clawup 1.0.1 → 1.0.4

package/dist/bin.js

@@ -1,221 +1,3560 @@
 #!/usr/bin/env node
 "use strict";
-/**
- * Agent Army CLI — Entry point
- *
- * Provides interactive commands for the full agent lifecycle:
- * init, deploy, redeploy, status, ssh, validate, destroy, config
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// lib/process.ts
+function trackChild(child) {
+  activeChildren.add(child);
+  const remove = () => activeChildren.delete(child);
+  child.on("close", remove);
+  child.on("error", remove);
+}
+function setupGracefulShutdown() {
+  const cleanup = (signal, exitCode) => {
+    for (const child of activeChildren) {
+      child.kill(signal);
+    }
+    process.exit(exitCode);
+  };
+  process.on("SIGINT", () => cleanup("SIGINT", 130));
+  process.on("SIGTERM", () => cleanup("SIGTERM", 143));
+}
+var activeChildren;
+var init_process = __esm({
+  "lib/process.ts"() {
+    "use strict";
+    activeChildren = /* @__PURE__ */ new Set();
+  }
+});
+
+// lib/vendor.ts
+function getVendorDir() {
+  return path.join(__dirname, "..", "..", "vendor");
+}
+function getVendorBinDir(tool) {
+  return path.join(getVendorDir(), tool);
+}
+function resolveVendoredBinary(command) {
+  const entry = VENDOR_COMMANDS[command];
+  if (!entry) return null;
+  const binPath = path.join(getVendorBinDir(entry.dir), entry.bin);
+  if (fs.existsSync(binPath)) {
+    return binPath;
+  }
+  return null;
+}
+function resolveCommand(command) {
+  const vendored = resolveVendoredBinary(command);
+  if (vendored) return vendored;
+  return command;
+}
+function isVendored(command) {
+  return resolveVendoredBinary(command) !== null;
+}
+function commandExistsWithVendor(command) {
+  if (isVendored(command)) return true;
+  const bin = process.platform === "win32" ? "where" : "which";
+  const result = (0, import_child_process.spawnSync)(bin, [command], { shell: false, stdio: "ignore" });
+  return result.status === 0;
+}
+var fs, path, import_child_process, VENDOR_COMMANDS;
+var init_vendor = __esm({
+  "lib/vendor.ts"() {
+    "use strict";
+    fs = __toESM(require("fs"));
+    path = __toESM(require("path"));
+    import_child_process = require("child_process");
+    VENDOR_COMMANDS = {
+      pulumi: { dir: "pulumi", bin: process.platform === "win32" ? "pulumi.exe" : "pulumi" },
+      aws: { dir: "aws-cli", bin: process.platform === "win32" ? "aws.exe" : "aws" }
+    };
+  }
+});
+
+// lib/exec.ts
+function capture(command, args = [], cwd) {
+  const resolved = resolveCommand(command);
+  try {
+    const result = (0, import_child_process2.execSync)([resolved, ...args].join(" "), {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return { stdout: result.trim(), stderr: "", exitCode: 0 };
+  } catch (err) {
+    const e = err;
+    return {
+      stdout: (e.stdout ?? "").toString().trim(),
+      stderr: (e.stderr ?? "").toString().trim(),
+      exitCode: e.status ?? 1
+    };
+  }
+}
+function stream(command, args = [], cwd) {
+  const resolved = resolveCommand(command);
+  return new Promise((resolve2) => {
+    const opts = {
+      cwd,
+      stdio: "inherit",
+      shell: true
+    };
+    const child = (0, import_child_process2.spawn)(resolved, args, opts);
+    trackChild(child);
+    child.on("close", (code) => resolve2(code ?? 1));
+    child.on("error", (err) => {
+      console.warn(`[exec] Child process error: ${err.message}`);
+      resolve2(1);
+    });
+  });
+}
+function commandExists(command) {
+  return commandExistsWithVendor(command);
+}
+var import_child_process2;
+var init_exec = __esm({
+  "lib/exec.ts"() {
+    "use strict";
+    import_child_process2 = require("child_process");
+    init_process();
+    init_vendor();
+  }
+});
+
+// lib/workspace.ts
+function cliVersion() {
+  const pkgPath = path2.join(__dirname, "..", "..", "package.json");
+  try {
+    return JSON.parse(fs2.readFileSync(pkgPath, "utf-8")).version;
+  } catch {
+    return "unknown";
+  }
+}
+function getBundledInfraDir() {
+  return path2.join(__dirname, "..", "..", "infra");
+}
+function isDevMode() {
+  const repoRoot = path2.resolve(__dirname, "..", "..", "..");
+  return fs2.existsSync(path2.join(repoRoot, "Pulumi.yaml")) && fs2.existsSync(path2.join(repoRoot, "node_modules", "@pulumi"));
+}
+function getWorkspaceDir() {
+  if (isDevMode()) return void 0;
+  return WORKSPACE_DIR;
+}
+function ensureWorkspace() {
+  if (isDevMode()) return { ok: true };
+  const bundled = getBundledInfraDir();
+  if (!fs2.existsSync(bundled)) {
+    return {
+      ok: false,
+      error: `Bundled infrastructure not found at ${bundled}. The CLI package may be corrupt \u2014 try reinstalling.`
+    };
+  }
+  const version = cliVersion();
+  const versionFile = path2.join(WORKSPACE_DIR, VERSION_FILE);
+  const currentVersion = fs2.existsSync(versionFile) ? fs2.readFileSync(versionFile, "utf-8").trim() : null;
+  if (currentVersion === version) {
+    return { ok: true };
+  }
+  fs2.mkdirSync(WORKSPACE_DIR, { recursive: true });
+  const preservePatterns = ["Pulumi.*.yaml", "clawup.yaml"];
+  const preserved = /* @__PURE__ */ new Map();
+  for (const pattern of preservePatterns) {
+    const files = fs2.readdirSync(WORKSPACE_DIR).filter((f) => {
+      if (pattern === "clawup.yaml") return f === "clawup.yaml";
+      return f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml";
+    });
+    for (const f of files) {
+      preserved.set(f, fs2.readFileSync(path2.join(WORKSPACE_DIR, f)));
+    }
+  }
+  copyDirSync(bundled, WORKSPACE_DIR);
+  for (const [name, content] of preserved) {
+    fs2.writeFileSync(path2.join(WORKSPACE_DIR, name), content);
+  }
+  try {
+    (0, import_child_process3.execSync)("npm install --production", {
+      cwd: WORKSPACE_DIR,
+      stdio: "pipe",
+      timeout: 3e5
+      // 5 minutes
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      error: `Failed to install Pulumi SDK dependencies in workspace:
+${msg}`
+    };
+  }
+  fs2.writeFileSync(versionFile, version, "utf-8");
+  return { ok: true };
+}
+function copyDirSync(src, dest) {
+  fs2.mkdirSync(dest, { recursive: true });
+  for (const entry of fs2.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path2.join(src, entry.name);
+    const destPath = path2.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDirSync(srcPath, destPath);
+    } else {
+      fs2.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+var fs2, path2, os, import_child_process3, WORKSPACE_DIR, VERSION_FILE;
+var init_workspace = __esm({
+  "lib/workspace.ts"() {
+    "use strict";
+    fs2 = __toESM(require("fs"));
+    path2 = __toESM(require("path"));
+    os = __toESM(require("os"));
+    import_child_process3 = require("child_process");
+    WORKSPACE_DIR = path2.join(os.homedir(), ".clawup", "workspace");
+    VERSION_FILE = ".cli-version";
+  }
+});
+
+// lib/tailscale.ts
+function isTailscaleInstalled() {
+  const bin = process.platform === "win32" ? "where" : "which";
+  const result = (0, import_child_process5.spawnSync)(bin, ["tailscale"], { shell: false, stdio: "ignore" });
+  if (result.status === 0) return true;
+  if (process.platform === "darwin") {
+    try {
+      const fs8 = require("fs");
+      return fs8.existsSync("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function isTailscaleRunning() {
+  try {
+    const output = (0, import_child_process4.execSync)("tailscale status --json", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    const status = JSON.parse(output);
+    return status.BackendState === "Running";
+  } catch {
+    return false;
+  }
+}
+function requireTailscale() {
+  if (!isTailscaleInstalled()) {
+    const installHint = process.platform === "darwin" ? "Install from the Mac App Store or https://tailscale.com/download" : "Install from https://tailscale.com/download";
+    console.error(
+      `
+${import_picocolors.default.red(import_picocolors.default.bold("Error:"))} Tailscale is not installed.
+
+This command connects to agents over Tailscale.
+  ${installHint}
+`
+    );
+    process.exit(1);
+  }
+  if (!isTailscaleRunning()) {
+    console.error(
+      `
+${import_picocolors.default.red(import_picocolors.default.bold("Error:"))} Tailscale is not connected.
+
+This command connects to agents over Tailscale.
+  Tailscale is not running. Open the Tailscale app or run: ${import_picocolors.default.cyan("tailscale up")}
+`
+    );
+    process.exit(1);
+  }
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function listTailscaleDevices(apiKey, tailnet) {
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      const result = (0, import_child_process4.execSync)(
+        `curl -sf -H "Authorization: Bearer ${apiKey}" "https://api.tailscale.com/api/v2/tailnet/${tailnet}/devices?fields=default"`,
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+      );
+      const data = JSON.parse(result);
+      if (!data.devices || !Array.isArray(data.devices)) return null;
+      return data.devices.map((d) => ({
+        id: d.id,
+        name: d.name ?? "",
+        hostname: d.hostname ?? ""
+      }));
+    } catch (err) {
+      lastError = err;
+      if (attempt < MAX_RETRIES) {
+        sleepSync(BASE_DELAY_MS * Math.pow(2, attempt));
+      }
+    }
+  }
+  console.warn(
+    `[tailscale] Failed to list devices after ${MAX_RETRIES + 1} attempts: ${lastError instanceof Error ? lastError.message : String(lastError)}`
+  );
+  return null;
+}
+function cleanupTailscaleDevices(apiKey, tailnet, stackName, agents) {
+  const cleaned = [];
+  const failed = [];
+  const devices = listTailscaleDevices(apiKey, tailnet);
+  if (!devices) return { cleaned, failed };
+  for (const agent of agents) {
+    const tsHost = `${stackName}-${agent.name}`;
+    const matching = devices.filter(
+      (d) => d.hostname === tsHost || d.name.startsWith(`${tsHost}.`)
+    );
+    for (const device of matching) {
+      const deleted = deleteTailscaleDevice(apiKey, device.id);
+      if (deleted) {
+        cleaned.push(`${agent.name} (${device.hostname})`);
+      } else {
+        failed.push(agent.name);
+      }
+    }
+  }
+  return { cleaned, failed };
+}
+function deleteTailscaleDevice(apiKey, deviceId) {
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      (0, import_child_process4.execSync)(
+        `curl -sf -X DELETE -H "Authorization: Bearer ${apiKey}" "https://api.tailscale.com/api/v2/device/${deviceId}"`,
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+      );
+      return true;
+    } catch (err) {
+      lastError = err;
+      if (attempt < MAX_RETRIES) {
+        sleepSync(BASE_DELAY_MS * Math.pow(2, attempt));
+      }
+    }
+  }
+  console.warn(
+    `[tailscale] Failed to delete device ${deviceId} after ${MAX_RETRIES + 1} attempts: ${lastError instanceof Error ? lastError.message : String(lastError)}`
+  );
+  return false;
+}
+function ensureMagicDns(apiKey) {
+  try {
+    const dnsResp = tsApiGet(apiKey, "/tailnet/-/dns/preferences");
+    const dns = JSON.parse(dnsResp);
+    if (dns.magicDNS) return false;
+    const nsResp = tsApiGet(apiKey, "/tailnet/-/dns/nameservers");
+    const ns = JSON.parse(nsResp);
+    if (!ns.dns || ns.dns.length === 0) {
+      tsApiPost(apiKey, "/tailnet/-/dns/nameservers", { dns: ["1.1.1.1", "8.8.8.8"] });
+    }
+    tsApiPost(apiKey, "/tailnet/-/dns/preferences", { magicDNS: true });
+    return true;
+  } catch (err) {
+    console.warn(
+      `[tailscale] Could not check/enable MagicDNS: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+}
+function ensureTailscaleFunnel(apiKey) {
+  const result = { magicDns: false, funnelAcl: false };
+  result.magicDns = ensureMagicDns(apiKey);
+  try {
+    const aclResp = tsApiGet(apiKey, "/tailnet/-/acl");
+    const acl = JSON.parse(aclResp);
+    const nodeAttrs = acl.nodeAttrs ?? [];
+    const hasFunnel = nodeAttrs.some(
+      (a) => Array.isArray(a.attr) && a.attr.includes("funnel")
+    );
+    if (!hasFunnel) {
+      nodeAttrs.push({ target: ["autogroup:member"], attr: ["funnel"] });
+      acl.nodeAttrs = nodeAttrs;
+      tsApiPost(apiKey, "/tailnet/-/acl", acl);
+      result.funnelAcl = true;
+    }
+  } catch (err) {
+    console.warn(
+      `[tailscale] Could not check/enable Funnel ACL: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return result;
+}
+function tsApiGet(apiKey, path8) {
+  return (0, import_child_process4.execSync)(
+    `curl -sf -H "Authorization: Bearer ${apiKey}" -H "Accept: application/json" "https://api.tailscale.com/api/v2${path8}"`,
+    { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+  );
+}
+function tsApiPost(apiKey, path8, body) {
+  const fs8 = require("fs");
+  const os6 = require("os");
+  const nodePath = require("path");
+  const tmpFile = nodePath.join(os6.tmpdir(), `ts-api-${Date.now()}.json`);
+  try {
+    fs8.writeFileSync(tmpFile, JSON.stringify(body));
+    return (0, import_child_process4.execSync)(
+      `curl -sf -X POST -H "Authorization: Bearer ${apiKey}" -H "Content-Type: application/json" -d @${tmpFile} "https://api.tailscale.com/api/v2${path8}"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 15e3 }
+    );
+  } finally {
+    try {
+      fs8.unlinkSync(tmpFile);
+    } catch {
+    }
+  }
+}
+var import_child_process4, import_child_process5, import_picocolors, MAX_RETRIES, BASE_DELAY_MS;
+var init_tailscale = __esm({
+  "lib/tailscale.ts"() {
+    "use strict";
+    import_child_process4 = require("child_process");
+    import_child_process5 = require("child_process");
+    import_picocolors = __toESM(require("picocolors"));
+    MAX_RETRIES = 3;
+    BASE_DELAY_MS = 1e3;
+  }
+});
+
+// lib/pulumi.ts
+function selectOrCreateStack(stackName, cwd) {
+  const select3 = capture("pulumi", ["stack", "select", stackName], cwd);
+  if (select3.exitCode === 0) return { ok: true };
+  const init = capture("pulumi", ["stack", "init", stackName], cwd);
+  if (init.exitCode === 0) return { ok: true };
+  return { ok: false, error: init.stderr || select3.stderr };
+}
+function setConfig(key, value, secret = false, cwd) {
+  const args = ["config", "set", key, value];
+  if (secret) args.push("--secret");
+  const result = capture("pulumi", args, cwd);
+  return result.exitCode === 0;
+}
+function getConfig(key, cwd) {
+  const result = capture("pulumi", ["config", "get", key], cwd);
+  return result.exitCode === 0 ? result.stdout.trim() : null;
+}
+var init_pulumi = __esm({
+  "lib/pulumi.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
+// lib/config.ts
+function configsDir() {
+  return path3.join(os2.homedir(), import_core.CONFIG_DIR);
+}
+function ensureConfigsDir() {
+  const dir = configsDir();
+  if (!fs3.existsSync(dir)) {
+    fs3.mkdirSync(dir, { recursive: true });
+  }
+}
+function configPath(name) {
+  return path3.join(configsDir(), `${name}.yaml`);
+}
+function syncManifestToProject(name, projectDir) {
+  const src = configPath(name);
+  const dest = path3.join(projectDir ?? process.cwd(), import_core.MANIFEST_FILE);
+  fs3.copyFileSync(src, dest);
+}
+function manifestExists(name) {
+  return fs3.existsSync(configPath(name));
+}
+function loadManifest(name) {
+  const filePath = configPath(name);
+  if (!fs3.existsSync(filePath)) return null;
+  try {
+    const raw = fs3.readFileSync(filePath, "utf-8");
+    return import_yaml.default.parse(raw);
+  } catch (err) {
+    console.warn(`[config] Failed to load manifest '${name}' at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+function saveManifest(name, manifest) {
+  ensureConfigsDir();
+  const filePath = configPath(name);
+  fs3.writeFileSync(filePath, import_yaml.default.stringify(manifest), "utf-8");
+}
+function listManifests() {
+  const dir = configsDir();
+  if (!fs3.existsSync(dir)) return [];
+  return fs3.readdirSync(dir).filter((f) => f.endsWith(".yaml")).map((f) => f.replace(/\.yaml$/, "")).sort();
+}
+function resolveConfigName(name) {
+  if (name) {
+    if (!manifestExists(name)) {
+      const available = listManifests();
+      if (available.length === 0) {
+        throw new Error(`Config '${name}' not found. No configs exist. Run 'clawup init' to create one.`);
+      }
+      throw new Error(
+        `Config '${name}' not found. Available configs:
+  ${available.join("\n  ")}`
+      );
+    }
+    return name;
+  }
+  const configs = listManifests();
+  if (configs.length === 0) {
+    throw new Error("No configs found. Run 'clawup init' to create one.");
+  }
+  if (configs.length === 1) {
+    return configs[0];
+  }
+  throw new Error(
+    `Multiple configs found. Specify one with --config:
+  ${configs.join("\n  ")}`
+  );
+}
+function pluginsDir(stackName) {
+  return path3.join(configsDir(), stackName, import_core.PLUGINS_DIR);
+}
+function loadPluginConfig(stackName, pluginName) {
+  const filePath = path3.join(pluginsDir(stackName), `${pluginName}.yaml`);
+  if (!fs3.existsSync(filePath)) return null;
+  try {
+    const raw = fs3.readFileSync(filePath, "utf-8");
+    return import_yaml.default.parse(raw);
+  } catch (err) {
+    console.warn(`[config] Failed to load plugin config '${pluginName}' for stack '${stackName}': ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+var fs3, path3, os2, import_yaml, import_core;
+var init_config = __esm({
+  "lib/config.ts"() {
+    "use strict";
+    fs3 = __toESM(require("fs"));
+    path3 = __toESM(require("path"));
+    os2 = __toESM(require("os"));
+    import_yaml = __toESM(require("yaml"));
+    import_core = require("@clawup/core");
+  }
+});
+
+// lib/ui.ts
+function showBanner() {
+  console.log();
+  p2.intro(import_picocolors2.default.bgCyan(import_picocolors2.default.black(" Agent Army ")));
+}
+function handleCancel(value) {
+  if (p2.isCancel(value)) {
+    p2.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+}
+function exitWithError(message) {
+  p2.log.error(message);
+  process.exit(1);
+}
+function formatCost(monthlyCost) {
+  return `~$${monthlyCost}/mo`;
+}
+function formatAgentList(agents) {
+  return agents.map((a) => `  ${import_picocolors2.default.bold(a.displayName)} (${a.role})`).join("\n");
+}
+var p2, import_picocolors2;
+var init_ui = __esm({
+  "lib/ui.ts"() {
+    "use strict";
+    p2 = __toESM(require("@clack/prompts"));
+    import_picocolors2 = __toESM(require("picocolors"));
+  }
+});
+
+// lib/tool-helpers.ts
+function getConfig2(exec, key, cwd) {
+  const result = exec.capture("pulumi", ["config", "get", key], cwd);
+  return result.exitCode === 0 ? result.stdout.trim() : null;
+}
+function getStackOutputs(exec, showSecrets = false, cwd) {
+  const args = ["stack", "output", "--json"];
+  if (showSecrets) args.push("--show-secrets");
+  const result = exec.capture("pulumi", args, cwd);
+  if (result.exitCode !== 0) return null;
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    return null;
+  }
+}
+var init_tool_helpers = __esm({
+  "lib/tool-helpers.ts"() {
+    "use strict";
+  }
+});
+
+// tools/deploy.ts
+var import_core2, import_picocolors3, deployTool;
+var init_deploy = __esm({
+  "tools/deploy.ts"() {
+    "use strict";
+    init_config();
+    import_core2 = require("@clawup/core");
+    init_workspace();
+    init_tailscale();
+    init_tool_helpers();
+    init_ui();
+    import_picocolors3 = __toESM(require("picocolors"));
+    deployTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      ui.intro("Agent Army");
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        ui.log.error(wsResult.error ?? "Failed to set up workspace.");
+        process.exit(1);
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        ui.log.error(err.message);
+        process.exit(1);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        ui.log.error(`Config '${configName}' could not be loaded.`);
+        process.exit(1);
+      }
+      const selectResult = exec.capture("pulumi", ["stack", "select", manifest.stackName], cwd);
+      if (selectResult.exitCode !== 0) {
+        const initResult = exec.capture("pulumi", ["stack", "init", manifest.stackName], cwd);
+        if (initResult.exitCode !== 0) {
+          ui.log.error(initResult.stderr || selectResult.stderr);
+          ui.log.error(`Could not select Pulumi stack "${manifest.stackName}".`);
+          process.exit(1);
+        }
+      }
+      const totalCost = manifest.agents.reduce((sum, a) => {
+        const costs = manifest.provider === "hetzner" ? import_core2.HETZNER_COST_ESTIMATES : import_core2.COST_ESTIMATES;
+        return sum + (costs[a.instanceType ?? manifest.instanceType] ?? 30);
+      }, 0);
+      ui.note(
+        [
+          `Stack:    ${manifest.stackName}`,
+          `Region:   ${manifest.region}`,
+          ``,
+          `Agents (${manifest.agents.length}):`,
+          formatAgentList(manifest.agents),
+          ``,
+          `Estimated cost: ${formatCost(totalCost)}`
+        ].join("\n"),
+        "Deployment Summary"
+      );
+      if (!options.yes) {
+        const confirmed = await ui.confirm({
+          message: "Proceed with deployment?"
