@alfe.ai/integrations 0.6.0 → 0.6.1

package/dist/index.js

@@ -1,19 +1,122 @@
+import { randomBytes } from "node:crypto";
+import { closeSync, copyFileSync, cpSync, existsSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { randomBytes } from "node:crypto";
-import { basename, dirname, join } from "node:path";
 import { homedir, platform, tmpdir } from "node:os";
-import { chmodSync, closeSync, copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { buildConfigValidationSchema, parseManifestFile } from "@alfe.ai/integration-manifest";
 import { createLogger } from "@auriclabs/logger";
 import { parseDocument } from "yaml";
 import { toServerConfig } from "@alfe.ai/mcp-bundler";
+//#region src/filesystem.ts
+const UNSAFE_RECORD_KEYS = new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
+function assertSafeRecordKey(value, label) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 1e3 || value.includes("\0") || UNSAFE_RECORD_KEYS.has(value)) throw new Error(`${label} must be a safe record key`);
+	return value;
+}
+/** Integration ids become directory and record keys, so keep them one safe segment. */
+function assertSafePathSegment(value, label) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 240 || value === "." || value === ".." || value.startsWith(".") || value.includes("/") || value.includes("\\") || value.includes("\0") || value.includes("..") || UNSAFE_RECORD_KEYS.has(value)) throw new Error(`${label} must be a safe path segment`);
+	return value;
+}
+/** Reject absolute and lexically escaping repository-owned paths. */
+function assertSafeRelativePath(value, label) {
+	if (typeof value !== "string" || value.length === 0 || value.includes("\0") || isAbsolute(value)) throw new Error(`${label} must be a non-empty relative path`);
+	const normalized = value.replaceAll("\\", "/");
+	if (normalized.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error(`${label} must stay within the integration checkout`);
+	return normalized;
+}
+function isWithin(root, candidate) {
+	const rel = relative(root, candidate);
+	return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+/**
+* Resolve an existing repository-owned path and prove its real target remains
+* beneath the checkout. This closes the symlink escape left by lexical schema
+* validation alone.
+*/
+function resolveExistingWithin(rootPath, relativePath, label, expected = "either") {
+	const safeRelative = assertSafeRelativePath(relativePath, label);
+	const root = realpathSync(rootPath);
+	const lexical = resolve(root, safeRelative);
+	if (!isWithin(root, lexical)) throw new Error(`${label} escapes the integration checkout`);
+	const actual = realpathSync(lexical);
+	if (!isWithin(root, actual)) throw new Error(`${label} resolves outside the integration checkout`);
+	const stat = lstatSync(actual);
+	if (expected === "file" && !stat.isFile()) throw new Error(`${label} must resolve to a regular file`);
+	if (expected === "directory" && !stat.isDirectory()) throw new Error(`${label} must resolve to a directory`);
+	return actual;
+}
+/** Crash-safe, owner-only replacement for local state/config files. */
+function atomicWriteFileSync(filePath, contents, mode = 384) {
+	const dir = dirname(filePath);
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const tempPath = resolve(dir, `.${basename(filePath)}.tmp-${String(process.pid)}-${randomBytes(8).toString("hex")}`);
+	let fd;
+	try {
+		fd = openSync(tempPath, "wx", mode);
+		writeFileSync(fd, contents, { encoding: "utf-8" });
+		fsyncSync(fd);
+		closeSync(fd);
+		fd = void 0;
+		renameSync(tempPath, filePath);
+	} catch (err) {
+		if (fd !== void 0) closeSync(fd);
+		rmSync(tempPath, { force: true });
+		throw err;
+	}
+}
+/**
+* Read an ownership/accounting JSON file without converting corruption into
+* an empty ledger. An empty fallback would make the next reconciliation forget
+* what Alfe owns and can leak runtime config or credentials indefinitely.
+*/
+function readJsonObjectFileSync(filePath, label) {
+	if (!existsSync(filePath)) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+	} catch (err) {
+		throw new Error(`${label} is unreadable; refusing an empty-ledger fallback: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`${label} must contain a JSON object`);
+	return parsed;
+}
+function getOptionalJsonObjectField(record, key, label) {
+	const value = record[key];
+	if (value === void 0) return {};
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must contain a JSON object`);
+	return value;
+}
+//#endregion
 //#region src/registry.ts
+/**
+* Registry — fetches the integration registry index from the integrations service.
+*
+* Calls GET /integrations/registry (public, no auth required) and caches the result.
+* The API URL can be passed explicitly or set via ALFE_API_URL env var.
+*
+* The cache is time-bounded by a TTL (default 60s). Long-running consumers — chiefly
+* the agent daemon, which constructs the Registry once at startup and never restarts —
+* would otherwise be pinned to the registry snapshot taken at process boot, and could
+* never resolve a version published after the daemon came up (the "stale cache" bug).
+* With a TTL, every consumer self-heals within a bounded window. The resolve-for-install
+* path additionally forces a fresh read (see `load({ fresh: true })`) because installing
+* a specific version is a rare, correctness-critical action that must never race the TTL.
+*/
 /** Default cache TTL — refetch the registry index after this many ms. */
 const DEFAULT_REGISTRY_TTL_MS = 6e4;
 var Registry = class {
 	index = null;
 	loadedAt = 0;
+	loadPromise = null;
 	fetcher;
 	ttlMs;
 	/**
@@ -36,19 +139,31 @@ var Registry = class {
 	* TTL; refetches once the cache is stale (or when `{ fresh: true }` is passed).
 	*/
 	async load(options = {}) {
-		if (!options.fresh && this.index && !this.isStale()) return this.index;
-		const raw = await this.fetcher();
-		const integrations = {};
-		for (const entry of raw) {
-			const { id, ...rest } = entry;
-			integrations[id] = rest;
-		}
-		this.index = {
-			version: 1,
-			integrations
+		if (!options.fresh && this.index && !this.isStale()) return cloneRegistryIndex(this.index);
+		if (this.loadPromise) return this.loadPromise;
+		const load = async () => {
+			const raw = await this.fetcher();
+			if (!Array.isArray(raw)) throw new Error("Integration registry response must be an array");
+			const integrations = Object.create(null);
+			for (const unvalidated of raw) {
+				const { id, ...rest } = validateRegistryEntry(unvalidated);
+				if (Object.hasOwn(integrations, id)) throw new Error(`Integration registry contains duplicate id "${id}"`);
+				integrations[id] = cloneRegistryEntry(rest);
+			}
+			this.index = {
+				version: 1,
+				integrations
+			};
+			this.loadedAt = Date.now();
+			return cloneRegistryIndex(this.index);
 		};
-		this.loadedAt = Date.now();
-		return this.index;
+		const promise = load();
+		this.loadPromise = promise;
+		try {
+			return await promise;
+		} finally {
+			if (this.loadPromise === promise) this.loadPromise = null;
+		}
 	}
 	/**
 	* Force reload the index (bypass cache). Equivalent to `load({ fresh: true })`.
@@ -65,7 +180,9 @@ var Registry = class {
 	*                a just-published version).
 	*/
 	async get(id, fresh = false) {
-		return (await this.load({ fresh })).integrations[id];
+		const index = await this.load({ fresh });
+		if (!Object.hasOwn(index.integrations, id)) return void 0;
+		return cloneRegistryEntry(index.integrations[id]);
 	}
 	/**
 	* List all integrations in the registry.
@@ -74,7 +191,7 @@ var Registry = class {
 		const index = await this.load();
 		return Object.entries(index.integrations).map(([id, entry]) => ({
 			id,
-			...entry
+			...cloneRegistryEntry(entry)
 		}));
 	}
 	/**
@@ -86,6 +203,80 @@ var Registry = class {
 		return all.filter((entry) => entry.id.toLowerCase().includes(q) || (entry.name?.toLowerCase().includes(q) ?? false) || entry.description.toLowerCase().includes(q));
 	}
 };
+function validateRegistryEntry(value) {
+	const unknownValue = value;
+	if (typeof unknownValue !== "object" || unknownValue === null) throw new Error("Integration registry entry must be an object");
+	const entry = unknownValue;
+	assertSafePathSegment(entry.id, "Integration registry id");
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(entry.id)) throw new Error(`Integration registry id "${entry.id}" is invalid`);
+	let repository;
+	try {
+		repository = new URL(entry.repository);
+	} catch {
+		throw new Error(`Integration "${entry.id}" repository must be a valid HTTPS URL`);
+	}
+	if (repository.protocol !== "https:" || repository.username !== "" || repository.password !== "") throw new Error(`Integration "${entry.id}" repository must be HTTPS without embedded credentials`);
+	if (!/^[0-9a-f]{40}$/i.test(entry.commit)) throw new Error(`Integration "${entry.id}" commit must be a full 40-character SHA-1`);
+	if (!Array.isArray(entry.versions) || entry.versions.length === 0 || entry.versions.some((version) => typeof version !== "string" || version.length === 0) || new Set(entry.versions).size !== entry.versions.length) throw new Error(`Integration "${entry.id}" versions must be a non-empty unique string array`);
+	if (typeof entry.latest !== "string" || !entry.versions.includes(entry.latest)) throw new Error(`Integration "${entry.id}" latest version must appear in versions`);
+	if (typeof entry.description !== "string") throw new Error(`Integration "${entry.id}" description must be a string`);
+	if (entry.name !== void 0 && typeof entry.name !== "string") throw new Error(`Integration "${entry.id}" name must be a string`);
+	if (entry.subdir !== void 0) assertSafeRelativePath(entry.subdir, `Integration "${entry.id}" subdir`);
+	if (entry.supported_agents !== void 0) {
+		if (!Array.isArray(entry.supported_agents) || entry.supported_agents.some((runtime) => typeof runtime !== "string")) throw new Error(`Integration "${entry.id}" supported_agents must be a string array`);
+		for (const runtime of entry.supported_agents) assertSafePathSegment(runtime, `Integration "${entry.id}" runtime id`);
+	}
+	if (entry.icon !== void 0 && typeof entry.icon !== "string") throw new Error(`Integration "${entry.id}" icon must be a string`);
+	if (entry.author !== void 0 && typeof entry.author !== "string" && (!isRecord$2(entry.author) || typeof entry.author.name !== "string" || entry.author.url !== void 0 && typeof entry.author.url !== "string")) throw new Error(`Integration "${entry.id}" author is invalid`);
+	assertOptionalStringArray(entry.features, `Integration "${entry.id}" features`);
+	assertOptionalStringArray(entry.preview_images, `Integration "${entry.id}" preview_images`);
+	if (entry.pricing !== void 0) validatePricing(entry.id, entry.pricing);
+	if (entry.config_schema !== void 0) {
+		if (!Array.isArray(entry.config_schema) || entry.config_schema.some((field) => !isRecord$2(field) || typeof field.key !== "string" || typeof field.label !== "string" || typeof field.type !== "string")) throw new Error(`Integration "${entry.id}" config_schema is invalid`);
+	}
+	return entry;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertOptionalStringArray(value, label) {
+	if (value !== void 0 && (!Array.isArray(value) || value.some((entry) => typeof entry !== "string"))) throw new Error(`${label} must be a string array`);
+}
+function validatePricing(id, value) {
+	if (!isRecord$2(value) || ![
+		"free",
+		"paid",
+		"usage"
+	].includes(String(value.type))) throw new Error(`Integration "${id}" pricing is invalid`);
+	if (value.price !== void 0 && (typeof value.price !== "number" || !Number.isFinite(value.price) || value.price < 0)) throw new Error(`Integration "${id}" pricing.price is invalid`);
+	if (value.currency !== void 0 && typeof value.currency !== "string") throw new Error(`Integration "${id}" pricing.currency is invalid`);
+	if (value.interval !== void 0 && value.interval !== "month" && value.interval !== "year") throw new Error(`Integration "${id}" pricing.interval is invalid`);
+	if (value.description !== void 0 && typeof value.description !== "string") throw new Error(`Integration "${id}" pricing.description is invalid`);
+}
+function cloneRegistryEntry(entry) {
+	return {
+		...entry,
+		versions: [...entry.versions],
+		...entry.supported_agents ? { supported_agents: [...entry.supported_agents] } : {},
+		...entry.features ? { features: [...entry.features] } : {},
+		...entry.preview_images ? { preview_images: [...entry.preview_images] } : {},
+		...entry.author && typeof entry.author === "object" ? { author: { ...entry.author } } : {},
+		...entry.pricing ? { pricing: { ...entry.pricing } } : {},
+		...entry.config_schema ? { config_schema: entry.config_schema.map((field) => ({
+			...field,
+			...field.options ? { options: [...field.options] } : {},
+			...field.select_options ? { select_options: field.select_options.map((option) => ({ ...option })) } : {}
+		})) } : {}
+	};
+}
+function cloneRegistryIndex(index) {
+	const integrations = {};
+	for (const [id, entry] of Object.entries(index.integrations)) integrations[id] = cloneRegistryEntry(entry);
+	return {
+		version: index.version,
+		integrations
+	};
+}
 //#endregion
 //#region src/resolver.ts
 var RegistryResolveError = class extends Error {
@@ -165,6 +356,7 @@ const NPX_PREWARM_TIMEOUT_MS = 12e4;
 * staging dir for a real integration install.
