@bitseek/claw 1.2.8 → 1.2.9

package/dist/{deliver-Df8pSQk6.js → deliver-BRwFsEUd.js}

@@ -3,15 +3,15 @@ import { a as logVerbose } from "./globals-B68W7uN8.js";
 import { t as createSubsystemLogger } from "./subsystem-DjdBljTA.js";
 import { _ as normalizeOptionalAccountId, g as normalizeAccountId } from "./session-key-BLprDJYq.js";
 import { E as triggerInternalHook, f as getActivePluginRegistryVersion, u as getActivePluginRegistry, w as createInternalHookEvent } from "./registry-7fg1BnMw.js";
-import { t as getChannelDock } from "./dock-DT8sACcR.js";
-import { F as parseInlineDirectives, i as resolveMirroredTranscriptText, r as appendAssistantMessageToSessionTranscript } from "./sessions-B2mnwD21.js";
-import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-vsjS_m58.js";
+import { t as getChannelDock } from "./dock-CoclJnwp.js";
+import { F as parseInlineDirectives, i as resolveMirroredTranscriptText, r as appendAssistantMessageToSessionTranscript } from "./sessions-BXz4gdq6.js";
+import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-C4cYqW07.js";
 import { i as isSilentReplyText, n as SILENT_REPLY_TOKEN } from "./tokens-DyLBF_df.js";
-import { i as isMessagingToolDuplicate } from "./pi-embedded-helpers-CrD8I6qf.js";
-import { i as getAgentScopedMediaLocalRoots } from "./fetch-DC-NMnAU.js";
+import { i as isMessagingToolDuplicate } from "./pi-embedded-helpers-CEMPdfif.js";
+import { i as getAgentScopedMediaLocalRoots } from "./fetch-DOjg912W.js";
 import { c as resolveChunkMode, f as parseFenceSpans, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit, n as chunkByParagraph } from "./chunk-kLPohhLl.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-BYHgyUjA.js";
-import { l as markdownToSignalTextChunks, t as sendMessageSignal } from "./send-CQJKPGw4.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DQlQMRGZ.js";
+import { l as markdownToSignalTextChunks, t as sendMessageSignal } from "./send-CZ2O-5pP.js";
 import { i as failDelivery, r as enqueueDelivery, t as ackDelivery } from "./delivery-queue-DhqwvOP8.js";
 
 //#region src/plugins/hooks.ts

package/dist/{devices-cli-D6CoUTi_.js → devices-cli-jakb5Fk0.js}

@@ -2,10 +2,10 @@ import { p as theme } from "./globals-B68W7uN8.js";
 import "./paths-BnKiOk2S.js";
 import { d as defaultRuntime } from "./subsystem-DjdBljTA.js";
 import "./boolean-DtWR5bt3.js";
-import "./auth-profiles-D_x1_5v_.js";
-import "./agent-scope-CJelRKYY.js";
+import "./auth-profiles-CyG9VwU_.js";
+import "./agent-scope-CY2-lUIY.js";
 import "./utils-DIzy5B5o.js";
-import "./workspace-BHfqkuYN.js";
+import "./workspace-DzeL98px.js";
 import "./logger-BJMfryJd.js";
 import "./exec-CEAvKSx9.js";
 import "./github-copilot-token-CulJ9J5l.js";
@@ -13,13 +13,13 @@ import "./host-env-security-CJMD0__Z.js";
 import "./version-CGDNfh5C.js";
 import "./env-vars-Dw0EwyGP.js";
 import "./registry-7fg1BnMw.js";
-import "./manifest-registry-Kbw8YPsZ.js";
+import "./manifest-registry-CBF8Vfz8.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-0J6eKf3g.js";
-import { Vt as approveDevicePairing, Wt as listDevicePairing, Xt as summarizeDeviceTokens } from "./client-BvL3EdiZ.js";
-import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-CzoM7hPS.js";
+import { Vt as approveDevicePairing, Wt as listDevicePairing, Xt as summarizeDeviceTokens } from "./client-vUKV2o6h.js";
+import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-CmAGfSJE.js";
 import "./pairing-token-DoBZxQnC.js";
-import { r as isLoopbackHost } from "./net-BXeYv7Iu.js";
-import "./tailnet-C1XBcWue.js";
+import { r as isLoopbackHost } from "./net-C75G4fup.js";
+import "./tailnet-CfP3A6g2.js";
 import { n as formatTimeAgo } from "./format-relative-DlCMhQXD.js";
 import { n as withProgress } from "./progress-CwQKn0ae.js";
 import { t as renderTable } from "./table-CqULNDay.js";

package/dist/{diagnostic-Bvatw1Xn.js → diagnostic-DjxUqpmL.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as createSubsystemLogger } from "./subsystem-DjdBljTA.js";
-import { M as loadConfig } from "./auth-profiles-D_x1_5v_.js";
+import { M as loadConfig } from "./auth-profiles-CyG9VwU_.js";
 import { n as getDiagnosticSessionState, r as pruneDiagnosticSessionStates, t as diagnosticSessionStates } from "./diagnostic-session-state-Dx-rJXBO.js";
 