+        });
+        if (!confirmed) {
+          ui.cancel("Deployment cancelled.");
+        }
+      }
+      syncManifestToProject(configName, cwd);
+      exec.capture("pulumi", ["config", "set", "instanceType", manifest.instanceType], cwd);
+      const tailnetDnsName = getConfig2(exec, "tailnetDnsName", cwd);
+      const tailscaleApiKey = getConfig2(exec, "tailscaleApiKey", cwd);
+      if (tailnetDnsName && tailscaleApiKey) {
+        const spinner4 = ui.spinner("Cleaning up stale Tailscale devices...");
+        const { cleaned, failed } = cleanupTailscaleDevices(
+          tailscaleApiKey,
+          tailnetDnsName,
+          manifest.stackName,
+          manifest.agents
+        );
+        if (cleaned.length > 0) {
+          spinner4.stop(`Removed ${cleaned.length} stale Tailscale device(s)`);
+        } else {
+          spinner4.stop("No stale Tailscale devices found");
+        }
+        if (failed.length > 0) {
+          ui.log.warn(
+            `Could not remove some devices: ${failed.join(", ")}. Check https://login.tailscale.com/admin/machines`
+          );
+        }
+      }
+      if (tailscaleApiKey) {
+        const spinner4 = ui.spinner("Ensuring Tailscale MagicDNS is enabled...");
+        const magicDnsChanged = ensureMagicDns(tailscaleApiKey);
+        spinner4.stop(magicDnsChanged ? "MagicDNS enabled" : "MagicDNS OK");
+      }
+      if (tailscaleApiKey) {
+        const spinner4 = ui.spinner("Ensuring Tailscale Funnel prerequisites...");
+        const funnel = ensureTailscaleFunnel(tailscaleApiKey);
+        const changes = [];
+        if (funnel.funnelAcl) changes.push("Funnel ACL enabled");
+        spinner4.stop(changes.length > 0 ? changes.join(", ") : "Funnel prerequisites OK");
+      }
+      ui.log.step("Running pulumi up...");
+      console.log();
+      const exitCode = await exec.stream("pulumi", ["up", "--yes"], { cwd });
+      console.log();
+      if (exitCode !== 0) {
+        ui.log.error("Deployment failed. Check the output above for details.");
+        process.exit(1);
+      }
+      ui.log.success("Deployment complete!");
+      const outputsResult = exec.capture("pulumi", [
+        "stack",
+        "output",
+        "--json",
+        "--show-secrets"
+      ], cwd);
+      if (outputsResult.exitCode === 0) {
+        try {
+          const outputs = JSON.parse(outputsResult.stdout);
+          const lines = [];
+          for (const agent of manifest.agents) {
+            const urlKey = `${agent.role}TailscaleUrl`;
+            const ipKey = `${agent.role}PublicIp`;
+            const idKey = `${agent.role}InstanceId`;
+            lines.push(`${agent.displayName} (${agent.role}):`);
+            if (outputs[urlKey]) lines.push(`  Tailscale URL: ${outputs[urlKey]}`);
+            if (outputs[ipKey]) lines.push(`  Public IP:     ${outputs[ipKey]}`);
+            if (outputs[idKey]) lines.push(`  Instance ID:   ${outputs[idKey]}`);
+            lines.push("");
+          }
+          ui.note(lines.join("\n"), "Agent Details");
+          const webhookLines = [];
+          for (const agent of manifest.agents) {
+            const webhookUrl = outputs[`${agent.role}WebhookUrl`];
+            if (webhookUrl) {
+              webhookLines.push(`  ${agent.displayName} (${agent.role}): ${webhookUrl}`);
+            }
+          }
+          if (webhookLines.length > 0) {
+            ui.note(webhookLines.join("\n"), "Webhook URLs");
+          }
+        } catch (err) {
+          ui.log.warn(`Could not parse stack outputs: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (!isTailscaleInstalled()) {
+        const hint = process.platform === "darwin" ? "Install from the Mac App Store or https://tailscale.com/download" : "Install from https://tailscale.com/download";
+        ui.log.warn(
+          `Tailscale is required to connect to agents.
+  ${hint}
+  Then run: ${import_picocolors3.default.cyan("tailscale up")}`
+        );
+      } else if (!isTailscaleRunning()) {
+        ui.log.warn(
+          `Tailscale is not running. Start it before validating agents.
+  Open the Tailscale app or run: ${import_picocolors3.default.cyan("tailscale up")}`
+        );
+      }
+      ui.log.info(
+        `Run ${import_picocolors3.default.cyan("clawup webhooks setup")} to configure Linear webhooks for your agents.`
+      );
+      ui.outro("Agents will be ready in 3-5 minutes. Run `clawup validate` to check.");
+    };
+  }
+});
+
+// tools/status.ts
+function getClaudeCodeVersion(exec, host, timeout = 5) {
+  const result = exec.capture("ssh", [
+    "-o",
+    `ConnectTimeout=${timeout}`,
+    ...SSH_OPTS,
+    `${import_core3.SSH_USER}@${host}`,
+    `"/home/${import_core3.SSH_USER}/.local/bin/claude --version 2>/dev/null || echo ''"`
+  ]);
+  if (result.exitCode === 0 && result.stdout?.trim()) {
+    return result.stdout.trim();
+  }
+  return "\u2014";
+}
+function getGhVersion(exec, host, timeout = 5) {
+  const result = exec.capture("ssh", [
+    "-o",
+    `ConnectTimeout=${timeout}`,
+    ...SSH_OPTS,
+    `${import_core3.SSH_USER}@${host}`,
+    `"gh --version 2>/dev/null | head -n1 | awk '{print \\$3}' || echo ''"`
+  ]);
+  if (result.exitCode === 0 && result.stdout?.trim()) {
+    return result.stdout.trim();
+  }
+  return "\u2014";
+}
+function getGhAuthStatus(exec, host, timeout = 5) {
+  const result = exec.capture("ssh", [
+    "-o",
+    `ConnectTimeout=${timeout}`,
+    ...SSH_OPTS,
+    `${import_core3.SSH_USER}@${host}`,
+    `"gh auth status 2>&1 >/dev/null && echo 'OK' || echo 'no'"`
+  ]);
+  if (result.exitCode === 0 && result.stdout?.trim() === "OK") {
+    return "\u2713";
+  }
+  return "\u2014";
+}
+var import_core3, SSH_OPTS, statusTool;
+var init_status = __esm({
+  "tools/status.ts"() {
+    "use strict";
+    init_config();
+    import_core3 = require("@clawup/core");
+    init_workspace();
+    init_tailscale();
+    init_tool_helpers();
+    SSH_OPTS = [
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/dev/null",
+      "-o",
+      "BatchMode=yes"
+    ];
+    statusTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      if (!options.json) {
+        ui.intro("Agent Army");
+      }
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        ui.log.error(wsResult.error ?? "Failed to set up workspace.");
+        process.exit(1);
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        ui.log.error(err.message);
+        process.exit(1);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        ui.log.error(`Config '${configName}' could not be loaded.`);
+        process.exit(1);
+      }
+      const selectResult = exec.capture("pulumi", ["stack", "select", manifest.stackName], cwd);
+      if (selectResult.exitCode !== 0) {
+        const initResult = exec.capture("pulumi", ["stack", "init", manifest.stackName], cwd);
+        if (initResult.exitCode !== 0) {
+          if (!options.json) {
+            ui.log.error(initResult.stderr || selectResult.stderr);
+            ui.log.error(`Could not select Pulumi stack "${manifest.stackName}".`);
+          }
+          process.exit(1);
+        }
+      }
+      const outputs = getStackOutputs(exec, true, cwd);
+      if (!outputs) {
+        ui.log.error("Could not fetch stack outputs. Has the stack been deployed?");
+        process.exit(1);
+      }
+      const tailnetDnsName = getConfig2(exec, "tailnetDnsName", cwd);
+      const tailscaleUp = isTailscaleRunning();
+      if (!tailscaleUp && !options.json) {
+        ui.log.warn(
+          'Tailscale is not running \u2014 CLI version columns will show "\u2014".\n  Open the Tailscale app or run: tailscale up'
+        );
+      }
+      const statusData = manifest.agents.map((agent) => {
+        let claudeCodeVersion = "\u2014";
+        let ghVersion = "\u2014";
+        let ghAuth = "\u2014";
+        if (tailnetDnsName) {
+          const tsHost = (0, import_core3.tailscaleHostname)(manifest.stackName, agent.name);
+          const host = `${tsHost}.${tailnetDnsName}`;
+          claudeCodeVersion = getClaudeCodeVersion(exec, host);
+          ghVersion = getGhVersion(exec, host);
+          if (ghVersion !== "\u2014") {
+            ghAuth = getGhAuthStatus(exec, host);
+          }
+        }
+        return {
+          name: agent.displayName,
+          role: agent.role,
+          instanceId: outputs[`${agent.role}InstanceId`] ?? "\u2014",
+          publicIp: outputs[`${agent.role}PublicIp`] ?? "\u2014",
+          tailscaleUrl: outputs[`${agent.role}TailscaleUrl`] ?? "\u2014",
+          claudeCodeVersion,
+          ghVersion,
+          ghAuth
         };
-        return ownKeys(o);
+      });
+      if (options.json) {
+        console.log(JSON.stringify(statusData, null, 2));
+        return;
+      }
+      ui.log.step(`Stack: ${manifest.stackName} | Region: ${manifest.region}`);
+      console.log();
+      const nameW = 12;
+      const roleW = 10;
+      const idW = 22;
+      const ipW = 16;
+      const claudeW = 16;
+      const ghW = 8;
+      const authW = 6;
+      const header = [
+        "Agent".padEnd(nameW),
+        "Role".padEnd(roleW),
+        "Instance ID".padEnd(idW),
+        "Public IP".padEnd(ipW),
+        "Claude Code".padEnd(claudeW),
+        "gh".padEnd(ghW),
+        "Auth".padEnd(authW)
+      ].join("  ");
+      const separator = [
+        "\u2500".repeat(nameW),
+        "\u2500".repeat(roleW),
+        "\u2500".repeat(idW),
+        "\u2500".repeat(ipW),
+        "\u2500".repeat(claudeW),
+        "\u2500".repeat(ghW),
+        "\u2500".repeat(authW)
+      ].join("  ");
+      console.log(`  ${header}`);
+      console.log(`  ${separator}`);
+      for (const s of statusData) {
+        const row = [
+          s.name.padEnd(nameW),
+          s.role.padEnd(roleW),
+          s.instanceId.padEnd(idW),
+          s.publicIp.padEnd(ipW),
+          s.claudeCodeVersion.padEnd(claudeW),
+          s.ghVersion.padEnd(ghW),
+          s.ghAuth.padEnd(authW)
+        ].join("  ");
+        console.log(`  ${row}`);
+      }
+      console.log();
+      const urlLines = statusData.filter((s) => s.tailscaleUrl !== "\u2014").map((s) => `  ${s.name}: ${s.tailscaleUrl}`);
+      if (urlLines.length > 0) {
+        ui.note(urlLines.join("\n"), "Tailscale URLs");
+      }
     };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
+  }
+});
+
+// tools/validate.ts
+function runSshCheck(exec, host, command, timeout) {
+  const result = exec.capture("ssh", [
+    "-o",
+    `ConnectTimeout=${timeout}`,
+    ...SSH_OPTS2,
+    `${import_core4.SSH_USER}@${host}`,
+    `"${command.replace(/"/g, '\\"')}"`
+  ]);
+  return { ok: result.exitCode === 0, output: result.stdout || result.stderr };
+}
+var import_core4, import_picocolors4, SSH_OPTS2, validateTool;
+var init_validate = __esm({
+  "tools/validate.ts"() {
+    "use strict";
+    init_config();
+    import_core4 = require("@clawup/core");
+    init_workspace();
+    init_tailscale();
+    init_tool_helpers();
+    import_picocolors4 = __toESM(require("picocolors"));
+    SSH_OPTS2 = [
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/dev/null",
+      "-o",
+      "BatchMode=yes"
+    ];
+    validateTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      ui.intro("Agent Army");
+      requireTailscale();
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        ui.log.error(wsResult.error ?? "Failed to set up workspace.");
+        process.exit(1);
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        ui.log.error(err.message);
+        process.exit(1);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        ui.log.error(`Config '${configName}' could not be loaded.`);
+        process.exit(1);
+      }
+      const selectResult = exec.capture("pulumi", ["stack", "select", manifest.stackName], cwd);
+      if (selectResult.exitCode !== 0) {
+        const initResult = exec.capture("pulumi", ["stack", "init", manifest.stackName], cwd);
+        if (initResult.exitCode !== 0) {
+          ui.log.error(`Could not select Pulumi stack "${manifest.stackName}".`);
+          process.exit(1);
+        }
+      }
+      const tailnetDnsName = getConfig2(exec, "tailnetDnsName", cwd);
+      if (!tailnetDnsName) {
+        ui.log.error("Could not determine tailnet DNS name from Pulumi config.");
+        process.exit(1);
+      }
+      const timeout = parseInt(options.timeout ?? "30", 10);
+      const results = [];
+      ui.log.step(`Validating ${manifest.agents.length} agents (timeout: ${timeout}s)...`);
+      console.log();
+      for (const agent of manifest.agents) {
+        const tsHost = (0, import_core4.tailscaleHostname)(manifest.stackName, agent.name);
+        const host = `${tsHost}.${tailnetDnsName}`;
+        const checks = [];
+        ui.log.info(`${import_picocolors4.default.bold(agent.displayName)} (${agent.role}) \u2014 ${host}`);
+        const ssh = runSshCheck(exec, host, "echo 'SSH OK'", timeout);
+        checks.push({
+          name: "SSH connectivity",
+          passed: ssh.ok,
+          detail: ssh.ok ? "connected" : "connection failed"
+        });
+        if (ssh.ok) {
+          const gateway = runSshCheck(exec, host, "systemctl --user is-active openclaw-gateway", timeout);
+          checks.push({
+            name: "OpenClaw gateway",
+            passed: gateway.ok,
+            detail: gateway.ok ? "running" : gateway.output || "not running"
+          });
+          const workspace = runSshCheck(
+            exec,
+            host,
+            `test -f /home/${import_core4.SSH_USER}/.openclaw/workspace/SOUL.md && test -f /home/${import_core4.SSH_USER}/.openclaw/workspace/HEARTBEAT.md && echo 'OK'`,
+            timeout
+          );
+          checks.push({
+            name: "Workspace files",
+            passed: workspace.ok,
+            detail: workspace.ok ? "SOUL.md + HEARTBEAT.md present" : "missing files"
+          });
+          const claudeCode = runSshCheck(
+            exec,
+            host,
+            `/home/${import_core4.SSH_USER}/.local/bin/claude --version 2>/dev/null || echo 'not installed'`,
+            timeout
+          );
+          const claudeVersion = claudeCode.output.trim();
+          const claudeInstalled = claudeCode.ok && !claudeVersion.includes("not installed");
+          checks.push({
+            name: "Claude Code CLI",
+            passed: claudeInstalled,
+            detail: claudeInstalled ? claudeVersion : "not installed"
+          });
+          if (claudeInstalled) {
+            const credCheck = runSshCheck(
+              exec,
+              host,
+              `grep -E '"(ANTHROPIC_API_KEY|CLAUDE_CODE_OAUTH_TOKEN)"' /home/${import_core4.SSH_USER}/.openclaw/openclaw.json | head -1`,
+              timeout
+            );
+            const hasApiKey = credCheck.output.includes("ANTHROPIC_API_KEY");
+            const hasOAuthToken = credCheck.output.includes("CLAUDE_CODE_OAUTH_TOKEN");
