@bitseek/claw 1.2.0 → 1.2.1

package/dist/{gateway-cli-Cb1IDsaH.js → gateway-cli-D5wMqxbT.js}

@@ -3,12 +3,12 @@ import { g as resolveStateDir, i as isNixMode, l as resolveGatewayLockDir, o as
 import { a as setConsoleSubsystemFilter, d as defaultRuntime, n as runtimeForLogger, o as setConsoleTimestampPrefix, t as createSubsystemLogger } from "./subsystem-DjdBljTA.js";
 import "./boolean-DtWR5bt3.js";
 import { i as logAcceptedEnvOption, r as isTruthyEnvValue } from "./entry.js";
-import { Ai as DEFAULT_MODEL, B as OpenClawSchema, Er as resolveThinkingDefault, F as readConfigFileSnapshotForWrite, Fn as resolveSubagentMaxConcurrent, I as resolveConfigSnapshotHash, Jn as loadAuthProfileStoreForRuntime, M as loadConfig, Mn as buildTalkConfigResponse, N as parseConfigJson5, P as readConfigFileSnapshot, Pn as resolveAgentMaxConcurrent, R as writeConfigFile, Si as normalizeSecretInput, St as AVATAR_MAX_BYTES, Tt as isAvatarImageDataUrl, Un as upsertAuthProfile, _r as resolveAllowedModelRef, ai as resolveApiKeyForProvider, ar as buildAllowedModelSet, at as parseDurationMs, bn as applyLegacyMigrations, br as resolveDefaultModelForAgent, dr as isCliProvider, ir as isPidAlive, j as createConfigIO, ji as DEFAULT_PROVIDER, k as migrateLegacyConfig, ki as DEFAULT_CONTEXT_TOKENS, kt as looksLikeAvatarPath, l as resolveApiKeyForProfile, lr as getModelRefStatus, mr as normalizeModelSelection, ot as parseByteSize, wr as resolveSubagentConfiguredModelSelection, wt as isAvatarHttpUrl, xi as normalizeOptionalSecretInput, xn as ensureControlUiAllowedOriginsForNonLoopbackBind, xr as resolveHooksGmailModel, yn as applyMergePatch, yr as resolveConfiguredModelRef, z as validateConfigObjectWithPlugins } from "./auth-profiles-D_x1_5v_.js";
+import { Ai as DEFAULT_MODEL, B as OpenClawSchema, Er as resolveThinkingDefault, F as readConfigFileSnapshotForWrite, Fn as resolveSubagentMaxConcurrent, I as resolveConfigSnapshotHash, Jn as loadAuthProfileStoreForRuntime, M as loadConfig, Mn as buildTalkConfigResponse, N as parseConfigJson5, P as readConfigFileSnapshot, Pn as resolveAgentMaxConcurrent, R as writeConfigFile, Si as normalizeSecretInput, St as AVATAR_MAX_BYTES, Tt as isAvatarImageDataUrl, Un as upsertAuthProfile, _r as resolveAllowedModelRef, ai as resolveApiKeyForProvider, ar as buildAllowedModelSet, at as parseDurationMs, bn as applyLegacyMigrations, br as resolveDefaultModelForAgent, dr as isCliProvider, ir as isPidAlive, j as createConfigIO, ji as DEFAULT_PROVIDER, k as migrateLegacyConfig, ki as DEFAULT_CONTEXT_TOKENS, kt as looksLikeAvatarPath, l as resolveApiKeyForProfile, lr as getModelRefStatus, mr as normalizeModelSelection, ot as parseByteSize, wr as resolveSubagentConfiguredModelSelection, wt as isAvatarHttpUrl, xi as normalizeOptionalSecretInput, xn as ensureControlUiAllowedOriginsForNonLoopbackBind, xr as resolveHooksGmailModel, yn as applyMergePatch, yr as resolveConfiguredModelRef, z as validateConfigObjectWithPlugins } from "./auth-profiles-CyG9VwU_.js";
 import { t as formatCliCommand } from "./command-format-CVXyxgq3.js";
-import { a as resolveAgentDir, c as resolveAgentModelFallbacksOverride, d as resolveDefaultAgentId, i as resolveAgentConfig, l as resolveAgentSkillsFilter, m as resolveSessionAgentId, n as listAgentEntries, r as listAgentIds, u as resolveAgentWorkspaceDir } from "./agent-scope-CJelRKYY.js";
+import { a as resolveAgentDir, c as resolveAgentModelFallbacksOverride, d as resolveDefaultAgentId, i as resolveAgentConfig, l as resolveAgentSkillsFilter, m as resolveSessionAgentId, n as listAgentEntries, r as listAgentIds, u as resolveAgentWorkspaceDir } from "./agent-scope-CY2-lUIY.js";
 import { S as isCronRunSessionKey, T as parseAgentSessionKey, c as normalizeAgentId, g as normalizeAccountId$1, h as DEFAULT_ACCOUNT_ID, l as normalizeMainKey, m as toAgentStoreSessionKey, o as classifySessionKeyShape, p as toAgentRequestSessionKey, r as buildAgentMainSessionKey, t as DEFAULT_AGENT_ID, u as resolveAgentIdFromSessionKey, w as isSubagentSessionKey } from "./session-key-BLprDJYq.js";
 import { E as isPlainObject, T as truncateUtf16Safe, n as clamp, s as ensureDir, v as resolveUserPath, x as shortenHomePath } from "./utils-DIzy5B5o.js";
-import { A as isNotFoundPathError, C as openBoundaryFileSync, P as matchesSkillFilter, S as openBoundaryFile, T as sameFileIdentity, a as DEFAULT_IDENTITY_FILENAME, c as DEFAULT_SOUL_FILENAME, d as ensureAgentWorkspace, h as resolveDefaultAgentWorkspaceDir, i as DEFAULT_HEARTBEAT_FILENAME, l as DEFAULT_TOOLS_FILENAME, o as DEFAULT_MEMORY_ALT_FILENAME, p as isWorkspaceOnboardingCompleted, r as DEFAULT_BOOTSTRAP_FILENAME, s as DEFAULT_MEMORY_FILENAME, t as DEFAULT_AGENTS_FILENAME, u as DEFAULT_USER_FILENAME, v as resolveWorkspaceTemplateDir, w as openVerifiedFileSync, y as resolveOpenClawPackageRoot } from "./workspace-BHfqkuYN.js";
+import { A as isNotFoundPathError, C as openBoundaryFileSync, P as matchesSkillFilter, S as openBoundaryFile, T as sameFileIdentity, a as DEFAULT_IDENTITY_FILENAME, c as DEFAULT_SOUL_FILENAME, d as ensureAgentWorkspace, h as resolveDefaultAgentWorkspaceDir, i as DEFAULT_HEARTBEAT_FILENAME, l as DEFAULT_TOOLS_FILENAME, o as DEFAULT_MEMORY_ALT_FILENAME, p as isWorkspaceOnboardingCompleted, r as DEFAULT_BOOTSTRAP_FILENAME, s as DEFAULT_MEMORY_FILENAME, t as DEFAULT_AGENTS_FILENAME, u as DEFAULT_USER_FILENAME, v as resolveWorkspaceTemplateDir, w as openVerifiedFileSync, y as resolveOpenClawPackageRoot } from "./workspace-DzeL98px.js";
 import { i as logWarn, t as logDebug } from "./logger-BJMfryJd.js";
 import { n as runExec, t as runCommandWithTimeout } from "./exec-CEAvKSx9.js";
 import "./github-copilot-token-CulJ9J5l.js";
@@ -16,112 +16,112 @@ import "./host-env-security-CJMD0__Z.js";
 import { n as resolveRuntimeServiceVersion, t as VERSION } from "./version-CGDNfh5C.js";
 import "./env-vars-Dw0EwyGP.js";
 import { C as clearInternalHooks, E as triggerInternalHook, T as registerInternalHook, h as createEmptyPluginRegistry, t as CHANNEL_IDS, u as getActivePluginRegistry, w as createInternalHookEvent } from "./registry-7fg1BnMw.js";
-import { u as isTestDefaultMemorySlotDisabled } from "./manifest-registry-Kbw8YPsZ.js";
-import "./dock-DT8sACcR.js";
-import "./model-DmBmzJI6.js";
-import "./pi-model-discovery-BZ2RCD_u.js";
+import { u as isTestDefaultMemorySlotDisabled } from "./manifest-registry-CBF8Vfz8.js";
+import "./dock-CoclJnwp.js";
+import "./model-DMZUvZJo.js";
+import "./pi-model-discovery-RrejIg26.js";
 import { d as hasBinary } from "./frontmatter-C0E8mspC.js";
-import { c as resolveBundledSkillsDir, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-BCgFAMj3.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-Cg9ZP1NN.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-DG-bH5mO.js";
+import { c as resolveBundledSkillsDir, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-D4S-gyVf.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-laKq24fx.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-DQzBD0Y7.js";
 import { _ as normalizeGatewayClientMode, f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-0J6eKf3g.js";
-import { $ as resolveAgentMainSessionKey, A as readSessionPreviewItemsFromTranscript, B as cleanStaleLockFiles, C as normalizeSessionDeliveryFields, D as capArrayByJsonBytes, E as archiveSessionTranscripts, G as resolveSessionResetPolicy, I as stripInlineDirectiveTagsForDisplay, L as stripInlineDirectiveTagsFromMessageForDisplay, M as resolveSessionTranscriptCandidates, N as stripEnvelopeFromMessage, O as cleanupArchivedSessionTranscripts, P as stripEnvelopeFromMessages, Q as canonicalizeMainSessionAlias, R as jsonUtf8Bytes, T as archiveFileOnDisk, U as evaluateSessionFreshness, Y as mergeSessionEntry, Z as setSessionRuntimeModel, d as updateSessionStore, et as resolveExplicitAgentSessionKey, it as snapshotSessionOrigin, k as readSessionMessages, n as parseSessionThreadInfo, nt as resolveMainSessionKeyFromConfig, o as loadSessionStore, t as extractDeliveryInfo, tt as resolveMainSessionKey, x as mergeDeliveryContext, y as deliveryContextFromSession } from "./sessions-B2mnwD21.js";
-import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, v as normalizeWhatsAppTarget } from "./plugins-vsjS_m58.js";
-import { i as resolveWhatsAppAccount } from "./accounts-BQHz8_1_.js";
-import "./accounts-B3zSNWIv.js";
+import { $ as resolveAgentMainSessionKey, A as readSessionPreviewItemsFromTranscript, B as cleanStaleLockFiles, C as normalizeSessionDeliveryFields, D as capArrayByJsonBytes, E as archiveSessionTranscripts, G as resolveSessionResetPolicy, I as stripInlineDirectiveTagsForDisplay, L as stripInlineDirectiveTagsFromMessageForDisplay, M as resolveSessionTranscriptCandidates, N as stripEnvelopeFromMessage, O as cleanupArchivedSessionTranscripts, P as stripEnvelopeFromMessages, Q as canonicalizeMainSessionAlias, R as jsonUtf8Bytes, T as archiveFileOnDisk, U as evaluateSessionFreshness, Y as mergeSessionEntry, Z as setSessionRuntimeModel, d as updateSessionStore, et as resolveExplicitAgentSessionKey, it as snapshotSessionOrigin, k as readSessionMessages, n as parseSessionThreadInfo, nt as resolveMainSessionKeyFromConfig, o as loadSessionStore, t as extractDeliveryInfo, tt as resolveMainSessionKey, x as mergeDeliveryContext, y as deliveryContextFromSession } from "./sessions-BXz4gdq6.js";
