@gguf/claw 2026.2.4 → 2026.2.5

package/dist/{image-BYmtfVH8.js → image-CgBndiQy.js}

@@ -1,9 +1,10 @@
-import { P as shortenHomeInString } from "./exec-B7WKla_0.js";
-import { H as resolveOpenClawAgentDir, f as normalizeProviders, g as getApiKeyForModel, h as resolveImplicitProviders, m as resolveImplicitCopilotProvider, p as resolveImplicitBedrockProvider, v as requireApiKey } from "./model-selection-Cs1y6OBv.js";
-import { z as sanitizeUserFacingText } from "./pi-embedded-helpers-DiK8Qn1l.js";
-import { t as loadConfig } from "./config-CGsoho7J.js";
-import { i as discoverModels, r as discoverAuthStorage } from "./pi-model-discovery-CnK2Dol8.js";
-import { n as redactToolDetail } from "./redact-BR0IM00e.js";
+import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
+import { P as shortenHomeInString } from "./exec-BMnoMcZW.js";
+import { B as resolveOpenClawAgentDir, _ as getApiKeyForModel, g as resolveImplicitProviders, h as resolveImplicitCopilotProvider, m as resolveImplicitBedrockProvider, p as normalizeProviders, y as requireApiKey } from "./model-selection-mzTqrNoj.js";
+import { V as sanitizeUserFacingText } from "./pi-embedded-helpers-BxqZh6U7.js";
+import { t as loadConfig } from "./config-CG73z4h6.js";
+import { n as discoverModels, t as discoverAuthStorage } from "./pi-model-discovery-EhM2JAQo.js";
+import { n as redactToolDetail } from "./redact-BIMJ3ntQ.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { complete } from "@mariozechner/pi-ai";
@@ -1367,6 +1368,7 @@ function resolveProviderVisionModelFromConfig(params) {
 
 //#endregion
 //#region src/media-understanding/providers/image.ts
+var image_exports = /* @__PURE__ */ __exportAll({ describeImageWithModel: () => describeImageWithModel });
 async function describeImageWithModel(params) {
 	await ensureOpenClawModelsJson(params.cfg, params.agentDir);
 	const authStorage = discoverAuthStorage(params.agentDir);
@@ -1416,4 +1418,4 @@ async function describeImageWithModel(params) {
 }
 
 //#endregion
-export { resolveToolDisplay as _, resolveProviderVisionModelFromConfig as a, extractAssistantThinking as c, formatReasoningMessage as d, inferToolMetaFromArgs as f, stripThinkingTagsFromText as g, stripMinimaxToolCallXml as h, decodeDataUrl as i, extractThinkingFromTaggedStream as l, stripDowngradedToolCallText as m, coerceImageAssistantText as n, minimaxUnderstandImage as o, promoteThinkingTagsToBlocks as p, coerceImageModelConfig as r, extractAssistantText as s, describeImageWithModel as t, extractThinkingFromTaggedText as u, ensureOpenClawModelsJson as v };
+export { stripThinkingTagsFromText as _, decodeDataUrl as a, extractAssistantText as c, extractThinkingFromTaggedText as d, formatReasoningMessage as f, stripMinimaxToolCallXml as g, stripDowngradedToolCallText as h, coerceImageModelConfig as i, extractAssistantThinking as l, promoteThinkingTagsToBlocks as m, image_exports as n, resolveProviderVisionModelFromConfig as o, inferToolMetaFromArgs as p, coerceImageAssistantText as r, minimaxUnderstandImage as s, describeImageWithModel as t, extractThinkingFromTaggedStream as u, resolveToolDisplay as v, ensureOpenClawModelsJson as y };

package/dist/{image-CXg7Z0WD.js → image-nRwqkmtf.js}

@@ -1,8 +1,9 @@
-import { G as resolveImplicitProviders, H as normalizeProviders, T as resolveOpenClawAgentDir, U as resolveImplicitBedrockProvider, W as resolveImplicitCopilotProvider, et as getApiKeyForModel, nt as requireApiKey } from "./auth-profiles-CfFGCDJa.js";
-import { i as discoverModels, r as discoverAuthStorage } from "./pi-model-discovery-CsRo-xMp.js";
-import { r as loadConfig } from "./config-DCT1RAo6.js";
-import { D as sanitizeUserFacingText } from "./pi-embedded-helpers-DJgCXZEz.js";
-import { n as resolveToolDisplay, t as formatToolDetail } from "./tool-display-BMYWrp0L.js";
+import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
+import { $ as getApiKeyForModel, H as resolveImplicitBedrockProvider, S as resolveOpenClawAgentDir, U as resolveImplicitCopilotProvider, V as normalizeProviders, W as resolveImplicitProviders, tt as requireApiKey } from "./auth-profiles-CYBuGiBb.js";