 //#region src/infra/diagnostic-events.ts

package/dist/{diagnostics-ABz8E7c-.js → diagnostics-DR9Z0mN5.js}

@@ -1,5 +1,5 @@
-import { s as resolveGatewayLogPaths } from "./service-Bjqlh_fF.js";
-import fs from "node:fs/promises";
+import { s as resolveGatewayLogPaths } from "./service-CFfCS51c.js";
+import fsPromises from "node:fs/promises";
 
 //#region src/daemon/diagnostics.ts
 const GATEWAY_LOG_ERROR_PATTERNS = [
@@ -11,7 +11,7 @@ const GATEWAY_LOG_ERROR_PATTERNS = [
 ];
 async function readLastLogLine(filePath) {
 	try {
-		const lines = (await fs.readFile(filePath, "utf8")).split(/\r?\n/).map((line) => line.trim());
+		const lines = (await fsPromises.readFile(filePath, "utf8")).split(/\r?\n/).map((line) => line.trim());
 		for (let i = lines.length - 1; i >= 0; i -= 1) if (lines[i]) return lines[i];
 		return null;
 	} catch {
@@ -20,8 +20,8 @@ async function readLastLogLine(filePath) {
 }
 async function readLastGatewayErrorLine(env) {
 	const { stdoutPath, stderrPath } = resolveGatewayLogPaths(env);
-	const stderrRaw = await fs.readFile(stderrPath, "utf8").catch(() => "");
-	const stdoutRaw = await fs.readFile(stdoutPath, "utf8").catch(() => "");
+	const stderrRaw = await fsPromises.readFile(stderrPath, "utf8").catch(() => "");
+	const stdoutRaw = await fsPromises.readFile(stdoutPath, "utf8").catch(() => "");
 	const lines = [...stderrRaw.split(/\r?\n/), ...stdoutRaw.split(/\r?\n/)].map((line) => line.trim());
 	for (let i = lines.length - 1; i >= 0; i -= 1) {
 		const line = lines[i];

package/dist/{directory-cli-Dkil59xj.js → directory-cli-3FgAtenS.js}

@@ -2,10 +2,10 @@ import { p as theme, t as danger } from "./globals-B68W7uN8.js";
 import "./paths-BnKiOk2S.js";
 import { d as defaultRuntime } from "./subsystem-DjdBljTA.js";
 import "./boolean-DtWR5bt3.js";
-import { M as loadConfig } from "./auth-profiles-D_x1_5v_.js";
-import "./agent-scope-CJelRKYY.js";
+import { M as loadConfig } from "./auth-profiles-CyG9VwU_.js";
+import "./agent-scope-CY2-lUIY.js";
 import "./utils-DIzy5B5o.js";
-import "./workspace-BHfqkuYN.js";
+import "./workspace-DzeL98px.js";
 import "./logger-BJMfryJd.js";
 import "./exec-CEAvKSx9.js";
 import "./github-copilot-token-CulJ9J5l.js";
@@ -13,13 +13,13 @@ import "./host-env-security-CJMD0__Z.js";
 import "./version-CGDNfh5C.js";
 import "./env-vars-Dw0EwyGP.js";
 import "./registry-7fg1BnMw.js";
-import "./manifest-registry-Kbw8YPsZ.js";
+import "./manifest-registry-CBF8Vfz8.js";
 import "./message-channel-0J6eKf3g.js";
-import { t as getChannelPlugin } from "./plugins-vsjS_m58.js";
-import "./accounts-BQHz8_1_.js";
+import { t as getChannelPlugin } from "./plugins-C4cYqW07.js";
+import "./accounts-Cv5CUnT4.js";
 import "./logging-5MtSkLpb.js";
-import "./bindings-Hx6KNJeg.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-D8KYuWir.js";
+import "./bindings-DGvp9FdD.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-DGtYwfd7.js";
 import { t as formatDocsLink } from "./links-BDNlbZvM.js";
 import { t as formatHelpExamples } from "./help-format-B3bKmDqF.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BSfSxnxh.js";

package/dist/{dns-cli-CJydclW8.js → dns-cli-DUsjD4em.js}

@@ -2,10 +2,10 @@ import { p as theme } from "./globals-B68W7uN8.js";
 import "./paths-BnKiOk2S.js";
 import { d as defaultRuntime } from "./subsystem-DjdBljTA.js";
 import "./boolean-DtWR5bt3.js";
-import { M as loadConfig } from "./auth-profiles-D_x1_5v_.js";
-import "./agent-scope-CJelRKYY.js";
+import { M as loadConfig } from "./auth-profiles-CyG9VwU_.js";
+import "./agent-scope-CY2-lUIY.js";
 import "./utils-DIzy5B5o.js";
-import "./workspace-BHfqkuYN.js";
+import "./workspace-DzeL98px.js";
 import "./logger-BJMfryJd.js";
 import "./exec-CEAvKSx9.js";
 import "./github-copilot-token-CulJ9J5l.js";
@@ -13,8 +13,8 @@ import "./host-env-security-CJMD0__Z.js";
 import "./version-CGDNfh5C.js";
 import "./env-vars-Dw0EwyGP.js";
 import "./registry-7fg1BnMw.js";
-import "./manifest-registry-Kbw8YPsZ.js";
-import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C1XBcWue.js";
+import "./manifest-registry-CBF8Vfz8.js";
+import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CfP3A6g2.js";
 import { t as formatDocsLink } from "./links-BDNlbZvM.js";
 import { t as renderTable } from "./table-CqULNDay.js";
 import { n as resolveWideAreaDiscoveryDomain, t as getWideAreaZonePath } from "./widearea-dns-CABro6I6.js";

