@gguf/claw 2026.2.1 → 2026.2.2

package/dist/index.js

@@ -12,11 +12,11 @@ import { deriveSessionKey, loadSessionStore, resolveSessionKey, resolveStorePath
 import { ensureBinary } from "./infra/binaries.js";
 import { loadDotEnv } from "./infra/dotenv.js";
 import { normalizeEnv } from "./infra/env.js";
+import { formatUncaughtError } from "./infra/errors.js";
 import { isMainModule } from "./infra/is-main.js";
 import { ensureOpenClawCliOnPath } from "./infra/path-env.js";
 import { describePortOwner, ensurePortAvailable, handlePortError, PortInUseError, } from "./infra/ports.js";
 import { assertSupportedRuntime } from "./infra/runtime-guard.js";
-import { formatUncaughtError } from "./infra/errors.js";
 import { installUnhandledRejectionHandler } from "./infra/unhandled-rejections.js";
 import { enableConsoleCapture } from "./logging.js";
 import { runCommandWithTimeout, runExec } from "./process/exec.js";

package/dist/infra/archive.js

@@ -1,7 +1,7 @@
+import JSZip from "jszip";
 import fs from "node:fs/promises";
 import path from "node:path";
 import * as tar from "tar";
-import JSZip from "jszip";
 const TAR_SUFFIXES = [".tgz", ".tar.gz", ".tar"];
 export function resolveArchiveKind(filePath) {
     const lower = filePath.toLowerCase();

package/dist/infra/dotenv.js

@@ -1,6 +1,6 @@
+import dotenv from "dotenv";
 import fs from "node:fs";
 import path from "node:path";
-import dotenv from "dotenv";
 import { resolveConfigDir } from "../utils.js";
 export function loadDotEnv(opts) {
     const quiet = opts?.quiet ?? true;

package/dist/infra/exec-approvals.js

@@ -435,6 +435,10 @@ export function matchAllowlist(entries, resolution) {
     return null;
 }
 const DISALLOWED_PIPELINE_TOKENS = new Set([">", "<", "`", "\n", "\r", "(", ")"]);
+const DOUBLE_QUOTE_ESCAPES = new Set(["\\", '"', "$", "`", "\n", "\r"]);
+function isDoubleQuoteEscape(next) {
+    return Boolean(next && DOUBLE_QUOTE_ESCAPES.has(next));
+}
 /**
  * Iterates through a command string while respecting shell quoting rules.
  * The callback receives each character and the next character, and returns an action:
@@ -478,6 +482,21 @@ function iterateQuoteAware(command, onChar) {
             continue;
         }
         if (inDouble) {
+            if (ch === "\\" && isDoubleQuoteEscape(next)) {
+                buf += ch;
+                buf += next;
+                i += 1;
+                continue;
+            }
+            if (ch === "$" && next === "(") {
+                return { ok: false, reason: "unsupported shell token: $()" };
+            }
+            if (ch === "`") {
+                return { ok: false, reason: "unsupported shell token: `" };
+            }
+            if (ch === "\n" || ch === "\r") {
+                return { ok: false, reason: "unsupported shell token: newline" };
+            }
             if (ch === '"') {
                 inDouble = false;
             }
@@ -584,6 +603,12 @@ function tokenizeShellSegment(segment) {
             continue;
         }
         if (inDouble) {
+            const next = segment[i + 1];
+            if (ch === "\\" && isDoubleQuoteEscape(next)) {
+                buf += next;
+                i += 1;
+                continue;
+            }
             if (ch === '"') {
                 inDouble = false;
             }
@@ -841,6 +866,7 @@ function splitCommandChain(command) {
     };
     for (let i = 0; i < command.length; i += 1) {
         const ch = command[i];
+        const next = command[i + 1];
         if (escaped) {
             buf += ch;
             escaped = false;
@@ -859,6 +885,12 @@ function splitCommandChain(command) {
             continue;
         }
         if (inDouble) {
+            if (ch === "\\" && isDoubleQuoteEscape(next)) {
+                buf += ch;
+                buf += next;
+                i += 1;
+                continue;
+            }
             if (ch === '"') {
                 inDouble = false;
             }