+import { n as discoverModels, t as discoverAuthStorage } from "./pi-model-discovery-DzEIEgHL.js";
+import { i as loadConfig } from "./config-CKLedg5Y.js";
+import { k as sanitizeUserFacingText } from "./pi-embedded-helpers-DF8SAHU-.js";
+import { n as resolveToolDisplay, t as formatToolDetail } from "./tool-display-DmgKs6-V.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { complete } from "@mariozechner/pi-ai";
@@ -575,6 +576,7 @@ function resolveProviderVisionModelFromConfig(params) {
 
 //#endregion
 //#region src/media-understanding/providers/image.ts
+var image_exports = /* @__PURE__ */ __exportAll({ describeImageWithModel: () => describeImageWithModel });
 async function describeImageWithModel(params) {
 	await ensureOpenClawModelsJson(params.cfg, params.agentDir);
 	const authStorage = discoverAuthStorage(params.agentDir);
@@ -624,4 +626,4 @@ async function describeImageWithModel(params) {
 }
 
 //#endregion
-export { ensureOpenClawModelsJson as _, resolveProviderVisionModelFromConfig as a, extractAssistantThinking as c, formatReasoningMessage as d, inferToolMetaFromArgs as f, stripThinkingTagsFromText as g, stripMinimaxToolCallXml as h, decodeDataUrl as i, extractThinkingFromTaggedStream as l, stripDowngradedToolCallText as m, coerceImageAssistantText as n, minimaxUnderstandImage as o, promoteThinkingTagsToBlocks as p, coerceImageModelConfig as r, extractAssistantText as s, describeImageWithModel as t, extractThinkingFromTaggedText as u };
+export { stripThinkingTagsFromText as _, decodeDataUrl as a, extractAssistantText as c, extractThinkingFromTaggedText as d, formatReasoningMessage as f, stripMinimaxToolCallXml as g, stripDowngradedToolCallText as h, coerceImageModelConfig as i, extractAssistantThinking as l, promoteThinkingTagsToBlocks as m, image_exports as n, resolveProviderVisionModelFromConfig as o, inferToolMetaFromArgs as p, coerceImageAssistantText as r, minimaxUnderstandImage as s, describeImageWithModel as t, extractThinkingFromTaggedStream as u, ensureOpenClawModelsJson as v };

package/dist/index.js

@@ -1,93 +1,93 @@
 #!/usr/bin/env node
-import "./pi-embedded-helpers-CC00lEFI.js";
-import { $t as waitForever, Ct as waitForGatewayReachable, E as runMessageAction, F as CHANNEL_MESSAGE_ACTION_NAMES, Jt as runMemoryStatus, K as CHANNEL_TARGETS_DESCRIPTION, N as formatTargetDisplay, Yt as monitorWebChannel, Zt as installUnhandledRejectionHandler, bt as resolveControlUiLinks, dt as formatControlUiSshHint, gt as openUrl, jr as applyTemplate, lr as lookupContextTokens, lt as detectBrowserOpenSupport, mt as moveToTrash, nt as resolveCommitHash, ot as DEFAULT_WORKSPACE, pt as handleReset, q as CHANNEL_TARGET_DESCRIPTION, qt as registerMemoryCli, st as applyWizardMetadata, t as getReplyFromConfig, ut as ensureWorkspaceAndSessions, yt as randomToken } from "./reply-CoztdrN_.js";
-import { g as resolveStateDir, i as isNixMode, m as resolveOAuthDir, o as resolveConfigPath, r as STATE_DIR, u as resolveGatewayPort } from "./paths-BDd7_JUB.js";
-import { D as DEFAULT_AGENT_ID, E as DEFAULT_ACCOUNT_ID, N as normalizeAgentId, c as resolveDefaultAgentId, f as DEFAULT_AGENT_WORKSPACE_DIR, h as DEFAULT_IDENTITY_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace } from "./agent-scope-CrgUOY3f.js";
-import { D as info, E as danger, I as colorize, L as isRich, M as setVerbose, R as theme, S as normalizeChatChannelId, c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL, l as restoreTerminalState, r as enableConsoleCapture, s as visibleWidth, v as getChatChannelMeta } from "./subsystem-46MXi6Ip.js";
-import { _ as shortenHomePath, b as toWhatsappJid, d as normalizeE164, f as resolveConfigDir, g as shortenHomeInString, h as resolveUserPath, n as assertWebChannel, p as resolveHomeDir } from "./utils-Dg0Xbl6w.js";
-import { n as runExec, t as runCommandWithTimeout } from "./exec-CTo4hK94.js";