package/dist/{dock-DT8sACcR.js → dock-CoclJnwp.js}

@@ -2,10 +2,10 @@ import { g as normalizeAccountId } from "./session-key-BLprDJYq.js";
 import { c as escapeRegExp, p as normalizeE164 } from "./utils-DIzy5B5o.js";
 import { a as getChatChannelMeta, n as CHAT_CHANNEL_ORDER, p as requireActivePluginRegistry } from "./registry-7fg1BnMw.js";
 import { t as resolveAccountEntry } from "./account-lookup-DndUerpe.js";
-import { C as resolveDiscordAccount, l as resolveTelegramAccount, m as resolveSlackReplyToMode, p as resolveSlackAccount, v as normalizeWhatsAppTarget } from "./plugins-vsjS_m58.js";
-import { i as resolveWhatsAppAccount } from "./accounts-BQHz8_1_.js";
-import { r as resolveIMessageAccount } from "./accounts-B3zSNWIv.js";
-import { i as resolveSignalAccount } from "./accounts-DTfEeXyO.js";
+import { C as resolveDiscordAccount, l as resolveTelegramAccount, m as resolveSlackReplyToMode, p as resolveSlackAccount, v as normalizeWhatsAppTarget } from "./plugins-C4cYqW07.js";
+import { i as resolveWhatsAppAccount } from "./accounts-Cv5CUnT4.js";
+import { r as resolveIMessageAccount } from "./accounts-2NNZ6Hbp.js";
+import { i as resolveSignalAccount } from "./accounts-NHpMJ0aq.js";
 
 //#region src/config/types.tools.ts
 const TOOLS_BY_SENDER_KEY_TYPES = [

package/dist/{docs-cli-BkufgU5Y.js → docs-cli-CpIeooaU.js}

@@ -4,15 +4,15 @@ import { d as defaultRuntime } from "./subsystem-DjdBljTA.js";
 import "./boolean-DtWR5bt3.js";
 import { t as formatCliCommand } from "./command-format-CVXyxgq3.js";
 import "./utils-DIzy5B5o.js";
-import "./workspace-BHfqkuYN.js";
+import "./workspace-DzeL98px.js";
 import "./logger-BJMfryJd.js";
 import { t as runCommandWithTimeout } from "./exec-CEAvKSx9.js";
 import "./host-env-security-CJMD0__Z.js";
 import "./registry-7fg1BnMw.js";
-import "./manifest-registry-Kbw8YPsZ.js";
+import "./manifest-registry-CBF8Vfz8.js";
 import { d as hasBinary } from "./frontmatter-C0E8mspC.js";
-import "./skills-BCgFAMj3.js";
-import "./path-alias-guards-Cg9ZP1NN.js";
+import "./skills-D4S-gyVf.js";
+import "./path-alias-guards-laKq24fx.js";
 import "./redact-Ck5U_y4i.js";
 import "./errors-BJz45-qI.js";
 import { t as formatDocsLink } from "./links-BDNlbZvM.js";

package/dist/{doctor-completion-sKCaOE5l.js → doctor-completion-BIt5xBwC.js}

@@ -1,7 +1,7 @@
 import { S as resolveCliName } from "./paths-BYr-iJJ9.js";
 import { y as resolveOpenClawPackageRoot } from "./workspace-CRdln__H.js";
 import { t as note } from "./note-CLcV1fjx.js";
-import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-B_pSnPVY.js";
+import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-BuLkcc9o.js";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 

package/dist/{doctor-completion-leOuoRMt.js → doctor-completion-BSR7Om4e.js}

@@ -1,7 +1,7 @@
 import { S as resolveCliName } from "./paths-BnKiOk2S.js";
-import { y as resolveOpenClawPackageRoot } from "./workspace-BHfqkuYN.js";
+import { y as resolveOpenClawPackageRoot } from "./workspace-DzeL98px.js";
 import { t as note } from "./note-BuhsMSuP.js";
-import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-BWcHEWr6.js";
+import { a as resolveCompletionCachePath, i as isCompletionInstalled, o as resolveShellFromEnv, r as installCompletion, s as usesSlowDynamicCompletion, t as completionCacheExists } from "./completion-cli-DSxTjQik.js";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 