package/dist/infra/gateway-lock.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import fs from "node:fs/promises";
 import fsSync from "node:fs";
+import fs from "node:fs/promises";
 import path from "node:path";
 import { resolveConfigPath, resolveGatewayLockDir, resolveStateDir } from "../config/paths.js";
 const DEFAULT_TIMEOUT_MS = 5000;

package/dist/infra/heartbeat-runner.d.ts

@@ -1,9 +1,9 @@
 import type { ChannelHeartbeatDeps } from "../channels/plugins/types.js";
 import type { OpenClawConfig } from "../config/config.js";
 import type { AgentDefaultsConfig } from "../config/types.agent-defaults.js";
+import type { OutboundSendDeps } from "./outbound/deliver.js";
 import { type RuntimeEnv } from "../runtime.js";
 import { type HeartbeatRunResult } from "./heartbeat-wake.js";
-import type { OutboundSendDeps } from "./outbound/deliver.js";
 type HeartbeatDeps = OutboundSendDeps & ChannelHeartbeatDeps & {
     runtime?: RuntimeEnv;
     getQueueSize?: (lane?: string) => number;

package/dist/infra/heartbeat-runner.js

@@ -5,8 +5,8 @@ import { resolveUserTimezone } from "../agents/date-time.js";
 import { resolveEffectiveMessagesConfig } from "../agents/identity.js";
 import { DEFAULT_HEARTBEAT_FILENAME } from "../agents/workspace.js";
 import { DEFAULT_HEARTBEAT_ACK_MAX_CHARS, DEFAULT_HEARTBEAT_EVERY, isHeartbeatContentEffectivelyEmpty, resolveHeartbeatPrompt as resolveHeartbeatPromptText, stripHeartbeatToken, } from "../auto-reply/heartbeat.js";
-import { HEARTBEAT_TOKEN } from "../auto-reply/tokens.js";
 import { getReplyFromConfig } from "../auto-reply/reply.js";
+import { HEARTBEAT_TOKEN } from "../auto-reply/tokens.js";
 import { getChannelPlugin } from "../channels/plugins/index.js";
 import { parseDurationMs } from "../cli/parse-duration.js";
 import { loadConfig } from "../config/config.js";
@@ -15,8 +15,8 @@ import { formatErrorMessage } from "../infra/errors.js";
 import { peekSystemEvents } from "../infra/system-events.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { getQueueSize } from "../process/command-queue.js";
-import { defaultRuntime } from "../runtime.js";
 import { normalizeAgentId, toAgentStoreSessionKey } from "../routing/session-key.js";
+import { defaultRuntime } from "../runtime.js";
 import { emitHeartbeatEvent, resolveIndicatorType } from "./heartbeat-events.js";
 import { resolveHeartbeatVisibility } from "./heartbeat-visibility.js";
 import { requestHeartbeatNow, setHeartbeatWakeHandler, } from "./heartbeat-wake.js";

package/dist/infra/net/fetch-guard.d.ts

@@ -0,0 +1,20 @@
+import { type LookupFn, type SsrFPolicy } from "./ssrf.js";
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export type GuardedFetchOptions = {
+    url: string;
+    fetchImpl?: FetchLike;
+    init?: RequestInit;
+    maxRedirects?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    policy?: SsrFPolicy;
+    lookupFn?: LookupFn;
+    pinDns?: boolean;
+};
+export type GuardedFetchResult = {
+    response: Response;
+    finalUrl: string;
+    release: () => Promise<void>;
+};
+export declare function fetchWithSsrFGuard(params: GuardedFetchOptions): Promise<GuardedFetchResult>;
+export {};