-import { G as resolveAuthProfileOrder, P as resolveEnvApiKey, Z as resolveApiKeyForProfile, bt as DEFAULT_MODEL, ct as upsertAuthProfile, l as resolveConfiguredModelRef, lt as ensureAuthProfileStore, o as normalizeProviderId, pt as resolveAuthStorePath, xt as DEFAULT_PROVIDER, yt as DEFAULT_CONTEXT_TOKENS } from "./model-selection-Cp1maz7B.js";
-import "./github-copilot-token-VZsS4013.js";
-import { n as replaceCliName, r as resolveCliName, t as formatCliCommand } from "./command-format-BQK1OIvH.js";
-import { t as parseBooleanValue } from "./boolean-CE7i9tBR.js";
-import { r as normalizeEnv, t as isTruthyEnvValue } from "./env-DOcCob95.js";
-import { M as VERSION, a as readConfigFileSnapshot, h as parseDurationMs, n as createConfigIO, r as loadConfig, s as writeConfigFile } from "./config-qgIz1lbh.js";
-import "./manifest-registry-BFpLJJDB.js";
-import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-D1CxUobm.js";
-import { D as resolveSessionKey, E as deriveSessionKey, d as loadSessionStore, m as saveSessionStore } from "./sandbox-BXUfp_qv.js";
-import "./image-ClOB6QDJ.js";
-import "./pi-model-discovery-DjGamP_B.js";
-import { E as formatUncaughtError, c as describePortOwner, l as ensurePortAvailable, s as PortInUseError, u as handlePortError } from "./chrome-D2LUApAY.js";
-import "./skills-C4b1FA1e.js";
-import "./routes-Ds-tIZFJ.js";
-import { n as movePathToTrash } from "./server-context-D2cv-pIA.js";
-import { l as normalizeMessageChannel, m as GATEWAY_CLIENT_NAMES, p as GATEWAY_CLIENT_MODES } from "./message-channel-CQGWXVL4.js";
-import "./logging-BdnOSVPD.js";
-import "./accounts-BlHoTziG.js";
-import { a as resolveSessionTranscriptsDirForAgent, i as resolveSessionTranscriptsDir, o as resolveStorePath } from "./paths-50eo6DV6.js";
-import "./redact-BKh-zp-c.js";
-import "./tool-display-rIUh61kT.js";
-import "./deliver-Bsvrattg.js";
-import "./dispatcher-BNB5aCZ6.js";
-import "./manager-BArueSTR.js";
-import "./sqlite-Dz6S6ijV.js";
-import "./channel-summary-C8GoEKgH.js";
-import "./client-zqMhLTAX.js";
-import { n as callGateway, r as randomIdempotencyKey } from "./call-CPBhMXxo.js";
-import "./login-qr-C2H_iQJU.js";
-import "./pairing-store-BnMngoWQ.js";
-import { t as formatDocsLink } from "./links-C9fyAH-V.js";
-import { r as runCommandWithRuntime } from "./cli-utils-CukoNm8O.js";
-import { n as withProgress } from "./progress-uNDQDtGB.js";
-import "./pi-tools.policy-DleRi9eC.js";
-import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-gfROyHgB.js";
-import "./pairing-labels-DK2aLSd2.js";
-import "./control-service-BW5sW2U1.js";
-import "./restart-sentinel-CdcBcziq.js";
-import "./channel-selection-BCn8_qun.js";
-import { t as createDefaultDeps } from "./deps-BrcOX0ht.js";
-import { l as ensureBinary, u as promptYesNo } from "./tailscale-Cvk3mQDZ.js";
-import { t as isMainModule } from "./is-main-DrJg4t1R.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-CuGC6r1F.js";
-import { t as assertSupportedRuntime } from "./runtime-guard-BG6JybtL.js";
-import { a as buildAgentSummaries, c as loadAgentIdentity, f as parseIdentityMarkdown, i as applyAgentConfig, l as pruneAgentConfig, n as statusCommand, o as findAgentEntryIndex, s as listAgentEntries, t as runOnboardingWizard, u as identityHasValues } from "./onboarding-DcN1avQK.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-Cw9kFCkw.js";
-import { n as logConfigUpdated, t as formatConfigPath } from "./logging-CLCWl7Iu.js";
-import "./note-BFpD-42H.js";
-import { t as WizardCancelledError } from "./prompts-CIDznuZR.js";
-import { t as createClackPrompter } from "./clack-prompter-OmDa1Hm1.js";
-import { _ as applyGoogleGeminiModelDefault, g as upsertSharedEnvVar, h as applyAuthChoice, m as warnIfModelConfigLooksOff, v as promptAuthChoiceGrouped } from "./onboard-skills-fL84FI8F.js";