+            const credIsConfigured = credCheck.ok && (hasApiKey || hasOAuthToken);
+            const credType = hasOAuthToken ? "OAuth token" : "API key";
+            if (credIsConfigured) {
+              const envVar = hasOAuthToken ? "CLAUDE_CODE_OAUTH_TOKEN" : "ANTHROPIC_API_KEY";
+              const testScript = `
+export ${envVar}=$(jq -r '.env.${envVar}' /home/${import_core4.SSH_USER}/.openclaw/openclaw.json)
+timeout 15 /home/${import_core4.SSH_USER}/.local/bin/claude -p 'hi' 2>&1 | head -5
+          `.trim();
+              const authTest = runSshCheck(exec, host, testScript, timeout + 15);
+              const authWorks = authTest.ok && !authTest.output.includes("Invalid API key") && !authTest.output.includes("not authenticated");
+              checks.push({
+                name: "Claude Code auth",
+                passed: authWorks,
+                detail: authWorks ? `${credType} verified` : `${credType} test failed: ${authTest.output.substring(0, 50)}`
+              });
+            } else {
+              checks.push({
+                name: "Claude Code auth",
+                passed: false,
+                detail: "No credentials configured"
+              });
+            }
+          }
+          const ghVersion = runSshCheck(
+            exec,
+            host,
+            `gh --version 2>/dev/null | head -n1 || echo 'not installed'`,
+            timeout
+          );
+          const ghVersionStr = ghVersion.output.trim();
+          const ghInstalled = ghVersion.ok && !ghVersionStr.includes("not installed");
+          checks.push({
+            name: "GitHub CLI",
+            passed: ghInstalled,
+            detail: ghInstalled ? ghVersionStr : "not installed"
+          });
+          if (ghInstalled) {
+            const ghAuth = runSshCheck(
+              exec,
+              host,
+              `gh auth status 2>&1 | head -n2 || echo 'not authenticated'`,
+              timeout
+            );
+            const ghAuthStr = ghAuth.output.trim();
+            const ghAuthenticated = ghAuth.ok && !ghAuthStr.includes("not authenticated") && !ghAuthStr.includes("not logged");
+            checks.push({
+              name: "GitHub CLI auth",
+              passed: ghAuthenticated,
+              detail: ghAuthenticated ? "authenticated" : "not authenticated (optional)"
+            });
+          }
+        } else {
+          checks.push({ name: "OpenClaw gateway", passed: false, detail: "skipped (no SSH)" });
+          checks.push({ name: "Workspace files", passed: false, detail: "skipped (no SSH)" });
+          checks.push({ name: "Claude Code CLI", passed: false, detail: "skipped (no SSH)" });
+          checks.push({ name: "Claude Code auth", passed: false, detail: "skipped (no SSH)" });
+          checks.push({ name: "GitHub CLI", passed: false, detail: "skipped (no SSH)" });
+          checks.push({ name: "GitHub CLI auth", passed: false, detail: "skipped (no SSH)" });
+        }
+        const allPassed = checks.every((c) => c.passed);
+        for (const check of checks) {
+          const icon = check.passed ? import_picocolors4.default.green("PASS") : import_picocolors4.default.red("FAIL");
+          console.log(`    ${icon}  ${check.name}: ${check.detail ?? ""}`);
+        }
+        console.log();
+        results.push({ agent: agent.displayName, checks, passed: allPassed });
+      }
+      const passed = results.filter((r) => r.passed).length;
+      const failed = results.filter((r) => !r.passed).length;
+      const summaryLines = [
+        `Total:  ${results.length}`,
+        `Passed: ${passed}`,
+        `Failed: ${failed}`
+      ];
+      ui.note(summaryLines.join("\n"), "Validation Summary");
+      if (failed > 0) {
+        ui.log.warn("Some agents failed validation.");
+        console.log("  1. Wait 3-5 minutes for cloud-init to complete");
+        const agentHints = results.filter((r) => !r.passed).map((r) => {
+          const agent = manifest.agents.find((a) => a.displayName === r.agent);
+          return agent ? agent.role : r.agent;
+        });
+        console.log(`  2. Check logs: clawup ssh ${agentHints[0] ?? "<role>"} -- journalctl -u openclaw`);
+        console.log("  3. Verify Tailscale: tailscale status");
+        process.exit(1);
+      } else {
+        ui.log.success("All agents are healthy!");
+      }
+    };
+  }
+});
+
+// tools/destroy.ts
+var destroyTool;
+var init_destroy = __esm({
+  "tools/destroy.ts"() {
+    "use strict";
+    init_config();
+    init_tailscale();
+    init_workspace();
+    init_tool_helpers();
+    init_ui();
+    destroyTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      ui.intro("Agent Army");
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        ui.log.error(wsResult.error ?? "Failed to set up workspace.");
+        process.exit(1);
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        ui.log.error(err.message);
+        process.exit(1);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        ui.log.error(`Config '${configName}' could not be loaded.`);
+        process.exit(1);
+      }
+      const selectResult = exec.capture("pulumi", ["stack", "select", manifest.stackName], cwd);
+      if (selectResult.exitCode !== 0) {
+        const initResult = exec.capture("pulumi", ["stack", "init", manifest.stackName], cwd);
+        if (initResult.exitCode !== 0) {
+          ui.log.error(`Could not select Pulumi stack "${manifest.stackName}".`);
+          process.exit(1);
+        }
+      }
+      const manifestProvider = manifest.provider ?? "aws";
+      const resourceLabel = manifestProvider === "hetzner" ? "Hetzner servers" : "EC2 instances";
+      const infraLabel = manifestProvider === "hetzner" ? "Firewall rules" : "VPC, subnet, and security group";
+      ui.note(
+        [
+          `Stack:  ${manifest.stackName}`,
+          `Region: ${manifest.region}`,
+          ``,
+          `Agents (${manifest.agents.length}):`,
+          formatAgentList(manifest.agents),
+          ``,
+          `This will PERMANENTLY DESTROY:`,
+          `  - ${manifest.agents.length} ${resourceLabel}`,
+          `  - All workspace data on those instances`,
+          `  - ${infraLabel}`,
+          `  - Tailscale device registrations`
+        ].join("\n"),
+        "Destruction Plan"
+      );
+      if (!options.yes) {
+        const typedName = await ui.text({
+          message: `Type the stack name to confirm: "${manifest.stackName}"`,
+          validate: (val) => {
+            if (val !== manifest.stackName) return `Must type "${manifest.stackName}" to confirm`;
+            return void 0;
+          }
+        });
+        const confirmed = await ui.confirm({
+          message: "Are you ABSOLUTELY sure?",
+          initialValue: false
+        });
+        if (!confirmed) {
+          ui.cancel("Destruction cancelled.");
+        }
+      }
+      syncManifestToProject(configName, cwd);
+      ui.log.step("Running pulumi destroy...");
+      console.log();
+      const exitCode = await exec.stream("pulumi", ["destroy", "--yes"], { cwd });
+      console.log();
+      if (exitCode !== 0) {
+        ui.log.error("Destruction failed. Check the output above for details.");
+        process.exit(1);
+      }
+      const tailnetDnsName = getConfig2(exec, "tailnetDnsName", cwd);
+      const tailscaleApiKey = getConfig2(exec, "tailscaleApiKey", cwd);
+      if (tailnetDnsName && tailscaleApiKey) {
+        const spinner4 = ui.spinner("Removing agents from Tailscale...");
+        const { cleaned, failed } = cleanupTailscaleDevices(
+          tailscaleApiKey,
+          tailnetDnsName,
+          manifest.stackName,
+          manifest.agents
+        );
+        if (failed.length === 0) {
+          spinner4.stop(cleaned.length > 0 ? "Tailscale devices cleaned up" : "No Tailscale devices found");
+        } else {
+          spinner4.stop("Some Tailscale devices could not be removed");
+          ui.log.warn(
+            `Could not remove: ${failed.join(", ")}. Remove manually from https://login.tailscale.com/admin/machines`
+          );
+        }
+      } else if (tailnetDnsName && !tailscaleApiKey) {
+        ui.log.warn("No Tailscale API key configured - devices must be removed manually.");
+        console.log("  Remove devices at: https://login.tailscale.com/admin/machines");
+        console.log("  Tip: Set a Tailscale API key (`clawup init`) for automatic cleanup.");
+      }
+      ui.log.success(`Stack "${manifest.stackName}" has been destroyed.`);
+      ui.outro("Done!");
+    };
+  }
+});
+
+// tools/redeploy.ts
+var import_picocolors5, redeployTool;
+var init_redeploy = __esm({
+  "tools/redeploy.ts"() {
+    "use strict";
+    init_config();
+    init_workspace();
+    init_tailscale();
+    init_tool_helpers();
+    init_ui();
+    import_picocolors5 = __toESM(require("picocolors"));
+    redeployTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      ui.intro("Agent Army");
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        ui.log.error(wsResult.error ?? "Failed to set up workspace.");
+        process.exit(1);
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        ui.log.error(err.message);
+        process.exit(1);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        ui.log.error(`Config '${configName}' could not be loaded.`);
+        process.exit(1);
+      }
+      const selectResult = exec.capture("pulumi", ["stack", "select", manifest.stackName], cwd);
+      const stackExists = selectResult.exitCode === 0;
+      if (!stackExists) {
+        ui.log.warn(`Stack "${manifest.stackName}" does not exist. Falling back to fresh deploy.`);
+        const initResult = exec.capture("pulumi", ["stack", "init", manifest.stackName], cwd);
+        if (initResult.exitCode !== 0) {
+          ui.log.error(initResult.stderr || `Could not create Pulumi stack "${manifest.stackName}".`);
+          process.exit(1);
+        }
+      }
+      ui.note(
+        [
+          `Stack:    ${manifest.stackName}`,
+          `Region:   ${manifest.region}`,
+          `Mode:     ${stackExists ? "In-place update (--refresh)" : "Fresh deploy (new stack)"}`,
+          ``,
+          `Agents (${manifest.agents.length}):`,
+          formatAgentList(manifest.agents),
+          ``,
+          stackExists ? `This will update resources in-place where possible.
+Tailscale devices will be preserved.` : `This will create all resources from scratch.`
+        ].join("\n"),
+        "Redeploy Summary"
+      );
+      if (!options.yes) {
+        const confirmed = await ui.confirm({
+          message: "Proceed with redeploy?"
+        });
+        if (!confirmed) {
+          ui.cancel("Redeploy cancelled.");
+          return;
+        }
+      }
+      syncManifestToProject(configName, cwd);
+      const configSetResult = exec.capture("pulumi", ["config", "set", "instanceType", manifest.instanceType], cwd);
+      if (configSetResult.exitCode !== 0) {
+        ui.log.error(`Failed to set Pulumi config: ${configSetResult.stderr || "unknown error"}`);
+        process.exit(1);
+      }
+      const tailnetDnsName = getConfig2(exec, "tailnetDnsName", cwd);
+      const tailscaleApiKey = getConfig2(exec, "tailscaleApiKey", cwd);
+      if (tailnetDnsName && tailscaleApiKey) {
+        const spinner4 = ui.spinner("Cleaning up stale Tailscale devices...");
+        const { cleaned, failed } = cleanupTailscaleDevices(
+          tailscaleApiKey,
+          tailnetDnsName,
+          manifest.stackName,
+          manifest.agents
+        );
+        if (cleaned.length > 0) {
+          spinner4.stop(`Removed ${cleaned.length} stale Tailscale device(s)`);
+        } else {
+          spinner4.stop("No stale Tailscale devices found");
+        }
+        if (failed.length > 0) {
+          ui.log.warn(
+            `Could not remove some devices: ${failed.join(", ")}. Check https://login.tailscale.com/admin/machines`
+          );
+        }
+      }
+      if (tailscaleApiKey) {
+        const spinner4 = ui.spinner("Ensuring Tailscale MagicDNS is enabled...");
+        const magicDnsChanged = ensureMagicDns(tailscaleApiKey);
+        spinner4.stop(magicDnsChanged ? "MagicDNS enabled" : "MagicDNS OK");
+      }
+      const hasLinearAgents = manifest.agents.some(
+        (a) => !!getConfig2(exec, `${a.role}LinearApiKey`, cwd)
+      );
+      if (hasLinearAgents && tailscaleApiKey) {
+        const spinner4 = ui.spinner("Ensuring Tailscale Funnel prerequisites...");
+        const funnel = ensureTailscaleFunnel(tailscaleApiKey);
+        const changes = [];
+        if (funnel.funnelAcl) changes.push("Funnel ACL enabled");
+        spinner4.stop(changes.length > 0 ? changes.join(", ") : "Funnel prerequisites OK");
+      }
+      const pulumiArgs = stackExists ? ["up", "--refresh", "--yes"] : ["up", "--yes"];
+      ui.log.step(stackExists ? "Running pulumi up --refresh..." : "Running pulumi up...");
+      console.log();
+      const exitCode = await exec.stream("pulumi", pulumiArgs, { cwd });
+      console.log();
+      if (exitCode !== 0) {
+        ui.log.error("Redeploy failed. Check the output above for details.");
+        if (stackExists) {
+          ui.log.warn(
+            "If the in-place update cannot recover, try: clawup destroy && clawup deploy"
+          );
+        }
+        process.exit(1);
+      }
+      ui.log.success("Redeploy complete!");
+      const outputsResult = exec.capture("pulumi", [
+        "stack",
+        "output",
+        "--json",
+        "--show-secrets"
+      ], cwd);
+      if (outputsResult.exitCode === 0) {
+        try {
+          const outputs = JSON.parse(outputsResult.stdout);
+          const lines = [];
+          for (const agent of manifest.agents) {
+            const urlKey = `${agent.role}TailscaleUrl`;
+            const ipKey = `${agent.role}PublicIp`;
+            const idKey = `${agent.role}InstanceId`;
+            lines.push(`${agent.displayName} (${agent.role}):`);
+            if (outputs[urlKey]) lines.push(`  Tailscale URL: ${outputs[urlKey]}`);
+            if (outputs[ipKey]) lines.push(`  Public IP:     ${outputs[ipKey]}`);
+            if (outputs[idKey]) lines.push(`  Instance ID:   ${outputs[idKey]}`);
+            lines.push("");
+          }
+          ui.note(lines.join("\n"), "Agent Details");
+        } catch (err) {
+          ui.log.warn(`Could not parse stack outputs: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (!isTailscaleInstalled()) {
+        const hint = process.platform === "darwin" ? "Install from the Mac App Store or https://tailscale.com/download" : "Install from https://tailscale.com/download";
+        ui.log.warn(
+          `Tailscale is required to connect to agents.
+  ${hint}
+  Then run: ${import_picocolors5.default.cyan("tailscale up")}`
+        );
+      } else if (!isTailscaleRunning()) {
+        ui.log.warn(
+          `Tailscale is not running. Start it before validating agents.