+import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, v as normalizeWhatsAppTarget } from "./plugins-C4cYqW07.js";
+import { i as resolveWhatsAppAccount } from "./accounts-Cv5CUnT4.js";
+import "./accounts-2NNZ6Hbp.js";
 import "./logging-5MtSkLpb.js";
-import "./accounts-DTfEeXyO.js";
-import { t as buildChannelAccountBindings } from "./bindings-Hx6KNJeg.js";
-import "./send-Cpaj_bKB.js";
-import "./send-BpXRh0BM.js";
-import { $n as normalizeSendPolicy, $t as isExternalHookSession, A as agentCommandFromIngress, Ar as waitForActiveTasks, At as formatRestartSentinelMessage, Br as onAgentEvent, Bt as normalizeOptionalSessionKey, C as readJsonBodyWithLimit, Cr as OPENAI_TTS_VOICES, D as sleepWithAbort, Dn as formatZonedTimestamp, Dr as markGatewayDraining, E as computeBackoff, Er as getTotalQueueSize, Et as runWithModelFallback, F as createDefaultDeps, Fn as isSystemEventContextChanged, Ft as normalizeHttpWebhookUrl, Gn as DEFAULT_INPUT_IMAGE_MIMES, Gt as buildDeliveryFromLegacyPayload, Ht as normalizePayloadToSystemText, I as createOutboundSendDeps$1, Ir as stripHeartbeatToken, It as normalizeCronJobCreate, Jn as extractFileContentFromSource, Kn as DEFAULT_INPUT_MAX_REDIRECTS, Kt as hasLegacyDeliveryHints, L as resolveAgentAvatar, Lr as clearAgentRunContext, Lt as normalizeCronJobPatch, M as resolveAgentDeliveryPlan, Mr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, Mt as summarizeRestartSentinel, N as resolveAgentOutboundTarget, Or as resetAllLanes, Ot as consumeRestartSentinel, P as createOutboundSendDeps, Pn as enqueueSystemEvent, Pt as writeRestartSentinel, Qn as resolveAgentTimeoutMs, Qt as getHookType, Rn as requestHeartbeatNow, Rr as emitAgentEvent, Rt as inferLegacyName, S as handleSlackHttpRequest, Sn as loadProviderUsageSummary, Sr as OPENAI_TTS_MODELS, St as resolveOutboundChannelPlugin, Un as ACP_SESSION_IDENTITY_RENDERER_VERSION, Ut as normalizeRequiredName, Vr as registerAgentRunContext, Vt as normalizeOptionalText, W as buildHistoryContextFromEntries, Wn as DEFAULT_INPUT_IMAGE_MAX_BYTES, Wt as migrateLegacyCronPayload, Xn as normalizeMimeList, Xt as buildSafeExternalPrompt, Yn as extractImageContentFromSource, Zn as resolveInputFileLimits, Zt as detectSuspiciousPatterns, _ as loadOpenClawPlugins, _n as setPreRestartDeferralCheck, _r as resolveTtsPrefsPath, _t as resolveOutboundSessionRoute, a as runSubagentAnnounceFlow, b as resolveAgentOutboundIdentity, bn as normalizeGroupActivation, br as setTtsProvider, bt as resolveOutboundTarget, c as abortEmbeddedPiRun, cn as parseVerboseOverride, cr as resolveAgentSessionDirs, ct as resolveCronStyleNow, d as applyToolPolicyPipeline, dn as deferGatewayRestartUntilIdle, dr as getTtsProvider, dt as runCliAgent, en as applyBrowserProxyPaths, er as resolveSendPolicy, f as buildDefaultToolPolicyPipelineSteps, fn as emitGatewayRestart, fr as isTtsEnabled, ft as createOpenClawTools, gn as setGatewaySigusr1RestartPolicy, gr as resolveTtsConfig, gt as ensureOutboundSessionEntry, h as resolvePluginTools, hn as scheduleGatewaySigusr1Restart, hr as resolveTtsAutoMode, ir as stopSubagentsForRequester, jr as CommandLane, kr as setCommandLaneConcurrency, kt as formatDoctorNonInteractiveHint, l as getActiveEmbeddedRunCount, ln as buildOutboundSessionContext, lr as resolveUserTimezone, lt as getCliSessionId, m as getPluginToolMeta, mn as markGatewaySigusr1RestartHandled, mr as resolveTtsApiKey, mt as resolveAnnounceTargetFromKey, n as initSubagentRegistry, nn as resolveSessionAuthProfileOverride, nt as createReplyDispatcher, o as clearSessionQueues, on as applyModelOverrideToSessionEntry, ot as BARE_SESSION_RESET_PROMPT, pn as isGatewaySigusr1RestartExternallyAllowed, pr as isTtsProviderConfigured, pt as readLatestAssistantReply, qn as DEFAULT_INPUT_TIMEOUT_MS, qt as stripLegacyDeliveryFields, r as listDescendantRunsForRequester, rr as isAbortRequestText, rt as getTotalPendingReplies, s as runEmbeddedPiAgent, sn as applyVerboseOverride, sr as getAcpSessionManager, t as countActiveDescendantRuns, tn as persistBrowserProxyFiles, tt as dispatchInboundMessage, u as waitForEmbeddedPiRunEnd, un as consumeGatewaySigusr1RestartAuthorization, ur as clearBootstrapSnapshot, ut as setCliSessionId, v as createPluginRuntime, vn as triggerOpenClawRestart, vr as resolveTtsProviderOrder, w as requestBodyErrorToText, wr as getActiveTaskCount, wt as resetDirectoryCache, xr as textToSpeech, xt as resolveSessionDeliveryTarget, yn as unbindThreadBindingsBySessionKey, yr as setTtsEnabled, zr as getAgentRunContext, zt as normalizeOptionalAgentId } from "./subagent-registry-WD5F6cBf.js";
+import "./accounts-NHpMJ0aq.js";
+import { t as buildChannelAccountBindings } from "./bindings-DGvp9FdD.js";
+import "./send-ZyB64ntO.js";
+import "./send-BTswySBz.js";
+import { $n as normalizeSendPolicy, $t as isExternalHookSession, A as agentCommandFromIngress, Ar as waitForActiveTasks, At as formatRestartSentinelMessage, Br as onAgentEvent, Bt as normalizeOptionalSessionKey, C as readJsonBodyWithLimit, Cr as OPENAI_TTS_VOICES, D as sleepWithAbort, Dn as formatZonedTimestamp, Dr as markGatewayDraining, E as computeBackoff, Er as getTotalQueueSize, Et as runWithModelFallback, F as createDefaultDeps, Fn as isSystemEventContextChanged, Ft as normalizeHttpWebhookUrl, Gn as DEFAULT_INPUT_IMAGE_MIMES, Gt as buildDeliveryFromLegacyPayload, Ht as normalizePayloadToSystemText, I as createOutboundSendDeps$1, Ir as stripHeartbeatToken, It as normalizeCronJobCreate, Jn as extractFileContentFromSource, Kn as DEFAULT_INPUT_MAX_REDIRECTS, Kt as hasLegacyDeliveryHints, L as resolveAgentAvatar, Lr as clearAgentRunContext, Lt as normalizeCronJobPatch, M as resolveAgentDeliveryPlan, Mr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, Mt as summarizeRestartSentinel, N as resolveAgentOutboundTarget, Or as resetAllLanes, Ot as consumeRestartSentinel, P as createOutboundSendDeps, Pn as enqueueSystemEvent, Pt as writeRestartSentinel, Qn as resolveAgentTimeoutMs, Qt as getHookType, Rn as requestHeartbeatNow, Rr as emitAgentEvent, Rt as inferLegacyName, S as handleSlackHttpRequest, Sn as loadProviderUsageSummary, Sr as OPENAI_TTS_MODELS, St as resolveOutboundChannelPlugin, Un as ACP_SESSION_IDENTITY_RENDERER_VERSION, Ut as normalizeRequiredName, Vr as registerAgentRunContext, Vt as normalizeOptionalText, W as buildHistoryContextFromEntries, Wn as DEFAULT_INPUT_IMAGE_MAX_BYTES, Wt as migrateLegacyCronPayload, Xn as normalizeMimeList, Xt as buildSafeExternalPrompt, Yn as extractImageContentFromSource, Zn as resolveInputFileLimits, Zt as detectSuspiciousPatterns, _ as loadOpenClawPlugins, _n as setPreRestartDeferralCheck, _r as resolveTtsPrefsPath, _t as resolveOutboundSessionRoute, a as runSubagentAnnounceFlow, b as resolveAgentOutboundIdentity, bn as normalizeGroupActivation, br as setTtsProvider, bt as resolveOutboundTarget, c as abortEmbeddedPiRun, cn as parseVerboseOverride, cr as resolveAgentSessionDirs, ct as resolveCronStyleNow, d as applyToolPolicyPipeline, dn as deferGatewayRestartUntilIdle, dr as getTtsProvider, dt as runCliAgent, en as applyBrowserProxyPaths, er as resolveSendPolicy, f as buildDefaultToolPolicyPipelineSteps, fn as emitGatewayRestart, fr as isTtsEnabled, ft as createOpenClawTools, gn as setGatewaySigusr1RestartPolicy, gr as resolveTtsConfig, gt as ensureOutboundSessionEntry, h as resolvePluginTools, hn as scheduleGatewaySigusr1Restart, hr as resolveTtsAutoMode, ir as stopSubagentsForRequester, jr as CommandLane, kr as setCommandLaneConcurrency, kt as formatDoctorNonInteractiveHint, l as getActiveEmbeddedRunCount, ln as buildOutboundSessionContext, lr as resolveUserTimezone, lt as getCliSessionId, m as getPluginToolMeta, mn as markGatewaySigusr1RestartHandled, mr as resolveTtsApiKey, mt as resolveAnnounceTargetFromKey, n as initSubagentRegistry, nn as resolveSessionAuthProfileOverride, nt as createReplyDispatcher, o as clearSessionQueues, on as applyModelOverrideToSessionEntry, ot as BARE_SESSION_RESET_PROMPT, pn as isGatewaySigusr1RestartExternallyAllowed, pr as isTtsProviderConfigured, pt as readLatestAssistantReply, qn as DEFAULT_INPUT_TIMEOUT_MS, qt as stripLegacyDeliveryFields, r as listDescendantRunsForRequester, rr as isAbortRequestText, rt as getTotalPendingReplies, s as runEmbeddedPiAgent, sn as applyVerboseOverride, sr as getAcpSessionManager, t as countActiveDescendantRuns, tn as persistBrowserProxyFiles, tt as dispatchInboundMessage, u as waitForEmbeddedPiRunEnd, un as consumeGatewaySigusr1RestartAuthorization, ur as clearBootstrapSnapshot, ut as setCliSessionId, v as createPluginRuntime, vn as triggerOpenClawRestart, vr as resolveTtsProviderOrder, w as requestBodyErrorToText, wr as getActiveTaskCount, wt as resetDirectoryCache, xr as textToSpeech, xt as resolveSessionDeliveryTarget, yn as unbindThreadBindingsBySessionKey, yr as setTtsEnabled, zr as getAgentRunContext, zt as normalizeOptionalAgentId } from "./subagent-registry-D6OfBLNb.js";