package/dist/infra/net/fetch-guard.js

@@ -0,0 +1,122 @@
+import { closeDispatcher, createPinnedDispatcher, resolvePinnedHostname, resolvePinnedHostnameWithPolicy, } from "./ssrf.js";
+const DEFAULT_MAX_REDIRECTS = 3;
+function isRedirectStatus(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function buildAbortSignal(params) {
+    const { timeoutMs, signal } = params;
+    if (!timeoutMs && !signal) {
+        return { signal: undefined, cleanup: () => { } };
+    }
+    if (!timeoutMs) {
+        return { signal, cleanup: () => { } };
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    const onAbort = () => controller.abort();
+    if (signal) {
+        if (signal.aborted) {
+            controller.abort();
+        }
+        else {
+            signal.addEventListener("abort", onAbort, { once: true });
+        }
+    }
+    const cleanup = () => {
+        clearTimeout(timeoutId);
+        if (signal) {
+            signal.removeEventListener("abort", onAbort);
+        }
+    };
+    return { signal: controller.signal, cleanup };
+}
+export async function fetchWithSsrFGuard(params) {
+    const fetcher = params.fetchImpl ?? globalThis.fetch;
+    if (!fetcher) {
+        throw new Error("fetch is not available");
+    }
+    const maxRedirects = typeof params.maxRedirects === "number" && Number.isFinite(params.maxRedirects)
+        ? Math.max(0, Math.floor(params.maxRedirects))
+        : DEFAULT_MAX_REDIRECTS;
+    const { signal, cleanup } = buildAbortSignal({
+        timeoutMs: params.timeoutMs,
+        signal: params.signal,
+    });
+    let released = false;
+    const release = async (dispatcher) => {
+        if (released) {
+            return;
+        }
+        released = true;
+        cleanup();
+        await closeDispatcher(dispatcher ?? undefined);
+    };
+    const visited = new Set();
+    let currentUrl = params.url;
+    let redirectCount = 0;
+    while (true) {
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(currentUrl);
+        }
+        catch {
+            await release();
+            throw new Error("Invalid URL: must be http or https");
+        }
+        if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+            await release();
+            throw new Error("Invalid URL: must be http or https");
+        }
+        let dispatcher = null;
+        try {
+            const usePolicy = Boolean(params.policy?.allowPrivateNetwork || params.policy?.allowedHostnames?.length);
+            const pinned = usePolicy
+                ? await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+                    lookupFn: params.lookupFn,
+                    policy: params.policy,
+                })
+                : await resolvePinnedHostname(parsedUrl.hostname, params.lookupFn);
+            if (params.pinDns !== false) {
+                dispatcher = createPinnedDispatcher(pinned);
+            }
+            const init = {
+                ...(params.init ? { ...params.init } : {}),
+                redirect: "manual",
+                ...(dispatcher ? { dispatcher } : {}),
+                ...(signal ? { signal } : {}),
+            };
+            const response = await fetcher(parsedUrl.toString(), init);
+            if (isRedirectStatus(response.status)) {
+                const location = response.headers.get("location");
+                if (!location) {
+                    await release(dispatcher);
+                    throw new Error(`Redirect missing location header (${response.status})`);
+                }
+                redirectCount += 1;
+                if (redirectCount > maxRedirects) {
+                    await release(dispatcher);
+                    throw new Error(`Too many redirects (limit: ${maxRedirects})`);
+                }
+                const nextUrl = new URL(location, parsedUrl).toString();
+                if (visited.has(nextUrl)) {
+                    await release(dispatcher);
+                    throw new Error("Redirect loop detected");
+                }
+                visited.add(nextUrl);
+                void response.body?.cancel();
+                await closeDispatcher(dispatcher);
+                currentUrl = nextUrl;
+                continue;
+            }
+            return {
+                response,
+                finalUrl: currentUrl,
+                release: async () => release(dispatcher),
+            };
+        }
+        catch (err) {
+            await release(dispatcher);
+            throw err;
+        }
+    }
+}