package/dist/{doctor-config-flow-BrXA2e34.js → doctor-config-flow-DUdUJgfq.js}

@@ -1,27 +1,27 @@
 import { f as resolveLegacyStateDirs, g as resolveStateDir, m as resolveOAuthDir, p as resolveNewStateDir, s as resolveConfigPathCandidate, t as CONFIG_PATH } from "./paths-BnKiOk2S.js";
-import { B as OpenClawSchema, Cn as formatSlackStreamModeMigrationMessage, Dn as resolveSlackNativeStreaming, En as resolveDiscordPreviewStreamMode, Ht as isTrustedSafeBinPath, On as resolveSlackStreamingMode, P as readConfigFileSnapshot, Vt as getTrustedSafeBinDirs, Wt as normalizeTrustedSafeBinDirs, k as migrateLegacyConfig, kn as resolveTelegramPreviewStreamMode, tn as resolveCommandResolutionFromArgv, wn as formatSlackStreamingBooleanMigrationMessage } from "./auth-profiles-D_x1_5v_.js";
+import { B as OpenClawSchema, Cn as formatSlackStreamModeMigrationMessage, Dn as resolveSlackNativeStreaming, En as resolveDiscordPreviewStreamMode, Ht as isTrustedSafeBinPath, On as resolveSlackStreamingMode, P as readConfigFileSnapshot, Vt as getTrustedSafeBinDirs, Wt as normalizeTrustedSafeBinDirs, k as migrateLegacyConfig, kn as resolveTelegramPreviewStreamMode, tn as resolveCommandResolutionFromArgv, wn as formatSlackStreamingBooleanMigrationMessage } from "./auth-profiles-CyG9VwU_.js";
 import { t as formatCliCommand } from "./command-format-CVXyxgq3.js";
-import { d as resolveDefaultAgentId } from "./agent-scope-CJelRKYY.js";
+import { d as resolveDefaultAgentId } from "./agent-scope-CY2-lUIY.js";
 import { c as normalizeAgentId, g as normalizeAccountId, h as DEFAULT_ACCOUNT_ID, n as DEFAULT_MAIN_KEY, r as buildAgentMainSessionKey } from "./session-key-BLprDJYq.js";
 import { g as resolveHomeDir, u as isRecord } from "./utils-DIzy5B5o.js";
 import { l as normalizeChatChannelId } from "./registry-7fg1BnMw.js";
-import { f as parseToolsBySenderTypedKey } from "./dock-DT8sACcR.js";
-import { Q as canonicalizeMainSessionAlias, l as saveSessionStore } from "./sessions-B2mnwD21.js";
-import { l as resolveTelegramAccount, s as listTelegramAccountIds } from "./plugins-vsjS_m58.js";
-import { r as resolveMergedSafeBinProfileFixtures, t as listInterpreterLikeSafeBins } from "./exec-safe-bin-runtime-policy-BP6ImlkB.js";
-import { i as readChannelAllowFromStore } from "./pairing-store-BfzlN-z9.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-DER6qA6X.js";
+import { f as parseToolsBySenderTypedKey } from "./dock-CoclJnwp.js";
+import { Q as canonicalizeMainSessionAlias, l as saveSessionStore } from "./sessions-BXz4gdq6.js";
+import { l as resolveTelegramAccount, s as listTelegramAccountIds } from "./plugins-C4cYqW07.js";
+import { r as resolveMergedSafeBinProfileFixtures, t as listInterpreterLikeSafeBins } from "./exec-safe-bin-runtime-policy-CpMj95vJ.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-rFuiIoGM.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-S_lBQAKI.js";
 import { t as collectProviderDangerousNameMatchingScopes } from "./dangerous-name-matching-CffcsSiI.js";
 import { r as shouldMoveSingleAccountChannelKey, t as fetchTelegramChatId } from "./api-CzfBiQzt.js";
 import { t as note } from "./note-BuhsMSuP.js";
-import { t as isWithinDir } from "./path-safety-__ACzYqx.js";
-import { n as formatConfigIssueLines } from "./issue-format-DF2YB-kZ.js";
+import { t as isWithinDir } from "./path-safety-Cr4WZsHE.js";
+import { n as formatConfigIssueLines } from "./issue-format-D8MobWNt.js";
 import { a as isMattermostMutableAllowEntry, c as normalizeTelegramAllowFromEntry, i as isMSTeamsMutableAllowEntry, n as isGoogleChatMutableAllowEntry, o as isSlackMutableAllowEntry, r as isIrcMutableAllowEntry, s as isNumericTelegramUserId, t as isDiscordMutableAllowEntry } from "./mutable-allowlist-detectors-BaVrnZS3.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";
 import JSON5 from "json5";
-import fs$1 from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/commands/doctor-legacy-config.ts
 function normalizeCompatibilityConfigValues(cfg) {
@@ -2109,7 +2109,7 @@ async function maybeMigrateLegacyConfig() {
 	const targetPath = resolveConfigPathCandidate(process.env, () => home);
 	const targetDir = path.dirname(targetPath);
 	try {
-		await fs$1.access(targetPath);
+		await fsPromises.access(targetPath);
 		return changes;
 	} catch {}
 	const legacyCandidates = [
@@ -2119,14 +2119,14 @@ async function maybeMigrateLegacyConfig() {
 	];
 	let legacyPath = null;
 	for (const candidate of legacyCandidates) try {
-		await fs$1.access(candidate);
+		await fsPromises.access(candidate);
 		legacyPath = candidate;
 		break;
 	} catch {}
 	if (!legacyPath) return changes;
-	await fs$1.mkdir(targetDir, { recursive: true });
+	await fsPromises.mkdir(targetDir, { recursive: true });
 	try {
-		await fs$1.copyFile(legacyPath, targetPath, fs$1.constants.COPYFILE_EXCL);
+		await fsPromises.copyFile(legacyPath, targetPath, fsPromises.constants.COPYFILE_EXCL);
 		changes.push(`Migrated legacy config: ${legacyPath} -> ${targetPath}`);
 	} catch {}
 	return changes;