+  Open the Tailscale app or run: ${import_picocolors5.default.cyan("tailscale up")}`
+        );
+      }
+      ui.outro("Agents updated. Run `clawup validate` to verify.");
+    };
+  }
+});
+
+// tools/push.ts
+function sshExec(exec, host, command) {
+  const result = exec.capture("ssh", [
+    "-o",
+    "ConnectTimeout=15",
+    ...SSH_OPTS3,
+    `${import_core5.SSH_USER}@${host}`,
+    `"${command.replace(/"/g, '\\"')}"`
+  ]);
+  return { ok: result.exitCode === 0, output: result.stdout || result.stderr };
+}
+function rsyncDir(exec, localDir, host, remoteDir) {
+  const src = localDir.endsWith("/") ? localDir : `${localDir}/`;
+  const result = exec.capture("rsync", [
+    "-avz",
+    "--delete",
+    "-e",
+    `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes`,
+    src,
+    `${import_core5.SSH_USER}@${host}:${remoteDir}/`
+  ]);
+  return { ok: result.exitCode === 0, output: result.stdout || result.stderr };
+}
+function scpFile(exec, localFile, host, remotePath) {
+  const result = exec.capture("scp", [
+    ...SSH_OPTS3,
+    localFile,
+    `${import_core5.SSH_USER}@${host}:${remotePath}`
+  ]);
+  return { ok: result.exitCode === 0, output: result.stdout || result.stderr };
+}
+function findAgent(agents, query) {
+  const q = query.toLowerCase();
+  const resolvedRole = import_core5.AGENT_ALIASES[q] ?? q;
+  return agents.find(
+    (a) => a.role === resolvedRole || a.name === q || a.name === `agent-${q}` || a.displayName.toLowerCase() === q
+  );
+}
+var fs4, path4, import_core5, import_identity, import_core6, import_core7, os3, import_picocolors6, SSH_OPTS3, REMOTE_WORKSPACE, REMOTE_SKILLS, pushTool;
+var init_push = __esm({
+  "tools/push.ts"() {
+    "use strict";
+    fs4 = __toESM(require("fs"));
+    path4 = __toESM(require("path"));
+    init_config();
+    import_core5 = require("@clawup/core");
+    init_workspace();
+    init_pulumi();
+    import_identity = require("@clawup/core/identity");
+    import_core6 = require("@clawup/core");
+    import_core7 = require("@clawup/core");
+    os3 = __toESM(require("os"));
+    import_picocolors6 = __toESM(require("picocolors"));
+    SSH_OPTS3 = [
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/dev/null",
+      "-o",
+      "BatchMode=yes"
+    ];
+    REMOTE_WORKSPACE = `/home/${import_core5.SSH_USER}/.openclaw/workspace`;
+    REMOTE_SKILLS = `${REMOTE_WORKSPACE}/skills`;
+    pushTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      ui.intro("Clawup");
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        throw new Error(wsResult.error ?? "Failed to set up workspace.");
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        throw new Error(err.message);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        throw new Error(`Config '${configName}' could not be loaded.`);
+      }
+      const stackResult = selectOrCreateStack(manifest.stackName, cwd);
+      if (!stackResult.ok) {
+        throw new Error(`Could not select Pulumi stack "${manifest.stackName}".`);
+      }
+      const tailnetDnsName = getConfig("tailnetDnsName", cwd);
+      if (!tailnetDnsName) {
+        throw new Error("Could not determine tailnet DNS name from Pulumi config.");
+      }
+      const noFlags = !options.skills && !options.workspace && !options.memoryReset && !options.openclaw && !options.pushConfig;
+      const doSkills = options.skills || noFlags;
+      const doWorkspace = options.workspace || noFlags;
+      let targetAgents = manifest.agents;
+      if (options.agent) {
+        const matched = findAgent(manifest.agents, options.agent);
+        if (!matched) {
+          const validNames = manifest.agents.map((a) => `${a.role}, ${a.displayName.toLowerCase()}, ${a.name}`).join("\n  ");
+          ui.log.error(
+            `Unknown agent: "${options.agent}"
+Valid identifiers:
+  ${validNames}`
+          );
+          return;
+        }
+        targetAgents = [matched];
+      }
+      const actions = [];
+      if (doSkills) actions.push("skills");
+      if (doWorkspace) actions.push("workspace");
+      if (options.memoryReset) actions.push("memory-reset");
+      if (options.openclaw) actions.push("openclaw upgrade");
+      if (options.pushConfig) actions.push("config");
+      ui.log.step(
+        `Pushing [${actions.join(", ")}] to ${targetAgents.length} agent(s)...`
+      );
+      console.log();
+      let allOk = true;
+      for (const agent of targetAgents) {
+        const tsHost = (0, import_core5.tailscaleHostname)(manifest.stackName, agent.name);
+        const host = `${tsHost}.${tailnetDnsName}`;
+        ui.log.info(`${import_picocolors6.default.bold(agent.displayName)} (${agent.role}) \u2014 ${host}`);
+        let needsRestart = false;
+        if (doWorkspace || doSkills) {
+          try {
+            const identityCacheDir = path4.join(os3.homedir(), ".clawup", "identity-cache");
+            const identity = (0, import_identity.fetchIdentitySync)(agent.identity, identityCacheDir);
+            sshExec(exec, host, `mkdir -p ${REMOTE_WORKSPACE}`);
+            const tmpDir = fs4.mkdtempSync(path4.join(os3.tmpdir(), "push-identity-"));
+            for (const [relPath, content] of Object.entries(identity.files)) {
+              const localFile = path4.join(tmpDir, relPath);
+              fs4.mkdirSync(path4.dirname(localFile), { recursive: true });
+              fs4.writeFileSync(localFile, content);
+            }
+            if (doWorkspace) {
+              const topFiles = Object.keys(identity.files).filter((f) => !f.startsWith("skills/"));
+              let wsOk = true;
+              for (const relPath of topFiles) {
+                const localFile = path4.join(tmpDir, relPath);
+                const result = scpFile(exec, localFile, host, `${REMOTE_WORKSPACE}/${relPath}`);
+                if (!result.ok) {
+                  console.log(`    ${import_picocolors6.default.red("FAIL")}  workspace file ${relPath}: ${result.output.substring(0, 100)}`);
+                  wsOk = false;
+                  allOk = false;
+                }
+              }
+              if (wsOk) {
+                console.log(`    ${import_picocolors6.default.green("OK")}  workspace files synced (${topFiles.length} files)`);
+              }
+            }
+            if (doSkills) {
+              const skillsLocalDir = path4.join(tmpDir, "skills");
+              if (fs4.existsSync(skillsLocalDir)) {
+                sshExec(exec, host, `mkdir -p ${REMOTE_SKILLS}`);
+                const result = rsyncDir(exec, skillsLocalDir, host, REMOTE_SKILLS);
+                if (result.ok) {
+                  console.log(`    ${import_picocolors6.default.green("OK")}  skills synced`);
+                } else {
+                  console.log(`    ${import_picocolors6.default.red("FAIL")}  skills sync failed: ${result.output.substring(0, 100)}`);
+                  allOk = false;
+                }
+              }
+              const { public: publicSkills } = (0, import_core6.classifySkills)(identity.manifest.skills);
+              for (const skill of publicSkills) {
+                const cmd = `export NVM_DIR="$HOME/.nvm" && [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" && clawhub install ${skill.slug}`;
+                const result = sshExec(exec, host, cmd);
+                if (result.ok) {
+                  console.log(`    ${import_picocolors6.default.green("OK")}  clawhub skill installed: ${skill.slug}`);
+                } else {
+                  console.log(`    ${import_picocolors6.default.red("FAIL")}  clawhub skill ${skill.slug}: ${result.output.substring(0, 100)}`);
+                  allOk = false;
+                }
+              }
+              if (identity.manifest.deps?.length) {
+                const resolved = (0, import_core7.resolveDeps)(identity.manifest.deps);
+                for (const dep of resolved) {
+                  if (!dep.entry.postInstallScript) continue;
+                  const cmd = dep.entry.postInstallScript;
+                  const result = sshExec(exec, host, cmd);
+                  if (result.ok) {
+                    console.log(`    ${import_picocolors6.default.green("OK")}  dep post-install: ${dep.name}`);
+                  } else {
+                    console.log(`    ${import_picocolors6.default.red("FAIL")}  dep post-install ${dep.name}: ${result.output.substring(0, 100)}`);
+                    allOk = false;
+                  }
+                }
+              }
+            }
+            fs4.rmSync(tmpDir, { recursive: true, force: true });
+          } catch (err) {
+            console.log(`    ${import_picocolors6.default.red("FAIL")}  identity fetch failed: ${err.message}`);
+            allOk = false;
+          }
+        }
+        if (options.memoryReset) {
+          const cmd = `rm -rf ${REMOTE_WORKSPACE}/memory ${REMOTE_WORKSPACE}/MEMORY.md`;
+          const result = sshExec(exec, host, cmd);
+          if (result.ok) {
+            console.log(`    ${import_picocolors6.default.green("OK")}  memory reset`);
+          } else {
+            console.log(`    ${import_picocolors6.default.red("FAIL")}  memory reset failed: ${result.output.substring(0, 100)}`);
+            allOk = false;
+          }
+        }
+        if (options.openclaw) {
+          const cmd = `npm install -g openclaw@latest 2>&1`;
+          const result = sshExec(exec, host, cmd);
+          if (result.ok) {
+            console.log(`    ${import_picocolors6.default.green("OK")}  openclaw upgraded`);
+            needsRestart = true;
+          } else {
+            console.log(`    ${import_picocolors6.default.red("FAIL")}  openclaw upgrade failed: ${result.output.substring(0, 100)}`);
+            allOk = false;
+          }
+        }
+        if (options.pushConfig) {
+          const localConfig = path4.join(
+            `/home/${import_core5.SSH_USER}/.openclaw`,
+            "openclaw.json"
+          );
+          const operatorConfig = path4.join(
+            process.env.HOME ?? "",
+            ".openclaw",
+            "openclaw.json"
+          );
+          if (fs4.existsSync(operatorConfig)) {
+            const result = scpFile(
+              exec,
+              operatorConfig,
+              host,
+              `/home/${import_core5.SSH_USER}/.openclaw/openclaw.json`
+            );
+            if (result.ok) {
+              console.log(`    ${import_picocolors6.default.green("OK")}  openclaw.json pushed`);
+              needsRestart = true;
+            } else {
+              console.log(`    ${import_picocolors6.default.red("FAIL")}  config push failed: ${result.output.substring(0, 100)}`);
+              allOk = false;
+            }
+          } else {
+            console.log(`    ${import_picocolors6.default.red("FAIL")}  local openclaw.json not found at ${operatorConfig}`);
+            allOk = false;
+          }
+        }
+        if (needsRestart) {
+          const result = sshExec(exec, host, "systemctl --user restart openclaw-gateway");
+          if (result.ok) {
+            console.log(`    ${import_picocolors6.default.green("OK")}  gateway restarted`);
+          } else {
+            console.log(`    ${import_picocolors6.default.red("FAIL")}  gateway restart failed: ${result.output.substring(0, 100)}`);
+            allOk = false;
+          }
+        }
+        console.log();
+      }
+      if (allOk) {
+        ui.log.success(`Push completed successfully for ${targetAgents.length} agent(s).`);
+      } else {
+        ui.log.warn("Push completed with some failures. Check output above.");
+        throw new Error("Push completed with failures.");
+      }
+    };
+  }
+});
+
+// tools/webhooks.ts
+function sshExec2(exec, host, command) {
+  const result = exec.capture("ssh", [
+    "-o",
+    "ConnectTimeout=15",
+    ...SSH_OPTS4,
+    `${import_core8.SSH_USER}@${host}`,
+    `"${command.replace(/"/g, '\\"')}"`
+  ]);
+  return { ok: result.exitCode === 0, output: result.stdout || result.stderr };
+}
+var import_core8, import_picocolors7, SSH_OPTS4, webhooksSetupTool;
+var init_webhooks = __esm({
+  "tools/webhooks.ts"() {
+    "use strict";
+    init_config();
+    import_core8 = require("@clawup/core");
+    init_workspace();
+    init_tool_helpers();
+    import_picocolors7 = __toESM(require("picocolors"));
+    SSH_OPTS4 = [
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/dev/null",
+      "-o",
+      "BatchMode=yes"
+    ];
+    webhooksSetupTool = async (runtime, options) => {
+      const { ui, exec } = runtime;
+      ui.intro("Agent Army \u2014 Webhook Setup");
+      const wsResult = ensureWorkspace();
+      if (!wsResult.ok) {
+        ui.log.error(wsResult.error ?? "Failed to set up workspace.");
+        process.exit(1);
+      }
+      const cwd = getWorkspaceDir();
+      let configName;
+      try {
+        configName = resolveConfigName(options.config);
+      } catch (err) {
+        ui.log.error(err.message);
+        process.exit(1);
+      }
+      const manifest = loadManifest(configName);
+      if (!manifest) {
+        ui.log.error(`Config '${configName}' could not be loaded.`);
+        process.exit(1);
+      }
+      const selectResult = exec.capture("pulumi", ["stack", "select", manifest.stackName], cwd);
+      if (selectResult.exitCode !== 0) {
+        ui.log.error(`Could not select Pulumi stack "${manifest.stackName}". Run ${import_picocolors7.default.cyan("clawup deploy")} first.`);
+        process.exit(1);
+      }
+      const outputs = getStackOutputs(exec, true, cwd);
+      if (!outputs) {
+        ui.log.error(`Could not fetch stack outputs. Run ${import_picocolors7.default.cyan("clawup deploy")} first.`);
+        process.exit(1);
+      }
+      const tailnetDnsName = getConfig2(exec, "tailnetDnsName", cwd);
+      if (!tailnetDnsName) {
+        ui.log.error("Could not read tailnetDnsName from Pulumi config.");
+        process.exit(1);
+      }
+      const agentsWithUrls = manifest.agents.filter(
+        (agent) => outputs[`${agent.role}WebhookUrl`]
+      );
+      if (agentsWithUrls.length === 0) {
+        ui.log.error(
+          `No webhook URLs found in stack outputs.
+  Make sure agents are deployed and exposing webhook endpoints.
+  Run ${import_picocolors7.default.cyan("clawup deploy")} if you haven't already.`
+        );
+        process.exit(1);
+      }
+      ui.note(
+        [
+          "This will walk you through creating Linear webhooks for each agent.",
+          "You'll need access to your Linear workspace settings."