package/dist/infra/net/ssrf.d.ts

@@ -1,10 +1,14 @@
-import { lookup as dnsLookup } from "node:dns/promises";
 import { lookup as dnsLookupCb } from "node:dns";
+import { lookup as dnsLookup } from "node:dns/promises";
 import { type Dispatcher } from "undici";
 export declare class SsrFBlockedError extends Error {
     constructor(message: string);
 }
-type LookupFn = typeof dnsLookup;
+export type LookupFn = typeof dnsLookup;
+export type SsrFPolicy = {
+    allowPrivateNetwork?: boolean;
+    allowedHostnames?: string[];
+};
 export declare function isPrivateIpAddress(address: string): boolean;
 export declare function isBlockedHostname(hostname: string): boolean;
 export declare function createPinnedLookup(params: {
@@ -17,8 +21,11 @@ export type PinnedHostname = {
     addresses: string[];
     lookup: typeof dnsLookupCb;
 };
+export declare function resolvePinnedHostnameWithPolicy(hostname: string, params?: {
+    lookupFn?: LookupFn;
+    policy?: SsrFPolicy;
+}): Promise<PinnedHostname>;
 export declare function resolvePinnedHostname(hostname: string, lookupFn?: LookupFn): Promise<PinnedHostname>;
 export declare function createPinnedDispatcher(pinned: PinnedHostname): Dispatcher;
 export declare function closeDispatcher(dispatcher?: Dispatcher | null): Promise<void>;
 export declare function assertPublicHostname(hostname: string, lookupFn?: LookupFn): Promise<void>;
-export {};

package/dist/infra/net/ssrf.js

@@ -1,5 +1,5 @@
-import { lookup as dnsLookup } from "node:dns/promises";
 import { lookup as dnsLookupCb } from "node:dns";
+import { lookup as dnsLookup } from "node:dns/promises";
 import { Agent } from "undici";
 export class SsrFBlockedError extends Error {
     constructor(message) {
@@ -16,6 +16,12 @@ function normalizeHostname(hostname) {
     }
     return normalized;
 }
+function normalizeHostnameSet(values) {
+    if (!values || values.length === 0) {
+        return new Set();
+    }
+    return new Set(values.map((value) => normalizeHostname(value)).filter(Boolean));
+}
 function parseIpv4(address) {
     const parts = address.split(".");
     if (parts.length !== 4) {
@@ -158,24 +164,32 @@ export function createPinnedLookup(params) {
         cb(null, chosen.address, chosen.family);
     });
 }
-export async function resolvePinnedHostname(hostname, lookupFn = dnsLookup) {
+export async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
     const normalized = normalizeHostname(hostname);
     if (!normalized) {
         throw new Error("Invalid hostname");
     }
-    if (isBlockedHostname(normalized)) {
-        throw new SsrFBlockedError(`Blocked hostname: ${hostname}`);
-    }
-    if (isPrivateIpAddress(normalized)) {
-        throw new SsrFBlockedError("Blocked: private/internal IP address");
+    const allowPrivateNetwork = Boolean(params.policy?.allowPrivateNetwork);
+    const allowedHostnames = normalizeHostnameSet(params.policy?.allowedHostnames);
+    const isExplicitAllowed = allowedHostnames.has(normalized);
+    if (!allowPrivateNetwork && !isExplicitAllowed) {
+        if (isBlockedHostname(normalized)) {
+            throw new SsrFBlockedError(`Blocked hostname: ${hostname}`);
+        }
+        if (isPrivateIpAddress(normalized)) {
+            throw new SsrFBlockedError("Blocked: private/internal IP address");
+        }
     }
+    const lookupFn = params.lookupFn ?? dnsLookup;
     const results = await lookupFn(normalized, { all: true });
     if (results.length === 0) {
         throw new Error(`Unable to resolve hostname: ${hostname}`);
     }
-    for (const entry of results) {
-        if (isPrivateIpAddress(entry.address)) {
-            throw new SsrFBlockedError("Blocked: resolves to private/internal IP address");
+    if (!allowPrivateNetwork && !isExplicitAllowed) {
+        for (const entry of results) {
+            if (isPrivateIpAddress(entry.address)) {
+                throw new SsrFBlockedError("Blocked: resolves to private/internal IP address");
+            }
         }
     }
     const addresses = Array.from(new Set(results.map((entry) => entry.address)));
@@ -188,6 +202,9 @@ export async function resolvePinnedHostname(hostname, lookupFn = dnsLookup) {
         lookup: createPinnedLookup({ hostname: normalized, addresses }),
     };
 }
+export async function resolvePinnedHostname(hostname, lookupFn = dnsLookup) {
+    return await resolvePinnedHostnameWithPolicy(hostname, { lookupFn });
+}
 export function createPinnedDispatcher(pinned) {
     return new Agent({
         connect: {