-import { $ as setVeniceApiKey, C as applyMoonshotConfig, D as applyOpenrouterConfig, F as applyXiaomiConfig, G as setCloudflareAiGatewayConfig, J as setMinimaxApiKey, K as setGeminiApiKey, L as applyZaiConfig, N as applyVercelAiGatewayConfig, Q as setSyntheticApiKey, W as setAnthropicApiKey, X as setOpencodeZenApiKey, Y as setMoonshotApiKey, Z as setOpenrouterApiKey, at as validateAnthropicSetupToken, et as setVercelAiGatewayApiKey, f as applyOpencodeZenConfig, g as applyMinimaxConfig, it as buildTokenProfileId, j as applyVeniceConfig, k as applySyntheticConfig, m as applyMinimaxApiConfig, nt as setZaiApiKey, q as setKimiCodingApiKey, tt as setXiaomiApiKey, v as applyAuthProfileConfig, w as applyMoonshotConfigCn, x as applyKimiCodeConfig, y as applyCloudflareAiGatewayConfig } from "./github-copilot-auth-BoRchp_Q.js";
-import { n as setupChannels } from "./onboard-channels-CJCy7TTQ.js";
-import "./plugin-auto-enable-JQ63k0Ce.js";
-import "./archive-BrH5WBhI.js";
-import "./installs-W4Pc1LJz.js";
-import { i as healthCommand } from "./health-format-B4_A88V3.js";
-import "./update-runner-s8Rs8ex3.js";
-import "./auth-DK3l201_.js";
-import "./audit-CWGOX7Eh.js";
-import { t as renderTable } from "./table-DuNe7Qes.js";
-import "./skills-status-CSCMqNZP.js";
-import { t as resolveGatewayService } from "./service-CAxAjHNB.js";
-import { r as isSystemdUserServiceAvailable } from "./systemd-CNYEkRek.js";
-import "./service-audit-DBSAGhm8.js";
-import "./node-service-CjtBRyjp.js";
-import "./channels-status-issues-C9vMMPG0.js";
-import "./status.update-2ZdxeIeT.js";
-import { a as getFlagValue, c as hasFlag, i as getCommandPath, l as hasHelpOrVersion, o as getPositiveIntFlagValue, r as registerSubCliCommands, s as getVerboseFlag } from "./register.subclis-Bo-xmQ-W.js";
-import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-SvVB4Fmv.js";
-import { t as formatHelpExamples } from "./help-format-CGcnDM3D.js";
-import { a as createOutboundSendDeps, n as resolveSessionKeyForRequest, t as agentCommand } from "./agent-DuQt3QDO.js";
-import { i as hasExplicitOptions, n as resolveCliChannelOptions, r as ensurePluginRegistryLoaded } from "./channel-options-BCSvD6JM.js";
-import { n as parsePositiveIntOrUndefined, t as collectOption } from "./helpers-HZ-6iA1e.js";
-import { a as CONFIGURE_WIZARD_SECTIONS, n as configureCommandWithSections, t as configureCommand } from "./configure-C1_0rFdQ.js";
-import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-vNkYv9tq.js";
-import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-Cbkoh9qw.js";
-import "./widearea-dns-BIhjVRG1.js";
-import "./auth-health-Ba9GTScq.js";
-import { n as loadAndMaybeMigrateDoctorConfig, t as doctorCommand } from "./doctor-CT9JPoCt.js";
-import "./hooks-status-XV9oQICf.js";
-import "./tui-cV-R-JXi.js";
+import "./pi-embedded-helpers-BB4uACeq.js";
+import { $ as CHANNEL_TARGET_DESCRIPTION, $t as runMemoryStatus, Fr as applyTemplate, M as formatTargetDisplay, Ot as waitForGatewayReachable, P as CHANNEL_MESSAGE_ACTION_NAMES, Q as CHANNEL_TARGETS_DESCRIPTION, Qt as registerMemoryCli, T as runMessageAction, Tt as resolveControlUiLinks, an as waitForever, ct as resolveCommitHash, dt as DEFAULT_WORKSPACE, en as monitorWebChannel, ft as applyWizardMetadata, gt as formatControlUiSshHint, ht as ensureWorkspaceAndSessions, mt as detectBrowserOpenSupport, pr as lookupContextTokens, rn as installUnhandledRejectionHandler, t as getReplyFromConfig, vt as handleReset, wt as randomToken, xt as openUrl, yt as moveToTrash } from "./reply-B8pOiUNN.js";
+import { g as resolveStateDir, i as isNixMode, m as resolveOAuthDir, o as resolveConfigPath, r as STATE_DIR, u as resolveGatewayPort } from "./paths-scjhy7N2.js";
+import { c as normalizeAgentId, n as DEFAULT_AGENT_ID, t as DEFAULT_ACCOUNT_ID } from "./session-key-Dm2EOhrH.js";
+import { D as info, E as danger, I as colorize, L as isRich, M as setVerbose, R as theme, S as normalizeChatChannelId, c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL, l as restoreTerminalState, r as enableConsoleCapture, s as visibleWidth, v as getChatChannelMeta } from "./subsystem-CAq3uyo7.js";