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-CTtLmER4.js";
 import { i as normalizeInputProvenance } from "./input-provenance-C8z9KgIz.js";
 import "./chat-envelope-D3RSz140.js";
-import { n as readJsonFile, r as writeJsonAtomic, t as createAsyncLock } from "./json-files-CuJjdF_0.js";
-import { $ as validateNodePairApproveParams, $t as roleScopesAllow, A as validateCronStatusParams, At as validateWizardStartParams, B as validateExecApprovalsGetParams, C as validateConfigSetParams, Ct as validateToolsCatalogParams, D as validateCronRemoveParams, Dt as validateWebLoginWaitParams, E as validateCronListParams, Et as validateWebLoginStartParams, F as validateDevicePairRemoveParams, G as validateModelsAuthSetParams, Gt as rejectDevicePairing, H as validateExecApprovalsNodeSetParams, Ht as ensureDeviceToken, I as validateDeviceTokenRevokeParams, It as parseSessionLabel, J as validateNodeDescribeParams, Jt as revokeDeviceToken, K as validateModelsListParams, Kt as removePairedDevice, L as validateDeviceTokenRotateParams, Lt as buildDeviceAuthPayload, M as validateDevicePairApproveParams, Mt as PROTOCOL_VERSION, N as validateDevicePairListParams, Nt as ErrorCodes, O as validateCronRunParams, Ot as validateWizardCancelParams, P as validateDevicePairRejectParams, Pt as errorShape, Q as validateNodeListParams, Qt as verifyDeviceToken, R as validateExecApprovalRequestParams, Rt as buildDeviceAuthPayloadV3, S as validateConfigSchemaParams, St as validateTalkModeParams, T as validateCronAddParams, Tt as validateWakeParams, U as validateExecApprovalsSetParams, Ut as getPairedDevice, V as validateExecApprovalsNodeGetParams, Vt as approveDevicePairing, W as validateLogsTailParams, Wt as listDevicePairing, X as validateNodeInvokeParams, Xt as summarizeDeviceTokens, Y as validateNodeEventParams, Yt as rotateDeviceToken, Z as validateNodeInvokeResultParams, Zt as updatePairedDeviceMetadata, _ as validateChatInjectParams, _t as validateSkillsBinsParams, a as validateAgentWaitParams, at as validatePollParams, b as validateConfigGetParams, bt as validateSkillsUpdateParams, c as validateAgentsFilesGetParams, ct as validateSendParams, d as validateAgentsListParams, dt as validateSessionsListParams, et as validateNodePairListParams, f as validateAgentsUpdateParams, ft as validateSessionsPatchParams, g as validateChatHistoryParams, gt as validateSessionsUsageParams, h as validateChatAbortParams, ht as validateSessionsResolveParams, i as validateAgentParams, in as verifyDeviceSignature, it as validateNodeRenameParams, j as validateCronUpdateParams, jt as validateWizardStatusParams, k as validateCronRunsParams, kt as validateWizardNextParams, l as validateAgentsFilesListParams, lt as validateSessionsCompactParams, m as validateChannelsStatusParams, mt as validateSessionsResetParams, n as formatValidationErrors, nt as validateNodePairRequestParams, o as validateAgentsCreateParams, ot as validatePushTestParams, p as validateChannelsLogoutParams, pt as validateSessionsPreviewParams, q as validateModelsVerifyParams, qt as requestDevicePairing, r as validateAgentIdentityParams, rn as normalizeDevicePublicKeyBase64Url, rt as validateNodePairVerifyParams, s as validateAgentsDeleteParams, st as validateRequestFrame, tn as deriveDeviceIdFromPublicKey, tt as validateNodePairRejectParams, u as validateAgentsFilesSetParams, ut as validateSessionsDeleteParams, v as validateChatSendParams, vt as validateSkillsInstallParams, w as validateConnectParams, wt as validateUpdateRunParams, x as validateConfigPatchParams, xt as validateTalkConfigParams, y as validateConfigApplyParams, yt as validateSkillsStatusParams, z as validateExecApprovalResolveParams, zt as normalizeDeviceMetadataForAuth } from "./client-BvL3EdiZ.js";
-import { f as loadGatewayTlsRuntime$1, l as authorizeOperatorScopesForMethod, n as callGateway, s as ADMIN_SCOPE$3, u as isNodeRoleMethod } from "./call-CzoM7hPS.js";
+import { n as readJsonFile, r as writeJsonAtomic, t as createAsyncLock } from "./json-files-rR19q30D.js";
+import { $ as validateNodePairApproveParams, $t as roleScopesAllow, A as validateCronStatusParams, At as validateWizardStartParams, B as validateExecApprovalsGetParams, C as validateConfigSetParams, Ct as validateToolsCatalogParams, D as validateCronRemoveParams, Dt as validateWebLoginWaitParams, E as validateCronListParams, Et as validateWebLoginStartParams, F as validateDevicePairRemoveParams, G as validateModelsAuthSetParams, Gt as rejectDevicePairing, H as validateExecApprovalsNodeSetParams, Ht as ensureDeviceToken, I as validateDeviceTokenRevokeParams, It as parseSessionLabel, J as validateNodeDescribeParams, Jt as revokeDeviceToken, K as validateModelsListParams, Kt as removePairedDevice, L as validateDeviceTokenRotateParams, Lt as buildDeviceAuthPayload, M as validateDevicePairApproveParams, Mt as PROTOCOL_VERSION, N as validateDevicePairListParams, Nt as ErrorCodes, O as validateCronRunParams, Ot as validateWizardCancelParams, P as validateDevicePairRejectParams, Pt as errorShape, Q as validateNodeListParams, Qt as verifyDeviceToken, R as validateExecApprovalRequestParams, Rt as buildDeviceAuthPayloadV3, S as validateConfigSchemaParams, St as validateTalkModeParams, T as validateCronAddParams, Tt as validateWakeParams, U as validateExecApprovalsSetParams, Ut as getPairedDevice, V as validateExecApprovalsNodeGetParams, Vt as approveDevicePairing, W as validateLogsTailParams, Wt as listDevicePairing, X as validateNodeInvokeParams, Xt as summarizeDeviceTokens, Y as validateNodeEventParams, Yt as rotateDeviceToken, Z as validateNodeInvokeResultParams, Zt as updatePairedDeviceMetadata, _ as validateChatInjectParams, _t as validateSkillsBinsParams, a as validateAgentWaitParams, at as validatePollParams, b as validateConfigGetParams, bt as validateSkillsUpdateParams, c as validateAgentsFilesGetParams, ct as validateSendParams, d as validateAgentsListParams, dt as validateSessionsListParams, et as validateNodePairListParams, f as validateAgentsUpdateParams, ft as validateSessionsPatchParams, g as validateChatHistoryParams, gt as validateSessionsUsageParams, h as validateChatAbortParams, ht as validateSessionsResolveParams, i as validateAgentParams, in as verifyDeviceSignature, it as validateNodeRenameParams, j as validateCronUpdateParams, jt as validateWizardStatusParams, k as validateCronRunsParams, kt as validateWizardNextParams, l as validateAgentsFilesListParams, lt as validateSessionsCompactParams, m as validateChannelsStatusParams, mt as validateSessionsResetParams, n as formatValidationErrors, nt as validateNodePairRequestParams, o as validateAgentsCreateParams, ot as validatePushTestParams, p as validateChannelsLogoutParams, pt as validateSessionsPreviewParams, q as validateModelsVerifyParams, qt as requestDevicePairing, r as validateAgentIdentityParams, rn as normalizeDevicePublicKeyBase64Url, rt as validateNodePairVerifyParams, s as validateAgentsDeleteParams, st as validateRequestFrame, tn as deriveDeviceIdFromPublicKey, tt as validateNodePairRejectParams, u as validateAgentsFilesSetParams, ut as validateSessionsDeleteParams, v as validateChatSendParams, vt as validateSkillsInstallParams, w as validateConnectParams, wt as validateUpdateRunParams, x as validateConfigPatchParams, xt as validateTalkConfigParams, y as validateConfigApplyParams, yt as validateSkillsStatusParams, z as validateExecApprovalResolveParams, zt as normalizeDeviceMetadataForAuth } from "./client-vUKV2o6h.js";
+import { f as loadGatewayTlsRuntime$1, l as authorizeOperatorScopesForMethod, n as callGateway, s as ADMIN_SCOPE$3, u as isNodeRoleMethod } from "./call-CmAGfSJE.js";
 import "./pairing-token-DoBZxQnC.js";
 import { t as safeEqualSecret } from "./secret-equal-Gla36CGi.js";
-import { a as isTrustedProxyAddress, c as pickPrimaryLanIPv4, d as resolveGatewayListenHosts, f as rawDataToString, l as resolveClientIp, n as isLoopbackAddress, o as isValidIPv4, r as isLoopbackHost, s as normalizeHostHeader, t as isLocalishHost, u as resolveGatewayBindHost } from "./net-BXeYv7Iu.js";
-import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C1XBcWue.js";
+import { a as isTrustedProxyAddress, c as pickPrimaryLanIPv4, d as resolveGatewayListenHosts, f as rawDataToString, l as resolveClientIp, n as isLoopbackAddress, o as isValidIPv4, r as isLoopbackHost, s as normalizeHostHeader, t as isLocalishHost, u as resolveGatewayBindHost } from "./net-C75G4fup.js";