+        ].join("\n"),
+        "Linear Webhook Setup"
+      );
+      const secrets = [];
+      for (const agent of manifest.agents) {
+        const webhookUrl = outputs[`${agent.role}WebhookUrl`];
+        if (!webhookUrl) {
+          ui.log.warn(`No webhook URL found for ${agent.displayName} (${agent.role}) \u2014 skipping.`);
+          continue;
+        }
+        ui.note(
+          [
+            `Webhook URL: ${import_picocolors7.default.cyan(String(webhookUrl))}`,
+            "",
+            "Steps:",
+            '1. Go to Linear Settings \u2192 API \u2192 Webhooks \u2192 "New webhook"',
+            "2. Paste the URL above",
+            "3. Select events to receive (e.g., Issues, Comments)",
+            '4. Create the webhook and copy the "Signing secret"'
+          ].join("\n"),
+          `${agent.displayName} (${agent.role})`
+        );
+        const secret = await ui.text({
+          message: `Signing secret for ${agent.displayName}`,
+          placeholder: "Paste the signing secret from Linear",
+          validate: (val) => {
+            if (!val) return "Signing secret is required";
+          }
+        });
+        secrets.push({
+          role: agent.role,
+          name: agent.name,
+          agentName: agent.displayName,
+          secret
+        });
+      }
+      if (secrets.length === 0) {
+        ui.log.warn("No webhook secrets collected.");
+        ui.outro("Nothing to do.");
+        return;
+      }
+      const configSpinner = ui.spinner("Saving webhook secrets to Pulumi config...");
+      for (const { role, secret } of secrets) {
+        exec.capture(
+          "pulumi",
+          ["config", "set", `${role}LinearWebhookSecret`, secret, "--secret"],
+          cwd
+        );
+      }
+      configSpinner.stop(`Saved ${secrets.length} webhook secret(s) to Pulumi config`);
+      const applySpinner = ui.spinner("Applying webhook secrets to running agents...");
+      let applied = 0;
+      let failed = 0;
+      for (const { role, name, agentName, secret } of secrets) {
+        const tsHost = (0, import_core8.tailscaleHostname)(manifest.stackName, name);
+        const host = `${tsHost}.${tailnetDnsName}`;
+        const escapedSecret = secret.replace(/'/g, "'\\''");
+        const jqCmd = `jq '.plugins.entries.linear.config.webhookSecret = \\"${escapedSecret.replace(/\\/g, "\\\\").replace(/"/g, '\\\\\\"')}\\"' /home/${import_core8.SSH_USER}/.openclaw/openclaw.json > /tmp/openclaw-patched.json && mv /tmp/openclaw-patched.json /home/${import_core8.SSH_USER}/.openclaw/openclaw.json`;
+        const patchResult = sshExec2(exec, host, jqCmd);
+        if (!patchResult.ok) {
+          applySpinner.stop(`Failed to patch config on ${agentName}`);
+          ui.log.warn(`  ${agentName}: ${patchResult.output}`);
+          failed++;
+          continue;
+        }
+        const restartResult = sshExec2(exec, host, "systemctl --user restart openclaw-gateway");
+        if (!restartResult.ok) {
+          applySpinner.stop(`Failed to restart gateway on ${agentName}`);
+          ui.log.warn(`  ${agentName}: ${restartResult.output}`);
+          failed++;
+          continue;
+        }
+        applied++;
+      }
+      if (applied > 0 && failed === 0) {
+        applySpinner.stop(`Applied to ${applied} agent(s)`);
+      } else if (applied > 0) {
+        applySpinner.stop(`Applied to ${applied} agent(s), ${failed} failed`);
+      } else {
+        applySpinner.stop(`Failed to apply to any agents`);
+      }
+      if (failed > 0) {
+        ui.log.warn(
+          `Some agents could not be reached. They will pick up the secrets on next deploy.`
+        );
+      }
+      ui.outro("Webhook setup complete!");
+    };
+  }
+});
+
+// adapters/cli-adapter.ts
+function createCLIAdapter() {
+  return {
+    ui: new CLIUIAdapter(),
+    exec: new CLIExecAdapter(),
+    platform: "cli"
+  };
+}
+var p3, import_picocolors8, import_child_process6, CLIExecAdapter, CLIUIAdapter, cliAdapter;
+var init_cli_adapter = __esm({
+  "adapters/cli-adapter.ts"() {
+    "use strict";
+    p3 = __toESM(require("@clack/prompts"));
+    import_picocolors8 = __toESM(require("picocolors"));
+    import_child_process6 = require("child_process");
+    init_process();
+    init_vendor();
+    CLIExecAdapter = class {
+      capture(command, args = [], cwd) {
+        const resolved = resolveCommand(command);
+        try {
+          const result = (0, import_child_process6.execSync)([resolved, ...args].join(" "), {
+            cwd,
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+          return { stdout: result.trim(), stderr: "", exitCode: 0 };
+        } catch (err) {
+          const e = err;
+          return {
+            stdout: (e.stdout ?? "").toString().trim(),
+            stderr: (e.stderr ?? "").toString().trim(),
+            exitCode: e.status ?? 1
+          };
+        }
+      }
+      stream(command, args = [], options) {
+        const resolved = resolveCommand(command);
+        return new Promise((resolve2) => {
+          const opts = {
+            cwd: options?.cwd,
+            stdio: options?.capture ? "pipe" : "inherit",
+            shell: true
+          };
+          const child = (0, import_child_process6.spawn)(resolved, args, opts);
+          trackChild(child);
+          child.on("close", (code) => resolve2(code ?? 1));
+          child.on("error", (err) => {
+            console.warn(`[exec] Child process error: ${err.message}`);
+            resolve2(1);
+          });
+        });
+      }
+      commandExists(command) {
+        return commandExistsWithVendor(command);
+      }
+    };
+    CLIUIAdapter = class {
+      intro(message) {
+        console.log();
+        p3.intro(import_picocolors8.default.bgCyan(import_picocolors8.default.black(` ${message} `)));
+      }
+      note(content, title) {
+        p3.note(content, title);
+      }
+      outro(message) {
+        p3.outro(message);
+      }
+      cancel(message) {
+        p3.cancel(message);
+        process.exit(0);
+      }
+      log = {
+        info(message) {
+          p3.log.info(message);
+        },
+        step(message) {
+          p3.log.step(message);
+        },
+        success(message) {
+          p3.log.success(message);
+        },
+        warn(message) {
+          p3.log.warn(message);
+        },
+        error(message) {
+          p3.log.error(message);
+        }
+      };
+      async text(options) {
+        const result = await p3.text({
+          message: options.message,
+          placeholder: options.placeholder,
+          defaultValue: options.defaultValue,
+          validate: options.validate
+        });
+        if (p3.isCancel(result)) {
+          this.cancel("Operation cancelled.");
+        }
+        return result;
+      }
+      async confirm(options) {
+        const result = await p3.confirm({
+          message: options.message,
+          initialValue: options.initialValue
+        });
+        if (p3.isCancel(result)) {
+          this.cancel("Operation cancelled.");
+        }
         return result;
+      }
+      async select(options) {
+        const result = await p3.select({
+          message: options.message,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          options: options.options,
+          initialValue: options.initialValue
+        });
+        if (p3.isCancel(result)) {
+          this.cancel("Operation cancelled.");
+        }
+        return result;
+      }
+      async multiSelect(options) {
+        const result = await p3.multiselect({
+          message: options.message,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          options: options.options,
+          initialValues: options.initialValues,
+          required: options.required
+        });
+        if (p3.isCancel(result)) {
+          this.cancel("Operation cancelled.");
+        }
+        return result;
+      }
+      spinner(message) {
+        const s = p3.spinner();
+        s.start(message);
+        return {
+          stop(msg, code) {
+            s.stop(msg, code);
+          },
+          message(msg) {
+            s.message(msg);
+          }
+        };
+      }
     };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const commander_1 = require("commander");
-const process_1 = require("./lib/process");
-const init_1 = require("./commands/init");
-const deploy_1 = require("./commands/deploy");
-const status_1 = require("./commands/status");
-const ssh_1 = require("./commands/ssh");
-const validate_1 = require("./commands/validate");
-const push_1 = require("./commands/push");
-const destroy_1 = require("./commands/destroy");
-const list_1 = require("./commands/list");
-const update_1 = require("./commands/update");
-const config_1 = require("./commands/config");
-const secrets_1 = require("./commands/secrets");
-const redeploy_1 = require("./commands/redeploy");
-const webhooks_1 = require("./commands/webhooks");
-const update_check_1 = require("./lib/update-check");
-// Forward SIGINT/SIGTERM to child processes before exiting
-(0, process_1.setupGracefulShutdown)();
-// Read version from package.json so it stays in sync with npm publish
-const pkgJson = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf-8"));
-const program = new commander_1.Command();
-program
-    .name("clawup")
-    .description("Deploy and manage a fleet of OpenClaw AI agents on AWS")
-    .version(pkgJson.version);
-program
-    .command("init")
-    .description("Interactive setup wizard — configure stack, secrets, and agents")
-    .option("--deploy", "Deploy immediately after init")
-    .option("-y, --yes", "Skip confirmation prompt (for deploy)")
-    .action(async (opts) => {
-    await (0, init_1.initCommand)(opts);
-});
-program
-    .command("deploy")
-    .description("Deploy agents with pulumi up")
-    .option("-y, --yes", "Skip confirmation prompt")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, deploy_1.deployCommand)(opts);
-});
-program
-    .command("status")
-    .description("Show agent statuses from stack outputs")
-    .option("--json", "Output as JSON")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, status_1.statusCommand)(opts);
-});
-program
-    .command("ssh <agent>")
-    .description("SSH to an agent by name or alias (juno, titus, scout)")
-    .option("-u, --user <user>", "SSH user")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .argument("[command...]", "Command to run on the agent")
-    .action(async (agent, commandArgs, opts) => {
-    await (0, ssh_1.sshCommand)(agent, commandArgs, opts);
-});
-program
-    .command("validate")
-    .description("Health check agents via Tailscale SSH")
-    .option("-t, --timeout <seconds>", "SSH timeout in seconds", "30")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, validate_1.validateCommand)(opts);
-});
-program
-    .command("push")
-    .description("Push workspace files, skills, and config to running agents")
-    .option("--skills", "Sync skills to remote workspace")
-    .option("--workspace", "Sync workspace files from identity")
-    .option("--memory-reset", "Remove remote memory/ dir and MEMORY.md")
-    .option("--openclaw", "Upgrade openclaw to latest + restart gateway")
-    .option("--config-push", "Copy local openclaw.json to remote + restart gateway")
-    .option("-a, --agent <name>", "Target a single agent (name, role, or alias)")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, push_1.pushCommand)({
-        skills: opts.skills,
-        workspace: opts.workspace,
-        memoryReset: opts.memoryReset,
-        openclaw: opts.openclaw,
-        pushConfig: opts.configPush,
-        agent: opts.agent,
-        config: opts.config,
-    });
-});
-program
-    .command("redeploy")
-    .description("Update agents in-place without destroying infrastructure")
-    .option("-y, --yes", "Skip confirmation prompt")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, redeploy_1.redeployCommand)(opts);
-});
-program
-    .command("destroy")
-    .description("Tear down all resources with safety confirmations")
-    .option("-y, --yes", "Skip confirmation prompts (dangerous!)")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, destroy_1.destroyCommand)(opts);
-});
-program
-    .command("list")
-    .description("List all saved configs")
-    .option("--json", "Output as JSON")
-    .action(async (opts) => {
-    await (0, list_1.listCommand)(opts);
-});
-const configCmd = program
-    .command("config")
-    .description("View or modify config without re-running init");
-configCmd
-    .command("show")
-    .description("Display current config")
-    .option("--json", "Output as JSON")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, config_1.configShowCommand)(opts);
-});
-configCmd
-    .command("set <key> <value>")
-    .description("Update a config value")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .option("-a, --agent <name>", "Target a specific agent")
-    .action(async (key, value, opts) => {
-    await (0, config_1.configSetCommand)(key, value, opts);
-});
-configCmd
-    .command("migrate")
-    .description("Migrate plugin config files into the manifest (one-time upgrade)")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, config_1.configMigrateCommand)(opts);
-});
-const secretsCmd = program
-    .command("secrets")
-    .description("View or update Pulumi secrets without re-running init");
-secretsCmd
-    .command("set <key> <value>")
-    .description("Set a secret (e.g. braveApiKey, anthropicApiKey)")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .option("-a, --agent <role>", "Agent role for per-agent secrets (e.g. eng, pm, tester)")
-    .action(async (key, value, opts) => {
-    await (0, secrets_1.secretsSetCommand)(key, value, opts);
-});
-secretsCmd
-    .command("list")
-    .description("Show which secrets are configured (values redacted)")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, secrets_1.secretsListCommand)(opts);
-});
-const webhooksCmd = program
-    .command("webhooks")
-    .description("Manage agent webhooks");
-webhooksCmd
-    .command("setup")
-    .description("Configure Linear webhooks for deployed agents")
-    .option("-c, --config <name>", "Config name (auto-detected if only one)")
-    .action(async (opts) => {
-    await (0, webhooks_1.webhooksSetupCommand)(opts);
-});
-program
-    .command("update")
-    .description("Update clawup CLI to the latest version")
-    .action(async (opts) => {
-    await (0, update_1.updateCommand)(opts);
-});
-// Fire-and-forget update check — must run before parse() because
-// Commander's --help/--version call process.exit() synchronously.
-// The cached path (no await) prints the notice before exit;
-// the stale-cache path fetches in the background for the next run.
-(0, update_check_1.checkForUpdates)(pkgJson.version).catch(() => { });
+    cliAdapter = createCLIAdapter();
+  }
+});
+
+// adapters/api-adapter.ts
+var init_api_adapter = __esm({
+  "adapters/api-adapter.ts"() {
+    "use strict";
+    init_vendor();
+  }
+});
+
+// adapters/index.ts
+var init_adapters = __esm({
+  "adapters/index.ts"() {
+    "use strict";
+    init_cli_adapter();
+    init_api_adapter();
+  }
+});
+
+// tools/index.ts
+var init_tools = __esm({
+  "tools/index.ts"() {
+    "use strict";
+    init_deploy();
+    init_status();
+    init_validate();
+    init_destroy();
+    init_redeploy();
+    init_push();
+    init_webhooks();
+    init_adapters();
+  }
+});
+
+// commands/deploy.ts
+var deploy_exports = {};
+__export(deploy_exports, {
+  deployCommand: () => deployCommand
+});
+async function deployCommand(opts) {
+  await deployTool(createCLIAdapter(), opts);
+}
+var init_deploy2 = __esm({
+  "commands/deploy.ts"() {
+    "use strict";
+    init_tools();
+  }
+});
+
+// bin.ts
+var fs7 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
+var import_commander = require("commander");
+init_process();
+
+// commands/init.ts
+var import_child_process7 = require("child_process");
+var p4 = __toESM(require("@clack/prompts"));
+var import_core9 = require("@clawup/core");
+var import_identity2 = require("@clawup/core/identity");
+var os4 = __toESM(require("os"));
+var path5 = __toESM(require("path"));
+
+// lib/prerequisites.ts
+var p = __toESM(require("@clack/prompts"));
+init_exec();
+init_vendor();
+init_workspace();
+init_tailscale();
+async function checkPrerequisites() {
+  const results = [];
+  if (commandExists("pulumi")) {
+    const ver = capture("pulumi", ["version"]);
+    const source = isVendored("pulumi") ? "vendored" : "system";
+    results.push({ name: "Pulumi", ok: true, message: `found (${ver.stdout}, ${source})` });
+  } else {
+    results.push({
+      name: "Pulumi",
+      ok: false,
+      message: "not found",
+      hint: "Install from https://www.pulumi.com/docs/iac/download-install/ or run `npm install` to vendor automatically"
+    });
+  }
+  if (commandExists("node")) {
+    const ver = capture("node", ["-v"]);
+    const major = parseInt(ver.stdout.replace("v", "").split(".")[0], 10);
+    if (major >= 18) {
+      results.push({ name: "Node.js", ok: true, message: `${ver.stdout} (>= 18 required)` });
+    } else {
+      results.push({
+        name: "Node.js",
+        ok: false,
+        message: `${ver.stdout} is too old`,
+        hint: "Requires Node.js 18+. Install from https://nodejs.org/"
+      });
+    }
+  } else {
+    results.push({
+      name: "Node.js",
+      ok: false,
+      message: "not found",
+      hint: "Install from https://nodejs.org/"
+    });
+  }
+  if (commandExists("aws")) {
+    const source = isVendored("aws") ? "vendored" : "system";
+    results.push({ name: "AWS CLI", ok: true, message: `found (${source})` });
+  } else {
+    results.push({
+      name: "AWS CLI",
+      ok: false,
+      message: "not found",
+      hint: "Install from https://aws.amazon.com/cli/ or run `npm install` to vendor automatically"
+    });
+  }
+  if (isTailscaleInstalled()) {
+    results.push({ name: "Tailscale", ok: true, message: "found" });
+  } else {
+    const hint = process.platform === "darwin" ? "Install from the Mac App Store or https://tailscale.com/download" : "Install from https://tailscale.com/download";
+    results.push({
+      name: "Tailscale",
+      ok: false,
+      message: "not found",
+      hint
+    });
+  }
+  if (isDevMode()) {
+    if (commandExists("pnpm")) {
+      results.push({ name: "pnpm", ok: true, message: "found" });
+    } else {
+      results.push({
+        name: "pnpm",
+        ok: false,
+        message: "not found",
+        hint: "Install with: npm install -g pnpm"
+      });
+    }
+  }
+  const allOk = results.every((r) => r.ok);
+  for (const r of results) {
+    if (r.ok) {
+      p.log.success(`${r.name}: ${r.message}`);
+    } else {
+      p.log.error(`${r.name}: ${r.message}`);
+      if (r.hint) {
+        p.log.message(`  ${r.hint}`);
+      }
+    }
+  }
+  return allOk;
+}
+
+// commands/init.ts
+init_pulumi();
+init_config();
+init_workspace();
+init_ui();
+async function initCommand(opts = {}) {
+  showBanner();
+  p4.log.step("Checking prerequisites...");
+  const prereqsOk = await checkPrerequisites();
+  if (!prereqsOk) {
+    exitWithError("Prerequisites not met. Please install the missing tools and try again.");
+  }
+  p4.log.success("All prerequisites satisfied!");
+  const stackName = await p4.text({
+    message: "Pulumi stack name",
+    placeholder: "dev",
+    defaultValue: "dev"
+  });
+  handleCancel(stackName);
+  const provider = await p4.select({
+    message: "Cloud provider",
+    options: import_core9.PROVIDERS.map((prov) => ({ value: prov.value, label: prov.label, hint: prov.hint })),
+    initialValue: "aws"
+  });
+  handleCancel(provider);
+  let region;
+  let instanceType;
+  if (provider === "aws") {
+    const awsRegion = await p4.select({
+      message: "AWS region",
+      options: import_core9.AWS_REGIONS,
+      initialValue: "us-east-1"
+    });
+    handleCancel(awsRegion);
+    region = awsRegion;
+    const awsInstanceType = await p4.select({
+      message: "Default instance type",
+      options: import_core9.INSTANCE_TYPES,
+      initialValue: "t3.medium"
+    });
+    handleCancel(awsInstanceType);
+    instanceType = awsInstanceType;
+  } else {
+    const hetznerLocation = await p4.select({
+      message: "Hetzner location",
+      options: import_core9.HETZNER_LOCATIONS,
+      initialValue: "fsn1"
+    });
+    handleCancel(hetznerLocation);
+    region = hetznerLocation;
+    const serverTypeOptions = (0, import_core9.hetznerServerTypes)(region);
+    const hetznerServerType = await p4.select({
+      message: "Default server type",
+      options: serverTypeOptions,
+      initialValue: serverTypeOptions[0].value
+    });
+    handleCancel(hetznerServerType);
+    instanceType = hetznerServerType;
+  }
+  const ownerName = await p4.text({
+    message: "Owner name (for workspace templates)",
+    placeholder: "Boss",
+    defaultValue: "Boss"
+  });
+  handleCancel(ownerName);
+  const timezone = await p4.text({
+    message: "Your timezone",
+    placeholder: "PST (America/Los_Angeles)",
+    defaultValue: "PST (America/Los_Angeles)"
+  });
+  handleCancel(timezone);
+  const workingHours = await p4.text({
+    message: "Your working hours",
+    placeholder: "9am-6pm",
+    defaultValue: "9am-6pm"
+  });
+  handleCancel(workingHours);
+  const userNotes = await p4.text({
+    message: "Any notes for your agents about you? (optional)",
+    placeholder: "e.g., Prefers concise updates, hates unnecessary meetings",
+    defaultValue: ""
+  });
+  handleCancel(userNotes);
+  const basicConfig = {
+    stackName,
+    provider,
+    region,
+    instanceType,
+    ownerName,
+    timezone,
+    workingHours,
+    userNotes: userNotes || "No additional notes provided yet."