+import { _ as shortenHomePath, b as toWhatsappJid, d as normalizeE164, f as resolveConfigDir, g as shortenHomeInString, h as resolveUserPath, n as assertWebChannel, p as resolveHomeDir } from "./utils-CKSrBNwq.js";
+import { n as runExec, t as runCommandWithTimeout } from "./exec-HEWTMJ7j.js";
+import { c as resolveDefaultAgentId, f as DEFAULT_AGENT_WORKSPACE_DIR, h as DEFAULT_IDENTITY_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace } from "./agent-scope-CMs5Y7l-.js";
+import { $ as resolveApiKeyForProfile, I as resolveEnvApiKey, J as resolveAuthProfileOrder, bt as DEFAULT_PROVIDER, ct as upsertAuthProfile, d as resolveConfiguredModelRef, ft as resolveAuthStorePath, lt as ensureAuthProfileStore, s as normalizeProviderId, vt as DEFAULT_CONTEXT_TOKENS, yt as DEFAULT_MODEL } from "./model-selection-DMUrNhQP.js";
+import "./github-copilot-token-pGSmVaW-.js";
+import { n as replaceCliName, r as resolveCliName, t as formatCliCommand } from "./command-format-ChfKqObn.js";
+import { t as parseBooleanValue } from "./boolean-BgXe2hyu.js";
+import { r as normalizeEnv, t as isTruthyEnvValue } from "./env-0_mKbEWW.js";
+import { c as writeConfigFile, h as parseDurationMs, i as loadConfig, j as VERSION, o as readConfigFileSnapshot, r as createConfigIO } from "./config-CAuZ-EkU.js";
+import "./manifest-registry-DHaa1SJb.js";
+import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-BYIWo0Cp.js";
+import { D as resolveSessionKey, E as deriveSessionKey, d as loadSessionStore, m as saveSessionStore } from "./sandbox-CV8VwPij.js";
+import "./image-Ca_PtqY7.js";
+import "./pi-model-discovery-CV2V1HHz.js";
+import { E as formatUncaughtError, c as describePortOwner, l as ensurePortAvailable, s as PortInUseError, u as handlePortError } from "./chrome-BNSd7Bie.js";
+import "./skills-D5JDj3TR.js";
+import "./routes-DchZU3EK.js";
+import { n as movePathToTrash } from "./server-context-vChIAqjH.js";
+import { h as GATEWAY_CLIENT_NAMES, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES } from "./message-channel-Bpfe5l5f.js";
+import "./logging-BWRYHvLp.js";
+import "./accounts-BgZmhIm6.js";
+import { a as resolveSessionTranscriptsDirForAgent, i as resolveSessionTranscriptsDir, o as resolveStorePath } from "./paths-Bb0nwPeu.js";
+import "./redact-DJCFY628.js";
+import "./tool-display-BxZG0o1b.js";
+import "./deliver-C3bnXkg5.js";
+import "./dispatcher-6oI-H42S.js";
+import "./manager-LpytrxUw.js";
+import "./sqlite-BKl1HJFe.js";
+import "./channel-summary-DUiKDBLv.js";
+import "./client-BYVbRnuQ.js";
+import { i as randomIdempotencyKey, n as callGateway } from "./call-BTbA5OB4.js";
+import "./login-qr-BIlr0vwe.js";
+import "./pairing-store-DFq7WtOv.js";
+import { t as formatDocsLink } from "./links-B5pRdmo1.js";
+import { r as runCommandWithRuntime } from "./cli-utils-BkRQdAoC.js";
+import { n as withProgress } from "./progress-xpLtQsNY.js";
+import "./pi-tools.policy-BQ8N5y8a.js";
+import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-vzh0MGHs.js";
+import "./pairing-labels-CtqLxbG6.js";
+import "./session-cost-usage-CBP4Hv9D.js";
+import "./control-service-CS61Road.js";
+import "./channel-selection-CJWYmCLf.js";
+import { t as createDefaultDeps } from "./deps-BG1LonF6.js";
+import { l as ensureBinary, u as promptYesNo } from "./tailscale-BVGD9gSD.js";
+import { t as isMainModule } from "./is-main-B6kCyqsv.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-DP3DsVge.js";
+import { a as gatewayInstallErrorHint, g as assertSupportedRuntime, i as buildGatewayInstallPlan, r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-DMd0mgTK.js";
+import { a as buildAgentSummaries, c as loadAgentIdentity, f as parseIdentityMarkdown, i as applyAgentConfig, l as pruneAgentConfig, n as statusCommand, o as findAgentEntryIndex, s as listAgentEntries, t as runOnboardingWizard, u as identityHasValues } from "./onboarding-BP4-5uzE.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-BIc7L8EF.js";
+import { n as logConfigUpdated, t as formatConfigPath } from "./logging-TXWhN8jG.js";
+import "./note-B5HnoeZX.js";