package/dist/infra/outbound/agent-delivery.d.ts

@@ -1,9 +1,9 @@
 import type { ChannelOutboundTargetMode } from "../../channels/plugins/types.js";
+import type { OpenClawConfig } from "../../config/config.js";
 import type { SessionEntry } from "../../config/sessions.js";
+import type { OutboundTargetResolution } from "./targets.js";
 import { type GatewayMessageChannel } from "../../utils/message-channel.js";
 import { type SessionDeliveryTarget } from "./targets.js";
-import type { OpenClawConfig } from "../../config/config.js";
-import type { OutboundTargetResolution } from "./targets.js";
 export type AgentDeliveryPlan = {
     baseDelivery: SessionDeliveryTarget;
     resolvedChannel: GatewayMessageChannel;

package/dist/infra/outbound/deliver.d.ts

@@ -2,12 +2,12 @@ import type { ReplyPayload } from "../../auto-reply/types.js";
 import type { OpenClawConfig } from "../../config/config.js";
 import type { sendMessageDiscord } from "../../discord/send.js";
 import type { sendMessageIMessage } from "../../imessage/send.js";
-import { sendMessageSignal } from "../../signal/send.js";
 import type { sendMessageSlack } from "../../slack/send.js";
 import type { sendMessageTelegram } from "../../telegram/send.js";
 import type { sendMessageWhatsApp } from "../../web/outbound.js";
 import type { NormalizedOutboundPayload } from "./payloads.js";
 import type { OutboundChannel } from "./targets.js";
+import { sendMessageSignal } from "../../signal/send.js";
 export type { NormalizedOutboundPayload } from "./payloads.js";
 export { normalizeOutboundPayloads } from "./payloads.js";
 type SendMatrixMessage = (to: string, text: string, opts?: {

package/dist/infra/outbound/deliver.js

@@ -2,9 +2,9 @@ import { chunkByParagraph, chunkMarkdownTextWithMode, resolveChunkMode, resolveT
 import { resolveChannelMediaMaxBytes } from "../../channels/plugins/media-limits.js";
 import { loadChannelOutboundAdapter } from "../../channels/plugins/outbound/load.js";
 import { resolveMarkdownTableMode } from "../../config/markdown-tables.js";
+import { appendAssistantMessageToSessionTranscript, resolveMirroredTranscriptText, } from "../../config/sessions.js";
 import { markdownToSignalTextChunks } from "../../signal/format.js";
 import { sendMessageSignal } from "../../signal/send.js";
-import { appendAssistantMessageToSessionTranscript, resolveMirroredTranscriptText, } from "../../config/sessions.js";
 import { normalizeReplyPayloadsForDelivery } from "./payloads.js";
 export { normalizeOutboundPayloads } from "./payloads.js";
 function throwIfAborted(abortSignal) {