+import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CfP3A6g2.js";
 import { i as isSilentReplyText, n as SILENT_REPLY_TOKEN } from "./tokens-DyLBF_df.js";
-import { a as getMachineDisplayName, i as startBrowserControlServiceFromConfig, n as createBrowserRouteDispatcher, r as createBrowserControlContext } from "./with-timeout-l0X_rwcb.js";
-import { j as runGlobalGatewayStopSafely, k as getGlobalHookRunner, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-DTgCZWjU.js";
-import { d as startDiagnosticHeartbeat, f as stopDiagnosticHeartbeat, m as isDiagnosticsEnabled } from "./diagnostic-Bvatw1Xn.js";
+import { a as getMachineDisplayName, i as startBrowserControlServiceFromConfig, n as createBrowserRouteDispatcher, r as createBrowserControlContext } from "./with-timeout-B9qgOUui.js";
+import { j as runGlobalGatewayStopSafely, k as getGlobalHookRunner, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-H0xCFj4j.js";
+import { d as startDiagnosticHeartbeat, f as stopDiagnosticHeartbeat, m as isDiagnosticsEnabled } from "./diagnostic-DjxUqpmL.js";
 import "./diagnostic-session-state-Dx-rJXBO.js";
-import { S as saveCronStore, b as loadCronStore, x as resolveCronStorePath } from "./send-sj8Hu26l.js";
-import { c as detectMime } from "./image-ops-BGTBZMuE.js";
-import "./pi-embedded-helpers-C3sJPGXn.js";
-import { C as resolveToolProfilePolicy, _ as collectExplicitAllowlist, y as mergeAlsoAllowPolicy } from "./sandbox-CLIUxOtc.js";
+import { S as saveCronStore, b as loadCronStore, x as resolveCronStorePath } from "./send-D0X-8aPh.js";
+import { c as detectMime } from "./image-ops-B2L37gT8.js";
+import "./pi-embedded-helpers-BB2whkUz.js";
+import { C as resolveToolProfilePolicy, _ as collectExplicitAllowlist, y as mergeAlsoAllowPolicy } from "./sandbox-BLqUWbp2.js";
 import { i as listCoreToolSections, n as PROFILE_OPTIONS, o as resolveCoreToolProfiles } from "./tool-catalog-uQj_-Ahx.js";
-import "./chrome-DuDCGdf-.js";
+import "./chrome-DeZyLFsG.js";
 import { i as enableTailscaleServe, n as disableTailscaleServe, o as getTailnetHostname, r as enableTailscaleFunnel, t as disableTailscaleFunnel } from "./tailscale-D3xGoMdQ.js";
-import { a as resolveGatewayAuth, c as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, i as isLocalDirectRequest, l as createAuthRateLimiter, n as authorizeHttpGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as authorizeWsControlUiGatewayConnect, s as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, t as assertGatewayAuthConfigured, u as normalizeRateLimitClientIp } from "./auth-B3HDYw4G.js";
-import { l as ensureGatewayStartupAuth, u as mergeGatewayTailscaleConfig } from "./server-context-DnPsW_Mg.js";
-import "./paths-BjoSX1aC.js";
+import { a as resolveGatewayAuth, c as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, i as isLocalDirectRequest, l as createAuthRateLimiter, n as authorizeHttpGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as authorizeWsControlUiGatewayConnect, s as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, t as assertGatewayAuthConfigured, u as normalizeRateLimitClientIp } from "./auth-anvTU0Sb.js";
+import { l as ensureGatewayStartupAuth, u as mergeGatewayTailscaleConfig } from "./server-context-DRq_OT33.js";
+import "./paths-B_L2Zoe-.js";
 import { a as testRegexWithBoundedInput, i as compileSafeRegex } from "./redact-Ck5U_y4i.js";
 import { o as isErrno, r as formatErrorMessage } from "./errors-BJz45-qI.js";
-import { i as openFileWithinRoot, l as writeFileWithinRoot, s as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-CJDtl_QU.js";
-import { n as SsrFBlockedError } from "./proxy-env-BQIJPH4j.js";
-import "./store-U8cs0QvT.js";
-import { n as inspectPortUsage, o as formatPortDiagnostics, t as ensurePortAvailable } from "./ports-sCOQUaAP.js";
+import { i as openFileWithinRoot, l as writeFileWithinRoot, s as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-BqJ9egpm.js";
+import { n as SsrFBlockedError } from "./proxy-env-BoopXu2J.js";
+import "./store-TdzSHRPN.js";
+import { n as inspectPortUsage, o as formatPortDiagnostics, t as ensurePortAvailable } from "./ports-DRaxdQmm.js";
 import { t as movePathToTrash } from "./trash-ClChDUTf.js";
-import "./server-middleware-CKSnhiM2.js";
-import "./tool-images-CnpAosfi.js";
+import "./server-middleware-DHxnFjIL.js";
+import "./tool-images-CmgHk8xk.js";
 import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s as normalizeThinkLevel, t as formatThinkingLevels } from "./thinking-pYqswKJZ.js";
-import "./models-config-CmrBGsQs.js";
-import "./exec-approvals-allowlist-B4DS6FIn.js";
-import "./exec-safe-bin-runtime-policy-BP6ImlkB.js";
-import { n as loadModelCatalog } from "./model-catalog-D1X8r3WJ.js";
-import "./fetch-DC-NMnAU.js";
-import { g as registerUnhandledRejectionHandler } from "./audio-transcription-runner-DGyS5H3K.js";
-import { t as fetchWithSsrFGuard } from "./fetch-guard-B62rgaSw.js";
-import { x as extractTextFromChatContent } from "./image-BfqphdQM.js";
+import "./models-config-AePb9RAo.js";
+import "./exec-approvals-allowlist-CFjPSbxI.js";
+import "./exec-safe-bin-runtime-policy-CpMj95vJ.js";
+import { n as loadModelCatalog } from "./model-catalog-DFi9HgWu.js";
+import "./fetch-DOjg912W.js";
+import { g as registerUnhandledRejectionHandler } from "./audio-transcription-runner-DkibzFT2.js";
+import { t as fetchWithSsrFGuard } from "./fetch-guard-Csbz9pui.js";
+import { x as extractTextFromChatContent } from "./image-BjuH1GKB.js";
 import "./tool-display-0M664wep.js";
-import "./api-key-rotation-xfk-b2Sv.js";
+import "./api-key-rotation-Cf7QM5M_.js";
 import "./proxy-fetch-DEHZt1Tx.js";
-import { a as resolveAgentIdentity, t as createReplyPrefixOptions } from "./reply-prefix-DpXMFuAa.js";
+import { a as resolveAgentIdentity, t as createReplyPrefixOptions } from "./reply-prefix-H_GSyyzN.js";
 import "./chunk-kLPohhLl.js";
-import "./markdown-tables-BYHgyUjA.js";
-import "./ir-DziC-P4Z.js";
+import "./markdown-tables-DQlQMRGZ.js";
+import "./ir-CEwBpxhC.js";
 import "./render-CXDO_kgw.js";
-import { a as ToolInputError } from "./target-errors-C5LA-JI-.js";
-import { r as isRestartEnabled } from "./commands-C67IbXs7.js";
-import "./commands-registry-D0_D5hFV.js";
+import { a as ToolInputError } from "./target-errors-DPJ9HFp9.js";
+import { r as isRestartEnabled } from "./commands-d8L0zY8O.js";
+import "./commands-registry-C78O6aNi.js";
 import "./fetch-BM2hI5N6.js";
 import "./retry-DwXRBpwv.js";
-import { a as readChannelAllowFromStoreSync } from "./pairing-store-BfzlN-z9.js";
+import { a as readChannelAllowFromStoreSync } from "./pairing-store-rFuiIoGM.js";
 import { a as mergeExecApprovalsSocketDefaults, c as readExecApprovalsSnapshot, p as saveExecApprovals, r as ensureExecApprovals, s as normalizeExecApprovals, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-HRn5F9dF.js";
-import { _ as matchSystemRunApprovalBinding, g as buildSystemRunApprovalBinding, h as resolveSystemRunApprovalRuntimeContext, m as resolveSystemRunApprovalRequestContext, v as missingSystemRunApprovalBinding, y as toSystemRunApprovalMismatchError } from "./nodes-screen-DcxCMjOs.js";
-import { n as resolveSystemRunCommand } from "./system-run-command-GKGzGztn.js";
-import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as lookupContextTokens } from "./session-utils-BncMg1bn.js";
+import { _ as matchSystemRunApprovalBinding, g as buildSystemRunApprovalBinding, h as resolveSystemRunApprovalRuntimeContext, m as resolveSystemRunApprovalRequestContext, v as missingSystemRunApprovalBinding, y as toSystemRunApprovalMismatchError } from "./nodes-screen-BHwVUMr8.js";
+import { n as resolveSystemRunCommand } from "./system-run-command-XHAlbx5q.js";
+import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as lookupContextTokens } from "./session-utils-DxaIoRMp.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-BCEcVVJ6.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format-JlIz56oG.js";
-import { S as registerSkillsChangeListener, _ as requestNodePairing, c as recordRemoteNodeInfo, d as removeRemoteNodeInfo, f as setSkillsRemoteRegistry, g as renamePairedNode, h as rejectNodePairing, l as refreshRemoteBinsForConnectedNodes, m as listNodePairing, o as getRemoteSkillEligibility, p as approveNodePairing, s as primeRemoteSkillsCache, u as refreshRemoteNodeBins, v as updatePairedNodeMetadata, x as getSkillsSnapshotVersion, y as verifyNodeToken } from "./skill-commands-CYucDd3C.js";
-import { t as listAgentWorkspaceDirs } from "./workspace-dirs-BOgNOBjy.js";
+import { S as registerSkillsChangeListener, _ as requestNodePairing, c as recordRemoteNodeInfo, d as removeRemoteNodeInfo, f as setSkillsRemoteRegistry, g as renamePairedNode, h as rejectNodePairing, l as refreshRemoteBinsForConnectedNodes, m as listNodePairing, o as getRemoteSkillEligibility, p as approveNodePairing, s as primeRemoteSkillsCache, u as refreshRemoteNodeBins, v as updatePairedNodeMetadata, x as getSkillsSnapshotVersion, y as verifyNodeToken } from "./skill-commands-Cpr3Poo2.js";