 */
 const STAGING_PREFIX = ".staging-";
+const BACKUP_PREFIX = ".backup-";
 /** Shared @alfe.ai packages available to all integration hooks */
 const SHARED_PACKAGES = {
 	"@alfe.ai/config": "latest",
@@ -191,7 +383,10 @@ var Installer = class {
 	* Get the path where an integration's content lives.
 	*/
 	getInstallPath(name) {
-		return join(this.basePath, name);
+		const safeName = assertSafePathSegment(name, "Integration id");
+		const installPath = join(this.basePath, safeName);
+		this.recoverInterruptedSwap(safeName, installPath);
+		return installPath;
 	}
 	/**
 	* Install an integration by cloning its git repo and checking out the pinned commit.
@@ -205,6 +400,7 @@ var Installer = class {
 	* it is cleaned up before retrying.
 	*/
 	async install(resolved) {
+		this.validateResolved(resolved);
 		const installPath = this.getInstallPath(resolved.id);
 		if (existsSync(installPath)) rmSync(installPath, {
 			recursive: true,
@@ -225,6 +421,7 @@ var Installer = class {
 		try {
 			await execFileAsync$2("git", [
 				"clone",
+				"--",
 				resolved.repository,
 				installPath
 			], { timeout: GIT_TIMEOUT_MS });
@@ -246,11 +443,12 @@ var Installer = class {
 	*/
 	async cloneAndExtractSubdir(resolved, installPath) {
 		if (!resolved.subdir) throw new InstallerError("subdir is required for monorepo extraction");
-		const subdir = resolved.subdir;
+		const subdir = assertSafeRelativePath(resolved.subdir, "Integration subdir");
 		const tempDir = mkdtempSync(join(tmpdir(), `alfe-clone-${resolved.id}-`));
 		try {
 			await execFileAsync$2("git", [
 				"clone",
+				"--",
 				resolved.repository,
 				tempDir
 			], { timeout: GIT_TIMEOUT_MS });
@@ -258,9 +456,8 @@ var Installer = class {
 				cwd: tempDir,
 				timeout: GIT_TIMEOUT_MS
 			});
-			const subdirPath = join(tempDir, subdir);
-			if (!existsSync(subdirPath)) throw new InstallerError(`Subdir "${subdir}" not found in repo after checkout`);
-			cpSync(subdirPath, installPath, { recursive: true });
+			if (!existsSync(join(tempDir, subdir))) throw new InstallerError(`Subdir "${subdir}" not found in repo after checkout`);
+			cpSync(resolveExistingWithin(tempDir, subdir, "Integration subdir", "directory"), installPath, { recursive: true });
 		} catch (err) {
 			if (existsSync(installPath)) rmSync(installPath, {
 				recursive: true,
@@ -294,6 +491,7 @@ var Installer = class {
 	* cleaned up (try/finally) so a failed prepare leaves no partial clone.
 	*/
 	async stage(resolved) {
+		this.validateResolved(resolved);
 		mkdirSync(this.basePath, { recursive: true });
 		this.sweepStagingDirs();
 		const stagingPath = join(this.basePath, `${STAGING_PREFIX}${resolved.id}-${randomBytes(6).toString("hex")}`);
@@ -317,18 +515,55 @@ var Installer = class {
 		}
 	}
 	/**
-	* Commit a previously-staged clone: remove the live install dir and rename
-	* the staged dir into its place. Same-filesystem `renameSync` makes the swap
-	* near-atomic (no window where the install dir is half-populated). Called
-	* inside the runtime-suspension window during a diff-based upgrade.
+	* Commit a previously-staged clone with a recoverable same-filesystem swap.
+	* The live dir first moves to a deterministic backup, then the staged dir
+	* moves into place. A failed second rename restores the prior install; a
+	* daemon crash is recovered on the next `getInstallPath()` call.
 	*/
 	commitStaged(name, stagedPath) {
 		const installPath = this.getInstallPath(name);
-		if (existsSync(installPath)) rmSync(installPath, {
+		const base = realpathSync(this.basePath);
+		const staged = realpathSync(stagedPath);
+		const backupPath = join(this.basePath, `${BACKUP_PREFIX}${name}`);
+		if (dirname(staged) !== base || !basename(staged).startsWith(`${STAGING_PREFIX}${name}-`)) throw new InstallerError("Refusing to commit a staging directory outside the integrations root");
+		if (existsSync(backupPath)) rmSync(backupPath, {
+			recursive: true,
+			force: true
+		});
+		const hadLiveInstall = existsSync(installPath);
+		if (hadLiveInstall) renameSync(installPath, backupPath);
+		try {
+			renameSync(staged, installPath);
+		} catch (err) {
+			if (hadLiveInstall && existsSync(backupPath) && !existsSync(installPath)) renameSync(backupPath, installPath);
+			throw err;
+		}
+		if (existsSync(backupPath)) try {
+			rmSync(backupPath, {
+				recursive: true,
+				force: true
+			});
+		} catch (err) {
+			log$6.warn({
+				integrationId: name,
+				err: err instanceof Error ? err.message : String(err)
+			}, "Upgrade committed but prior install backup could not be removed");
+		}
+	}
+	/** Restore a live install left in the deterministic backup by a killed swap. */
+	recoverInterruptedSwap(name, installPath) {
+		if (!existsSync(this.basePath)) return;
+		const backupPath = join(this.basePath, `${BACKUP_PREFIX}${name}`);
+		if (!existsSync(backupPath)) return;
+		if (!existsSync(installPath)) {
+			renameSync(backupPath, installPath);
+			log$6.warn({ integrationId: name }, "Recovered integration install from interrupted upgrade swap");
+			return;
+		}
+		rmSync(backupPath, {
 			recursive: true,
 			force: true
 		});
-		renameSync(stagedPath, installPath);
 	}
 	/**
 	* Remove any orphaned `.staging-*` directories under the base path. Called at
@@ -359,11 +594,10 @@ var Installer = class {
 	async update(name, resolved) {
 		const installPath = this.getInstallPath(name);
 		if (!existsSync(installPath)) throw new InstallerError(`Integration "${name}" is not installed — cannot update`);
-		rmSync(installPath, {
-			recursive: true,
-			force: true
-		});
-		return this.install(resolved);
+		if (resolved.id !== name) throw new InstallerError("Resolved integration id must match the installed integration id");
+		const stagedPath = await this.stage(resolved);
+		this.commitStaged(name, stagedPath);
+		return installPath;
 	}
 	/**
 	* Remove an installed integration.
@@ -399,7 +633,7 @@ var Installer = class {
 			type: "module",
 			dependencies: { ...SHARED_PACKAGES }
 		};
-		writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf-8");
+		atomicWriteFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
 		log$6.info("Installing shared @alfe.ai packages for integration hooks");
 		await this.runNpmInstall(this.basePath);
 		this.sharedPackagesReady = true;
@@ -522,14 +756,20 @@ var Installer = class {
 	isInstalled(name) {
 		return existsSync(this.getInstallPath(name));
 	}
+	validateResolved(resolved) {
+		assertSafePathSegment(resolved.id, "Integration id");
+		if (resolved.repository.length === 0 || resolved.repository.startsWith("-") || resolved.repository.includes("\0")) throw new InstallerError("Integration repository is invalid");
+		if (!/^[0-9a-f]{6,64}$/i.test(resolved.commit)) throw new InstallerError("Integration commit must be a hexadecimal git object id");
+		if (resolved.subdir) assertSafeRelativePath(resolved.subdir, "Integration subdir");
+	}
 };
 //#endregion
 //#region src/state.ts
 /**
 * State Manager — manages ~/.alfe/integrations.json.
 *
-* Read-modify-write with advisory file lock to prevent corruption
-* from concurrent access. Secrets are NEVER written to this file.
+* Daemon-owned read-modify-write state with crash-safe atomic replacement.
+* Secrets are NEVER written to this file.
 */
 const DEFAULT_STATE_PATH = join(homedir(), ".alfe", "integrations.json");
 const EMPTY_STATE = {
@@ -538,7 +778,6 @@ const EMPTY_STATE = {
 };
 var StateManager = class {
 	filePath;
-	lockHeld = false;
 	constructor(filePath) {
 		this.filePath = filePath ?? DEFAULT_STATE_PATH;
 	}
@@ -550,27 +789,19 @@ var StateManager = class {
 			...EMPTY_STATE,
 			integrations: {}
 		};
+		let parsed;
 		try {
-			const raw = readFileSync(this.filePath, "utf-8");
-			const parsed = JSON.parse(raw);
-			if (typeof parsed !== "object" || parsed.version !== 1) return {
-				...EMPTY_STATE,
-				integrations: {}
-			};
-			return parsed;
-		} catch {
-			return {
-				...EMPTY_STATE,
-				integrations: {}
-			};
+			parsed = JSON.parse(readFileSync(this.filePath, "utf-8"));
+		} catch (err) {
+			throw new Error(`Integration state file is unreadable; refusing an empty-state fallback: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		return validateStateFile(parsed);
 	}
 	/**
 	* Write the state file atomically.
 	*/
 	write(state) {
-		mkdirSync(dirname(this.filePath), { recursive: true });
-		writeFileSync(this.filePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
+		atomicWriteFileSync(this.filePath, JSON.stringify(state, null, 2) + "\n");
 	}
 	/**
 	* Get a specific integration's state.
@@ -582,6 +813,7 @@ var StateManager = class {
 	* Set an integration's state (read-modify-write).
 	*/
 	set(name, entry) {
+		assertSafePathSegment(name, "Integration id");
 		const state = this.read();
 		state.integrations[name] = entry;
 		this.write(state);
@@ -591,7 +823,8 @@ var StateManager = class {
 	*/
 	update(name, partial) {
 		const state = this.read();
-		if (!(name in state.integrations)) throw new Error(`Integration "${name}" not found in state`);
+		assertSafePathSegment(name, "Integration id");
+		if (!Object.hasOwn(state.integrations, name)) throw new Error(`Integration "${name}" not found in state`);
 		state.integrations[name] = {
 			...state.integrations[name],
 			...partial
@@ -603,7 +836,8 @@ var StateManager = class {
 	*/
 	setStatus(name, status, error) {
 		const state = this.read();
-		if (!(name in state.integrations)) return;
+		assertSafePathSegment(name, "Integration id");
+		if (!Object.hasOwn(state.integrations, name)) return;
 		const existing = state.integrations[name];
 		existing.status = status;
 		if (error !== void 0) existing.error = error;
@@ -614,6 +848,7 @@ var StateManager = class {
 	* Remove an integration from the state file.