package/dist/{enable-CinNZxRH.js → enable-BNycqpJc.js}

@@ -1,5 +1,5 @@
 import { l as normalizeChatChannelId } from "./registry-7fg1BnMw.js";
-import { r as ensurePluginAllowlisted } from "./plugin-auto-enable-DER6qA6X.js";
+import { r as ensurePluginAllowlisted } from "./plugin-auto-enable-S_lBQAKI.js";
 
 //#region src/plugins/toggle-config.ts
 function setPluginEnabledInConfig(config, pluginId, enabled) {

package/dist/entry.js

@@ -384,7 +384,7 @@ if (!isMainModule({
 	}
 	function tryHandleRootHelpFastPath(argv) {
 		if (!isRootHelpInvocation(argv)) return false;
-		import("./program-BI6W1Gll.js").then(({ buildProgram }) => {
+		import("./program-3T_oL3TY.js").then(({ buildProgram }) => {
 			buildProgram().outputHelp();
 		}).catch((error) => {
 			console.error("[openclaw] Failed to display help:", error instanceof Error ? error.stack ?? error.message : error);
@@ -403,7 +403,7 @@ if (!isMainModule({
 			applyCliProfileEnv({ profile: parsed.profile });
 			process$1.argv = parsed.argv;
 		}
-		if (!tryHandleRootVersionFastPath(process$1.argv) && !tryHandleRootHelpFastPath(process$1.argv)) import("./run-main-D5C2p24j.js").then(({ runCli }) => runCli(process$1.argv)).catch((error) => {
+		if (!tryHandleRootVersionFastPath(process$1.argv) && !tryHandleRootHelpFastPath(process$1.argv)) import("./run-main-DOntWJzb.js").then(({ runCli }) => runCli(process$1.argv)).catch((error) => {
 			console.error("[openclaw] Failed to start CLI:", error instanceof Error ? error.stack ?? error.message : error);
 			process$1.exitCode = 1;
 		});

package/dist/{exec-approvals-allowlist-B4DS6FIn.js → exec-approvals-allowlist-CFjPSbxI.js}

@@ -1,4 +1,4 @@
-import { $t as matchAllowlist, Gt as validateSafeBinArgv, Ht as isTrustedSafeBinPath, Qt as DEFAULT_SAFE_BINS, Yt as isWindowsPlatform, Zt as splitCommandChain, dn as unwrapKnownShellMultiplexerInvocation, en as resolveAllowlistCandidatePath, gn as SAFE_BIN_PROFILES, in as extractShellWrapperInlineCommand, on as isDispatchWrapperExecutable, qt as analyzeShellCommand, sn as isShellWrapperExecutable, tn as resolveCommandResolutionFromArgv, un as unwrapKnownDispatchWrapperInvocation } from "./auth-profiles-D_x1_5v_.js";
+import { $t as matchAllowlist, Gt as validateSafeBinArgv, Ht as isTrustedSafeBinPath, Qt as DEFAULT_SAFE_BINS, Yt as isWindowsPlatform, Zt as splitCommandChain, dn as unwrapKnownShellMultiplexerInvocation, en as resolveAllowlistCandidatePath, gn as SAFE_BIN_PROFILES, in as extractShellWrapperInlineCommand, on as isDispatchWrapperExecutable, qt as analyzeShellCommand, sn as isShellWrapperExecutable, tn as resolveCommandResolutionFromArgv, un as unwrapKnownDispatchWrapperInvocation } from "./auth-profiles-CyG9VwU_.js";
 import path from "node:path";
 