+import { t as listAgentWorkspaceDirs } from "./workspace-dirs-Bevk6X_8.js";
 import { t as getChannelActivity } from "./channel-activity-C-cvytUe.js";
 import { n as normalizePollInput } from "./polls-CWOwBT3z.js";
-import "./tables-DVXe5x1J.js";
-import "./server-lifecycle-B2y6Fg7R.js";
+import "./tables-BOsRa7CS.js";
+import "./server-lifecycle-CcYnyYPQ.js";
 import { i as parseAbsoluteTimeMs, n as resolveCronStaggerMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-Cek4Eizw.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-D8KYuWir.js";
-import { i as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-DER6qA6X.js";
-import "./send-CQJKPGw4.js";
-import "./outbound-attachment-CXINK8df.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-DGtYwfd7.js";
+import { i as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-S_lBQAKI.js";
+import "./send-CZ2O-5pP.js";
+import "./outbound-attachment-DM-h2uQ1.js";
 import "./delivery-queue-DhqwvOP8.js";
-import "./send-e1X1pfda.js";
-import "./resolve-route-Cnto8LMw.js";
-import { a as resolveSubagentToolPolicy, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-BH0D2kX0.js";
+import "./send-BCLu4NEE.js";
+import "./resolve-route-ByAwAiq5.js";
+import { a as resolveSubagentToolPolicy, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-DRW8ya1z.js";
 import "./proxy-Dz7xT2Z_.js";
-import "./replies-Ckd7Lwt0.js";
-import { C as normalizeControlUiBasePath, S as buildControlUiAvatarUrl, c as handleReset, w as resolveAssistantAvatarUrl, x as CONTROL_UI_AVATAR_PREFIX } from "./onboard-helpers-CczYNQDJ.js";
+import "./replies-BDnb0prE.js";
+import { C as normalizeControlUiBasePath, S as buildControlUiAvatarUrl, c as handleReset, w as resolveAssistantAvatarUrl, x as CONTROL_UI_AVATAR_PREFIX } from "./onboard-helpers-D8lLbK3A.js";
 import "./prompt-style-CzS6Prvl.js";
-import "./pairing-labels-CFSUHOmk.js";
-import "./session-meta-DF1WT4cr.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-CuT-iG2F.js";
-import { r as resolveMemorySearchConfig } from "./manager-7hZXEYTj.js";
-import "./query-expansion-BrM3X6-L.js";
+import "./pairing-labels-x4akYNb7.js";
+import "./session-meta-Cew1QAYN.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-BUrf60e_.js";
+import { r as resolveMemorySearchConfig } from "./manager-DWpiNvlg.js";
+import "./query-expansion-Ba9OpCm9.js";
 import { t as formatDocsLink } from "./links-BDNlbZvM.js";
 import { n as runCommandWithRuntime } from "./cli-utils-k9A6CA1o.js";
 import { t as formatHelpExamples } from "./help-format-B3bKmDqF.js";
@@ -132,46 +132,46 @@ import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-B9LIt3MU.
 import { n as inheritOptionFromParent } from "./command-options-ZvhOayEd.js";
 import { t as WizardCancelledError } from "./prompts-DomsZukd.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-B7sHmVvT.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-CmUkQxtt.js";
-import { t as isWithinDir } from "./path-safety-tZSbJG67.js";
-import { t as assertCanonicalPathWithinBase } from "./install-safe-path-CWo3RPkH.js";
-import "./skill-scanner-BXOiOvI1.js";
-import { n as formatConfigIssueLines } from "./issue-format-CqVkT3gT.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-DA3Y8w1t.js";
+import { t as isWithinDir } from "./path-safety-BxYB92SS.js";
+import { t as assertCanonicalPathWithinBase } from "./install-safe-path-DVQh7rEs.js";
+import "./skill-scanner-0-AybMIe.js";
+import { n as formatConfigIssueLines } from "./issue-format-NBMJ5xAP.js";
 import { t as buildChannelAccountSnapshot } from "./status-BrwHRn2B.js";
-import "./channels-status-issues-5n9kobSz.js";
-import { a as buildBaseHints, i as applySensitiveHints, n as redactConfigSnapshot, o as mapSensitivePaths, r as restoreRedactedValues, s as applyDerivedTags, t as redactConfigObject } from "./redact-snapshot-D3QFNQl8.js";
-import "./daemon-install-helpers-C1iBqd73.js";
+import "./channels-status-issues-BMNB2aMG.js";
+import { a as buildBaseHints, i as applySensitiveHints, n as redactConfigSnapshot, o as mapSensitivePaths, r as restoreRedactedValues, s as applyDerivedTags, t as redactConfigObject } from "./redact-snapshot-kY3aFpcF.js";
+import "./daemon-install-helpers-D5tste0V.js";
 import "./runtime-guard-Ch9ZniVU.js";
-import "./systemd-Dbwmb4TX.js";
-import "./service-Wk285d-R.js";
-import "./lifecycle-core-DAWYYqJl.js";
-import "./systemd-hints-VM2JkQxw.js";
+import "./systemd-C4JtDaKk.js";
+import "./service-CZORJG4z.js";
+import "./lifecycle-core-oTVOKNSW.js";
+import "./systemd-hints-ZHrBbXDd.js";
 import { t as parsePort$1 } from "./parse-port-DPUPC687.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-CFnqQB6M.js";
-import "./diagnostics-DooDWHeF.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-oCVkh3bg.js";
+import "./diagnostics-vLzdmcgg.js";
 import "./table-BHL_2Py1.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-Dnn3h3FI.js";
-import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CJN2BLdi.js";
-import { a as probeGateway, n as collectEnabledInsecureOrDangerousFlags } from "./audit-DJfP7KjJ.js";
-import { t as discoverGatewayBeacons } from "./bonjour-discovery-t-SAPCsb.js";
-import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-XGYDzhkW.js";
-import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as isCronSystemEvent } from "./health-DugDjq1f.js";
-import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-M84PR-kz.js";
-import { o as isBitseekBuild } from "./status.update-n2QPQr8w.js";
-import { h as normalizeUpdateChannel, l as DEFAULT_PACKAGE_CHANNEL, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channel-account-context-CiCkIxCu.js";
-import { i as prepareSecretsRuntimeSnapshot, n as clearSecretsRuntimeSnapshot, r as getActiveSecretsRuntimeSnapshot, t as activateSecretsRuntimeSnapshot } from "./runtime-BI0xjrHi.js";
-import { t as runOnboardingWizard } from "./onboarding-DNV-TKzA.js";
-import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-BKjyYFyk.js";
+import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-BZscafy-.js";
+import { a as probeGateway, n as collectEnabledInsecureOrDangerousFlags } from "./audit-TSVXvoTa.js";
+import { t as discoverGatewayBeacons } from "./bonjour-discovery-B68dCYTY.js";
+import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-Dw7ag8qn.js";
+import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as isCronSystemEvent } from "./health-Dzwp2cfK.js";
+import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-Czpjuiah.js";
+import { o as isBitseekBuild } from "./status.update-B6whKviL.js";
+import { h as normalizeUpdateChannel, l as DEFAULT_PACKAGE_CHANNEL, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channel-account-context-DNFdIaSr.js";
+import { i as prepareSecretsRuntimeSnapshot, n as clearSecretsRuntimeSnapshot, r as getActiveSecretsRuntimeSnapshot, t as activateSecretsRuntimeSnapshot } from "./runtime-Cx-7xFzl.js";
+import { t as runOnboardingWizard } from "./onboarding-WDRpEgra.js";
+import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-DRX0c6-y.js";
 import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-CIlkd6Jc.js";
-import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-D7hSN9B8.js";
-import "./node-service-CzRylWgI.js";
+import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-DMwxqhrG.js";
+import "./node-service-83OYUi14.js";
 import "./constants-Dpz-jwYQ.js";
-import "./shared-BAdi_Ot7.js";
-import { d as verifyOpenAiCompatibleModel } from "./onboard-custom.shared-D52ggtQF.js";
-import { n as formatInstallFailureMessage, t as installSkill } from "./skills-install-BQyeS7wB.js";
-import { t as runGatewayUpdate } from "./update-runner-CX6jOI_r.js";
-import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-DWBFoy1G.js";
-import { n as forceFreePortAndWait } from "./ports-zWusnrvP.js";
+import "./shared-DvHQekWm.js";
+import { d as verifyOpenAiCompatibleModel } from "./onboard-custom.shared-CXzE62ZH.js";
+import { n as formatInstallFailureMessage, t as installSkill } from "./skills-install-C6-Zzqoi.js";
+import { t as runGatewayUpdate } from "./update-runner-CHxTFtW8.js";
+import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-A5CNJccm.js";
+import { n as forceFreePortAndWait } from "./ports-tfS1haOJ.js";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "node:path";
@@ -180,7 +180,7 @@ import * as fsSync from "node:fs";
 import fs from "node:fs";
 import chalk from "chalk";
 import { isDeepStrictEqual } from "node:util";
-import fs$1 from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { CURRENT_SESSION_VERSION, SessionManager } from "@mariozechner/pi-coding-agent";
@@ -1250,7 +1250,7 @@ function resolveCheckIntervalMs(cfg) {