+  };
+  p4.log.step("Configure Anthropic API key");
+  p4.note(
+    import_core9.KEY_INSTRUCTIONS.anthropicApiKey.steps.join("\n"),
+    import_core9.KEY_INSTRUCTIONS.anthropicApiKey.title
+  );
+  const anthropicApiKey = await p4.text({
+    message: "Anthropic API key",
+    placeholder: `${import_core9.MODEL_PROVIDERS.anthropic.keyPrefix}...`,
+    validate: (val) => {
+      if (!val) return "API key is required";
+      if (!val.startsWith(import_core9.MODEL_PROVIDERS.anthropic.keyPrefix)) {
+        return `Must start with ${import_core9.MODEL_PROVIDERS.anthropic.keyPrefix}`;
+      }
+    }
+  });
+  handleCancel(anthropicApiKey);
+  p4.log.step("Configure infrastructure secrets");
+  p4.note(
+    import_core9.KEY_INSTRUCTIONS.tailscaleAuthKey.steps.join("\n"),
+    import_core9.KEY_INSTRUCTIONS.tailscaleAuthKey.title
+  );
+  const tailscaleAuthKey = await p4.password({
+    message: "Tailscale auth key",
+    validate: (val) => {
+      if (!val.startsWith("tskey-auth-")) return "Must start with tskey-auth-";
+    }
+  });
+  handleCancel(tailscaleAuthKey);
+  p4.note(
+    import_core9.KEY_INSTRUCTIONS.tailnetDnsName.steps.join("\n"),
+    import_core9.KEY_INSTRUCTIONS.tailnetDnsName.title
+  );
+  const tailnetDnsName = await p4.text({
+    message: "Tailnet DNS name",
+    placeholder: "my-tailnet.ts.net",
+    validate: (val) => {
+      if (!val.endsWith(".ts.net")) return "Must end with .ts.net";
+    }
+  });
+  handleCancel(tailnetDnsName);
+  p4.note(
+    import_core9.KEY_INSTRUCTIONS.tailscaleApiKey.steps.join("\n"),
+    import_core9.KEY_INSTRUCTIONS.tailscaleApiKey.title
+  );
+  const tailscaleApiKey = await p4.text({
+    message: "Tailscale API key (press Enter to skip)",
+    placeholder: "tskey-api-... (optional)",
+    defaultValue: ""
+  });
+  handleCancel(tailscaleApiKey);
+  let hcloudToken;
+  if (provider === "hetzner") {
+    p4.note(
+      import_core9.KEY_INSTRUCTIONS.hcloudToken.steps.join("\n"),
+      import_core9.KEY_INSTRUCTIONS.hcloudToken.title
+    );
+    const token = await p4.password({
+      message: "Hetzner Cloud API token",
+      validate: (val) => {
+        if (!val) return "API token is required for Hetzner deployments";
+      }
+    });
+    handleCancel(token);
+    hcloudToken = token;
+  }
+  p4.log.step("Configure agents");
+  const agentMode = await p4.select({
+    message: "How would you like to configure agents?",
+    options: [
+      { value: "built-in", label: "Built-in agents", hint: "PM (Juno), Eng (Titus), QA (Scout)" },
+      { value: "identity", label: "From identity source", hint: "Load from a Git URL or local path" },
+      { value: "mix", label: "Mix of both", hint: "Pick built-in + add from identity source" }
+    ]
+  });
+  handleCancel(agentMode);
+  const fetchedIdentities = [];
+  const identityCacheDir = path5.join(os4.homedir(), ".clawup", "identity-cache");
+  if (agentMode === "built-in" || agentMode === "mix") {
+    const selectedBuiltIns = await p4.multiselect({
+      message: "Select agents",
+      options: Object.entries(import_core9.BUILT_IN_IDENTITIES).map(([key, entry]) => ({
+        value: key,
+        label: entry.label,
+        hint: entry.hint
+      })),
+      required: agentMode === "built-in"
+    });
+    handleCancel(selectedBuiltIns);
+    for (const key of selectedBuiltIns) {
+      const entry = import_core9.BUILT_IN_IDENTITIES[key];
+      const identity = await (0, import_identity2.fetchIdentity)(entry.path, identityCacheDir);
+      const agent = {
+        name: `agent-${identity.manifest.name}`,
+        displayName: identity.manifest.displayName,
+        role: identity.manifest.role,
+        identity: entry.path,
+        volumeSize: identity.manifest.volumeSize
+      };
+      fetchedIdentities.push({ agent, manifest: identity.manifest });
+    }
+  }
+  if (agentMode === "identity" || agentMode === "mix") {
+    let addMore = true;
+    while (addMore) {
+      const identityUrl = await p4.text({
+        message: "Identity source (Git URL or local path)",
+        placeholder: "https://github.com/org/identities#agent-name",
+        validate: (val) => {
+          if (!val.trim()) return "Identity source is required";
+        }
+      });
+      handleCancel(identityUrl);
+      const spinner4 = p4.spinner();
+      spinner4.start("Validating identity...");
+      try {
+        const identity = await (0, import_identity2.fetchIdentity)(identityUrl, identityCacheDir);
+        spinner4.stop(
+          `Found: ${identity.manifest.displayName} (${identity.manifest.role}) \u2014 ${identity.manifest.description}`
+        );
+        const volumeOverride = await p4.text({
+          message: `Volume size in GB (default: ${identity.manifest.volumeSize})`,
+          placeholder: String(identity.manifest.volumeSize),
+          defaultValue: String(identity.manifest.volumeSize),
+          validate: (val) => {
+            const n = parseInt(val, 10);
+            if (isNaN(n) || n < 8 || n > 500) return "Must be between 8 and 500";
+          }
+        });
+        handleCancel(volumeOverride);
+        const agent = {
+          name: `agent-${identity.manifest.name}`,
+          displayName: identity.manifest.displayName,
+          role: identity.manifest.role,
+          identity: identityUrl,
+          volumeSize: parseInt(volumeOverride, 10)
+        };
+        fetchedIdentities.push({ agent, manifest: identity.manifest });
+      } catch (err) {
+        spinner4.stop(`Failed to validate identity: ${err.message}`);
+        p4.log.error("Please check the URL and try again.");
+        continue;
+      }
+      const more = await p4.confirm({
+        message: "Add another identity-based agent?",
+        initialValue: false
+      });
+      handleCancel(more);
+      addMore = more;
+    }
+  }
+  if (fetchedIdentities.length === 0) {
+    exitWithError("No agents configured. At least one agent is required.");
+  }
+  const agents = fetchedIdentities.map((fi) => fi.agent);
+  const autoVars = {
+    OWNER_NAME: basicConfig.ownerName,
+    TIMEZONE: basicConfig.timezone,
+    WORKING_HOURS: basicConfig.workingHours,
+    USER_NOTES: basicConfig.userNotes
+  };
+  const allTemplateVarNames = /* @__PURE__ */ new Set();
+  for (const fi of fetchedIdentities) {
+    for (const v of fi.manifest.templateVars ?? []) {
+      allTemplateVarNames.add(v);
+    }
+  }
+  const templateVars = {};
+  for (const varName of allTemplateVarNames) {
+    if (autoVars[varName]) {
+      templateVars[varName] = autoVars[varName];
+    }
+  }
+  const remainingVars = [...allTemplateVarNames].filter((v) => !templateVars[v]);
+  if (remainingVars.length > 0) {
+    p4.log.step("Configure template variables");
+    p4.log.info(`Your agents use the following template variables: ${remainingVars.join(", ")}`);
+    for (const varName of remainingVars) {
+      const value = await p4.text({
+        message: `Value for ${varName}`,
+        placeholder: varName === "LINEAR_TEAM" ? "e.g., ENG" : varName === "GITHUB_REPO" ? "https://github.com/org/repo" : "",
+        validate: (val) => {
+          if (!val.trim()) return `${varName} is required`;
+        }
+      });
+      handleCancel(value);
+      templateVars[varName] = value;
+    }
+  }
+  p4.log.step("Configure integrations");
+  const agentPlugins = /* @__PURE__ */ new Map();
+  const agentDeps = /* @__PURE__ */ new Map();
+  const allPluginNames = /* @__PURE__ */ new Set();
+  const allDepNames = /* @__PURE__ */ new Set();
+  for (const fi of fetchedIdentities) {
+    const plugins = new Set(fi.manifest.plugins ?? []);
+    const deps = new Set(fi.manifest.deps ?? []);
+    agentPlugins.set(fi.agent.name, plugins);
+    agentDeps.set(fi.agent.name, deps);
+    for (const pl of plugins) allPluginNames.add(pl);
+    for (const d of deps) allDepNames.add(d);
+  }
+  const identityPluginDefaults = {};
+  for (const fi of fetchedIdentities) {
+    if (fi.manifest.pluginDefaults) {
+      identityPluginDefaults[fi.agent.name] = fi.manifest.pluginDefaults;
+    }
+  }
+  const integrationCredentials = {};
+  for (const agent of agents) {
+    integrationCredentials[agent.role] = {};
+  }
+  const slackCredentials = {};
+  if (allPluginNames.has("slack")) {
+    p4.note(
+      import_core9.KEY_INSTRUCTIONS.slackCredentials.steps.join("\n"),
+      import_core9.KEY_INSTRUCTIONS.slackCredentials.title
+    );
+    for (const fi of fetchedIdentities) {
+      if (!agentPlugins.get(fi.agent.name)?.has("slack")) continue;
+      const slackManifest = (0, import_core9.slackAppManifest)(fi.agent.displayName);
+      try {
+        (0, import_child_process7.execSync)(
+          process.platform === "darwin" ? "pbcopy" : "xclip -selection clipboard",
+          { input: slackManifest }
+        );
+        p4.log.success(`Slack manifest for ${fi.agent.displayName} copied to clipboard \u2014 paste it into Slack`);
+      } catch {
+        p4.log.warn(`Could not copy to clipboard. Manifest for ${fi.agent.displayName}:`);
+        console.log(slackManifest);
+      }
+      const botToken = await p4.password({
+        message: `Slack Bot Token for ${fi.agent.displayName} (${fi.agent.role})`,
+        validate: (val) => {
+          if (!val.startsWith("xoxb-")) return "Must start with xoxb-";
+        }
+      });
+      handleCancel(botToken);
+      const appToken = await p4.password({
+        message: `Slack App Token for ${fi.agent.displayName} (${fi.agent.role})`,
+        validate: (val) => {
+          if (!val.startsWith("xapp-")) return "Must start with xapp-";
+        }
+      });
+      handleCancel(appToken);
+      slackCredentials[fi.agent.role] = {
+        botToken,
+        appToken
+      };
+    }
+  }
+  if (allPluginNames.has("openclaw-linear")) {
+    p4.note(
+      import_core9.KEY_INSTRUCTIONS.linearApiKey.steps.join("\n"),
+      import_core9.KEY_INSTRUCTIONS.linearApiKey.title
+    );
+    const linearAgents = fetchedIdentities.filter(
+      (fi) => agentPlugins.get(fi.agent.name)?.has("openclaw-linear")
+    );
+    for (const fi of linearAgents) {
+      const linearKey = await p4.password({
+        message: `Linear API key for ${fi.agent.displayName} (${fi.agent.role})`,
+        validate: (val) => {
+          if (!val.startsWith("lin_api_")) return "Must start with lin_api_";
+        }
+      });
+      handleCancel(linearKey);
+      integrationCredentials[fi.agent.role].linearApiKey = linearKey;
+      const s2 = p4.spinner();
+      s2.start(`Fetching Linear user ID for ${fi.agent.displayName}...`);
+      try {
+        const res = await fetch("https://api.linear.app/graphql", {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: linearKey
+          },
+          body: JSON.stringify({ query: "{ viewer { id } }" })
+        });
+        const data = await res.json();
+        const uuid = data?.data?.viewer?.id;
+        if (!uuid) throw new Error("No user ID in response");
+        integrationCredentials[fi.agent.role].linearUserUuid = uuid;
+        s2.stop(`${fi.agent.displayName}: ${uuid}`);
+      } catch (err) {
+        s2.stop(`Could not fetch Linear user ID for ${fi.agent.displayName}`);
+        p4.log.warn(`${err instanceof Error ? err.message : String(err)}`);
+        const linearUserUuid = await p4.text({
+          message: `Enter Linear user UUID manually for ${fi.agent.displayName}`,
+          placeholder: "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+          validate: (val) => {
+            if (!val) return "Linear user UUID is required";
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(val)) {
+              return "Must be a valid UUID format";
+            }
+          }
+        });
+        handleCancel(linearUserUuid);
+        integrationCredentials[fi.agent.role].linearUserUuid = linearUserUuid;
+      }
+    }
+    p4.note(
+      [
+        "Create a webhook in Linear for each agent:",
+        '1. Go to Settings \u2192 API \u2192 Webhooks \u2192 "New webhook"',
+        "2. Paste the webhook URL shown below for each agent",
+        "3. Select events to receive (e.g., Issues, Comments)",
+        '4. Copy the "Signing secret" shown after creating the webhook'
+      ].join("\n"),
+      "Linear Webhook Setup"
+    );
+    for (const fi of linearAgents) {
+      const webhookUrl = `https://${(0, import_core9.tailscaleHostname)(basicConfig.stackName, fi.agent.name)}.${tailnetDnsName}/hooks/linear`;
+      p4.log.info(`${fi.agent.displayName} (${fi.agent.role}): ${webhookUrl}`);
+      const webhookSecretInput = await p4.password({
+        message: `Signing secret for ${fi.agent.displayName} (${fi.agent.role})`,
+        validate: (val) => {
+          if (!val) return "Webhook signing secret is required";
+        }
+      });
+      handleCancel(webhookSecretInput);
+      integrationCredentials[fi.agent.role].linearWebhookSecret = webhookSecretInput;
+    }
+  }
+  if (allDepNames.has("gh")) {
+    p4.note(
+      import_core9.KEY_INSTRUCTIONS.githubToken.steps.join("\n"),
+      import_core9.KEY_INSTRUCTIONS.githubToken.title
+    );
+    for (const fi of fetchedIdentities) {
+      if (!agentDeps.get(fi.agent.name)?.has("gh")) continue;
+      const githubKey = await p4.password({
+        message: `GitHub token for ${fi.agent.displayName} (${fi.agent.role})`,
+        validate: (val) => {
+          if (!val.startsWith("ghp_") && !val.startsWith("github_pat_")) {
+            return "Must start with ghp_ or github_pat_";
+          }
+        }
+      });
+      handleCancel(githubKey);
+      integrationCredentials[fi.agent.role].githubToken = githubKey;
+    }
+  }
+  let braveApiKey;
+  if (allDepNames.has("brave-search")) {
+    p4.note(
+      import_core9.KEY_INSTRUCTIONS.braveApiKey.steps.join("\n"),
+      import_core9.KEY_INSTRUCTIONS.braveApiKey.title
+    );
+    const braveKey = await p4.password({
+      message: "Brave Search API key",
+      validate: (val) => {
+        if (!val) return "API key is required";
+      }
+    });
+    handleCancel(braveKey);
+    braveApiKey = braveKey;
+  }
+  const costEstimates = basicConfig.provider === "aws" ? import_core9.COST_ESTIMATES : import_core9.HETZNER_COST_ESTIMATES;
+  const costPerAgent = costEstimates[basicConfig.instanceType] ?? 30;
+  const totalCost = agents.reduce((sum, a) => {
+    const agentCost = costEstimates[a.instanceType ?? basicConfig.instanceType] ?? costPerAgent;
+    return sum + agentCost;
+  }, 0);
+  const integrationNames = [];
+  if (allPluginNames.has("openclaw-linear")) integrationNames.push("Linear");
+  if (allPluginNames.has("slack")) integrationNames.push("Slack");
+  if (allDepNames.has("gh")) integrationNames.push("GitHub CLI");
+  if (allDepNames.has("brave-search")) integrationNames.push("Brave Search");
+  const providerLabel = basicConfig.provider === "aws" ? "AWS" : "Hetzner";
+  const regionLabel = basicConfig.provider === "aws" ? "Region" : "Location";
+  const customVarEntries = Object.entries(templateVars).filter(
+    ([k]) => !autoVars[k]
+  );
+  const summaryLines = [
+    `Stack:          ${basicConfig.stackName}`,
+    `Provider:       ${providerLabel}`,
+    `${regionLabel.padEnd(14, " ")} ${basicConfig.region}`,
+    `Instance type:  ${basicConfig.instanceType}`,
+    `Owner:          ${basicConfig.ownerName}`,
+    `Timezone:       ${basicConfig.timezone}`,
+    `Working hours:  ${basicConfig.workingHours}`
+  ];
+  if (customVarEntries.length > 0) {
+    for (const [k, v] of customVarEntries) {
+      summaryLines.push(`${k.padEnd(14, " ")} ${v}`);
+    }
+  }
+  if (integrationNames.length > 0) {
+    summaryLines.push(`Integrations:   ${integrationNames.join(", ")}`);
+  }
+  summaryLines.push(
+    ``,
+    `Agents (${agents.length}):`,
+    formatAgentList(agents),
+    ``,
+    `Estimated cost: ${formatCost(totalCost)}`
+  );
+  p4.note(summaryLines.join("\n"), "Deployment Summary");
+  const confirmed = await p4.confirm({
+    message: "Proceed with setup?"