 //#region src/infra/exec-approvals-allowlist.ts

package/dist/{exec-approvals-cli-Cani2Hjk.js → exec-approvals-cli-D8lFWgJj.js}

@@ -2,10 +2,10 @@ import { f as isRich, p as theme } from "./globals-B68W7uN8.js";
 import "./paths-BnKiOk2S.js";
 import { d as defaultRuntime } from "./subsystem-DjdBljTA.js";
 import "./boolean-DtWR5bt3.js";
-import "./auth-profiles-D_x1_5v_.js";
-import "./agent-scope-CJelRKYY.js";
+import "./auth-profiles-CyG9VwU_.js";
+import "./agent-scope-CY2-lUIY.js";
 import "./utils-DIzy5B5o.js";
-import "./workspace-BHfqkuYN.js";
+import "./workspace-DzeL98px.js";
 import "./logger-BJMfryJd.js";
 import "./exec-CEAvKSx9.js";
 import "./github-copilot-token-CulJ9J5l.js";
@@ -13,26 +13,26 @@ import "./host-env-security-CJMD0__Z.js";
 import "./version-CGDNfh5C.js";
 import "./env-vars-Dw0EwyGP.js";
 import "./registry-7fg1BnMw.js";
-import "./manifest-registry-Kbw8YPsZ.js";
+import "./manifest-registry-CBF8Vfz8.js";
 import "./message-channel-0J6eKf3g.js";
-import "./client-BvL3EdiZ.js";
-import "./call-CzoM7hPS.js";
+import "./client-vUKV2o6h.js";
+import "./call-CmAGfSJE.js";
 import "./pairing-token-DoBZxQnC.js";
-import "./net-BXeYv7Iu.js";
-import "./tailnet-C1XBcWue.js";
-import "./exec-approvals-allowlist-B4DS6FIn.js";
+import "./net-C75G4fup.js";
+import "./tailnet-CfP3A6g2.js";
+import "./exec-approvals-allowlist-CFjPSbxI.js";
 import { n as formatTimeAgo } from "./format-relative-DlCMhQXD.js";
 import { c as readExecApprovalsSnapshot, p as saveExecApprovals } from "./exec-approvals-HRn5F9dF.js";
 import { t as formatDocsLink } from "./links-BDNlbZvM.js";
 import "./progress-CwQKn0ae.js";
-import { n as callGatewayFromCli } from "./gateway-rpc-C7KYwonl.js";
-import "./systemd-HiU4Gzoc.js";
-import "./service-Bjqlh_fF.js";
+import { n as callGatewayFromCli } from "./gateway-rpc-B5Spvviy.js";
+import "./systemd-DRGkJYMb.js";
+import "./service-CFfCS51c.js";
 import { t as renderTable } from "./table-CqULNDay.js";
-import { t as describeUnknownError } from "./shared-_j1K2VJ9.js";
-import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-CnRUZWNJ.js";
+import { t as describeUnknownError } from "./shared-Cl1av01k.js";
+import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-DQa5fiBV.js";
 import JSON5 from "json5";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/cli/exec-approvals-cli.ts
 async function readStdin() {
@@ -329,7 +329,7 @@ function registerExecApprovalsCli(program) {
 			if (!opts.file && !opts.stdin) exitWithError("Provide --file or --stdin.");
 			if (opts.file && opts.stdin) exitWithError("Use either --file or --stdin (not both).");
 			const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
-			const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
+			const raw = opts.stdin ? await readStdin() : await fsPromises.readFile(String(opts.file), "utf8");
 			let file;
 			try {
 				file = JSON5.parse(raw);

package/dist/{exec-safe-bin-runtime-policy-BP6ImlkB.js → exec-safe-bin-runtime-policy-CpMj95vJ.js}

@@ -1,5 +1,5 @@
-import { Ut as listWritableExplicitTrustedSafeBinDirs, Vt as getTrustedSafeBinDirs, Wt as normalizeTrustedSafeBinDirs, _n as normalizeSafeBinProfileFixtures, vn as resolveSafeBinProfiles } from "./auth-profiles-D_x1_5v_.js";
-import { i as resolveSafeBins } from "./exec-approvals-allowlist-B4DS6FIn.js";
+import { Ut as listWritableExplicitTrustedSafeBinDirs, Vt as getTrustedSafeBinDirs, Wt as normalizeTrustedSafeBinDirs, _n as normalizeSafeBinProfileFixtures, vn as resolveSafeBinProfiles } from "./auth-profiles-CyG9VwU_.js";
+import { i as resolveSafeBins } from "./exec-approvals-allowlist-CFjPSbxI.js";
 
 //#region src/infra/exec-safe-bin-runtime-policy.ts
 const INTERPRETER_LIKE_SAFE_BINS = new Set([

package/dist/extensionAPI.js

@@ -10,7 +10,7 @@ import "./env-zky96nK6.js";
 import "./registry-BOq-EU8K.js";
 import "./dock-L5TLZmhV.js";
 import "./tokens-2c_yMaYC.js";
-import { P as resolveAgentTimeoutMs, t as runEmbeddedPiAgent } from "./pi-embedded-Claxav22.js";
+import { P as resolveAgentTimeoutMs, t as runEmbeddedPiAgent } from "./pi-embedded-DdMbqfLM.js";
 import "./plugins-BuQyooWr.js";
 import "./accounts-DYfFud2l.js";
 import "./bindings-Cn3Pwuys.js";

package/dist/{fetch-DC-NMnAU.js → fetch-DOjg912W.js}

@@ -1,8 +1,8 @@
 import { k as resolvePreferredOpenClawTmpDir } from "./globals-B68W7uN8.js";
 import { g as resolveStateDir } from "./paths-BnKiOk2S.js";
-import { u as resolveAgentWorkspaceDir } from "./agent-scope-CJelRKYY.js";
-import { c as detectMime, l as extensionForMime } from "./image-ops-BGTBZMuE.js";
-import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-B62rgaSw.js";
+import { u as resolveAgentWorkspaceDir } from "./agent-scope-CY2-lUIY.js";
+import { c as detectMime, l as extensionForMime } from "./image-ops-B2L37gT8.js";
+import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-Csbz9pui.js";
 import path from "node:path";
 