+import { t as WizardCancelledError } from "./prompts-FbZThK8w.js";
+import { t as createClackPrompter } from "./clack-prompter-CEKDd_Vg.js";
+import { d as warnIfModelConfigLooksOff, f as applyAuthChoice, g as promptAuthChoiceGrouped, h as applyGoogleGeminiModelDefault, m as upsertSharedEnvVar, p as applyOpenAIConfig } from "./onboard-skills-s8J5xbUr.js";
+import { $ as setVeniceApiKey, C as applyMoonshotConfig, D as applyOpenrouterConfig, F as applyXaiConfig, G as setCloudflareAiGatewayConfig, J as setMinimaxApiKey, K as setGeminiApiKey, L as applyXiaomiConfig, N as applyVercelAiGatewayConfig, Q as setSyntheticApiKey, W as setAnthropicApiKey, X as setOpencodeZenApiKey, Y as setMoonshotApiKey, Z as setOpenrouterApiKey, ct as buildTokenProfileId, et as setVercelAiGatewayApiKey, f as applyOpencodeZenConfig, g as applyMinimaxConfig, j as applyVeniceConfig, k as applySyntheticConfig, lt as validateAnthropicSetupToken, m as applyMinimaxApiConfig, nt as setXiaomiApiKey, q as setKimiCodingApiKey, rt as setZaiApiKey, tt as setXaiApiKey, v as applyAuthProfileConfig, w as applyMoonshotConfigCn, x as applyKimiCodeConfig, y as applyCloudflareAiGatewayConfig, z as applyZaiConfig } from "./github-copilot-auth-C8Uf0Q03.js";
+import { n as setupChannels } from "./onboard-channels-DKT27PdN.js";
+import "./plugin-auto-enable-Ci7TBlH2.js";
+import "./archive-Dy3Ezb-5.js";
+import "./skill-scanner-BoGjHXUZ.js";
+import "./installs-BhEjOqPy.js";
+import { l as healthCommand } from "./health-format-B3eStY5r.js";
+import "./update-runner-BDdk_K2S.js";
+import "./auth-CbhB03Rz.js";
+import "./audit-ZY6Dk5Ec.js";
+import { t as renderTable } from "./table-CLtGjVsx.js";
+import "./skills-status-CEvVUD3U.js";
+import { t as resolveGatewayService } from "./service-BZesBIaG.js";
+import { r as isSystemdUserServiceAvailable } from "./systemd-B-3NdMmA.js";
+import "./service-audit-C-IA4omi.js";
+import "./node-service-BAYHx0E7.js";
+import "./channels-status-issues-CrS1r5sr.js";
+import { c as registerSubCliCommands, d as getPositiveIntFlagValue, f as getVerboseFlag, l as getCommandPath, m as hasHelpOrVersion, p as hasFlag, u as getFlagValue } from "./completion-cli-BPIeQDFy.js";
+import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-C8rNIC0P.js";
+import { t as formatHelpExamples } from "./help-format-Bozi4K9H.js";
+import { a as createOutboundSendDeps, n as resolveSessionKeyForRequest, t as agentCommand } from "./agent-_H-0rbHV.js";
+import { i as hasExplicitOptions, n as resolveCliChannelOptions, r as ensurePluginRegistryLoaded } from "./channel-options-uftAnT5P.js";
+import { n as parsePositiveIntOrUndefined, t as collectOption } from "./helpers-5yebzF4C.js";
+import { i as CONFIGURE_WIZARD_SECTIONS, n as configureCommand, r as configureCommandWithSections } from "./configure-B47GYdlB.js";
+import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-N-cIaegf.js";
+import "./widearea-dns-D9Al4QRv.js";
+import "./auth-health-Ctf-_JFE.js";
+import { n as loadAndMaybeMigrateDoctorConfig, t as doctorCommand } from "./doctor-CwSrWRCp.js";
+import "./hooks-status-DepPyfBb.js";
+import "./tui-XH6_v0qC.js";
 import process$1 from "node:process";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
@@ -1812,8 +1812,15 @@ async function copyToClipboard(value) {
 
 //#endregion
 //#region src/cli/browser-cli-extension.ts
-function bundledExtensionRootDir() {
-	const here = path.dirname(fileURLToPath(import.meta.url));
+function resolveBundledExtensionRootDir(here = path.dirname(fileURLToPath(import.meta.url))) {
+	let current = here;
+	while (true) {
+		const candidate = path.join(current, "assets", "chrome-extension");
+		if (hasManifest(candidate)) return candidate;
+		const parent = path.dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
 	return path.resolve(here, "../../assets/chrome-extension");
 }
 function installedExtensionRootDir() {
@@ -1823,7 +1830,7 @@ function hasManifest(dir) {
 	return fs.existsSync(path.join(dir, "manifest.json"));
 }
 async function installChromeExtension(opts) {