+  });
+  handleCancel(confirmed);
+  if (!confirmed) {
+    p4.cancel("Setup cancelled.");
+    process.exit(0);
+  }
+  const s = p4.spinner();
+  s.start("Setting up workspace...");
+  const wsResult = ensureWorkspace();
+  if (!wsResult.ok) {
+    s.stop("Failed to set up workspace");
+    exitWithError(wsResult.error ?? "Failed to set up workspace.");
+  }
+  s.stop("Workspace ready");
+  const cwd = getWorkspaceDir();
+  s.start("Selecting Pulumi stack...");
+  const stackResult = selectOrCreateStack(basicConfig.stackName, cwd);
+  if (!stackResult.ok) {
+    s.stop("Failed to select/create stack");
+    if (stackResult.error) p4.log.error(stackResult.error);
+    exitWithError(`Could not select or create Pulumi stack "${basicConfig.stackName}".`);
+  }
+  s.stop("Pulumi stack ready");
+  s.start("Setting Pulumi configuration...");
+  setConfig("provider", basicConfig.provider, false, cwd);
+  if (basicConfig.provider === "aws") {
+    setConfig("aws:region", basicConfig.region, false, cwd);
+  } else {
+    setConfig("hetzner:location", basicConfig.region, false, cwd);
+    if (hcloudToken) {
+      setConfig("hcloud:token", hcloudToken, true, cwd);
+    }
+  }
+  setConfig("anthropicApiKey", anthropicApiKey, true, cwd);
+  setConfig("tailscaleAuthKey", tailscaleAuthKey, true, cwd);
+  setConfig("tailnetDnsName", tailnetDnsName, false, cwd);
+  if (tailscaleApiKey) {
+    setConfig("tailscaleApiKey", tailscaleApiKey, true, cwd);
+  }
+  setConfig("instanceType", basicConfig.instanceType, false, cwd);
+  setConfig("ownerName", basicConfig.ownerName, false, cwd);
+  setConfig("timezone", basicConfig.timezone, false, cwd);
+  setConfig("workingHours", basicConfig.workingHours, false, cwd);
+  setConfig("userNotes", basicConfig.userNotes, false, cwd);
+  for (const [role, creds] of Object.entries(integrationCredentials)) {
+    if (creds.linearApiKey) setConfig(`${role}LinearApiKey`, creds.linearApiKey, true, cwd);
+    if (creds.linearWebhookSecret) setConfig(`${role}LinearWebhookSecret`, creds.linearWebhookSecret, true, cwd);
+    if (creds.linearUserUuid) setConfig(`${role}LinearUserUuid`, creds.linearUserUuid, false, cwd);
+    if (creds.githubToken) setConfig(`${role}GithubToken`, creds.githubToken, true, cwd);
+  }
+  for (const [role, creds] of Object.entries(slackCredentials)) {
+    setConfig(`${role}SlackBotToken`, creds.botToken, true, cwd);
+    setConfig(`${role}SlackAppToken`, creds.appToken, true, cwd);
+  }
+  if (braveApiKey) setConfig("braveApiKey", braveApiKey, true, cwd);
+  s.stop("Configuration saved");
+  const configName = basicConfig.stackName;
+  s.start(`Writing config to ~/.clawup/configs/${configName}.yaml...`);
+  const manifestTemplateVars = {};
+  for (const [k, v] of Object.entries(templateVars)) {
+    if (!autoVars[k]) {
+      manifestTemplateVars[k] = v;
+    }
+  }
+  const manifest = {
+    stackName: configName,
+    provider: basicConfig.provider,
+    region: basicConfig.region,
+    instanceType: basicConfig.instanceType,
+    ownerName: basicConfig.ownerName,
+    timezone: basicConfig.timezone,
+    workingHours: basicConfig.workingHours,
+    userNotes: basicConfig.userNotes,
+    templateVars: Object.keys(manifestTemplateVars).length > 0 ? manifestTemplateVars : void 0,
+    agents
+  };
+  for (const fi of fetchedIdentities) {
+    const rolePlugins = agentPlugins.get(fi.agent.name);
+    if (!rolePlugins || rolePlugins.size === 0) continue;
+    const inlinePlugins = {};
+    const defaults = identityPluginDefaults[fi.agent.name] ?? {};
+    for (const pluginName of rolePlugins) {
+      const pluginDefaults = defaults[pluginName] ?? {};
+      const agentConfig = {
+        ...pluginDefaults,
+        agentId: fi.agent.name
+      };
+      if (pluginName === "openclaw-linear") {
+        const creds = integrationCredentials[fi.agent.role];
+        if (creds?.linearUserUuid) {
+          agentConfig.linearUserUuid = creds.linearUserUuid;
+        }
+      }
+      inlinePlugins[pluginName] = agentConfig;
+    }
+    if (Object.keys(inlinePlugins).length > 0) {
+      fi.agent.plugins = inlinePlugins;
+    }
+  }
+  saveManifest(configName, manifest);
+  s.stop("Config saved");
+  if (opts.deploy) {
+    p4.log.success("Config saved! Starting deployment...\n");
+    const { deployCommand: deployCommand2 } = await Promise.resolve().then(() => (init_deploy2(), deploy_exports));
+    await deployCommand2({ config: configName, yes: opts.yes });
+  } else {
+    p4.outro("Setup complete! Run `clawup deploy` to deploy your agents.");
+  }
+}
+
+// bin.ts
+init_deploy2();
+
+// commands/status.ts
+init_tools();
+async function statusCommand(opts) {
+  await statusTool(createCLIAdapter(), opts);
+}
+
+// commands/ssh.ts
+var p5 = __toESM(require("@clack/prompts"));
+init_config();
+init_pulumi();
+var import_core10 = require("@clawup/core");
+init_workspace();
+init_ui();
+init_tailscale();
+var import_child_process8 = require("child_process");
+async function sshCommand(agentNameOrAlias, commandArgs, opts) {
+  requireTailscale();
+  const wsResult = ensureWorkspace();
+  if (!wsResult.ok) {
+    exitWithError(wsResult.error ?? "Failed to set up workspace.");
+  }
+  const cwd = getWorkspaceDir();
+  let configName;
+  try {
+    configName = resolveConfigName(opts.config);
+  } catch (err) {
+    exitWithError(err.message);
+  }
+  const manifest = loadManifest(configName);
+  if (!manifest) {
+    exitWithError(`Config '${configName}' could not be loaded.`);
+  }
+  const stackResult = selectOrCreateStack(manifest.stackName, cwd);
+  if (!stackResult.ok) {
+    exitWithError(`Could not select Pulumi stack "${manifest.stackName}".`);
+  }
+  const query = agentNameOrAlias.toLowerCase();
+  const resolvedRole = import_core10.AGENT_ALIASES[query] ?? query;
+  const agent = manifest.agents.find(
+    (a) => a.role === resolvedRole || a.name === query || a.name === `agent-${query}` || a.displayName.toLowerCase() === query
+  );
+  if (!agent) {
+    const validNames = manifest.agents.map((a) => `${a.role}, ${a.displayName.toLowerCase()}, ${a.name}`).join("\n  ");
+    exitWithError(
+      `Unknown agent: "${agentNameOrAlias}"
+Valid identifiers (any of these work):
+  ${validNames}`
+    );
+  }
+  const tailnetDnsName = getConfig("tailnetDnsName", cwd);
+  if (!tailnetDnsName) {
+    exitWithError("Could not determine tailnet DNS name from Pulumi config.");
+  }
+  const tsHost = (0, import_core10.tailscaleHostname)(manifest.stackName, agent.name);
+  const sshHost = `${tsHost}.${tailnetDnsName}`;
+  const user = opts.user ?? import_core10.SSH_USER;
+  p5.log.info(`Connecting to ${agent.displayName} (${sshHost})...`);
+  const sshArgs = ["-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null", `${user}@${sshHost}`];
+  if (commandArgs.length > 0) {
+    sshArgs.push(commandArgs.join(" "));
+  }
+  const child = (0, import_child_process8.spawn)("ssh", sshArgs, { stdio: "inherit" });
+  child.on("close", (code) => {
+    process.exit(code ?? 0);
+  });
+}
+
+// commands/validate.ts
+init_tools();
+async function validateCommand(opts) {
+  await validateTool(createCLIAdapter(), opts);
+}
+
+// commands/push.ts
+init_tools();
+init_ui();
+async function pushCommand(opts) {
+  try {
+    await pushTool(createCLIAdapter(), opts);
+  } catch (err) {
+    exitWithError(err instanceof Error ? err.message : String(err));
+  }
+}
+
+// commands/destroy.ts
+init_tools();
+async function destroyCommand(opts) {
+  await destroyTool(createCLIAdapter(), opts);
+}
+
+// commands/list.ts
+init_config();
+async function listCommand(opts) {
+  const configs = listManifests();
+  if (configs.length === 0) {
+    console.log("No configs found. Run 'clawup init' to create one.");
+    return;
+  }
+  const data = configs.map((name) => {
+    const manifest = loadManifest(name);
+    return {
+      name,
+      agents: manifest?.agents.length ?? 0,
+      region: manifest?.region ?? "-",
+      stack: manifest?.stackName ?? "-",
+      path: configPath(name)
+    };
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  const nameWidth = Math.max(6, ...data.map((d) => d.name.length));
+  const agentsWidth = 6;
+  const regionWidth = Math.max(6, ...data.map((d) => d.region.length));
+  const stackWidth = Math.max(5, ...data.map((d) => d.stack.length));
+  console.log(
+    `${"NAME".padEnd(nameWidth)}  ${"AGENTS".padEnd(agentsWidth)}  ${"REGION".padEnd(regionWidth)}  ${"STACK".padEnd(stackWidth)}`
+  );
+  console.log(
+    `${"-".repeat(nameWidth)}  ${"-".repeat(agentsWidth)}  ${"-".repeat(regionWidth)}  ${"-".repeat(stackWidth)}`
+  );
+  for (const row of data) {
+    console.log(
+      `${row.name.padEnd(nameWidth)}  ${String(row.agents).padEnd(agentsWidth)}  ${row.region.padEnd(regionWidth)}  ${row.stack.padEnd(stackWidth)}`
+    );
+  }
+  console.log(`
+${data.length} config(s) found`);
+}
+
+// commands/update.ts
+var p6 = __toESM(require("@clack/prompts"));
+var import_picocolors9 = __toESM(require("picocolors"));
+init_exec();
+async function updateCommand(_opts) {
+  p6.intro(import_picocolors9.default.bgCyan(import_picocolors9.default.black(" Agent Army \u2014 Update ")));
+  const s = p6.spinner();
+  s.start("Checking npm for latest version\u2026");
+  const { default: https2 } = await import("https");
+  const latest = await new Promise((resolve2) => {
+    const req = https2.get(
+      "https://registry.npmjs.org/clawup/latest",
+      { timeout: 5e3 },
+      (res) => {
+        let data = "";
+        res.on("data", (chunk) => data += chunk);
+        res.on("end", () => {
+          try {
+            resolve2(JSON.parse(data).version ?? null);
+          } catch {
+            resolve2(null);
+          }
+        });
+      }
+    );
+    req.on("timeout", () => {
+      req.destroy();
+      resolve2(null);
+    });
+    req.on("error", () => resolve2(null));
+  });
+  if (!latest) {
+    s.stop("Failed to reach npm registry");
+    p6.log.error("Could not check for updates. Check your internet connection.");
+    process.exit(1);
+  }
+  const fs8 = await import("fs");
+  const path8 = await import("path");
+  const pkgJson2 = JSON.parse(
+    fs8.readFileSync(path8.join(__dirname, "..", "..", "package.json"), "utf-8")
+  );
+  const current = pkgJson2.version;
+  s.stop(`Current: ${import_picocolors9.default.dim(current)}  Latest: ${import_picocolors9.default.green(latest)}`);
+  const cParts = current.split(".").map(Number);
+  const lParts = latest.split(".").map(Number);
+  let isOutdated = false;
+  for (let i = 0; i < 3; i++) {
+    if ((lParts[i] ?? 0) > (cParts[i] ?? 0)) {
+      isOutdated = true;
+      break;
+    }
+    if ((lParts[i] ?? 0) < (cParts[i] ?? 0)) break;
+  }
+  if (!isOutdated) {
+    p6.log.success("You're already on the latest version!");
+    p6.outro("Done");
+    return;
+  }
+  p6.log.step(`Updating ${import_picocolors9.default.dim(current)} \u2192 ${import_picocolors9.default.green(latest)}`);
+  console.log();
+  const MAX_RETRIES2 = 3;
+  const RETRY_DELAY_MS = 1e4;
+  let exitCode = 1;
+  for (let attempt = 1; attempt <= MAX_RETRIES2; attempt++) {
+    exitCode = await stream("npm", ["install", "-g", `clawup@${latest}`]);
+    if (exitCode === 0) break;
+    if (attempt < MAX_RETRIES2) {
+      console.log();
+      p6.log.warn(
+        `Install failed (attempt ${attempt}/${MAX_RETRIES2}). Retrying in ${RETRY_DELAY_MS / 1e3}s \u2014 the new version may still be propagating\u2026`
+      );
+      await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+      console.log();
+    }
+  }
+  console.log();
+  if (exitCode === 0) {
+    p6.log.success(`Updated to ${import_picocolors9.default.green(latest)}`);
+  } else {
+    p6.log.error("Update failed. You may need to run with sudo:");
+    p6.log.message(`  sudo npm install -g clawup@${latest}`);
+    process.exit(1);
+  }
+  p6.outro("Done");
+}
+
+// commands/config.ts
+var process2 = __toESM(require("process"));
+var import_yaml2 = __toESM(require("yaml"));
+var fs5 = __toESM(require("fs"));
+init_config();
+var import_core11 = require("@clawup/core");
+var import_picocolors10 = __toESM(require("picocolors"));
+var SETTABLE_TOP_KEYS = [
+  "region",
+  "instanceType",
+  "ownerName",
+  "timezone",
+  "workingHours",
+  "userNotes"
+];
+var SETTABLE_AGENT_KEYS = [
+  "instanceType",
+  "volumeSize",
+  "displayName"
+];
+function isSettableTopKey(key) {
+  return SETTABLE_TOP_KEYS.includes(key);
+}
+function isSettableAgentKey(key) {
+  return SETTABLE_AGENT_KEYS.includes(key);
+}
+function allRegionValues(provider) {
+  if (provider === "hetzner") return import_core11.HETZNER_LOCATIONS.map((r) => r.value);
+  return import_core11.AWS_REGIONS.map((r) => r.value);
+}
+function allInstanceTypeValues(provider, region) {
+  if (provider === "hetzner") {
+    const types = region ? (0, import_core11.hetznerServerTypes)(region) : [...import_core11.HETZNER_SERVER_TYPES_EU, ...import_core11.HETZNER_SERVER_TYPES_US];
+    return types.map((t) => t.value);
+  }
+  return import_core11.INSTANCE_TYPES.map((t) => t.value);
+}
+function validateTopValue(manifest, key, value) {
+  const provider = manifest.provider ?? "aws";
+  if (key === "region") {
+    const valid = allRegionValues(provider);
+    if (!valid.includes(value)) {
+      return `Invalid region '${value}' for provider '${provider}'. Valid options:
+  ${valid.join("\n  ")}`;
+    }
+    if (provider === "hetzner" && manifest.instanceType) {
+      const validTypes = allInstanceTypeValues(provider, value);
+      if (!validTypes.includes(manifest.instanceType)) {
+        return `Region '${value}' is not compatible with current instanceType '${manifest.instanceType}'.