 	*/
 	remove(name) {
+		assertSafePathSegment(name, "Integration id");
 		const state = this.read();
 		state.integrations = Object.fromEntries(Object.entries(state.integrations).filter(([key]) => key !== name));
 		this.write(state);
@@ -624,8 +859,8 @@ var StateManager = class {
 	list() {
 		const state = this.read();
 		return Object.entries(state.integrations).map(([id, entry]) => ({
-			id,
-			...entry
+			...entry,
+			id
 		}));
 	}
 	/**
@@ -641,7 +876,8 @@ var StateManager = class {
 	*/
 	incrementReinstallAttempts(name) {
 		const state = this.read();
-		if (!(name in state.integrations)) return;
+		assertSafePathSegment(name, "Integration id");
+		if (!Object.hasOwn(state.integrations, name)) return;
 		state.integrations[name].reinstallAttempts = (state.integrations[name].reinstallAttempts ?? 0) + 1;
 		this.write(state);
 	}
@@ -650,11 +886,35 @@ var StateManager = class {
 	*/
 	resetReinstallAttempts(name) {
 		const state = this.read();
-		if (!(name in state.integrations)) return;
+		assertSafePathSegment(name, "Integration id");
+		if (!Object.hasOwn(state.integrations, name)) return;
 		state.integrations[name].reinstallAttempts = 0;
 		this.write(state);
 	}
 };
+const VALID_STATUSES = new Set([
+	"installing",
+	"installed",
+	"configured",
+	"active",
+	"error"
+]);
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateStateFile(value) {
+	if (!isRecord$1(value) || value.version !== 1 || !isRecord$1(value.integrations)) throw new Error("Integration state file has an unsupported or invalid shape");
+	const integrations = Object.create(null);
+	for (const [id, rawEntry] of Object.entries(value.integrations)) {
+		assertSafePathSegment(id, "Persisted integration id");
+		if (!isRecord$1(rawEntry) || typeof rawEntry.status !== "string" || !VALID_STATUSES.has(rawEntry.status) || typeof rawEntry.version !== "string" || typeof rawEntry.installedAt !== "string" || !isRecord$1(rawEntry.config) || rawEntry.error !== void 0 && typeof rawEntry.error !== "string" || rawEntry.reinstallAttempts !== void 0 && (typeof rawEntry.reinstallAttempts !== "number" || !Number.isSafeInteger(rawEntry.reinstallAttempts) || rawEntry.reinstallAttempts < 0) || rawEntry.customConnectionId !== void 0 && typeof rawEntry.customConnectionId !== "string") throw new Error(`Integration state entry "${id}" has an invalid shape`);
+		integrations[id] = rawEntry;
+	}
+	return {
+		version: 1,
+		integrations
+	};
+}
 //#endregion
 //#region src/lock.ts
 /**
@@ -683,30 +943,20 @@ var LockManager = class {
 			runtimes: {},
 			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
 		};
+		let parsed;
 		try {
-			const raw = readFileSync(this.filePath, "utf-8");
-			const parsed = JSON.parse(raw);
-			if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || parsed.version !== 1) return {
-				...EMPTY_LOCK,
-				runtimes: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
-			return parsed;
-		} catch {
-			return {
-				...EMPTY_LOCK,
-				runtimes: {},
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
+			parsed = JSON.parse(readFileSync(this.filePath, "utf-8"));
+		} catch (err) {
+			throw new Error(`Runtime lock file is unreadable; refusing an empty-lock fallback: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		return validateRuntimeLock(parsed);
 	}
 	/**
 	* Write the lock file atomically.
 	*/
 	write(lock) {
-		mkdirSync(dirname(this.filePath), { recursive: true });
 		lock.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		writeFileSync(this.filePath, JSON.stringify(lock, null, 2) + "\n", "utf-8");
+		atomicWriteFileSync(this.filePath, JSON.stringify(lock, null, 2) + "\n");
 	}
 	/**
 	* Add entries for an integration activation in a specific runtime.
@@ -716,6 +966,8 @@ var LockManager = class {
 	* what lets a config-only integration be torn down on deactivate.
 	*/
 	addEntries(runtime, integrationId, version, plugins, skills, installPath, opts) {
+		assertSafePathSegment(runtime, "Runtime id");
+		assertSafePathSegment(integrationId, "Integration id");
 		const lock = this.read();
 		if (!(runtime in lock.runtimes)) lock.runtimes[runtime] = {
 			plugins: [],
@@ -748,6 +1000,27 @@ var LockManager = class {
 		this.write(lock);
 	}
 	/**
+	* Snapshot an integration's entries without changing the lock. Teardown uses
+	* this first and only clears the entries after every physical removal
+	* succeeds, making a failed cleanup retryable.
+	*/
+	getEntriesForIntegration(integrationId) {
+		assertSafePathSegment(integrationId, "Integration id");
+		const lock = this.read();
+		const entries = {};
+		for (const [runtime, state] of Object.entries(lock.runtimes)) {
+			const plugins = state.plugins.filter((entry) => entry.sourceIntegration === integrationId);
+			const skills = state.skills.filter((entry) => entry.sourceIntegration === integrationId);
+			const config = (state.config ?? []).filter((entry) => entry.sourceIntegration === integrationId);
+			if (plugins.length > 0 || skills.length > 0 || config.length > 0) entries[runtime] = {
+				plugins,
+				skills,
+				config
+			};
+		}
+		return entries;
+	}
+	/**
 	* Remove all entries for a given integration across all runtimes.
 	* Returns what was removed, keyed by runtime.
 	*
@@ -756,6 +1029,7 @@ var LockManager = class {
 	* `applier.removeConfig` even for a config-only integration.
 	*/
 	removeEntries(integrationId) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const lock = this.read();
 		const removed = {};
 		for (const [runtime, state] of Object.entries(lock.runtimes)) {
@@ -784,6 +1058,49 @@ var LockManager = class {
 		};
 	}
 };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasStringFields(value, fields) {
+	return isRecord(value) && fields.every((field) => typeof value[field] === "string");
+}
+function validateRuntimeLock(value) {
+	if (!isRecord(value) || value.version !== 1 || !isRecord(value.runtimes) || typeof value.updatedAt !== "string") throw new Error("Runtime lock file has an unsupported or invalid shape");
+	const runtimes = Object.create(null);
+	for (const [runtime, rawState] of Object.entries(value.runtimes)) {
+		assertSafePathSegment(runtime, "Persisted runtime id");
+		if (!isRecord(rawState) || !Array.isArray(rawState.plugins) || !rawState.plugins.every((entry) => hasStringFields(entry, [
+			"package",
+			"sourceIntegration",
+			"integrationVersion"
+		])) || !Array.isArray(rawState.skills) || !rawState.skills.every((entry) => hasStringFields(entry, [
+			"name",
+			"sourcePath",
+			"sourceIntegration",
+			"integrationVersion"
+		])) || rawState.config !== void 0 && (!Array.isArray(rawState.config) || !rawState.config.every((entry) => hasStringFields(entry, ["sourceIntegration", "integrationVersion"])))) throw new Error(`Runtime lock entry "${runtime}" has an invalid shape`);
+		const state = rawState;
+		for (const plugin of state.plugins) {
+			assertSafePathSegment(plugin.sourceIntegration, "Persisted integration id");
+			if (plugin.package.length === 0 || plugin.package.startsWith("-") || plugin.package.includes("\0") || plugin.integrationVersion.length === 0) throw new Error(`Runtime lock plugin entry in "${runtime}" is invalid`);
+		}
+		for (const skill of state.skills) {
+			assertSafePathSegment(skill.sourceIntegration, "Persisted integration id");
+			assertSafePathSegment(skill.name, "Persisted skill name");
+			if (skill.integrationVersion.length === 0 || skill.sourcePath.includes("\0")) throw new Error(`Runtime lock skill entry in "${runtime}" is invalid`);
+		}
+		for (const config of state.config ?? []) {
+			assertSafePathSegment(config.sourceIntegration, "Persisted integration id");
+			if (config.integrationVersion.length === 0) throw new Error(`Runtime lock config entry in "${runtime}" is invalid`);
+		}
+		runtimes[runtime] = state;
+	}
+	return {
+		version: 1,
+		runtimes,
+		updatedAt: value.updatedAt
+	};
+}
 //#endregion
 //#region src/hooks.ts
 /**
@@ -821,6 +1138,7 @@ const HOOK_TIMEOUT_MS = 3e4;
 const INSTALL_HOOK_TIMEOUT_MS = 6e5;
 const INTEGRATIONS_BASE_DIR = join(homedir(), ".alfe", "integrations");
 const STATE_BASE_DIR = join(homedir(), ".alfe", "state");
+const IS_WINDOWS = platform() === "win32";
 /**
 * Build the environment variables for a hook script execution.