package/dist/infra/outbound/message-action-runner.d.ts

@@ -1,9 +1,9 @@
 import type { AgentToolResult } from "@mariozechner/pi-agent-core";
 import type { ChannelId, ChannelMessageActionName, ChannelThreadingToolContext } from "../../channels/plugins/types.js";
 import type { OpenClawConfig } from "../../config/config.js";
-import { type GatewayClientMode, type GatewayClientName } from "../../utils/message-channel.js";
 import type { OutboundSendDeps } from "./deliver.js";
 import type { MessagePollResult, MessageSendResult } from "./message.js";
+import { type GatewayClientMode, type GatewayClientName } from "../../utils/message-channel.js";
 export type MessageActionRunnerGateway = {
     url?: string;
     token?: string;

package/dist/infra/outbound/message-action-runner.js

@@ -1,20 +1,20 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { readNumberParam, readStringArrayParam, readStringParam, } from "../../agents/tools/common.js";
 import { resolveSessionAgentId } from "../../agents/agent-scope.js";
+import { readNumberParam, readStringArrayParam, readStringParam, } from "../../agents/tools/common.js";
 import { parseReplyDirectives } from "../../auto-reply/reply/reply-directives.js";
 import { dispatchChannelMessageAction } from "../../channels/plugins/message-actions.js";
+import { extensionForMime } from "../../media/mime.js";
+import { parseSlackTarget } from "../../slack/targets.js";
 import { isDeliverableMessageChannel, normalizeMessageChannel, } from "../../utils/message-channel.js";
+import { loadWebMedia } from "../../web/media.js";
 import { listConfiguredMessageChannels, resolveMessageChannelSelection, } from "./channel-selection.js";
 import { applyTargetToParams } from "./channel-target.js";
-import { ensureOutboundSessionEntry, resolveOutboundSessionRoute } from "./outbound-session.js";
+import { actionHasTarget, actionRequiresTarget } from "./message-action-spec.js";
 import { applyCrossContextDecoration, buildCrossContextDecoration, enforceCrossContextPolicy, shouldApplyCrossContextMarker, } from "./outbound-policy.js";
 import { executePollAction, executeSendAction } from "./outbound-send-service.js";
-import { actionHasTarget, actionRequiresTarget } from "./message-action-spec.js";
+import { ensureOutboundSessionEntry, resolveOutboundSessionRoute } from "./outbound-session.js";
 import { resolveChannelTarget } from "./target-resolver.js";
-import { loadWebMedia } from "../../web/media.js";
-import { extensionForMime } from "../../media/mime.js";
-import { parseSlackTarget } from "../../slack/targets.js";
 export function getToolResult(result) {
     return "toolResult" in result ? result.toolResult : undefined;
 }

package/dist/infra/outbound/outbound-policy.js

@@ -1,5 +1,5 @@
-import { normalizeTargetForProvider } from "./target-normalization.js";
 import { getChannelMessageAdapter } from "./channel-adapters.js";
+import { normalizeTargetForProvider } from "./target-normalization.js";
 import { formatTargetDisplay, lookupDirectoryDisplay } from "./target-resolver.js";
 const CONTEXT_GUARDED_ACTIONS = new Set([
     "send",

package/dist/infra/outbound/outbound-session.d.ts

@@ -1,7 +1,7 @@
 import type { ChannelId } from "../../channels/plugins/types.js";
 import type { OpenClawConfig } from "../../config/config.js";
-import { type RoutePeer } from "../../routing/resolve-route.js";
 import type { ResolvedMessagingTarget } from "./target-resolver.js";
+import { type RoutePeer } from "../../routing/resolve-route.js";
 export type OutboundSessionRoute = {
     sessionKey: string;
     baseSessionKey: string;