+Update instanceType first, or set both:
+  clawup config set instanceType <type>
+  clawup config set region ${value}`;
+      }
+    }
+  }
+  if (key === "instanceType") {
+    const valid = allInstanceTypeValues(provider, manifest.region);
+    if (!valid.includes(value)) {
+      return `Invalid instanceType '${value}' for provider '${provider}'. Valid options:
+  ${valid.join("\n  ")}`;
+    }
+  }
+  return null;
+}
+function validateAgentValue(manifest, key, value) {
+  if (key === "instanceType") {
+    const provider = manifest.provider ?? "aws";
+    const valid = allInstanceTypeValues(provider, manifest.region);
+    if (!valid.includes(value)) {
+      return `Invalid instanceType '${value}' for provider '${provider}'. Valid options:
+  ${valid.join("\n  ")}`;
+    }
+  }
+  if (key === "volumeSize") {
+    const num = Number(value);
+    if (isNaN(num) || num < 8 || num > 1e3) {
+      return `volumeSize must be a number between 8 and 1000 (GB). Got: '${value}'`;
+    }
+  }
+  return null;
+}
+async function configShowCommand(opts) {
+  let configName;
+  try {
+    configName = resolveConfigName(opts.config);
+  } catch (err) {
+    console.error(import_picocolors10.default.red(err.message));
+    process2.exit(1);
+  }
+  const manifest = loadManifest(configName);
+  if (!manifest) {
+    console.error(import_picocolors10.default.red(`Config '${configName}' could not be loaded.`));
+    process2.exit(1);
+  }
+  if (opts.json) {
+    console.log(import_yaml2.default.stringify(manifest).trimEnd());
+    return;
+  }
+  console.log();
+  console.log(import_picocolors10.default.bold(`Config: ${configName}`));
+  console.log();
+  console.log(`  Stack:          ${manifest.stackName}`);
+  console.log(`  Provider:       ${manifest.provider ?? "aws"}`);
+  console.log(`  Region:         ${manifest.region}`);
+  console.log(`  Instance Type:  ${manifest.instanceType}`);
+  console.log(`  Owner:          ${manifest.ownerName}`);
+  if (manifest.timezone) console.log(`  Timezone:       ${manifest.timezone}`);
+  if (manifest.workingHours) console.log(`  Working Hours:  ${manifest.workingHours}`);
+  if (manifest.userNotes) console.log(`  User Notes:     ${manifest.userNotes}`);
+  if (manifest.templateVars && Object.keys(manifest.templateVars).length > 0) {
+    console.log();
+    console.log(import_picocolors10.default.bold("Template Variables:"));
+    for (const [key, value] of Object.entries(manifest.templateVars)) {
+      console.log(`  ${key}: ${value}`);
+    }
+  }
+  console.log();
+  console.log(import_picocolors10.default.bold(`Agents (${manifest.agents.length}):`));
+  for (const agent of manifest.agents) {
+    const override = agent.instanceType ? ` [${agent.instanceType}]` : "";
+    console.log(`  ${import_picocolors10.default.bold(agent.displayName)} (${agent.role}) vol:${agent.volumeSize}GB${override}`);
+    console.log(`    identity: ${agent.identity}`);
+  }
+  console.log();
+}
+async function configSetCommand(key, value, opts) {
+  let configName;
+  try {
+    configName = resolveConfigName(opts.config);
+  } catch (err) {
+    console.error(import_picocolors10.default.red(err.message));
+    process2.exit(1);
+  }
+  const manifest = loadManifest(configName);
+  if (!manifest) {
+    console.error(import_picocolors10.default.red(`Config '${configName}' could not be loaded.`));
+    process2.exit(1);
+  }
+  if (opts.agent) {
+    if (!isSettableAgentKey(key)) {
+      console.error(import_picocolors10.default.red(`Invalid per-agent key '${key}'. Valid keys:
+  ${SETTABLE_AGENT_KEYS.join("\n  ")}`));
+      process2.exit(1);
+    }
+    const agent = manifest.agents.find(
+      (a) => a.name === opts.agent || a.displayName.toLowerCase() === opts.agent.toLowerCase() || a.role === opts.agent
+    );
+    if (!agent) {
+      const names = manifest.agents.map((a) => `${a.displayName} (${a.role})`).join(", ");
+      console.error(import_picocolors10.default.red(`Agent '${opts.agent}' not found. Available: ${names}`));
+      process2.exit(1);
+    }
+    const err = validateAgentValue(manifest, key, value);
+    if (err) {
+      console.error(import_picocolors10.default.red(err));
+      process2.exit(1);
+    }
+    const agentRec = agent;
+    const oldValue = agentRec[key];
+    if (key === "volumeSize") {
+      agent.volumeSize = Number(value);
+    } else {
+      agentRec[key] = value;
+    }
+    saveManifest(configName, manifest);
+    console.log(
+      import_picocolors10.default.green(`\u2713 ${agent.displayName}.${key}: ${String(oldValue ?? "(unset)")} \u2192 ${value}`)
+    );
+  } else if (key.startsWith("templateVars.")) {
+    const varName = key.slice("templateVars.".length);
+    if (!varName) {
+      console.error(import_picocolors10.default.red("Template variable name cannot be empty. Use: templateVars.KEY"));
+      process2.exit(1);
+    }
+    if (!manifest.templateVars) manifest.templateVars = {};
+    const oldValue = manifest.templateVars[varName];
+    manifest.templateVars[varName] = value;
+    saveManifest(configName, manifest);
+    console.log(import_picocolors10.default.green(`\u2713 templateVars.${varName}: ${String(oldValue ?? "(unset)")} \u2192 ${value}`));
+  } else {
+    if (!isSettableTopKey(key)) {
+      console.error(import_picocolors10.default.red(`Invalid key '${key}'. Valid keys:
+  ${SETTABLE_TOP_KEYS.join("\n  ")}
+  templateVars.<KEY>`));
+      process2.exit(1);
+    }
+    const err = validateTopValue(manifest, key, value);
+    if (err) {
+      console.error(import_picocolors10.default.red(err));
+      process2.exit(1);
+    }
+    const manifestRec = manifest;
+    const oldValue = manifestRec[key];
+    manifestRec[key] = value;
+    saveManifest(configName, manifest);
+    console.log(import_picocolors10.default.green(`\u2713 ${key}: ${String(oldValue ?? "(unset)")} \u2192 ${value}`));
+  }
+  console.log(import_picocolors10.default.dim("\nRun 'clawup redeploy' or 'clawup destroy && clawup deploy' to apply changes."));
+}
+async function configMigrateCommand(opts) {
+  let configName;
+  try {
+    configName = resolveConfigName(opts.config);
+  } catch (err) {
+    console.error(import_picocolors10.default.red(err.message));
+    process2.exit(1);
+  }
+  const manifest = loadManifest(configName);
+  if (!manifest) {
+    console.error(import_picocolors10.default.red(`Config '${configName}' could not be loaded.`));
+    process2.exit(1);
+  }
+  const pDir = pluginsDir(configName);
+  if (!fs5.existsSync(pDir)) {
+    console.log(import_picocolors10.default.green("No plugin config files found \u2014 nothing to migrate."));
+    return;
+  }
+  const pluginFiles = fs5.readdirSync(pDir).filter((f) => f.endsWith(".yaml"));
+  if (pluginFiles.length === 0) {
+    console.log(import_picocolors10.default.green("No plugin config files found \u2014 nothing to migrate."));
+    return;
+  }
+  let migratedCount = 0;
+  for (const file of pluginFiles) {
+    const pluginName = file.replace(/\.yaml$/, "");
+    const pluginConfig = loadPluginConfig(configName, pluginName);
+    if (!pluginConfig) continue;
+    for (const agent of manifest.agents) {
+      const roleConfig = pluginConfig.agents?.[agent.role];
+      if (!roleConfig) continue;
+      if (!agent.plugins) agent.plugins = {};
+      if (!agent.plugins[pluginName]) {
+        agent.plugins[pluginName] = roleConfig;
+        migratedCount++;
+      }
+    }
+    const filePath = `${pDir}/${file}`;
+    fs5.unlinkSync(filePath);
+    console.log(import_picocolors10.default.dim(`  Removed ${filePath}`));
+  }
+  try {
+    const remaining = fs5.readdirSync(pDir);
+    if (remaining.length === 0) {
+      fs5.rmdirSync(pDir);
+      const stackDir = `${pDir}/..`;
+      const stackRemaining = fs5.readdirSync(stackDir);
+      if (stackRemaining.length === 0) {
+        fs5.rmdirSync(stackDir);
+      }
+    }
+  } catch {
+  }
+  saveManifest(configName, manifest);
+  console.log(import_picocolors10.default.green(`
+\u2713 Migrated ${migratedCount} plugin config(s) into ${configName}.yaml`));
+  console.log(import_picocolors10.default.dim("Plugin config is now inline in the manifest under each agent's 'plugins' field."));
+}
+
+// commands/secrets.ts
+var process3 = __toESM(require("process"));
+init_config();
+init_pulumi();
+init_workspace();
+var import_picocolors11 = __toESM(require("picocolors"));
+var KNOWN_SECRETS = {
+  anthropicApiKey: { label: "Anthropic API Key", perAgent: false, isSecret: true },
+  tailscaleAuthKey: { label: "Tailscale Auth Key", perAgent: false, isSecret: true },
+  tailscaleApiKey: { label: "Tailscale API Key", perAgent: false, isSecret: true },
+  tailnetDnsName: { label: "Tailnet DNS Name", perAgent: false, isSecret: false },
+  braveApiKey: { label: "Brave Search API Key", perAgent: false, isSecret: true },
+  slackBotToken: { label: "Slack Bot Token", perAgent: true, isSecret: true },
+  slackAppToken: { label: "Slack App Token", perAgent: true, isSecret: true },
+  linearApiKey: { label: "Linear API Key", perAgent: true, isSecret: true },
+  linearWebhookSecret: { label: "Linear Webhook Secret", perAgent: true, isSecret: true },
+  linearUserUuid: { label: "Linear User UUID", perAgent: true, isSecret: false },
+  githubToken: { label: "GitHub Token", perAgent: true, isSecret: true }
+};
+function resolveStackAndCwd(configName) {
+  const manifest = loadManifest(configName);
+  if (!manifest) {
+    console.error(import_picocolors11.default.red(`Config '${configName}' could not be loaded.`));
+    process3.exit(1);
+  }
+  const wsResult = ensureWorkspace();
+  if (!wsResult.ok) {
+    console.error(import_picocolors11.default.red(wsResult.error ?? "Failed to set up workspace."));
+    process3.exit(1);
+  }
+  const cwd = getWorkspaceDir();
+  const stackResult = selectOrCreateStack(manifest.stackName, cwd);
+  if (!stackResult.ok) {
+    console.error(import_picocolors11.default.red(`Could not select Pulumi stack "${manifest.stackName}": ${stackResult.error}`));
+    process3.exit(1);
+  }
+  return { stackName: manifest.stackName, cwd };
+}
+async function secretsSetCommand(key, value, opts) {
+  let configName;
+  try {
+    configName = resolveConfigName(opts.config);
+  } catch (err) {
+    console.error(import_picocolors11.default.red(err.message));
+    process3.exit(1);
+  }
+  const meta = KNOWN_SECRETS[key];
+  if (!meta) {
+    const validKeys = Object.entries(KNOWN_SECRETS).map(([k, m]) => `  ${k}${m.perAgent ? " (per-agent: use --agent)" : ""}`).join("\n");
+    console.error(import_picocolors11.default.red(`Unknown secret '${key}'. Valid keys:
+${validKeys}`));
+    process3.exit(1);
+  }
+  let pulumiKey = key;
+  if (meta.perAgent) {
+    if (!opts.agent) {
+      console.error(import_picocolors11.default.red(`'${key}' is a per-agent secret. Use --agent <role> to specify which agent.`));
+      process3.exit(1);
+    }
+    pulumiKey = `${opts.agent}${key.charAt(0).toUpperCase()}${key.slice(1)}`;
+  }
+  const { cwd } = resolveStackAndCwd(configName);
+  const ok = setConfig(pulumiKey, value, meta.isSecret, cwd);
+  if (!ok) {
+    console.error(import_picocolors11.default.red(`Failed to set '${pulumiKey}' in Pulumi config.`));
+    process3.exit(1);
+  }
+  const maskedValue = meta.isSecret ? value.slice(0, 4) + "..." + value.slice(-4) : value;
+  console.log(import_picocolors11.default.green(`\u2713 ${pulumiKey}: set to ${maskedValue}`));
+  console.log(import_picocolors11.default.dim("\nRun 'clawup deploy' or 'clawup redeploy' to apply changes."));
+}
+async function secretsListCommand(opts) {
+  let configName;
+  try {
+    configName = resolveConfigName(opts.config);
+  } catch (err) {
+    console.error(import_picocolors11.default.red(err.message));
+    process3.exit(1);
+  }
+  const manifest = loadManifest(configName);
+  if (!manifest) {
+    console.error(import_picocolors11.default.red(`Config '${configName}' could not be loaded.`));
+    process3.exit(1);
+  }
+  const { cwd } = resolveStackAndCwd(configName);
+  const roles = manifest.agents.map((a) => a.role);
+  console.log();
+  console.log(import_picocolors11.default.bold(`Secrets for ${configName}:`));
+  console.log();
+  for (const [key, meta] of Object.entries(KNOWN_SECRETS)) {
+    if (meta.perAgent) continue;
+    const val = getConfig(key, cwd);
+    const status = val ? import_picocolors11.default.green("\u2713 set") : import_picocolors11.default.dim("\u2717 not set");
+    console.log(`  ${meta.label.padEnd(24)} ${status}`);
+  }
+  const perAgentKeys = Object.entries(KNOWN_SECRETS).filter(([, m]) => m.perAgent);
+  if (perAgentKeys.length > 0) {
+    for (const role of roles) {
+      console.log();
+      console.log(import_picocolors11.default.bold(`  ${role}:`));
+      for (const [key, meta] of perAgentKeys) {
+        const pulumiKey = `${role}${key.charAt(0).toUpperCase()}${key.slice(1)}`;
+        const val = getConfig(pulumiKey, cwd);
+        const status = val ? import_picocolors11.default.green("\u2713 set") : import_picocolors11.default.dim("\u2717 not set");
+        console.log(`    ${meta.label.padEnd(24)} ${status}`);
+      }
+    }
+  }
+  console.log();
+}
+
+// commands/redeploy.ts
+init_tools();
+async function redeployCommand(opts) {
+  await redeployTool(createCLIAdapter(), opts);
+}
+
+// commands/webhooks.ts
+init_tools();
+async function webhooksSetupCommand(opts) {
+  await webhooksSetupTool(createCLIAdapter(), opts);
+}
+
+// lib/update-check.ts
+var https = __toESM(require("https"));
+var fs6 = __toESM(require("fs"));
+var path6 = __toESM(require("path"));
+var os5 = __toESM(require("os"));
+var import_picocolors12 = __toESM(require("picocolors"));
+var PACKAGE_NAME = "clawup";
+var CACHE_FILE = ".update-check.json";
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 3e3;
+function getCacheDir() {
+  return path6.join(os5.homedir(), ".clawup");
+}
+function getCachePath() {
+  return path6.join(getCacheDir(), CACHE_FILE);
+}
+function loadCache() {
+  try {
+    const raw = fs6.readFileSync(getCachePath(), "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function saveCache(cache) {
+  const dir = getCacheDir();
+  if (!fs6.existsSync(dir)) {
+    fs6.mkdirSync(dir, { recursive: true });
+  }
+  fs6.writeFileSync(getCachePath(), JSON.stringify(cache), "utf-8");
+}
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const na = pa[i] ?? 0;
+    const nb = pb[i] ?? 0;
+    if (na > nb) return 1;
+    if (na < nb) return -1;
+  }
+  return 0;
+}
+function fetchLatestVersion() {
+  return new Promise((resolve2) => {
+    const req = https.get(
+      `https://registry.npmjs.org/${PACKAGE_NAME}/latest`,
+      { timeout: FETCH_TIMEOUT_MS },
+      (res) => {
+        let data = "";
+        res.on("data", (chunk) => data += chunk);
+        res.on("end", () => {
+          try {
+            const json = JSON.parse(data);
+            resolve2(json.version ?? null);
+          } catch {
+            resolve2(null);
+          }
+        });
+      }
+    );
+    req.on("timeout", () => {
+      req.destroy();
+      resolve2(null);
+    });
+    req.on("error", () => resolve2(null));
+  });
+}
+async function checkForUpdates(currentVersion) {
+  try {
+    const cache = loadCache();
+    const now = Date.now();
+    if (cache && now - cache.lastChecked < CHECK_INTERVAL_MS) {
+      if (compareSemver(cache.latestVersion, currentVersion) > 0) {
+        printUpdateNotice(currentVersion, cache.latestVersion);
+      }
+      return;
+    }
+    const latest = await fetchLatestVersion();
+    if (!latest) {
+      saveCache({ lastChecked: now, latestVersion: currentVersion });
+      return;
+    }
+    saveCache({ lastChecked: now, latestVersion: latest });
+    if (compareSemver(latest, currentVersion) > 0) {
+      printUpdateNotice(currentVersion, latest);
+    }
+  } catch {
+  }
+}
+function printUpdateNotice(current, latest) {
+  console.log();
+  console.log(
+    `  Update available: ${import_picocolors12.default.dim(current)} ${import_picocolors12.default.dim("\u2192")} ${import_picocolors12.default.green(latest)}`
+  );
+  console.log(`  Run ${import_picocolors12.default.cyan("clawup update")} to install`);
+  console.log();
+}
+
+// bin.ts
+setupGracefulShutdown();
+var pkgJson = JSON.parse(fs7.readFileSync(path7.join(__dirname, "..", "package.json"), "utf-8"));
+var program = new import_commander.Command();
+program.name("clawup").description("Deploy and manage a fleet of OpenClaw AI agents on AWS").version(pkgJson.version);
+program.command("init").description("Interactive setup wizard \u2014 configure stack, secrets, and agents").option("--deploy", "Deploy immediately after init").option("-y, --yes", "Skip confirmation prompt (for deploy)").action(async (opts) => {
+  await initCommand(opts);
+});
+program.command("deploy").description("Deploy agents with pulumi up").option("-y, --yes", "Skip confirmation prompt").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await deployCommand(opts);
+});
+program.command("status").description("Show agent statuses from stack outputs").option("--json", "Output as JSON").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await statusCommand(opts);
+});
+program.command("ssh <agent>").description("SSH to an agent by name or alias (juno, titus, scout)").option("-u, --user <user>", "SSH user").option("-c, --config <name>", "Config name (auto-detected if only one)").argument("[command...]", "Command to run on the agent").action(async (agent, commandArgs, opts) => {
+  await sshCommand(agent, commandArgs, opts);
+});
+program.command("validate").description("Health check agents via Tailscale SSH").option("-t, --timeout <seconds>", "SSH timeout in seconds", "30").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await validateCommand(opts);
+});
+program.command("push").description("Push workspace files, skills, and config to running agents").option("--skills", "Sync skills to remote workspace").option("--workspace", "Sync workspace files from identity").option("--memory-reset", "Remove remote memory/ dir and MEMORY.md").option("--openclaw", "Upgrade openclaw to latest + restart gateway").option("--config-push", "Copy local openclaw.json to remote + restart gateway").option("-a, --agent <name>", "Target a single agent (name, role, or alias)").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await pushCommand({
+    skills: opts.skills,
+    workspace: opts.workspace,
+    memoryReset: opts.memoryReset,
+    openclaw: opts.openclaw,
+    pushConfig: opts.configPush,
+    agent: opts.agent,
+    config: opts.config
+  });
+});
+program.command("redeploy").description("Update agents in-place without destroying infrastructure").option("-y, --yes", "Skip confirmation prompt").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await redeployCommand(opts);
+});
+program.command("destroy").description("Tear down all resources with safety confirmations").option("-y, --yes", "Skip confirmation prompts (dangerous!)").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await destroyCommand(opts);
+});
+program.command("list").description("List all saved configs").option("--json", "Output as JSON").action(async (opts) => {
+  await listCommand(opts);
+});
+var configCmd = program.command("config").description("View or modify config without re-running init");
+configCmd.command("show").description("Display current config").option("--json", "Output as JSON").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await configShowCommand(opts);
+});
+configCmd.command("set <key> <value>").description("Update a config value").option("-c, --config <name>", "Config name (auto-detected if only one)").option("-a, --agent <name>", "Target a specific agent").action(async (key, value, opts) => {
+  await configSetCommand(key, value, opts);
+});
+configCmd.command("migrate").description("Migrate plugin config files into the manifest (one-time upgrade)").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await configMigrateCommand(opts);
+});
+var secretsCmd = program.command("secrets").description("View or update Pulumi secrets without re-running init");
+secretsCmd.command("set <key> <value>").description("Set a secret (e.g. braveApiKey, anthropicApiKey)").option("-c, --config <name>", "Config name (auto-detected if only one)").option("-a, --agent <role>", "Agent role for per-agent secrets (e.g. eng, pm, tester)").action(async (key, value, opts) => {
+  await secretsSetCommand(key, value, opts);
+});
+secretsCmd.command("list").description("Show which secrets are configured (values redacted)").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await secretsListCommand(opts);
+});
+var webhooksCmd = program.command("webhooks").description("Manage agent webhooks");
+webhooksCmd.command("setup").description("Configure Linear webhooks for deployed agents").option("-c, --config <name>", "Config name (auto-detected if only one)").action(async (opts) => {
+  await webhooksSetupCommand(opts);
+});
+program.command("update").description("Update clawup CLI to the latest version").action(async (opts) => {
+  await updateCommand(opts);
+});
+checkForUpdates(pkgJson.version).catch(() => {
+});
 program.parse();
-//# sourceMappingURL=bin.js.map
+//# sourceMappingURL=bin.js.map