 *
@@ -833,6 +1151,7 @@ const STATE_BASE_DIR = join(homedir(), ".alfe", "state");
 */
 function buildHookEnv(options, additionalEnv) {
 	const { integrationName, config, secrets, runtimes } = options;
+	assertSafePathSegment(integrationName, "Integration id");
 	const nameUpper = integrationName.toUpperCase().replace(/[^A-Z0-9]/g, "_");
 	const integrationDir = join(INTEGRATIONS_BASE_DIR, integrationName);
 	const stateDir = join(STATE_BASE_DIR, integrationName);
@@ -871,12 +1190,13 @@ function buildHookEnv(options, additionalEnv) {
 * 3. Default → "bash"
 */
 function resolveInterpreter(scriptPath) {
-	const isWindows = platform() === "win32";
+	let fd;
 	try {
-		const fd = openSync(scriptPath, "r");
+		fd = openSync(scriptPath, "r");
 		const buf = Buffer.alloc(256);
 		readSync(fd, buf, 0, 256, 0);
 		closeSync(fd);
+		fd = void 0;
 		const firstLine = buf.toString("utf-8").split("\n")[0];
 		if (firstLine.startsWith("#!")) {
 			const shebang = firstLine.slice(2).trim();
@@ -888,7 +1208,7 @@ function resolveInterpreter(scriptPath) {
 				};
 			}
 			const cmd = shebang.split(/\s+/)[0];
-			if (isWindows && cmd.startsWith("/")) return {
+			if (IS_WINDOWS && cmd.startsWith("/")) return {
 				command: cmd.split("/").pop() ?? cmd,
 				args: [scriptPath]
 			};
@@ -897,13 +1217,15 @@ function resolveInterpreter(scriptPath) {
 				args: [scriptPath]
 			};
 		}
-	} catch {}
+	} catch {} finally {
+		if (fd !== void 0) closeSync(fd);
+	}
 	if (scriptPath.endsWith(".js") || scriptPath.endsWith(".mjs")) return {
 		command: "node",
 		args: [scriptPath]
 	};
 	if (scriptPath.endsWith(".py")) return {
-		command: isWindows ? "python" : "python3",
+		command: IS_WINDOWS ? "python" : "python3",
 		args: [scriptPath]
 	};
 	return {
@@ -926,13 +1248,17 @@ function resolveInterpreter(scriptPath) {
 * @returns Hook execution result
 */
 async function runHook(integrationPath, hookScript, env, timeoutMs = HOOK_TIMEOUT_MS) {
-	const scriptPath = join(integrationPath, hookScript);
-	if (!existsSync(scriptPath)) return {
-		exitCode: 0,
-		stdout: "",
-		stderr: `Hook script not found: ${scriptPath} (skipped)`,
-		timedOut: false
-	};
+	let scriptPath;
+	try {
+		scriptPath = resolveExistingWithin(integrationPath, hookScript, "Integration hook", "file");
+	} catch (err) {
+		return {
+			exitCode: 1,
+			stdout: "",
+			stderr: `Invalid integration hook: ${err instanceof Error ? err.message : String(err)}`,
+			timedOut: false
+		};
+	}
 	const { command, args } = resolveInterpreter(scriptPath);
 	return new Promise((resolve) => {
 		let stdout = "";
@@ -948,10 +1274,29 @@ async function runHook(integrationPath, hookScript, env, timeoutMs = HOOK_TIMEOU
 				"ignore",
 				"pipe",
 				"pipe"
-			]
+			],
+			detached: !IS_WINDOWS
 		});
 		const timer = setTimeout(() => {
 			timedOut = true;
+			if (IS_WINDOWS && proc.pid !== void 0) {
+				spawn("taskkill", [
+					"/PID",
+					String(proc.pid),
+					"/T",
+					"/F"
+				], {
+					stdio: "ignore",
+					windowsHide: true
+				}).once("error", () => {
+					proc.kill("SIGKILL");
+				});
+				return;
+			}
+			if (!IS_WINDOWS && proc.pid !== void 0) try {
+				process.kill(-proc.pid, "SIGKILL");
+				return;
+			} catch {}
 			proc.kill("SIGKILL");
 		}, timeoutMs);
 		proc.stdout.on("data", (data) => {
@@ -1063,20 +1408,50 @@ function pluginSpecVersion(spec) {
 const FULL_PLACEHOLDER = /^\{\{config\.([a-zA-Z0-9_]+)\}\}$/;
 function interpolateSelfConfig(obj, config) {
 	const result = {};
-	for (const [key, value] of Object.entries(obj)) if (typeof value === "string") {
+	for (const [key, value] of Object.entries(obj)) result[key] = interpolateSelfConfigValue(value, config);
+	return result;
+}
+function interpolateSelfConfigValue(value, config) {
+	if (typeof value === "string") {
 		const wholeMatch = FULL_PLACEHOLDER.exec(value);
 		if (wholeMatch) {
 			const raw = config[wholeMatch[1]];
-			result[key] = raw !== void 0 ? raw : value;
-			continue;
+			return raw !== void 0 ? raw : value;
 		}
-		result[key] = value.replace(/\{\{config\.([a-zA-Z0-9_]+)\}\}/g, (_match, configKey) => {
-			const val = config[configKey];
-			return typeof val === "string" || typeof val === "number" ? String(val) : _match;
+		return value.replace(/\{\{config\.([a-zA-Z0-9_]+)\}\}/g, (_match, configKey) => {
+			const candidate = config[configKey];
+			return typeof candidate === "string" || typeof candidate === "number" ? String(candidate) : _match;
 		});
-	} else if (value && typeof value === "object" && !Array.isArray(value)) result[key] = interpolateSelfConfig(value, config);
-	else result[key] = value;
-	return result;
+	}
+	if (Array.isArray(value)) return value.map((item) => interpolateSelfConfigValue(item, config));
+	if (value && typeof value === "object") return interpolateSelfConfig(value, config);
+	return value;
+}
+var IntegrationConfigValidationError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "IntegrationConfigValidationError";
+	}
+};
+function validateAndSplitConfig(manifest, config, options = {}) {
+	if (options.allowEmpty && Object.keys(config).length === 0) return {
+		nonSecretConfig: {},
+		secretConfig: /* @__PURE__ */ new Map()
+	};
+	const result = buildConfigValidationSchema(manifest.config_schema).safeParse(config);
+	if (!result.success) throw new IntegrationConfigValidationError("INVALID_CONFIG", `Config validation failed: ${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
+	const validatedConfig = result.data;
+	const missingRequired = manifest.config_schema.filter((field) => field.required && validatedConfig[field.key] === void 0).map((field) => field.key);
+	if (missingRequired.length > 0) throw new IntegrationConfigValidationError("MISSING_CONFIG", `Missing required config fields: ${missingRequired.join(", ")}`);
+	const nonSecretConfig = {};
+	const secretConfig = /* @__PURE__ */ new Map();
+	for (const [key, value] of Object.entries(validatedConfig)) if (manifest.config_schema.find((candidate) => candidate.key === key)?.type === "secret") secretConfig.set(key, value);
+	else nonSecretConfig[key] = value;
+	return {
+		nonSecretConfig,
+		secretConfig
+	};
 }
 /**
 * Merge universal installs with runtime-specific installs from the manifest.
@@ -1097,8 +1472,17 @@ function resolveInstallsForRuntime(manifest, runtime) {
 * checkout-able `manifestCommit` pins the clone.
 */
 function buildCustomResolved(id, cs) {
-	if (id.includes("/") || id.includes("\\") || id.includes("..")) throw new Error(`Refusing custom integration id with path separators: ${id}`);
-	const dir = dirname(cs.manifestPath);
+	assertSafePathSegment(id, "Custom integration id");
+	const manifestPath = assertSafeRelativePath(cs.manifestPath, "Custom integration manifest path");
+	let repositoryUrl;
+	try {
+		repositoryUrl = new URL(cs.manifestRepo);
+	} catch {
+		throw new Error("Custom integration repository must be a valid HTTPS URL");
+	}
+	if (repositoryUrl.protocol !== "https:" || repositoryUrl.username !== "" || repositoryUrl.password !== "") throw new Error("Custom integration repository must be an HTTPS URL without embedded credentials");
+	if (!/^[0-9a-f]{40}$/i.test(cs.manifestCommit)) throw new Error("Custom integration commit must be a full 40-character SHA-1");
+	const dir = dirname(manifestPath);
 	const subdir = dir === "." || dir === "" ? void 0 : dir;
 	const manifestVersion = cs.manifest?.version;
 	return {
@@ -1117,9 +1501,15 @@ function buildCustomResolved(id, cs) {
 */
 function ensureCanonicalManifestName(installPath, manifestPath) {
 	const canonical = join(installPath, "alfe-integration.yaml");
-	if (existsSync(canonical)) return;
-	const actual = join(installPath, basename(manifestPath));
-	if (existsSync(actual)) copyFileSync(actual, canonical);
+	if (existsSync(canonical)) {
+		resolveExistingWithin(installPath, "alfe-integration.yaml", "Canonical integration manifest", "file");
+		return;
+	}
+	rmSync(canonical, { force: true });
+	copyFileSync(resolveExistingWithin(installPath, basename(manifestPath), "Custom integration manifest", "file"), canonical);
+}
+function assertManifestIdentity(installId, manifest, isCustom) {
+	if (!(isCustom ? installId.startsWith(`custom:${manifest.id}@`) : manifest.id === installId)) throw new Error(`Manifest id "${manifest.id}" does not match install id "${installId}"`);
 }
 var IntegrationManager = class {
 	log = createLogger("IntegrationManager");
@@ -1158,6 +1548,11 @@ var IntegrationManager = class {
 	async install(params) {
 		const { name, version, config, customSource } = params;
 		if (!name) return this.err("INVALID_PARAMS", "Integration name is required");
+		try {
+			assertSafePathSegment(name, "Integration id");
+		} catch (err) {
+			return this.err("INVALID_PARAMS", err instanceof Error ? err.message : String(err));
+		}
 		const existing = this.state.get(name);
 		if (existing) {
 			if (existing.status === "installed" || existing.status === "configured" || existing.status === "active") {
@@ -1197,7 +1592,10 @@ var IntegrationManager = class {
 			const manifestPath = join(installPath, "alfe-integration.yaml");
 			if (!existsSync(manifestPath)) throw new Error(`No alfe-integration.yaml found in ${installPath}`);
 			const manifest = parseManifestFile(manifestPath);
+			assertManifestIdentity(name, manifest, customSource !== void 0);
 			this.log.info(`Manifest validated: ${manifest.id}@${manifest.version}`);
+			const preparedConfig = validateAndSplitConfig(manifest, config ?? {}, { allowEmpty: true });
+			this.secrets.set(name, preparedConfig.secretConfig);
 			for (const dep of manifest.depends_on) {
 				const depState = this.state.get(dep);
 				if (!depState || depState.status === "error") throw new Error(`Dependency "${dep}" is not installed. Install it first: alfe integration install ${dep}`);
@@ -1213,8 +1611,8 @@ var IntegrationManager = class {
 				this.log.info(`Running post_install hook: ${manifest.hooks.post_install}`);
 				const hookResult = await runHookWithContext(installPath, manifest.hooks.post_install, {
 					integrationName: name,
-					config: config ?? {},
-					secrets: this.secrets.get(name),
+					config: preparedConfig.nonSecretConfig,
+					secrets: preparedConfig.secretConfig,
 					runtimes: [...this.runtimeAppliers.keys()]
 				}, INSTALL_HOOK_TIMEOUT_MS);
 				if (hookResult.exitCode !== 0) throw new Error(this.hookFailureMessage("post_install hook failed", hookResult));
@@ -1223,7 +1621,7 @@ var IntegrationManager = class {
 				status: "installed",
 				version: manifest.version,
 				installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				config: config ?? {},
+				config: preparedConfig.nonSecretConfig,
 				customConnectionId: customSource?.connectionId
 			});
 			this.log.info(`Integration "${name}" installed successfully`);
@@ -1243,6 +1641,7 @@ var IntegrationManager = class {
 			try {
 				await this.installer.remove(name);
 			} catch {}
+			this.secrets.delete(name);
 			this.state.setStatus(name, "error", message);
 			return this.err("INSTALL_FAILED", message);
 		}
@@ -1263,20 +1662,7 @@ var IntegrationManager = class {
 		if (entry.status !== "installed" && entry.status !== "configured" && entry.status !== "active") return this.err("INVALID_STATE", `Cannot configure integration in "${entry.status}" state`);
 		this.log.info(`Configuring integration: ${name}`);
 		try {
-			const manifest = parseManifestFile(join(this.installer.getInstallPath(name), "alfe-integration.yaml"));
-			if (manifest.config_schema.length > 0) {
-				const result = buildConfigValidationSchema(manifest.config_schema).safeParse(config);
-				if (!result.success) {
-					const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-					return this.err("INVALID_CONFIG", `Config validation failed: ${issues}`);
-				}
-			}
-			const missingRequired = manifest.config_schema.filter((f) => f.required && config[f.key] === void 0).map((f) => f.key);
-			if (missingRequired.length > 0) return this.err("MISSING_CONFIG", `Missing required config fields: ${missingRequired.join(", ")}`);
-			const nonSecretConfig = {};
-			const secretConfig = /* @__PURE__ */ new Map();
-			for (const [key, value] of Object.entries(config)) if (manifest.config_schema.find((f) => f.key === key)?.type === "secret") secretConfig.set(key, value);
-			else nonSecretConfig[key] = value;
+			const { nonSecretConfig, secretConfig } = validateAndSplitConfig(parseManifestFile(join(this.installer.getInstallPath(name), "alfe-integration.yaml")), config);
 			this.state.update(name, {
 				status: "configured",
 				config: nonSecretConfig
@@ -1293,6 +1679,7 @@ var IntegrationManager = class {
 				}
 			};
 		} catch (err) {