 //#region src/media/local-roots.ts

package/dist/{fetch-guard-B62rgaSw.js → fetch-guard-Csbz9pui.js}

@@ -1,5 +1,5 @@
 import { i as logWarn } from "./logger-BJMfryJd.js";
-import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-BQIJPH4j.js";
+import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-BoopXu2J.js";
 import { t as bindAbortRelay } from "./fetch-timeout-CZWuvzq4.js";
 import { EnvHttpProxyAgent } from "undici";
 

package/dist/{fs-safe-CJDtl_QU.js → fs-safe-BqJ9egpm.js}

@@ -1,11 +1,11 @@
 import { _ as expandHomePrefix } from "./paths-BnKiOk2S.js";
-import { A as isNotFoundPathError, M as isSymlinkOpenError, T as sameFileIdentity, j as isPathInside, k as hasNodeErrorCode } from "./workspace-BHfqkuYN.js";
+import { A as isNotFoundPathError, M as isSymlinkOpenError, T as sameFileIdentity, j as isPathInside, k as hasNodeErrorCode } from "./workspace-DzeL98px.js";
 import { i as logWarn } from "./logger-BJMfryJd.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-Cg9ZP1NN.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-laKq24fx.js";
 import path from "node:path";
 import os from "node:os";
 import { constants } from "node:fs";
-import fs$1 from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { pipeline } from "node:stream/promises";
 