 }
 async function readState(statePath) {
 	try {
-		const raw = await fs$1.readFile(statePath, "utf-8");
+		const raw = await fsPromises.readFile(statePath, "utf-8");
 		const parsed = JSON.parse(raw);
 		return parsed && typeof parsed === "object" ? parsed : {};
 	} catch {
@@ -1331,7 +1331,7 @@ async function runAutoUpdateCommand(params) {
 			path.join(params.root, "dist", "index.mjs")
 		];
 		for (const candidate of candidates) try {
-			await fs$1.access(candidate);
+			await fsPromises.access(candidate);
 			argv.push(execPath, candidate, ...baseArgs);
 			break;
 		} catch {}
@@ -4406,20 +4406,20 @@ async function drainPendingWrite(filePath) {
 	if (pending) await pending.catch(() => void 0);
 }
 async function pruneIfNeeded(filePath, opts) {
-	const stat = await fs$1.stat(filePath).catch(() => null);
+	const stat = await fsPromises.stat(filePath).catch(() => null);
 	if (!stat || stat.size <= opts.maxBytes) return;
-	const lines = (await fs$1.readFile(filePath, "utf-8").catch(() => "")).split("\n").map((l) => l.trim()).filter(Boolean);
+	const lines = (await fsPromises.readFile(filePath, "utf-8").catch(() => "")).split("\n").map((l) => l.trim()).filter(Boolean);
 	const kept = lines.slice(Math.max(0, lines.length - opts.keepLines));
 	const { randomBytes } = await import("node:crypto");
 	const tmp = `${filePath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
-	await fs$1.writeFile(tmp, `${kept.join("\n")}\n`, "utf-8");
-	await fs$1.rename(tmp, filePath);
+	await fsPromises.writeFile(tmp, `${kept.join("\n")}\n`, "utf-8");
+	await fsPromises.rename(tmp, filePath);
 }
 async function appendCronRunLog(filePath, entry, opts) {
 	const resolved = path.resolve(filePath);
 	const next = (writesByPath.get(resolved) ?? Promise.resolve()).catch(() => void 0).then(async () => {
-		await fs$1.mkdir(path.dirname(resolved), { recursive: true });
-		await fs$1.appendFile(resolved, `${JSON.stringify(entry)}\n`, "utf-8");
+		await fsPromises.mkdir(path.dirname(resolved), { recursive: true });
+		await fsPromises.appendFile(resolved, `${JSON.stringify(entry)}\n`, "utf-8");
 		await pruneIfNeeded(resolved, {
 			maxBytes: opts?.maxBytes ?? DEFAULT_CRON_RUN_LOG_MAX_BYTES,
 			keepLines: opts?.keepLines ?? DEFAULT_CRON_RUN_LOG_KEEP_LINES
@@ -4513,7 +4513,7 @@ function filterRunLogEntries(entries, opts) {
 async function readCronRunLogEntriesPage(filePath, opts) {
 	await drainPendingWrite(filePath);
 	const limit = Math.max(1, Math.min(200, Math.floor(opts?.limit ?? 50)));
-	const raw = await fs$1.readFile(path.resolve(filePath), "utf-8").catch(() => "");
+	const raw = await fsPromises.readFile(path.resolve(filePath), "utf-8").catch(() => "");
 	const statuses = normalizeRunStatuses(opts);
 	const deliveryStatuses = normalizeDeliveryStatuses(opts);
 	const query = opts?.query?.trim().toLowerCase() ?? "";
@@ -4549,7 +4549,7 @@ async function readCronRunLogEntriesPageAll(opts) {
 	const query = opts.query?.trim().toLowerCase() ?? "";
 	const sortDir = opts.sortDir === "asc" ? "asc" : "desc";
 	const runsDir = path.resolve(path.dirname(path.resolve(opts.storePath)), "runs");
-	const jsonlFiles = (await fs$1.readdir(runsDir, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path.join(runsDir, entry.name));
+	const jsonlFiles = (await fsPromises.readdir(runsDir, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path.join(runsDir, entry.name));
 	if (jsonlFiles.length === 0) return {
 		entries: [],
 		total: 0,
@@ -4560,7 +4560,7 @@ async function readCronRunLogEntriesPageAll(opts) {
 	};
 	await Promise.all(jsonlFiles.map((f) => drainPendingWrite(f)));
 	const filtered = filterRunLogEntries((await Promise.all(jsonlFiles.map(async (filePath) => {
-		return parseAllRunLogEntries(await fs$1.readFile(filePath, "utf-8").catch(() => ""));
+		return parseAllRunLogEntries(await fsPromises.readFile(filePath, "utf-8").catch(() => ""));
 	}))).flat(), {
 		statuses,
 		deliveryStatuses,
@@ -9768,7 +9768,7 @@ function resolveAgentWorkspaceFileOrRespondError(params, respond) {
 }
 async function resolveWorkspaceRealPath(workspaceDir) {
 	try {
-		return await fs$1.realpath(workspaceDir);
+		return await fsPromises.realpath(workspaceDir);
 	} catch {
 		return path.resolve(workspaceDir);
 	}
@@ -9792,7 +9792,7 @@ async function resolveAgentWorkspaceFilePath(params) {
 	}
 	let candidateLstat;
 	try {
-		candidateLstat = await fs$1.lstat(candidatePath);
+		candidateLstat = await fsPromises.lstat(candidatePath);
 	} catch (err) {
 		if (isNotFoundPathError(err)) {
 			if (params.allowMissing) return {
@@ -9812,7 +9812,7 @@ async function resolveAgentWorkspaceFilePath(params) {
 	if (candidateLstat.isSymbolicLink()) {
 		let targetReal;
 		try {
-			targetReal = await fs$1.realpath(candidatePath);
+			targetReal = await fsPromises.realpath(candidatePath);
 		} catch (err) {
 			if (isNotFoundPathError(err)) {
 				if (params.allowMissing) return {
@@ -9831,7 +9831,7 @@ async function resolveAgentWorkspaceFilePath(params) {
 		}
 		let targetStat;
 		try {
-			targetStat = await fs$1.stat(targetReal);
+			targetStat = await fsPromises.stat(targetReal);
 		} catch (err) {
 			if (isNotFoundPathError(err)) {
 				if (params.allowMissing) return {
@@ -9878,13 +9878,13 @@ async function resolveAgentWorkspaceFilePath(params) {
 	return {
 		kind: "ready",
 		requestPath,
-		ioPath: await fs$1.realpath(candidatePath).catch(() => candidatePath),
+		ioPath: await fsPromises.realpath(candidatePath).catch(() => candidatePath),
 		workspaceReal
 	};
 }
 async function statFileSafely(filePath) {
 	try {
-		const [stat, lstat] = await Promise.all([fs$1.stat(filePath), fs$1.lstat(filePath)]);
+		const [stat, lstat] = await Promise.all([fsPromises.stat(filePath), fsPromises.lstat(filePath)]);
 		if (lstat.isSymbolicLink() || !stat.isFile()) return null;
 		if (stat.nlink > 1) return null;
 		if (!sameFileIdentity(stat, lstat)) return null;
@@ -9969,7 +9969,7 @@ function resolveOptionalStringParam(value) {
 async function moveToTrashBestEffort(pathname) {
 	if (!pathname) return;
 	try {
-		await fs$1.access(pathname);
+		await fsPromises.access(pathname);
 	} catch {
 		return;
 	}
@@ -10045,7 +10045,7 @@ const agentsHandlers = {
 			dir: workspaceDir,
 			ensureBootstrapFiles: !Boolean(nextConfig.agents?.defaults?.skipBootstrap)
 		});
-		await fs$1.mkdir(resolveSessionTranscriptsDirForAgent(agentId), { recursive: true });
+		await fsPromises.mkdir(resolveSessionTranscriptsDirForAgent(agentId), { recursive: true });
 		await writeConfigFile(nextConfig);
 		const safeName = sanitizeIdentityLine(rawName);
 		const emoji = resolveOptionalStringParam(params.emoji);
@@ -10058,7 +10058,7 @@ const agentsHandlers = {
 			...avatar ? [`- Avatar: ${sanitizeIdentityLine(avatar)}`] : [],
 			""
 		];
-		await fs$1.appendFile(identityPath, lines.join("\n"), "utf-8");
+		await fsPromises.appendFile(identityPath, lines.join("\n"), "utf-8");
 		respond(true, {
 			ok: true,
 			agentId,
@@ -10093,9 +10093,9 @@ const agentsHandlers = {
 		});
 		if (avatar) {
 			const workspace = workspaceDir ?? resolveAgentWorkspaceDir(nextConfig, agentId);
-			await fs$1.mkdir(workspace, { recursive: true });
+			await fsPromises.mkdir(workspace, { recursive: true });
 			const identityPath = path.join(workspace, DEFAULT_IDENTITY_FILENAME);
-			await fs$1.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, "utf-8");
+			await fsPromises.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, "utf-8");
 		}
 		respond(true, {
 			ok: true,
@@ -10219,7 +10219,7 @@ const agentsHandlers = {
 		const resolved = resolveAgentWorkspaceFileOrRespondError(params, respond);
 		if (!resolved) return;
 		const { agentId, workspaceDir, name } = resolved;
-		await fs$1.mkdir(workspaceDir, { recursive: true });
+		await fsPromises.mkdir(workspaceDir, { recursive: true });
 		const filePath = path.join(workspaceDir, name);
 		const resolvedPath = await resolveWorkspaceFilePathOrRespond({
 			respond,
@@ -12512,14 +12512,14 @@ function isRollingLogFile(file) {
 	return ROLLING_LOG_RE.test(path.basename(file));
 }
 async function resolveLogFile(file) {
-	if (await fs$1.stat(file).catch(() => null)) return file;
+	if (await fsPromises.stat(file).catch(() => null)) return file;
 	if (!isRollingLogFile(file)) return file;
 	const dir = path.dirname(file);
-	const entries = await fs$1.readdir(dir, { withFileTypes: true }).catch(() => null);
+	const entries = await fsPromises.readdir(dir, { withFileTypes: true }).catch(() => null);
 	if (!entries) return file;
 	return (await Promise.all(entries.filter((entry) => entry.isFile() && ROLLING_LOG_RE.test(entry.name)).map(async (entry) => {
 		const fullPath = path.join(dir, entry.name);
-		const fileStat = await fs$1.stat(fullPath).catch(() => null);
+		const fileStat = await fsPromises.stat(fullPath).catch(() => null);
 		return fileStat ? {