+			if (err instanceof IntegrationConfigValidationError) return this.err(err.code, err.message);
 			const message = err instanceof Error ? err.message : String(err);
 			this.log.error(`Failed to configure "${name}": ${message}`);
 			return this.err("CONFIGURE_FAILED", message);
@@ -1371,7 +1758,7 @@ var IntegrationManager = class {
 							await applier.applyClawHubSkill(skill.clawhub);
 						} else if (skill.path) {
 							const skillName = skill.path.split("/").pop() ?? skill.path;
-							const srcPath = join(installPath, skill.path);
+							const srcPath = resolveExistingWithin(installPath, skill.path, `Skill path for ${skillLabel}`, "directory");
 							this.log.info(`Applying skill ${skillName} to ${runtimeName}`);
 							await applier.applySkill(skillName, srcPath);
 						}
@@ -1385,8 +1772,10 @@ var IntegrationManager = class {
 				if (skillFailures.length > 0) this.log.warn(`Continuing activation with ${String(skillFailures.length)} failed skill(s): ${skillFailures.join(", ")}`);
 				let runtimeConfigApplied = false;
 				if (runtimeConfig && Object.keys(runtimeConfig).length > 0) {
-					const agentConfig = entry.config;
-					const interpolatedConfig = interpolateSelfConfig(runtimeConfig, agentConfig);
+					const interpolatedConfig = interpolateSelfConfig(runtimeConfig, {
+						...entry.config,
+						...Object.fromEntries(this.secrets.get(integrationId) ?? [])
+					});
 					this.log.info(`Applying config for ${integrationId} to ${runtimeName}`);
 					await applier.applyConfig(integrationId, interpolatedConfig);
 					configApplied = true;
@@ -1466,7 +1855,8 @@ var IntegrationManager = class {
 	async deactivate(integrationId) {
 		const entry = this.state.get(integrationId);
 		if (!entry) return this.err("NOT_FOUND", `Integration "${integrationId}" is not installed`);
-		if (entry.status !== "active") return {
+		const ownedEntries = this.lockManager.getEntriesForIntegration(integrationId);
+		if (entry.status !== "active" && entry.status !== "error" && Object.keys(ownedEntries).length === 0) return {
 			ok: true,
 			payload: {
 				name: integrationId,
@@ -1476,16 +1866,18 @@ var IntegrationManager = class {
 		};
 		this.log.info(`Deactivating integration: ${integrationId}`);
 		try {
-			const removed = this.lockManager.removeEntries(integrationId);
-			const { plugins: claimedPluginsByRuntime, skills: claimedSkillsByRuntime } = this.claimedEntriesByRuntime();
-			for (const [runtimeName, entries] of Object.entries(removed)) {
+			const { plugins: claimedPluginsByRuntime, skills: claimedSkillsByRuntime } = this.claimedEntriesByRuntime(integrationId);
+			const cleanupFailures = [];
+			for (const [runtimeName, entries] of Object.entries(ownedEntries)) {
 				const applier = this.runtimeAppliers.get(runtimeName);
 				if (!applier) {
 					this.log.warn(`No applier for runtime "${runtimeName}" — cannot remove entries`);
+					cleanupFailures.push(`runtime:${runtimeName}:missing-applier`);
 					continue;
 				}
 				if (!await applier.isAvailable()) {
 					this.log.warn(`Runtime "${runtimeName}" is not available — skipping removal`);
+					cleanupFailures.push(`runtime:${runtimeName}:unavailable`);
 					continue;
 				}
 				const keepPlugins = claimedPluginsByRuntime.get(runtimeName) ?? /* @__PURE__ */ new Set();
@@ -1500,6 +1892,7 @@ var IntegrationManager = class {
 						await applier.removePlugin(plugin.package);
 					} catch (err) {
 						this.log.warn(`Failed to remove plugin ${plugin.package} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+						cleanupFailures.push(`runtime:${runtimeName}:plugin`);
 					}
 				}
 				for (const skill of entries.skills) {
@@ -1513,13 +1906,17 @@ var IntegrationManager = class {
 						else await applier.removeSkill(skill.name);
 					} catch (err) {
 						this.log.warn(`Failed to remove skill ${skill.name} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+						cleanupFailures.push(`runtime:${runtimeName}:skill`);
 					}
 				}
-				this.log.info(`Removing config for ${integrationId} from ${runtimeName}`);
-				try {
-					await applier.removeConfig(integrationId);
-				} catch (err) {
-					this.log.warn(`Failed to remove config for ${integrationId} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+				if (entries.config.length > 0) {
+					this.log.info(`Removing config for ${integrationId} from ${runtimeName}`);
+					try {
+						await applier.removeConfig(integrationId);
+					} catch (err) {
+						this.log.warn(`Failed to remove config for ${integrationId} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+						cleanupFailures.push(`runtime:${runtimeName}:config`);
+					}
 				}
 			}
 			if (this.mcpApplier) {
@@ -1528,8 +1925,11 @@ var IntegrationManager = class {
 					await this.mcpApplier.removeForIntegration(integrationId);
 				} catch (err) {
 					this.log.warn(`Failed to remove MCP servers for ${integrationId} via bundler manager: ${err instanceof Error ? err.message : String(err)}`);
+					cleanupFailures.push("mcp");
 				}
 			}
+			if (cleanupFailures.length > 0) return this.err("DEACTIVATE_FAILED", `Failed to remove ${String(cleanupFailures.length)} integration contribution(s); ownership lock retained for retry`);
+			this.lockManager.removeEntries(integrationId);
 			this.state.setStatus(integrationId, "configured");
 			return {
 				ok: true,
@@ -1560,7 +1960,10 @@ var IntegrationManager = class {
 		if (!entry) return this.err("NOT_FOUND", `Integration "${name}" is not installed`);
 		this.log.info(`Uninstalling integration: ${name}`);
 		try {
-			if (entry.status === "active") await this.deactivate(name);
+			if (entry.status === "active" || entry.status === "error" || Object.keys(this.lockManager.getEntriesForIntegration(name)).length > 0) {
+				const deactivateResult = await this.deactivate(name);
+				if (!deactivateResult.ok) return this.err("UNINSTALL_FAILED", `Could not safely deactivate "${name}": ${deactivateResult.error?.message ?? "unknown cleanup failure"}`);
+			}
 			const installPath = this.installer.getInstallPath(name);
 			let manifest = null;
 			const manifestPath = join(installPath, "alfe-integration.yaml");
@@ -1631,7 +2034,7 @@ var IntegrationManager = class {
 		this.log.info(`Reinstalling integration: ${name}`);
 		try {
 			const uninstallResult = await this.uninstall({ name });
-			if (!uninstallResult.ok) this.log.warn(`Uninstall returned error during reinstall: ${String(uninstallResult.error?.message)} — proceeding with install`);
+			if (!uninstallResult.ok) return this.err("REINSTALL_FAILED", `Could not safely remove the existing integration: ${uninstallResult.error?.message ?? "unknown cleanup failure"}`);
 			const installResult = await this.install(params);
 			if (!installResult.ok) return installResult;
 			return await this.activate(name, { forcePlugins: true });
@@ -1702,6 +2105,8 @@ var IntegrationManager = class {
 		}
 		this.log.info(`Upgrading integration: ${name}${version ? `@${version}` : ""}`);
 		let stagedPath;
+		let newManifest;
+		let preparedUpgradeConfig;
 		try {
 			let resolved;
 			if (customSource) {
@@ -1713,6 +2118,16 @@ var IntegrationManager = class {
 			}
 			stagedPath = await this.installer.stage(resolved);
 			if (customSource) ensureCanonicalManifestName(stagedPath, customSource.manifestPath);
+			const stagedManifestPath = join(stagedPath, "alfe-integration.yaml");
+			if (!existsSync(stagedManifestPath)) throw new Error(`No alfe-integration.yaml found in staged upgrade for "${name}"`);
+			newManifest = parseManifestFile(stagedManifestPath);
+			assertManifestIdentity(name, newManifest, customSource !== void 0);
+			if (config !== void 0) preparedUpgradeConfig = validateAndSplitConfig(newManifest, config, { allowEmpty: true });
+			for (const dep of newManifest.depends_on) {
+				const depState = this.state.get(dep);
+				if (!depState || depState.status === "error") throw new Error(`Dependency "${dep}" is not installed. Install it first: alfe integration install ${dep}`);
+			}
+			this.log.info(`Staged upgrade manifest validated: ${newManifest.id}@${newManifest.version}`);
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
 			this.log.error(`Failed to prepare upgrade for "${name}": ${message}`);
@@ -1721,21 +2136,7 @@ var IntegrationManager = class {
 		try {
 			await opts?.onBeforeRuntimeMutation?.();
 			this.installer.commitStaged(name, stagedPath);
-			const newManifestPath = join(this.installer.getInstallPath(name), "alfe-integration.yaml");
-			if (!existsSync(newManifestPath)) throw new Error(`No alfe-integration.yaml found after commit for "${name}"`);
-			const newManifest = parseManifestFile(newManifestPath);
-			this.log.info(`Upgrade manifest validated: ${newManifest.id}@${newManifest.version}`);
-			for (const dep of newManifest.depends_on) {
-				const depState = this.state.get(dep);
-				if (!depState || depState.status === "error") throw new Error(`Dependency "${dep}" is not installed. Install it first: alfe integration install ${dep}`);
-			}
-			this.state.update(name, {
-				status: "installed",
-				version: newManifest.version,
-				installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				config: config ?? existing.config,
-				customConnectionId: customSource?.connectionId ?? existing.customConnectionId
-			});
+			this.log.info(`Upgrade committed: ${newManifest.id}@${newManifest.version}`);
 			const installHooksSupported = this.manifestSupportsRegisteredRuntime(newManifest);
 			if (!installHooksSupported && (newManifest.hooks.pre_install || newManifest.hooks.post_install)) this.log.warn(`Integration "${name}" upgrade install hooks skipped — no registered runtime (${[...this.runtimeAppliers.keys()].join(", ")}) is in supported_agents (${(newManifest.supported_agents ?? []).join(", ")})`);
 			if (installHooksSupported && newManifest.hooks.pre_install) {
@@ -1747,13 +2148,21 @@ var IntegrationManager = class {
 				this.log.info(`Running post_install hook: ${newManifest.hooks.post_install}`);
 				const hookResult = await runHookWithContext(this.installer.getInstallPath(name), newManifest.hooks.post_install, {
 					integrationName: name,
-					config: config ?? existing.config,
-					secrets: this.secrets.get(name),
+					config: preparedUpgradeConfig?.nonSecretConfig ?? existing.config,
+					secrets: preparedUpgradeConfig?.secretConfig ?? this.secrets.get(name),
 					runtimes: [...this.runtimeAppliers.keys()]
 				}, INSTALL_HOOK_TIMEOUT_MS);
 				if (hookResult.exitCode !== 0) throw new Error(this.hookFailureMessage("post_install hook failed", hookResult));
 			}
-			await this.applyUpgradeDiffRemovals(name, oldManifest, newManifest);
+			await this.applyUpgradeDiffRemovals(name, newManifest);
+			this.state.update(name, {
+				status: "installed",
+				version: newManifest.version,
+				installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				config: preparedUpgradeConfig?.nonSecretConfig ?? existing.config,
+				customConnectionId: customSource?.connectionId ?? existing.customConnectionId
+			});
+			if (preparedUpgradeConfig) this.secrets.set(name, preparedUpgradeConfig.secretConfig);
 			return await this.activate(name, { forcePlugins: true });
 		} catch (err) {
 			try {
@@ -1865,7 +2274,7 @@ var IntegrationManager = class {
 					commands: commands.map((cmd) => ({
 						name: cmd.name,
 						handler: cmd.handler,
-						resolvedPath: join(installPath, cmd.handler),
+						resolvedPath: resolveExistingWithin(installPath, cmd.handler, `Command handler ${cmd.name}`, "file"),
 						method: cmd.method ?? "handle",
 						timeoutMs: cmd.timeout_ms ?? 3e4,
 						description: cmd.description
@@ -1930,9 +2339,7 @@ var IntegrationManager = class {
 				healthy: hookResult.exitCode === 0,
 				status: entry.status,
 				version: manifest.version,
-				message: hookResult.exitCode === 0 ? "Healthy" : hookResult.timedOut ? `Health check failed (timed out after ${String(hookResult.timedOutAfterMs ?? "?")}ms)` : `Health check failed (exit ${String(hookResult.exitCode)})`,
-				stdout: hookResult.stdout || void 0,
-				stderr: hookResult.stderr || void 0
+				message: hookResult.exitCode === 0 ? "Healthy" : hookResult.timedOut ? `Health check failed (timed out after ${String(hookResult.timedOutAfterMs ?? "?")}ms)` : `Health check failed (exit ${String(hookResult.exitCode)})`
 			};
 		} catch (err) {
 			return {
@@ -1956,13 +2363,13 @@ var IntegrationManager = class {
 	/**
 	* Build a hook-failure message. A hook we SIGKILLed at its timeout is rendered
 	* as `(timed out after <ms>ms)` so it is visually distinguishable in Sentry
-	* from a genuine non-zero exit `(exit <code>)` — the two have very different
-	* root causes (Sentry AGENT-DAEMON-6).