package/dist/infra/outbound/outbound-session.js

@@ -4,10 +4,10 @@ import { parseDiscordTarget } from "../../discord/targets.js";
 import { parseIMessageTarget, normalizeIMessageHandle } from "../../imessage/targets.js";
 import { buildAgentSessionKey, } from "../../routing/resolve-route.js";
 import { resolveThreadSessionKeys } from "../../routing/session-key.js";
+import { resolveSignalPeerId, resolveSignalRecipient, resolveSignalSender, } from "../../signal/identity.js";
 import { resolveSlackAccount } from "../../slack/accounts.js";
 import { createSlackWebClient } from "../../slack/client.js";
 import { normalizeAllowListLower } from "../../slack/monitor/allow-list.js";
-import { resolveSignalPeerId, resolveSignalRecipient, resolveSignalSender, } from "../../signal/identity.js";
 import { parseSlackTarget } from "../../slack/targets.js";
 import { buildTelegramGroupPeerId } from "../../telegram/bot/helpers.js";
 import { resolveTelegramTargetChatType } from "../../telegram/inline-buttons.js";

package/dist/infra/outbound/target-resolver.js

@@ -1,8 +1,8 @@
 import { getChannelPlugin } from "../../channels/plugins/index.js";
 import { defaultRuntime } from "../../runtime.js";
 import { buildDirectoryCacheKey, DirectoryCache } from "./directory-cache.js";
-import { buildTargetResolverSignature, normalizeChannelTargetInput, normalizeTargetForProvider, } from "./target-normalization.js";
 import { ambiguousTargetError, unknownTargetError } from "./target-errors.js";
+import { buildTargetResolverSignature, normalizeChannelTargetInput, normalizeTargetForProvider, } from "./target-normalization.js";
 export async function resolveChannelTarget(params) {
     return resolveMessagingTarget(params);
 }

package/dist/infra/path-env.js

@@ -1,8 +1,8 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { isTruthyEnvValue } from "./env.js";
 import { resolveBrewPathDirs } from "./brew.js";
+import { isTruthyEnvValue } from "./env.js";
 function isExecutable(filePath) {
     try {
         fs.accessSync(filePath, fs.constants.X_OK);

package/dist/infra/ports-inspect.js

@@ -1,7 +1,7 @@
 import net from "node:net";
 import { runCommandWithTimeout } from "../process/exec.js";
-import { resolveLsofCommand } from "./ports-lsof.js";
 import { buildPortHints } from "./ports-format.js";
+import { resolveLsofCommand } from "./ports-lsof.js";
 function isErrno(err) {
     return Boolean(err && typeof err === "object" && "code" in err);
 }

package/dist/infra/provider-usage.load.d.ts

@@ -1,5 +1,5 @@
-import { type ProviderAuth } from "./provider-usage.auth.js";
 import type { UsageProviderId, UsageSummary } from "./provider-usage.types.js";
+import { type ProviderAuth } from "./provider-usage.auth.js";
 type UsageSummaryOptions = {
     now?: number;
     timeoutMs?: number;

package/dist/infra/provider-usage.load.js

@@ -1,7 +1,7 @@
+import { resolveFetch } from "./fetch.js";
 import { resolveProviderAuths } from "./provider-usage.auth.js";
 import { fetchAntigravityUsage, fetchClaudeUsage, fetchCodexUsage, fetchCopilotUsage, fetchGeminiUsage, fetchMinimaxUsage, fetchZaiUsage, } from "./provider-usage.fetch.js";
 import { DEFAULT_TIMEOUT_MS, ignoredErrors, PROVIDER_LABELS, usageProviders, withTimeout, } from "./provider-usage.shared.js";
-import { resolveFetch } from "./fetch.js";
 export async function loadProviderUsageSummary(opts = {}) {
     const now = opts.now ?? Date.now();
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;

package/dist/infra/retry.js

@@ -1,10 +1,10 @@
+import { sleep } from "../utils.js";
 const DEFAULT_RETRY_CONFIG = {
     attempts: 3,
     minDelayMs: 300,
     maxDelayMs: 30_000,
     jitter: 0,
 };
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const asFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
 const clampNumber = (value, fallback, min, max) => {
     const next = asFiniteNumber(value);