@@ -25,19 +25,19 @@ const ensureTrailingSep = (value) => value.endsWith(path.sep) ? value : value +
 async function expandRelativePathWithHome(relativePath) {
 	let home = process.env.HOME || process.env.USERPROFILE || os.homedir();
 	try {
-		home = await fs$1.realpath(home);
+		home = await fsPromises.realpath(home);
 	} catch {}
 	return expandHomePrefix(relativePath, { home });
 }
 async function openVerifiedLocalFile(filePath, options) {
 	try {
-		if ((await fs$1.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
+		if ((await fsPromises.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
 	} catch (err) {
 		if (err instanceof SafeOpenError) throw err;
 	}
 	let handle;
 	try {
-		handle = await fs$1.open(filePath, OPEN_READ_FLAGS);
+		handle = await fsPromises.open(filePath, OPEN_READ_FLAGS);
 	} catch (err) {
 		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "file not found");
 		if (isSymlinkOpenError(err)) throw new SafeOpenError("symlink", "symlink open blocked", { cause: err });
@@ -45,13 +45,13 @@ async function openVerifiedLocalFile(filePath, options) {
 		throw err;
 	}
 	try {
-		const [stat, lstat] = await Promise.all([handle.stat(), fs$1.lstat(filePath)]);
+		const [stat, lstat] = await Promise.all([handle.stat(), fsPromises.lstat(filePath)]);
 		if (lstat.isSymbolicLink()) throw new SafeOpenError("symlink", "symlink not allowed");
 		if (!stat.isFile()) throw new SafeOpenError("not-file", "not a file");
 		if (options?.rejectHardlinks && stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during read");
-		const realPath = await fs$1.realpath(filePath);
-		const realStat = await fs$1.stat(realPath);
+		const realPath = await fsPromises.realpath(filePath);
+		const realStat = await fsPromises.stat(realPath);
 		if (options?.rejectHardlinks && realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
 		return {
@@ -69,7 +69,7 @@ async function openVerifiedLocalFile(filePath, options) {
 async function resolvePathWithinRoot(params) {
 	let rootReal;
 	try {
-		rootReal = await fs$1.realpath(params.rootDir);
+		rootReal = await fsPromises.realpath(params.rootDir);
 	} catch (err) {
 		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "root dir not found");
 		throw err;
@@ -170,7 +170,7 @@ function buildAtomicWriteTempPath(targetPath) {
 	return path.join(dir, `.${base}.${process.pid}.${randomUUID()}.tmp`);
 }
 async function writeTempFileForAtomicReplace(params) {
-	const tempHandle = await fs$1.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
+	const tempHandle = await fsPromises.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
 	try {
 		if (typeof params.data === "string") await tempHandle.writeFile(params.data, params.encoding ?? "utf8");
 		else await tempHandle.writeFile(params.data);
@@ -180,7 +180,7 @@ async function writeTempFileForAtomicReplace(params) {
 	}
 }
 async function verifyAtomicWriteResult(params) {
-	const rootWithSep = ensureTrailingSep(await fs$1.realpath(params.rootDir));
+	const rootWithSep = ensureTrailingSep(await fsPromises.realpath(params.rootDir));
 	const opened = await openVerifiedLocalFile(params.targetPath, { rejectHardlinks: true });
 	try {
 		if (!sameFileIdentity(opened.stat, params.expectedStat)) throw new SafeOpenError("path-mismatch", "path changed during write");
@@ -191,13 +191,13 @@ async function verifyAtomicWriteResult(params) {
 }
 async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
 	try {
-		return await fs$1.realpath(ioPath);
+		return await fsPromises.realpath(ioPath);
 	} catch (err) {
 		if (!isNotFoundPathError(err)) throw err;
 	}
 	const fdCandidates = process.platform === "linux" ? [`/proc/self/fd/${handle.fd}`, `/dev/fd/${handle.fd}`] : process.platform === "win32" ? [] : [`/dev/fd/${handle.fd}`];
 	for (const fdPath of fdCandidates) try {
-		return await fs$1.realpath(fdPath);
+		return await fsPromises.realpath(fdPath);
 	} catch {}
 	throw new SafeOpenError("path-mismatch", "unable to resolve opened file path");
 }
@@ -212,10 +212,10 @@ async function openWritableFileWithinRoot(params) {
 	} catch (err) {
 		throw new SafeOpenError("invalid-path", "path alias escape blocked", { cause: err });
 	}
-	if (params.mkdir !== false) await fs$1.mkdir(path.dirname(resolved), { recursive: true });
+	if (params.mkdir !== false) await fsPromises.mkdir(path.dirname(resolved), { recursive: true });
 	let ioPath = resolved;
 	try {
-		const resolvedRealPath = await fs$1.realpath(resolved);
+		const resolvedRealPath = await fsPromises.realpath(resolved);
 		if (!isPathInside(rootWithSep, resolvedRealPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
 		ioPath = resolvedRealPath;
 	} catch (err) {
@@ -227,10 +227,10 @@ async function openWritableFileWithinRoot(params) {
 	let createdForWrite = false;
 	try {
 		try {
-			handle = await fs$1.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
+			handle = await fsPromises.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
 		} catch (err) {
 			if (!isNotFoundPathError(err)) throw err;
-			handle = await fs$1.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
+			handle = await fsPromises.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
 			createdForWrite = true;
 		}
 	} catch (err) {
@@ -244,7 +244,7 @@ async function openWritableFileWithinRoot(params) {
 		if (!stat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
 		if (stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		try {
-			const lstat = await fs$1.lstat(ioPath);
+			const lstat = await fsPromises.lstat(ioPath);
 			if (lstat.isSymbolicLink() || !lstat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
 			if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during write");
 		} catch (err) {
@@ -252,7 +252,7 @@ async function openWritableFileWithinRoot(params) {
 		}
 		const realPath = await resolveOpenedFileRealPathForHandle(handle, ioPath);
 		openedRealPath = realPath;
-		const realStat = await fs$1.stat(realPath);
+		const realStat = await fsPromises.stat(realPath);
 		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
 		if (realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!isPathInside(rootWithSep, realPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
@@ -267,7 +267,7 @@ async function openWritableFileWithinRoot(params) {
 		const cleanupCreatedPath = createdForWrite && err instanceof SafeOpenError;
 		const cleanupPath = openedRealPath ?? ioPath;
 		await handle.close().catch(() => {});
-		if (cleanupCreatedPath) await fs$1.rm(cleanupPath, { force: true }).catch(() => {});
+		if (cleanupCreatedPath) await fsPromises.rm(cleanupPath, { force: true }).catch(() => {});
 		throw err;
 	}
 }
@@ -290,7 +290,7 @@ async function writeFileWithinRoot(params) {
 			encoding: params.encoding,
 			mode: targetMode || 384
 		});
-		await fs$1.rename(tempPath, destinationPath);
+		await fsPromises.rename(tempPath, destinationPath);
 		tempPath = null;
 		try {
 			await verifyAtomicWriteResult({
@@ -303,7 +303,7 @@ async function writeFileWithinRoot(params) {
 			throw err;
 		}
 	} finally {
-		if (tempPath) await fs$1.rm(tempPath, { force: true }).catch(() => {});
+		if (tempPath) await fsPromises.rm(tempPath, { force: true }).catch(() => {});
 	}
 }
 async function copyFileWithinRoot(params) {
@@ -331,7 +331,7 @@ async function copyFileWithinRoot(params) {
 		});
 		await pipeline(sourceStream, targetStream);
 	} catch (err) {
-		if (target?.createdForWrite) await fs$1.rm(target.openedRealPath, { force: true }).catch(() => {});
+		if (target?.createdForWrite) await fsPromises.rm(target.openedRealPath, { force: true }).catch(() => {});
 		throw err;
 	} finally {
 		if (!sourceClosedByStream) await source.handle.close().catch(() => {});