-	const src = opts?.sourceDir ?? bundledExtensionRootDir();
+	const src = opts?.sourceDir ?? resolveBundledExtensionRootDir();
 	if (!hasManifest(src)) throw new Error("Bundled Chrome extension is missing. Reinstall OpenClaw and try again.");
 	const stateDir = opts?.stateDir ?? STATE_DIR;
 	const dest = path.join(stateDir, "browser", "chrome-extension");
@@ -2848,7 +2855,7 @@ async function loadValidConfig() {
 }
 function registerConfigCli(program) {
 	const cmd = program.command("config").description("Config helpers (get/set/unset). Run without subcommand for the wizard.").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/config", "docs.openclaw.ai/cli/config")}\n`).option("--section <section>", "Configure wizard sections (repeatable). Use with no subcommand.", (value, previous) => [...previous, value], []).action(async (opts) => {
-		const { CONFIGURE_WIZARD_SECTIONS, configureCommand, configureCommandWithSections } = await import("./configure-t-7r9i4H.js");
+		const { CONFIGURE_WIZARD_SECTIONS, configureCommand, configureCommandWithSections } = await import("./configure-B47GYdlB.js").then((n) => n.t);
 		const sections = Array.isArray(opts.section) ? opts.section.map((value) => typeof value === "string" ? value.trim() : "").filter(Boolean) : [];
 		if (sections.length === 0) {
 			await configureCommand(defaultRuntime);
@@ -3134,25 +3141,22 @@ async function dashboardCommand(runtime = defaultRuntime, options = {}) {
 	const bind = cfg.gateway?.bind ?? "loopback";
 	const basePath = cfg.gateway?.controlUi?.basePath;
 	const customBindHost = cfg.gateway?.customBindHost;
-	const token = cfg.gateway?.auth?.token ?? process.env.OPENCLAW_GATEWAY_TOKEN ?? "";
-	const links = resolveControlUiLinks({
+	const dashboardUrl = resolveControlUiLinks({
 		port,
 		bind,
 		customBindHost,
 		basePath
-	});
-	const authedUrl = token ? `${links.httpUrl}?token=${encodeURIComponent(token)}` : links.httpUrl;
-	runtime.log(`Dashboard URL: ${authedUrl}`);
-	const copied = await copyToClipboard(authedUrl).catch(() => false);
+	}).httpUrl;
+	runtime.log(`Dashboard URL: ${dashboardUrl}`);
+	const copied = await copyToClipboard(dashboardUrl).catch(() => false);
 	runtime.log(copied ? "Copied to clipboard." : "Copy to clipboard unavailable.");
 	let opened = false;
 	let hint;
 	if (!options.noOpen) {
-		if ((await detectBrowserOpenSupport()).ok) opened = await openUrl(authedUrl);
+		if ((await detectBrowserOpenSupport()).ok) opened = await openUrl(dashboardUrl);
 		if (!opened) hint = formatControlUiSshHint({
 			port,
-			basePath,
-			token: token || void 0
+			basePath
 		});
 	} else hint = "Browser launch disabled (--no-open). Use the URL above.";
 	if (opened) runtime.log("Opened in your browser. Keep that tab to control OpenClaw.");
@@ -4181,6 +4185,97 @@ async function runInteractiveOnboarding(opts, runtime = defaultRuntime) {
 	}
 }
 
+//#endregion
+//#region src/commands/onboard-non-interactive/local/auth-choice-inference.ts
+const AUTH_CHOICE_FLAG_MAP = [
+	{
+		flag: "anthropicApiKey",
+		authChoice: "apiKey",
+		label: "--anthropic-api-key"
+	},
+	{
+		flag: "geminiApiKey",
+		authChoice: "gemini-api-key",
+		label: "--gemini-api-key"
+	},
+	{
+		flag: "openaiApiKey",
+		authChoice: "openai-api-key",
+		label: "--openai-api-key"
+	},
+	{
+		flag: "openrouterApiKey",
+		authChoice: "openrouter-api-key",
+		label: "--openrouter-api-key"
+	},
+	{
+		flag: "aiGatewayApiKey",
+		authChoice: "ai-gateway-api-key",
+		label: "--ai-gateway-api-key"
+	},
+	{
+		flag: "cloudflareAiGatewayApiKey",
+		authChoice: "cloudflare-ai-gateway-api-key",
+		label: "--cloudflare-ai-gateway-api-key"
+	},
+	{
+		flag: "moonshotApiKey",
+		authChoice: "moonshot-api-key",
+		label: "--moonshot-api-key"
+	},
+	{
+		flag: "kimiCodeApiKey",
+		authChoice: "kimi-code-api-key",
+		label: "--kimi-code-api-key"
+	},
+	{
+		flag: "syntheticApiKey",
+		authChoice: "synthetic-api-key",
+		label: "--synthetic-api-key"
+	},
+	{
+		flag: "veniceApiKey",