+	* from a genuine non-zero exit `(exit <code>)`. Captured output is deliberately
+	* excluded: hooks inherit daemon credentials and receive integration secrets,
+	* so stdout/stderr is a secret-bearing channel that must not enter durable
+	* state, logs, or user-facing error messages.
 	*/
 	hookFailureMessage(label, hookResult) {
-		const reason = hookResult.timedOut ? `timed out after ${String(hookResult.timedOutAfterMs ?? "?")}ms` : `exit ${String(hookResult.exitCode)}`;
-		const output = hookResult.stderr || hookResult.stdout;
-		return output ? `${label} (${reason}): ${output}` : `${label} (${reason})`;
+		return `${label} (${hookResult.timedOut ? `timed out after ${String(hookResult.timedOutAfterMs ?? "?")}ms` : `exit ${String(hookResult.exitCode)}`})`;
 	}
 	/**
 	* Compute the plugin (bare package) names and skill names still claimed by
@@ -1976,13 +2383,13 @@ var IntegrationManager = class {
 	* integrations pinning the same plugin at different versions still keep the
 	* one file-system install alive when only one is removed.
 	*/
-	claimedEntriesByRuntime() {
+	claimedEntriesByRuntime(excludeIntegrationId) {
 		const remaining = this.lockManager.read();
 		const plugins = /* @__PURE__ */ new Map();
 		const skills = /* @__PURE__ */ new Map();
 		for (const [rtName, state] of Object.entries(remaining.runtimes)) {
-			plugins.set(rtName, new Set(state.plugins.map((p) => stripPluginVersion(p.package))));
-			skills.set(rtName, new Set(state.skills.map((s) => s.name)));
+			plugins.set(rtName, new Set(state.plugins.filter((entry) => entry.sourceIntegration !== excludeIntegrationId).map((entry) => stripPluginVersion(entry.package))));
+			skills.set(rtName, new Set(state.skills.filter((entry) => entry.sourceIntegration !== excludeIntegrationId).map((entry) => entry.name)));
 		}
 		return {
 			plugins,
@@ -1995,24 +2402,27 @@ var IntegrationManager = class {
 	* (and everything a sibling integration still claims) in place. Phase 4's
 	* `activate` re-applies and re-locks the new set immediately after.
 	*
-	* `removeEntries` clears this integration's lock rows and returns what it had;
-	* a candidate removal is skipped when it is EITHER (a) still declared by the
-	* new manifest, or (b) still claimed by another integration.
+	* The existing lock remains intact until every physical removal and MCP prune
+	* succeeds. This makes partial cleanup retryable; only then are the old rows
+	* cleared so activate() can record the new manifest's contributions.
 	*/
-	async applyUpgradeDiffRemovals(integrationId, oldManifest, newManifest) {
-		const removed = this.lockManager.removeEntries(integrationId);
-		const { plugins: claimedPluginsByRuntime, skills: claimedSkillsByRuntime } = this.claimedEntriesByRuntime();
-		for (const [runtimeName, entries] of Object.entries(removed)) {
+	async applyUpgradeDiffRemovals(integrationId, newManifest) {
+		const ownedEntries = this.lockManager.getEntriesForIntegration(integrationId);
+		const { plugins: claimedPluginsByRuntime, skills: claimedSkillsByRuntime } = this.claimedEntriesByRuntime(integrationId);
+		const cleanupFailures = [];
+		for (const [runtimeName, entries] of Object.entries(ownedEntries)) {
 			const applier = this.runtimeAppliers.get(runtimeName);
 			if (!applier) {
 				this.log.warn(`No applier for runtime "${runtimeName}" — cannot diff-remove entries`);
+				cleanupFailures.push(`runtime:${runtimeName}:missing-applier`);
 				continue;
 			}
 			if (!await applier.isAvailable()) {
 				this.log.warn(`Runtime "${runtimeName}" is not available — skipping upgrade diff removal`);
+				cleanupFailures.push(`runtime:${runtimeName}:unavailable`);
 				continue;
 			}
-			const { plugins: newPlugins, skills: newSkills, config: newRuntimeConfig } = resolveInstallsForRuntime(newManifest, runtimeName);
+			const { plugins: newPlugins, skills: newSkills } = resolveInstallsForRuntime(newManifest, runtimeName);
 			const keepPluginsNew = new Set(newPlugins.map((p) => stripPluginVersion(p.package)));
 			const keepSkillsNew = new Set(newSkills.map((s) => s.clawhub ?? s.path?.split("/").pop() ?? "unknown"));
 			const keepPluginsOther = claimedPluginsByRuntime.get(runtimeName) ?? /* @__PURE__ */ new Set();
@@ -2025,6 +2435,7 @@ var IntegrationManager = class {
 					await applier.removePlugin(plugin.package);
 				} catch (err) {
 					this.log.warn(`Failed to remove dropped plugin ${plugin.package} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+					cleanupFailures.push(`runtime:${runtimeName}:plugin`);
 				}
 			}
 			for (const skill of entries.skills) {
@@ -2035,17 +2446,16 @@ var IntegrationManager = class {
 					else await applier.removeSkill(skill.name);
 				} catch (err) {
 					this.log.warn(`Failed to remove dropped skill ${skill.name} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+					cleanupFailures.push(`runtime:${runtimeName}:skill`);
 				}
 			}
-			const oldRuntimeConfig = resolveInstallsForRuntime(oldManifest, runtimeName).config;
-			const oldHadConfig = Boolean(oldRuntimeConfig && Object.keys(oldRuntimeConfig).length > 0);
-			const newHasConfig = Boolean(newRuntimeConfig && Object.keys(newRuntimeConfig).length > 0);
-			if (oldHadConfig && !newHasConfig) {
-				this.log.info(`Upgrade: removing gone config for ${integrationId} from ${runtimeName}`);
+			if (entries.config.length > 0) {
+				this.log.info(`Upgrade: removing prior config for ${integrationId} from ${runtimeName}`);
 				try {
 					await applier.removeConfig(integrationId);
 				} catch (err) {
-					this.log.warn(`Failed to remove gone config for ${integrationId} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.log.warn(`Failed to remove prior config for ${integrationId} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+					cleanupFailures.push(`runtime:${runtimeName}:config`);
 				}
 			}
 		}
@@ -2056,8 +2466,11 @@ var IntegrationManager = class {
 				await this.mcpApplier.pruneForIntegration(integrationId, keepIds);
 			} catch (err) {
 				this.log.warn(`Failed to prune MCP servers for ${integrationId}: ${err instanceof Error ? err.message : String(err)}`);
+				cleanupFailures.push("mcp");
 			}
 		}
+		if (cleanupFailures.length > 0) throw new Error(`Failed to remove ${String(cleanupFailures.length)} superseded integration contribution(s); ownership lock retained for retry`);
+		this.lockManager.removeEntries(integrationId);
 	}
 	/**
 	* True when the manifest's `supported_agents` (if declared) intersects the
@@ -2283,6 +2696,11 @@ const INVALID_PARTIAL_PROVIDER_PHRASE = "custom model providers must declare";
 function isInvalidPartialProviderUnset(err) {
 	return (err instanceof Error ? err.message : String(err)).toLowerCase().includes(INVALID_PARTIAL_PROVIDER_PHRASE);
 }
+/** An already-absent config path is the only safe idempotent unset failure. */
+function isMissingConfigPathError(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	return /config path not found/i.test(message);
+}
 const delay$1 = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
@@ -2419,16 +2837,26 @@ function configSetErrorMessage(err, args) {
 	}
 	return `${target} failed: ${String(err)}`;
 }
-async function readParentObject(parentPath) {
+async function readParentObject(parentPath, options = {}) {
 	try {
 		const { stdout } = await execFileAsync$1("openclaw", [
 			"config",
 			"get",
 			parentPath
 		], { timeout: 1e4 });
-		const parsed = JSON.parse(stdout.trim());
+		const trimmed = stdout.trim();
+		if (trimmed === "") return {};
+		const parsed = JSON.parse(trimmed);
 		if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
-	} catch {}
+		if (parsed === null) return {};
+		if (options.failClosed) throw new Error(`OpenClaw config path "${parentPath}" is not an object`);
+	} catch (err) {
+		if (isMissingConfigPathError(err)) return {};
+		if (options.failClosed) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(`Unable to read OpenClaw config path "${parentPath}" for cleanup: ${message}`);
+		}
+	}
 	return {};
 }
 var OpenClawApplier = class {
@@ -2920,12 +3348,14 @@ var OpenClawApplier = class {
 		], { timeout: 3e4 });
 	}
 	applySkill(name, srcPath) {
+		assertSafePathSegment(name, "Skill name");
 		if (!existsSync(srcPath)) throw new Error(`Skill source path not found: ${srcPath}`);
 		mkdirSync(this.skillsDir, { recursive: true });
 		cpSync(srcPath, join(this.skillsDir, name), { recursive: true });
 		return Promise.resolve();
 	}
 	applyClawHubSkill(slug) {
+		assertSafePathSegment(slug, "ClawHub skill name");
 		return this.cliLock.run(async () => {
 			log$5.info({ slug }, "Installing skill from ClawHub");
 			try {
@@ -2950,6 +3380,7 @@ var OpenClawApplier = class {
 		});
 	}
 	removeClawHubSkill(slug) {
+		assertSafePathSegment(slug, "ClawHub skill name");
 		const workspaceSkillsDir = join(this.agentWorkspace, "skills", slug);
 		if (existsSync(workspaceSkillsDir)) {
 			rmSync(workspaceSkillsDir, {
@@ -2961,6 +3392,7 @@ var OpenClawApplier = class {
 		return Promise.resolve();
 	}
 	removeSkill(name) {
+		assertSafePathSegment(name, "Skill name");
 		const skillPath = join(this.skillsDir, name);
 		if (existsSync(skillPath)) rmSync(skillPath, {
 			recursive: true,
@@ -2978,8 +3410,9 @@ var OpenClawApplier = class {
 		return this.cliLock.run(() => this.applyConfigLocked(integrationId, config));
 	}
 	async applyConfigLocked(integrationId, config) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const tracking = this.readTracking();
-		const integrations = tracking._integrations ?? {};
+		const integrations = getOptionalJsonObjectField(tracking, "_integrations", "OpenClaw integration tracking field");
 		const previous = integrations[integrationId];
 		const { leaves, subtreesByParent } = partitionEntries(flattenConfig(config));
 		if (previous && typeof previous === "object" && !Array.isArray(previous)) {
@@ -3050,8 +3483,9 @@ var OpenClawApplier = class {
 		return this.cliLock.run(() => this.removeConfigLocked(integrationId));
 	}
 	async removeConfigLocked(integrationId) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const tracking = this.readTracking();
-		const integrations = tracking._integrations ?? {};
+		const integrations = getOptionalJsonObjectField(tracking, "_integrations", "OpenClaw integration tracking field");
 		if (!(integrationId in integrations)) return;
 		const integrationConfig = integrations[integrationId];
 		const { leaves, subtreesByParent } = partitionEntries(flattenConfig(integrationConfig));
@@ -3065,15 +3499,16 @@ var OpenClawApplier = class {
 	* Drop a set of dotted keys from a dot-free parent object via read-drop-write,
 	* UNLOCKED. If the parent becomes empty, `config unset` it; otherwise
 	* `--replace` the shrunk map (siblings survive because they remain in
-	* `remaining`). Warn-tolerant — a failed drop of an already-gone key must not
-	* fail the caller. Shared by `removeConfig` (whole-integration teardown) and
+	* `remaining`). A proven already-absent path is idempotent success; every
+	* other write failure propagates so callers retain the ownership record for a
+	* later retry. Shared by `removeConfig` (whole-integration teardown) and
 	* `applyConfig`'s stale-key diff (per-key removal between manifest versions).