 			path: fullPath,
 			mtimeMs: fileStat.mtimeMs
@@ -12527,7 +12527,7 @@ async function resolveLogFile(file) {
 	}))).filter((entry) => Boolean(entry)).toSorted((a, b) => b.mtimeMs - a.mtimeMs)[0]?.path ?? file;
 }
 async function readLogSlice(params) {
-	const stat = await fs$1.stat(params.file).catch(() => null);
+	const stat = await fsPromises.stat(params.file).catch(() => null);
 	if (!stat) return {
 		cursor: 0,
 		size: 0,
@@ -12565,7 +12565,7 @@ async function readLogSlice(params) {
 		truncated,
 		reset
 	};
-	const handle = await fs$1.open(params.file, "r");
+	const handle = await fsPromises.open(params.file, "r");
 	try {
 		let prefix = "";
 		if (start > 0) {
@@ -13612,7 +13612,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-BwnXBzS2.js");
+			const { handleNodeEvent } = await import("./server-node-events-B5xSV7Kq.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -14007,120 +14007,283 @@ const sendHandlers = {
 //#region src/agents/skills-market-catalog.ts
 const OFFICIAL_MARKET_CATALOG = [
 	{
-		id: "bnbchain-mcp-skill",
-		skillKey: "bnbchain-mcp-skill",
-		name: "BNB Chain MCP Toolkit",
-		summary: "Install and use BNB Chain MCP for blocks, transactions, contracts, token/NFT transfers, ERC-8004, and Greenfield operations.",
-		provider: "BNB Chain",
-		category: "infrastructure",
+		id: "xiaohongshu-mcp",
+		skillKey: "xiaohongshu-mcp",
+		name: "Xiaohongshu Automation",
+		summary: "Automate Xiaohongshu workflows for content operations and publishing tasks through a ClawHub skill.",
+		provider: "Borye",
+		category: "automation",
 		tags: [
-			"web3",
-			"bnb",
-			"bsc",
-			"opbnb",
-			"mcp",
-			"greenfield",
-			"erc-8004"
+			"xiaohongshu",
+			"automation",
+			"social",
+			"publishing",
+			"mcp"
 		],
-		sourceType: "local",
-		templateDir: "bnbchain-mcp-skill",
+		stars: 60,
+		downloads: 15840,
+		sourceType: "clawhub",
+		slug: "xiaohongshu-mcp",
 		official: true
 	},
 	{
-		id: "okx-dex-market",
-		skillKey: "okx-dex-market",
-		name: "OKX DEX Market Data",
-		summary: "Fetch real-time prices, candlesticks, trade history, and index prices across XLayer, Solana, Ethereum, Base, BSC, and more.",
-		provider: "OKX",
-		category: "onchain-data",
+		id: "github",
+		skillKey: "github",
+		name: "Github",
+		summary: "Work with GitHub repositories, issues, pull requests, and other developer workflows from ClawHub.",
+		provider: "steipete",
+		category: "developer-tools",
 		tags: [
-			"web3",
-			"okx",
-			"dex",
-			"price",
-			"candles",
-			"market",
-			"index"
+			"github",
+			"git",
+			"developer",
+			"issues",
+			"pull-requests"
 		],
-		sourceType: "local",
-		templateDir: "okx-dex-market",
+		stars: 323,
+		downloads: 99937,
+		sourceType: "clawhub",
+		slug: "github",
 		official: true
 	},
 	{
-		id: "okx-dex-token",
-		skillKey: "okx-dex-token",
-		name: "OKX Token Discovery",
-		summary: "Search tokens, inspect metadata, market cap, liquidity, rankings, and holder distribution across 20+ chains.",
-		provider: "OKX",
-		category: "onchain-data",
+		id: "openai-whisper",
+		skillKey: "openai-whisper",
+		name: "Openai Whisper",
+		summary: "Transcribe and process audio with Whisper via a ClawHub skill for speech-to-text workflows.",
+		provider: "steipete",
+		category: "audio-media",
+		tags: [
+			"audio",
+			"transcription",
+			"whisper",
+			"speech-to-text",
+			"media"
+		],
+		stars: 197,
+		downloads: 42056,
+		sourceType: "clawhub",
+		slug: "openai-whisper",
+		official: true
+	},
+	{
+		id: "skill-vetter",
+		skillKey: "skill-vetter",
+		name: "Skill Vetter",
+		summary: "Review and vet skills before adoption to help evaluate quality, fit, and readiness.",
+		provider: "spclaudehome",
+		category: "meta-security",
+		tags: [
+			"skills",
+			"review",
+			"vetting",
+			"quality",
+			"evaluation"
+		],
+		stars: 290,
+		downloads: 73729,
+		sourceType: "clawhub",
+		slug: "skill-vetter",
+		official: true
+	},
+	{
+		id: "gog",
+		skillKey: "gog",
+		name: "Gog",
+		summary: "Use Gog from ClawHub for developer and command-line workflows that benefit from fast utility tooling.",
+		provider: "steipete",
+		category: "developer-tools",
+		tags: [
+			"developer",
+			"cli",
+			"tooling",
+			"workflow",
+			"utility"
+		],
+		stars: 705,
+		downloads: 106425,
+		sourceType: "clawhub",
+		slug: "gog",
+		official: true
+	},
+	{
+		id: "openclaw-tavily-search",
+		skillKey: "openclaw-tavily-search",
+		name: "Tavily Web Search",
+		summary: "Search the web with Tavily through ClawHub for current information gathering and lightweight research.",
+		provider: "Jacky1n7",
+		category: "search-research",
 		tags: [
-			"web3",
-			"okx",
-			"token",
 			"search",
-			"market-cap",
-			"holders",
-			"ranking"
+			"web",
+			"research",
+			"tavily",
+			"current-events"
+		],
+		stars: 26,
+		downloads: 17437,
+		sourceType: "clawhub",
+		slug: "openclaw-tavily-search",
+		official: true
+	},
+	{
+		id: "summarize",
+		skillKey: "summarize",
+		name: "Summarize",
+		summary: "Summarize documents, pages, and other text content through a focused ClawHub skill.",
+		provider: "steipete",
+		category: "search-research",
+		tags: [
+			"summarization",
+			"text",
+			"research",
+			"documents",
+			"analysis"
 		],
-		sourceType: "local",
-		templateDir: "okx-dex-token",
+		stars: 542,
+		downloads: 139326,
+		sourceType: "clawhub",
+		slug: "summarize",
 		official: true
 	},
 	{
-		id: "okx-wallet-portfolio",
-		skillKey: "okx-wallet-portfolio",
-		name: "OKX Wallet Portfolio",
-		summary: "Check wallet total value, token holdings, and per-token balances across XLayer, Solana, Ethereum, Base, BSC, and more.",
-		provider: "OKX",
-		category: "wallet",
+		id: "skill-security-auditor",
+		skillKey: "skill-security-auditor",
+		name: "Skill Security Auditor",
+		summary: "Audit skills for security concerns and suspicious patterns before enabling them in production workflows.",
+		provider: "akhmittra",
+		category: "meta-security",
 		tags: [
-			"web3",
-			"okx",
-			"wallet",
-			"portfolio",
-			"balance",
-			"holdings"
+			"security",
+			"audit",
+			"skills",
+			"review",
+			"risk"
 		],
-		sourceType: "local",
-		templateDir: "okx-wallet-portfolio",
+		stars: 2,
+		downloads: 2547,
+		sourceType: "clawhub",
+		slug: "skill-security-auditor",
 		official: true
 	},
 	{
-		id: "okx-dex-swap",
-		skillKey: "okx-dex-swap",
-		name: "OKX DEX Swap Aggregator",
-		summary: "Get optimized swap routes and execution payloads using 500+ liquidity sources with slippage controls.",
-		provider: "OKX",
-		category: "defi",
+		id: "self-improving-agent",
+		skillKey: "self-improving-agent",
+		name: "Self Improving Agent",
+		summary: "Use a ClawHub agent focused on iterating on its own behavior and improving workflows over time.",
+		provider: "pskoett",
+		category: "meta-security",
 		tags: [
-			"web3",
-			"okx",
-			"dex",
-			"swap",
-			"routing",
-			"liquidity"
+			"agent",
+			"self-improvement",
+			"iteration",
+			"optimization",
+			"meta"
 		],
-		sourceType: "local",
-		templateDir: "okx-dex-swap",
+		stars: 1863,
+		downloads: 185770,
+		sourceType: "clawhub",
+		slug: "self-improving-agent",
 		official: true
 	},
 	{
-		id: "okx-onchain-gateway",
-		skillKey: "okx-onchain-gateway",
-		name: "OKX Onchain Gateway",
-		summary: "Estimate gas, simulate transactions, broadcast signed transactions, and track transaction orders on 20+ chains.",
-		provider: "OKX",
-		category: "infrastructure",
+		id: "find-skills",
+		skillKey: "find-skills",
+		name: "Find Skills",
+		summary: "Discover relevant ClawHub skills for a task so agents can expand capabilities on demand.",
+		provider: "JimLiuxinghai",
+		category: "meta-security",
 		tags: [
-			"web3",
-			"okx",
-			"transaction",
-			"gas",
-			"simulate",
-			"broadcast"
+			"skills",
+			"discovery",
+			"registry",
+			"clawhub",
+			"meta"
 		],
-		sourceType: "local",
-		templateDir: "okx-onchain-gateway",
+		stars: 766,
+		downloads: 181109,
+		sourceType: "clawhub",
+		slug: "find-skills",
+		official: true
+	},
+	{
+		id: "obsidian",
+		skillKey: "obsidian",
+		name: "Obsidian",
+		summary: "Work with Obsidian notes and knowledge-base content through a ClawHub integration skill.",
+		provider: "steipete",
+		category: "developer-tools",
+		tags: [
+			"obsidian",
+			"notes",
+			"knowledge-base",
+			"markdown",
+			"productivity"
+		],
+		stars: 187,
+		downloads: 47182,
+		sourceType: "clawhub",
+		slug: "obsidian",
+		official: true
+	},
+	{
+		id: "skill-creator-2",
+		skillKey: "skill-creator-2",
+		name: "Skill creator",
+		summary: "Create new skills with a ClawHub-assisted builder aimed at packaging and publishing reusable capabilities.",
+		provider: "yixinli867",
+		category: "meta-security",
+		tags: [
+			"skills",
+			"creator",
+			"builder",
+			"packaging",
+			"clawhub"
+		],
