
+				const botId = String(bot$1).trim();
+				const unit = normalizeClawdbotUnit(`clawdbot-${botId}`);
+				const show$2 = await mustBot(`systemctl show ${unit}`, [
+					...sudo ? ["sudo"] : [],
+					"systemctl",
+					"show",
+					shellQuote(unit)
+				].join(" "));
+				if (show$2) {
+					const parsed = parseSystemctlShow(show$2);
+					const loadState = parsed.LoadState || "";
+					const activeState = parsed.ActiveState || "";
+					const subState = parsed.SubState || "";
+					if (loadState && loadState !== "loaded") out.push({
+						status: "missing",
+						label: `${unit} load state`,
+						detail: `LoadState=${loadState}`
+					});
+					else if (activeState === "active" && subState === "running") out.push({
+						status: "ok",
+						label: `${unit} state`,
+						detail: `${activeState}/${subState}`
+					});
+					else out.push({
+						status: "missing",
+						label: `${unit} state`,
+						detail: `${activeState || "?"}/${subState || "?"}`
+					});
+				}
+				if (await mustBot(`channels status (${botId})`, [
+					...sudo ? ["sudo"] : [],
+					"/etc/clawdlets/bin/clawdbot-channels",
+					"--bot",
+					shellQuote(botId),
+					"status",
+					"--json"
+				].join(" "))) out.push({
+					status: "ok",
+					label: `channels status (${botId})`
+				});
+				return out;
+			}
+		});
+		for (const list$2 of botChecks) for (const c of list$2) add$3(c);
 		if (args.json) console.log(JSON.stringify({
 			host: hostName,
 			targetHost,
@@ -4306,6 +4790,7 @@ const server = defineCommand({
 	},
 	subCommands: {
 		audit: serverAudit,
+		channels: serverChannels,
 		deploy: serverDeploy,
 		manifest: serverManifest,
 		status: serverStatus,
@@ -4320,6 +4805,7 @@ const server = defineCommand({
 const baseCommands = {
 	bot,
 	bootstrap,
+	clawdbot,
 	config,
 	doctor,
 	env,