 	*
 	* Assumes the shared CLI lock is already held by the calling public method —
 	* the lock is NOT re-entrant, so this stays an `*Unlocked` internal.
 	*/
 	async dropSubtreeKeysUnlocked(parentPath, dottedKeys) {
-		const existing = await readParentObject(parentPath);
+		const existing = await readParentObject(parentPath, { failClosed: true });
 		if (Object.keys(existing).length === 0) return;
 		const remaining = Object.fromEntries(Object.entries(existing).filter(([k]) => !dottedKeys.has(k)));
 		try {
@@ -3084,10 +3519,8 @@ var OpenClawApplier = class {
 				"--replace"
 			]);
 		} catch (err) {
-			log$5.warn({
-				err: err instanceof Error ? err.message : String(err),
-				parentPath
-			}, "Failed to update parent config during subtree key drop");
+			if (isMissingConfigPathError(err)) return;
+			throw err;
 		}
 	}
 	/**
@@ -3107,15 +3540,17 @@ var OpenClawApplier = class {
 	* the provider subtree is unset for `models.providers.zhipu.baseUrl`, the
 	* follow-up `.apiKey` / `.models` leaves skip re-issuing the parent unset.
 	*
-	* Warn-tolerant (a failed unset of an already-gone key must never fail the
-	* caller) and assumes the shared CLI lock is held — stays an `*Unlocked`
-	* internal since the lock is NOT re-entrant. Shared by `removeConfig`
-	* (whole-integration teardown) and `applyConfig`'s stale-leaf diff.
+	* A proven already-absent path is idempotent success; every other failure
+	* propagates so the ownership ledger remains a retry record. Assumes the
+	* shared CLI lock is held — stays an `*Unlocked` internal since the lock is
+	* NOT re-entrant. Shared by `removeConfig` (whole-integration teardown) and
+	* `applyConfig`'s stale-leaf diff.
 	*/
 	async unsetLeafPathUnlocked(path, unsetParents) {
 		try {
 			await this.runConfigCommandUnlocked(["unset", path]);
 		} catch (err) {
+			if (isMissingConfigPathError(err)) return;
 			const parentPath = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : void 0;
 			if (parentPath && isInvalidPartialProviderUnset(err)) {
 				if (unsetParents.has(parentPath)) return;
@@ -3127,17 +3562,12 @@ var OpenClawApplier = class {
 						parentPath
 					}, "Leaf unset rejected as an invalid partial custom provider — unset the parent subtree instead");
 				} catch (parentErr) {
-					log$5.warn({
-						err: parentErr instanceof Error ? parentErr.message : String(parentErr),
-						parentPath
-					}, "Failed to unset parent subtree after an invalid-partial leaf unset");
+					if (isMissingConfigPathError(parentErr)) return;
+					throw parentErr;
 				}
 				return;
 			}
-			log$5.warn({
-				err: err instanceof Error ? err.message : String(err),
-				path
-			}, "Failed to unset config via openclaw config unset");
+			throw err;
 		}
 	}
 	/**
@@ -3197,16 +3627,10 @@ var OpenClawApplier = class {
 		return Promise.resolve(existsSync(this.home));
 	}
 	readTracking() {
-		if (!existsSync(this.trackingPath)) return {};
-		try {
-			return JSON.parse(readFileSync(this.trackingPath, "utf-8"));
-		} catch {
-			return {};
-		}
+		return readJsonObjectFileSync(this.trackingPath, "OpenClaw integration tracking file");
 	}
 	writeTracking(config) {
-		mkdirSync(join(this.trackingPath, ".."), { recursive: true });
-		writeFileSync(this.trackingPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+		atomicWriteFileSync(this.trackingPath, JSON.stringify(config, null, 2) + "\n");
 	}
 };
 //#endregion
@@ -3319,22 +3743,16 @@ var HermesApplier = class {
 	* be cleanly removed later (mirrors OpenClawApplier's `_integrations`).
 	*/
 	async applyConfig(integrationId, config) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const tracking = this.readTracking();
-		const integrations = tracking._integrations ?? {};
+		const integrations = getOptionalJsonObjectField(tracking, "_integrations", "Hermes integration tracking field");
 		const previous = integrations[integrationId];
 		const { leaves, subtreesByParent } = partitionEntries(flattenConfig(config));
 		if (previous && typeof previous === "object" && !Array.isArray(previous)) {
 			const prev = partitionEntries(flattenConfig(previous));
 			const nextLeafPaths = new Set(leaves.map((l) => l.path));
 			const staleLeafPaths = prev.leaves.filter((l) => !nextLeafPaths.has(l.path)).map((l) => l.path);
-			if (staleLeafPaths.length > 0) try {
-				await this.deleteConfigKeys(staleLeafPaths);
-			} catch (err) {
-				log$4.warn({
-					err: err instanceof Error ? err.message : String(err),
-					integrationId
-				}, "Failed to delete stale Hermes config keys during applyConfig diff");
-			}
+			if (staleLeafPaths.length > 0) await this.deleteConfigKeys(staleLeafPaths);
 			const staleSubtreeParents = [...prev.subtreesByParent].filter(([parent, prevKvs]) => {
 				const nextKvs = subtreesByParent.get(parent);
 				return [...prevKvs.keys()].some((k) => !nextKvs?.has(k));
@@ -3369,8 +3787,9 @@ var HermesApplier = class {
 	* `hermes config unset` verb — see the file header). Clears the tracking entry.
 	*/
 	async removeConfig(integrationId) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const tracking = this.readTracking();
-		const integrations = tracking._integrations ?? {};
+		const integrations = getOptionalJsonObjectField(tracking, "_integrations", "Hermes integration tracking field");
 		if (!(integrationId in integrations)) return;
 		const integrationConfig = integrations[integrationId];
 		const { leaves } = partitionEntries(flattenConfig(integrationConfig));
@@ -3381,6 +3800,7 @@ var HermesApplier = class {
 				err: err instanceof Error ? err.message : String(err),
 				integrationId
 			}, "Failed to delete Alfe config keys from ~/.hermes/config.yaml");
+			throw err;
 		}
 		tracking._integrations = Object.fromEntries(Object.entries(integrations).filter(([key]) => key !== integrationId));
 		this.writeTracking(tracking);
@@ -3521,10 +3941,11 @@ var HermesApplier = class {
 	deleteConfigKeysSync(paths) {
 		if (paths.length === 0 || !existsSync(this.configYamlPath)) return;
 		const doc = parseDocument(readFileSync(this.configYamlPath, "utf-8"));
+		if (doc.errors.length > 0) throw new Error("Hermes config.yaml is invalid; refusing destructive config cleanup");
 		const before = doc.toString();
 		for (const path of paths) doc.deleteIn(path.split("."));
 		const after = doc.toString();
-		if (before !== after) writeFileSync(this.configYamlPath, after, "utf-8");
+		if (before !== after) atomicWriteFileSync(this.configYamlPath, after);
 	}
 	/**
 	* Run `hermes config <args>` (only `set` is used — removal goes via
@@ -3550,16 +3971,10 @@ var HermesApplier = class {
 		return result;
 	}
 	readTracking() {
-		if (!existsSync(this.trackingPath)) return {};
-		try {
-			return JSON.parse(readFileSync(this.trackingPath, "utf-8"));
-		} catch {
-			return {};
-		}
+		return readJsonObjectFileSync(this.trackingPath, "Hermes integration tracking file");
 	}
 	writeTracking(config) {
-		mkdirSync(join(this.trackingPath, ".."), { recursive: true });
-		writeFileSync(this.trackingPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+		atomicWriteFileSync(this.trackingPath, JSON.stringify(config, null, 2) + "\n");
 	}
 };
 //#endregion
@@ -3662,8 +4077,8 @@ var HermesMcpSync = class {
 	*/
 	start() {
 		if (this.started) return;
-		this.started = true;
 		this.loadSyncedIds();
+		this.started = true;
 		this.syncOnce().catch((err) => {
 			log$3.warn({ err: errMsg$2(err) }, "Hermes MCP sync: initial sync failed");
 		});
@@ -3718,14 +4133,14 @@ var HermesMcpSync = class {
 		const desired = this.computeDesired();
 		const desiredIds = new Set(desired.keys());
 		const doc = parseDocument(existsSync(this.configPath) ? readFileSync(this.configPath, "utf-8") : "");
+		if (doc.errors.length > 0) throw new Error("Hermes config.yaml is invalid; refusing MCP reconciliation");
 		const before = doc.toString();
 		for (const [id, entry] of desired) doc.setIn(["mcp_servers", id], entry);
 		for (const id of this.syncedIds) if (!desiredIds.has(id)) doc.deleteIn(["mcp_servers", id]);
 		const after = doc.toString();
 		let changed = before !== after;
 		if (changed) {
-			mkdirSync(dirname(this.configPath), { recursive: true });
-			writeFileSync(this.configPath, after, "utf-8");
+			atomicWriteFileSync(this.configPath, after);
 			log$3.info({
 				added: [...desiredIds],
 				removed: [...this.syncedIds].filter((id) => !desiredIds.has(id))
@@ -3762,7 +4177,7 @@ var HermesMcpSync = class {
 	}
 	withAlfeApiKey(env) {
 		const merged = { ...env ?? {} };
-		if (!("ALFE_API_KEY" in merged)) merged.ALFE_API_KEY = ALFE_API_KEY_ENV_REF;
+		merged.ALFE_API_KEY = ALFE_API_KEY_ENV_REF;
 		return merged;
 	}
 	/** Read-merge-write `~/.hermes/.env` to set ALFE_API_KEY without clobbering other keys. */
@@ -3777,17 +4192,15 @@ var HermesMcpSync = class {
 		if (!existsSync(this.trackingPath)) return;
 		try {
 			const data = JSON.parse(readFileSync(this.trackingPath, "utf-8"));
-			if (Array.isArray(data.syncedIds)) this.syncedIds = new Set(data.syncedIds.filter((x) => typeof x === "string"));
-		} catch {}
-	}
-	persistSyncedIds() {
-		try {
-			mkdirSync(dirname(this.trackingPath), { recursive: true });
-			writeFileSync(this.trackingPath, JSON.stringify({ syncedIds: [...this.syncedIds] }, null, 2) + "\n", "utf-8");
+			if (!Array.isArray(data.syncedIds) || data.syncedIds.some((value) => typeof value !== "string")) throw new Error("invalid syncedIds shape");
+			this.syncedIds = new Set(data.syncedIds);
 		} catch (err) {
-			log$3.warn({ err: errMsg$2(err) }, "Hermes MCP sync: failed to persist synced-id sidecar");
+			throw new Error(`Hermes MCP ownership sidecar is unreadable; refusing reconciliation: ${errMsg$2(err)}`);
 		}
 	}
+	persistSyncedIds() {
+		atomicWriteFileSync(this.trackingPath, JSON.stringify({ syncedIds: [...this.syncedIds] }, null, 2) + "\n");
+	}
 };
 /**
 * Set `KEY=value` in a `.env`-style file, preserving every other line (comments,
@@ -3796,6 +4209,8 @@ var HermesMcpSync = class {
 * `~/.hermes/.env` ever holds.