+		stars: 26,
+		downloads: 5116,
+		sourceType: "clawhub",
+		slug: "skill-creator-2",
+		official: true
+	},
+	{
+		id: "upload-post",
+		skillKey: "upload-post",
+		name: "Upload Post",
+		summary: "Upload and publish posts through a ClawHub automation skill for social and content workflows.",
+		provider: "victorcavero14",
+		category: "automation",
+		tags: [
+			"upload",
+			"post",
+			"publishing",
+			"social",
+			"automation"
+		],
+		stars: 35,
+		downloads: 6588,
+		sourceType: "clawhub",
+		slug: "upload-post",
+		official: true
+	},
+	{
+		id: "security-auditor",
+		skillKey: "security-auditor",
+		name: "Security Auditor",
+		summary: "Run security-oriented reviews and checks with a general-purpose ClawHub security auditing skill.",
+		provider: "jgarrison929",
+		category: "meta-security",
+		tags: [
+			"security",
+			"auditor",
+			"review",
+			"analysis",
+			"checks"
+		],
+		stars: 14,
+		downloads: 10926,
+		sourceType: "clawhub",
+		slug: "security-auditor",
 		official: true
 	}
 ];
@@ -14138,6 +14301,17 @@ function isCommandNotFoundResult(result) {
 	const output = `${result.stderr}\n${result.stdout}`.toLowerCase();
 	return output.includes("enoent") || output.includes("command not found") || output.includes("not recognized as an internal or external command");
 }
+async function runMarketInstallCommand(runCommand, argv, options) {
+	try {
+		return await runCommand(argv, options);
+	} catch (err) {
+		return {
+			code: null,
+			stdout: "",
+			stderr: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
 async function installLocalMarketSkill(params) {
 	const templateDir = params.templateDir.trim();
 	if (hasPathTraversal(templateDir)) return {
@@ -14158,11 +14332,11 @@ async function installLocalMarketSkill(params) {
 			candidatePath: sourceDir,
 			boundaryLabel: "market templates directory"
 		});
-		if (!(await fs$1.stat(sourceDir)).isDirectory()) return {
+		if (!(await fsPromises.stat(sourceDir)).isDirectory()) return {
 			ok: false,
 			message: `Local template "${templateDir}" is not a directory.`
 		};
-		if (!(await fs$1.stat(sourceSkillPath)).isFile()) return {
+		if (!(await fsPromises.stat(sourceSkillPath)).isFile()) return {
 			ok: false,
 			message: `Local template "${templateDir}" is missing SKILL.md.`
 		};
@@ -14176,13 +14350,13 @@ async function installLocalMarketSkill(params) {
 	const workspaceSkillsDir = path.join(workspaceDir, "skills");
 	const targetDir = path.join(workspaceSkillsDir, templateDir);
 	try {
-		await fs$1.mkdir(workspaceSkillsDir, { recursive: true });
+		await fsPromises.mkdir(workspaceSkillsDir, { recursive: true });
 		await assertCanonicalPathWithinBase({
 			baseDir: workspaceSkillsDir,
 			candidatePath: targetDir,
 			boundaryLabel: "workspace skills directory"
 		});
-		await fs$1.cp(sourceDir, targetDir, {
+		await fsPromises.cp(sourceDir, targetDir, {
 			recursive: true,
 			force: true
 		});
@@ -14206,7 +14380,7 @@ async function installClawhubMarketSkill(params, deps) {
 	const workspaceDir = resolveUserPath(params.workspaceDir);
 	const timeoutMs = Math.min(Math.max(params.timeoutMs ?? 3e5, 1e3), 9e5);
 	const runCommand = deps?.runCommand ?? runCommandWithTimeout;
-	const first = await runCommand([
+	const first = await runMarketInstallCommand(runCommand, [
 		"clawhub",
 		"install",
 		slug
@@ -14222,7 +14396,7 @@ async function installClawhubMarketSkill(params, deps) {
 		ok: false,
 		message: `ClawHub install failed: ${formatInstallFailureMessage(first)}`
 	};
-	const fallback = await runCommand([
+	const fallback = await runMarketInstallCommand(runCommand, [
 		"npx",
 		"-y",
 		"clawhub",
@@ -16968,7 +17142,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.OPENCLAW_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.OPENCLAW_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./server-DbB5aXZq.js");
+	const mod = override ? await import(override) : await import("./server-CzDsmd9g.js");
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -17196,7 +17370,7 @@ async function resolveFileWithinRoot(rootReal, urlPath) {
 	if (normalized.endsWith("/")) return await tryOpen(path.posix.join(rel, "index.html"));
 	const candidate = path.join(rootReal, rel);
 	try {
-		const st = await fs$1.lstat(candidate);
+		const st = await fsPromises.lstat(candidate);
 		if (st.isSymbolicLink()) return null;
 		if (st.isDirectory()) return await tryOpen(path.posix.join(rel, "index.html"));
 	} catch {}
@@ -17233,8 +17407,8 @@ async function resolveA2uiRoot() {
 	for (const dir of candidates) try {
 		const indexPath = path.join(dir, "index.html");
 		const bundlePath = path.join(dir, "a2ui.bundle.js");
-		await fs$1.stat(indexPath);
-		await fs$1.stat(bundlePath);
+		await fsPromises.stat(indexPath);
+		await fsPromises.stat(bundlePath);
 		return dir;
 	} catch {}
 	return null;
@@ -17243,7 +17417,7 @@ async function resolveA2uiRootReal() {
 	if (cachedA2uiRootReal !== void 0 && (cachedA2uiRootReal !== null || Date.now() - cachedA2uiResolvedAtMs < A2UI_ROOT_RETRY_NULL_AFTER_MS)) return cachedA2uiRootReal;
 	if (!resolvingA2uiRoot) resolvingA2uiRoot = (async () => {
 		const root = await resolveA2uiRoot();
-		cachedA2uiRootReal = root ? await fs$1.realpath(root) : null;
+		cachedA2uiRootReal = root ? await fsPromises.realpath(root) : null;
 		cachedA2uiResolvedAtMs = Date.now();
 		resolvingA2uiRoot = null;
 		return cachedA2uiRootReal;
@@ -17464,13 +17638,13 @@ function normalizeBasePath(rawPath) {
 }
 async function prepareCanvasRoot(rootDir) {
 	await ensureDir(rootDir);
-	const rootReal = await fs$1.realpath(rootDir);
+	const rootReal = await fsPromises.realpath(rootDir);
 	try {
 		const indexPath = path.join(rootReal, "index.html");
-		await fs$1.stat(indexPath);
+		await fsPromises.stat(indexPath);
 	} catch {
 		try {
-			await fs$1.writeFile(path.join(rootReal, "index.html"), defaultIndexHTML(), "utf8");
+			await fsPromises.writeFile(path.join(rootReal, "index.html"), defaultIndexHTML(), "utf8");
 		} catch {}
 	}
 	return rootReal;
@@ -20477,7 +20651,7 @@ async function resolveGatewayOwnerStatus(pid, payload, platform, port) {
 }
 async function readLockPayload(lockPath) {
 	try {
-		const raw = await fs$1.readFile(lockPath, "utf8");
+		const raw = await fsPromises.readFile(lockPath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (typeof parsed.pid !== "number") return null;
 		if (typeof parsed.createdAt !== "string") return null;
@@ -20512,11 +20686,11 @@ async function acquireGatewayLock(opts = {}) {
 	const platform = opts.platform ?? process.platform;
 	const port = opts.port;
 	const { lockPath, configPath } = resolveGatewayLockPath(env);
-	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
+	await fsPromises.mkdir(path.dirname(lockPath), { recursive: true });
 	const startedAt = Date.now();
 	let lastPayload = null;
 	while (Date.now() - startedAt < timeoutMs) try {
-		const handle = await fs$1.open(lockPath, "wx");
+		const handle = await fsPromises.open(lockPath, "wx");
 		const startTime = platform === "linux" ? readLinuxStartTime(process.pid) : null;
 		const payload = {
 			pid: process.pid,
@@ -20530,7 +20704,7 @@ async function acquireGatewayLock(opts = {}) {
 			configPath,
 			release: async () => {
 				await handle.close().catch(() => void 0);
-				await fs$1.rm(lockPath, { force: true });
+				await fsPromises.rm(lockPath, { force: true });
 			}
 		};
 	} catch (err) {
@@ -20539,7 +20713,7 @@ async function acquireGatewayLock(opts = {}) {
 		const ownerPid = lastPayload?.pid;
 		const ownerStatus = ownerPid ? await resolveGatewayOwnerStatus(ownerPid, lastPayload, platform, port) : "unknown";
 		if (ownerStatus === "dead" && ownerPid) {
-			await fs$1.rm(lockPath, { force: true });
+			await fsPromises.rm(lockPath, { force: true });
 			continue;
 		}
 		if (ownerStatus !== "alive") {
@@ -20549,13 +20723,13 @@ async function acquireGatewayLock(opts = {}) {
 				stale = Number.isFinite(createdAt) ? Date.now() - createdAt > staleMs : false;
 			}
 			if (!stale) try {
-				const st = await fs$1.stat(lockPath);
+				const st = await fsPromises.stat(lockPath);
 				stale = Date.now() - st.mtimeMs > staleMs;
 			} catch {
 				stale = false;
 			}
 			if (stale) {
-				await fs$1.rm(lockPath, { force: true });
+				await fsPromises.rm(lockPath, { force: true });
 				continue;
 			}
 		}
@@ -22865,7 +23039,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	if (!minimalTestGateway) cron.start().catch((err) => logCron.error(`failed to start: ${String(err)}`));
 	if (!minimalTestGateway) (async () => {
 		const { recoverPendingDeliveries } = await import("./delivery-queue-DhqwvOP8.js").then((n) => n.n);
-		const { deliverOutboundPayloads } = await import("./deliver-DTgCZWjU.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-H0xCFj4j.js").then((n) => n.n);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),