package/dist/infra/skills-remote.js

@@ -1,8 +1,8 @@
-import { loadWorkspaceSkillEntries } from "../agents/skills.js";
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
-import { listNodePairing, updatePairedNodeMetadata } from "./node-pairing.js";
-import { createSubsystemLogger } from "../logging/subsystem.js";
+import { loadWorkspaceSkillEntries } from "../agents/skills.js";
 import { bumpSkillsSnapshotVersion } from "../agents/skills/refresh.js";
+import { createSubsystemLogger } from "../logging/subsystem.js";
+import { listNodePairing, updatePairedNodeMetadata } from "./node-pairing.js";
 const log = createSubsystemLogger("gateway/skills-remote");
 const remoteNodes = new Map();
 let remoteRegistry = null;

package/dist/infra/state-migrations.fs.js

@@ -1,5 +1,5 @@
-import fs from "node:fs";
 import JSON5 from "json5";
+import fs from "node:fs";
 export function safeReadDir(dir) {
     try {
         return fs.readdirSync(dir, { withFileTypes: true });

package/dist/infra/state-migrations.js

@@ -4,9 +4,9 @@ import path from "node:path";
 import { resolveDefaultAgentId } from "../agents/agent-scope.js";
 import { resolveLegacyStateDirs, resolveNewStateDir, resolveOAuthDir, resolveStateDir, } from "../config/paths.js";
 import { saveSessionStore } from "../config/sessions.js";
+import { canonicalizeMainSessionAlias } from "../config/sessions/main-session.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { buildAgentMainSessionKey, DEFAULT_ACCOUNT_ID, DEFAULT_MAIN_KEY, normalizeAgentId, } from "../routing/session-key.js";
-import { canonicalizeMainSessionAlias } from "../config/sessions/main-session.js";
 import { ensureDir, existsDir, fileExists, isLegacyWhatsAppAuthFile, readSessionStoreJson5, safeReadDir, } from "./state-migrations.fs.js";
 let autoMigrateChecked = false;
 let autoMigrateStateDirChecked = false;

package/dist/infra/tailscale.js

@@ -1,10 +1,10 @@
 import { existsSync } from "node:fs";
+import { formatCliCommand } from "../cli/command-format.js";
 import { promptYesNo } from "../cli/prompt.js";
 import { danger, info, logVerbose, shouldLogVerbose, warn } from "../globals.js";
 import { runExec } from "../process/exec.js";
 import { defaultRuntime } from "../runtime.js";
 import { colorize, isRich, theme } from "../terminal/theme.js";
-import { formatCliCommand } from "../cli/command-format.js";
 import { ensureBinary } from "./binaries.js";
 function parsePossiblyNoisyJsonObject(stdout) {
     const trimmed = stdout.trim();

package/dist/infra/tls/gateway.js

@@ -103,7 +103,7 @@ export async function loadGatewayTlsRuntime(cfg, log) {
                 cert,
                 key,
                 ca,
-                minVersion: "TLSv1.2",
+                minVersion: "TLSv1.3",
             },
         };
     }

package/dist/infra/update-global.d.ts

@@ -13,3 +13,9 @@ export declare function resolveGlobalPackageRoot(manager: GlobalInstallManager,
 export declare function detectGlobalInstallManagerForRoot(runCommand: CommandRunner, pkgRoot: string, timeoutMs: number): Promise<GlobalInstallManager | null>;
 export declare function detectGlobalInstallManagerByPresence(runCommand: CommandRunner, timeoutMs: number): Promise<GlobalInstallManager | null>;
 export declare function globalInstallArgs(manager: GlobalInstallManager, spec: string): string[];
+export declare function cleanupGlobalRenameDirs(params: {
+    globalRoot: string;
+    packageName: string;
+}): Promise<{
+    removed: string[];
+}>;