 */
 function upsertEnvVar(envPath, key, value) {
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error("Environment variable key is invalid");
+	if (value.includes("\n") || value.includes("\r") || value.includes("\0")) throw new Error(`Environment variable ${key} contains an invalid control character`);
 	const desiredLine = `${key}=${value}`;
 	const existing = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
 	const lines = existing.length > 0 ? existing.replace(/\n$/, "").split("\n") : [];
@@ -3810,10 +4225,7 @@ function upsertEnvVar(envPath, key, value) {
 		changed = lines[idx] !== desiredLine;
 		out = lines.map((line, i) => i === idx ? desiredLine : line);
 	}
-	if (changed) {
-		mkdirSync(dirname(envPath), { recursive: true });
-		writeFileSync(envPath, out.join("\n") + "\n", "utf-8");
-	}
+	if (changed) atomicWriteFileSync(envPath, out.join("\n") + "\n");
 	return changed;
 }
 function errMsg$2(err) {
@@ -3883,8 +4295,9 @@ var ClaudeCodeApplier = class {
 	* replace, no stale-key diff needed since nothing is applied to a runtime).
 	*/
 	applyConfig(integrationId, config) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const ledger = this.readLedger();
-		const integrations = ledger._integrations ?? {};
+		const integrations = getOptionalJsonObjectField(ledger, "_integrations", "Claude Code integration ledger field");
 		integrations[integrationId] = config;
 		ledger._integrations = integrations;
 		this.writeLedger(ledger);
@@ -3893,8 +4306,9 @@ var ClaudeCodeApplier = class {
 	}
 	/** Clear an integration's config contribution from the ledger. */
 	removeConfig(integrationId) {
+		assertSafePathSegment(integrationId, "Integration id");
 		const ledger = this.readLedger();
-		const integrations = ledger._integrations ?? {};
+		const integrations = getOptionalJsonObjectField(ledger, "_integrations", "Claude Code integration ledger field");
 		if (!(integrationId in integrations)) return Promise.resolve();
 		ledger._integrations = Object.fromEntries(Object.entries(integrations).filter(([key]) => key !== integrationId));
 		this.writeLedger(ledger);
@@ -3912,8 +4326,9 @@ var ClaudeCodeApplier = class {
 	* `getConfigRaw`.
 	*/
 	setConfigRaw(key, value) {
+		assertSafeRecordKey(key, "Raw config key");
 		const ledger = this.readLedger();
-		const raw = ledger._raw ?? {};
+		const raw = getOptionalJsonObjectField(ledger, "_raw", "Claude Code raw-config ledger field");
 		raw[key] = value;
 		ledger._raw = raw;
 		this.writeLedger(ledger);
@@ -3927,7 +4342,8 @@ var ClaudeCodeApplier = class {
 	*/
 	getConfigRaw(key) {
 		try {
-			const value = (this.readLedger()._raw ?? {})[key];
+			assertSafeRecordKey(key, "Raw config key");
+			const value = getOptionalJsonObjectField(this.readLedger(), "_raw", "Claude Code raw-config ledger field")[key];
 			return Promise.resolve(typeof value === "string" ? value : void 0);
 		} catch {
 			return Promise.resolve(void 0);
@@ -3980,6 +4396,7 @@ var ClaudeCodeApplier = class {
 	* clean no-op. We never throw for a claude-code ClawHub skill.
 	*/
 	applyClawHubSkill(slug) {
+		assertSafePathSegment(slug, "ClawHub skill name");
 		log$2.info({ slug }, "Claude Code applyClawHubSkill: no claude-code ClawHub fetch — skipping (native skill dirs land via applySkill)");
 		return Promise.resolve();
 	}
@@ -3991,6 +4408,7 @@ var ClaudeCodeApplier = class {
 		return Promise.resolve(existsSync(this.home));
 	}
 	copySkillDir(name, srcPath) {
+		assertSafePathSegment(name, "Skill name");
 		if (!existsSync(srcPath)) {
 			log$2.warn({
 				name,
@@ -4022,6 +4440,7 @@ var ClaudeCodeApplier = class {
 		return Promise.resolve();
 	}
 	deleteSkillDir(name) {
+		assertSafePathSegment(name, "Skill name");
 		const dest = join(this.skillsDir, name);
 		try {
 			rmSync(dest, {
@@ -4033,25 +4452,21 @@ var ClaudeCodeApplier = class {
 				dest
 			}, "Claude Code removeSkill: removed skill from ~/.claude/skills");
 		} catch (err) {
-			log$2.warn({
+			const message = err instanceof Error ? err.message : String(err);
+			log$2.error({
 				name,
 				dest,
-				err: err instanceof Error ? err.message : String(err)
+				err: message
 			}, "Claude Code removeSkill: failed to remove skill directory");
+			throw new Error(`Failed to remove Claude Code skill ${name}: ${message}`);
 		}
 		return Promise.resolve();
 	}
 	readLedger() {
-		if (!existsSync(this.ledgerPath)) return {};
-		try {
-			return JSON.parse(readFileSync(this.ledgerPath, "utf-8"));
-		} catch {
-			return {};
-		}
+		return readJsonObjectFileSync(this.ledgerPath, "Claude Code integration ledger");
 	}
 	writeLedger(ledger) {
-		mkdirSync(join(this.ledgerPath, ".."), { recursive: true });
-		writeFileSync(this.ledgerPath, JSON.stringify(ledger, null, 2) + "\n", "utf-8");
+		atomicWriteFileSync(this.ledgerPath, JSON.stringify(ledger, null, 2) + "\n");
 	}
 };
 //#endregion
@@ -4217,12 +4632,7 @@ var ClaudeCodeMcpSync = class {
 		const file = { mcpServers: Object.fromEntries(desired) };
 		const next = JSON.stringify(file, null, 2) + "\n";
 		if ((existsSync(this.configPath) ? readFileSync(this.configPath, "utf-8") : "") !== next) {
-			mkdirSync(dirname(this.configPath), { recursive: true });
-			writeFileSync(this.configPath, next, {
-				encoding: "utf-8",
-				mode: 384
-			});
-			chmodSync(this.configPath, 384);
+			atomicWriteFileSync(this.configPath, next);
 			log$1.info({
 				added: [...desiredIds],
 				removed: [...this.syncedIds].filter((id) => !desiredIds.has(id))
@@ -4262,8 +4672,8 @@ var ClaudeCodeMcpSync = class {
 	}
 	withAlfeApiKey(env) {
 		const merged = { ...env ?? {} };
-		if ("ALFE_API_KEY" in merged) return merged;
 		if (!this.apiKey) {
+			delete merged.ALFE_API_KEY;
 			log$1.warn("Claude Code MCP sync: no ALFE_API_KEY available — generated MCP servers will start in zero-accounts degraded mode");
 			return merged;
 		}
@@ -4279,8 +4689,7 @@ var ClaudeCodeMcpSync = class {
 	}
 	persistSyncedIds() {
 		try {
-			mkdirSync(dirname(this.trackingPath), { recursive: true });
-			writeFileSync(this.trackingPath, JSON.stringify({ syncedIds: [...this.syncedIds] }, null, 2) + "\n", "utf-8");
+			atomicWriteFileSync(this.trackingPath, JSON.stringify({ syncedIds: [...this.syncedIds] }, null, 2) + "\n");
 		} catch (err) {
 			log$1.warn({ err: errMsg$1(err) }, "Claude Code MCP sync: failed to persist synced-id sidecar");
 		}
@@ -4295,6 +4704,7 @@ const log = createLogger("McpApplier");
 const CONFIG_TEMPLATE_RE = /\{\{config\.([a-zA-Z0-9_]+)\}\}/g;
 const CREDENTIALS_TEMPLATE_RE = /\{\{credentials\.([a-z0-9-]+)\.([a-zA-Z0-9_]+)\}\}/g;
 const ALFE_TEMPLATE_RE = /\{\{alfe\.([a-zA-Z0-9_]+)\}\}/g;
+const RESERVED_RUNTIME_ENV_KEYS = new Set(["ALFE_API_KEY"]);
 /**
 * Budget for the activation-time warm of each applied server. Matches the
 * bundler's default `connectTimeoutMs` so the warm never reports "failed"
@@ -4329,10 +4739,12 @@ var McpApplier = class {
 	async applyForIntegration(integrationId, servers, mergedConfig, opts) {
 		const owner = `integration:${integrationId}`;
 		const applied = [];
+		const declaredIds = new Set(servers.map((server) => `${integrationId}-${server.id}`));
 		for (const server of servers) {
 			const id = `${integrationId}-${server.id}`;
 			const envResolved = await this.resolveEnv(server, mergedConfig, opts?.connectionId);
 			if (envResolved == null) {
+				await this.manager.removeServer(id, { expectedOwner: owner });
 				log.info({
 					integrationId,
 					server: server.id,
@@ -4346,6 +4758,7 @@ var McpApplier = class {
 			});
 			applied.push(id);
 		}
+		for (const { id, entry } of this.manager.listServers()) if (entry.owner === owner && !declaredIds.has(id)) await this.manager.removeServer(id, { expectedOwner: owner });
 		for (const id of applied) this.manager.warmServer(id, MCP_ACTIVATION_WARM_TIMEOUT_MS).then((status) => {
 			if (!status) return;
 			if (status.connected) log.info({
@@ -4421,13 +4834,17 @@ var McpApplier = class {
 		}
 		const resolved = {};
 		for (const [key, value] of Object.entries(server.env)) {
+			if (RESERVED_RUNTIME_ENV_KEYS.has(key)) {
+				log.warn({ key }, "Ignoring manifest override of reserved MCP runtime environment key");
+				continue;
+			}
 			const interpolated = interpolateString(value, mergedConfig, credentialsCache, this.platform);
-			if (needsCredentials && hasCredentialsPlaceholder(interpolated)) {
+			if (hasUnresolvedTemplate(interpolated)) {
 				log.warn({
 					provider,
 					connectionId,
 					key
-				}, "Credentials interpolation left a placeholder — skipping MCP registration");
+				}, "MCP interpolation left a placeholder — skipping registration");
 				return null;
 			}
 			resolved[key] = interpolated;
@@ -4435,8 +4852,8 @@ var McpApplier = class {
 		return resolved;
 	}
 };
-function hasCredentialsPlaceholder(value) {
-	return /\{\{credentials\.[a-z0-9-]+\.[a-zA-Z0-9_]+\}\}/.test(value);
+function hasUnresolvedTemplate(value) {
+	return /\{\{(?:config\.[a-zA-Z0-9_]+|credentials\.[a-z0-9-]+\.[a-zA-Z0-9_]+|alfe\.[a-zA-Z0-9_]+)\}\}/.test(value);
 }
 function interpolateString(value, mergedConfig, credentials, platform) {
 	let next = value.replace(CONFIG_TEMPLATE_RE, (match, configKey) => {