+		authChoice: "venice-api-key",
+		label: "--venice-api-key"
+	},
+	{
+		flag: "zaiApiKey",
+		authChoice: "zai-api-key",
+		label: "--zai-api-key"
+	},
+	{
+		flag: "xiaomiApiKey",
+		authChoice: "xiaomi-api-key",
+		label: "--xiaomi-api-key"
+	},
+	{
+		flag: "xaiApiKey",
+		authChoice: "xai-api-key",
+		label: "--xai-api-key"
+	},
+	{
+		flag: "minimaxApiKey",
+		authChoice: "minimax-api",
+		label: "--minimax-api-key"
+	},
+	{
+		flag: "opencodeZenApiKey",
+		authChoice: "opencode-zen",
+		label: "--opencode-zen-api-key"
+	}
+];
+function inferAuthChoiceFromFlags(opts) {
+	const matches = AUTH_CHOICE_FLAG_MAP.filter(({ flag }) => {
+		const value = opts[flag];
+		if (typeof value === "string") return value.trim().length > 0;
+		return Boolean(value);
+	});
+	return {
+		choice: matches[0]?.authChoice,
+		matches
+	};
+}
+
 //#endregion
 //#region src/commands/onboard-non-interactive/api-keys.ts
 async function resolveApiKeyFromProfiles(params) {
@@ -4369,6 +4464,24 @@ async function applyNonInteractiveAuthChoice(params) {
 		});
 		return applyXiaomiConfig(nextConfig);
 	}
+	if (authChoice === "xai-api-key") {
+		const resolved = await resolveNonInteractiveApiKey({
+			provider: "xai",
+			cfg: baseConfig,
+			flagValue: opts.xaiApiKey,
+			flagName: "--xai-api-key",
+			envVar: "XAI_API_KEY",
+			runtime
+		});
+		if (!resolved) return null;
+		if (resolved.source !== "profile") setXaiApiKey(resolved.key);
+		nextConfig = applyAuthProfileConfig(nextConfig, {
+			profileId: "xai:default",
+			provider: "xai",
+			mode: "api_key"
+		});
+		return applyXaiConfig(nextConfig);
+	}
 	if (authChoice === "openai-api-key") {
 		const resolved = await resolveNonInteractiveApiKey({
 			provider: "openai",
@@ -4387,7 +4500,7 @@ async function applyNonInteractiveAuthChoice(params) {
 		});
 		process.env.OPENAI_API_KEY = key;
 		runtime.log(`Saved OPENAI_API_KEY to ${shortenHomePath(result.path)}`);
-		return nextConfig;
+		return applyOpenAIConfig(nextConfig);
 	}
 	if (authChoice === "openrouter-api-key") {
 		const resolved = await resolveNonInteractiveApiKey({
@@ -4784,7 +4897,17 @@ async function runNonInteractiveOnboardingLocal(params) {
 			mode: "local"
 		}
 	};
-	const authChoice = opts.authChoice ?? "skip";
+	const inferredAuthChoice = inferAuthChoiceFromFlags(opts);
+	if (!opts.authChoice && inferredAuthChoice.matches.length > 1) {
+		runtime.error([
+			"Multiple API key flags were provided for non-interactive onboarding.",
+			"Use a single provider flag or pass --auth-choice explicitly.",
+			`Flags: ${inferredAuthChoice.matches.map((match) => match.label).join(", ")}`
+		].join("\n"));
+		runtime.exit(1);
+		return;
+	}
+	const authChoice = opts.authChoice ?? inferredAuthChoice.choice ?? "skip";
 	const nextConfigAfterAuth = await applyNonInteractiveAuthChoice({
 		nextConfig,
 		authChoice,
@@ -4987,7 +5110,7 @@ function resolveInstallDaemonFlag(command, opts) {
 	if (getOptionValueSource.call(command, "installDaemon") === "cli") return Boolean(opts.installDaemon);
 }
 function registerOnboardCommand(program) {
-	program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.openclaw.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.openclaw/workspace)").option("--reset", "Reset config + credentials + sessions + workspace before running wizard").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--auth-choice <choice>", "Auth: setup-token|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|cloudflare-ai-gateway-api-key|moonshot-api-key|moonshot-api-key-cn|kimi-code-api-key|synthetic-api-key|venice-api-key|gemini-api-key|zai-api-key|xiaomi-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip").option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--anthropic-api-key <key>", "Anthropic API key").option("--openai-api-key <key>", "OpenAI API key").option("--openrouter-api-key <key>", "OpenRouter API key").option("--ai-gateway-api-key <key>", "Vercel AI Gateway API key").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID").option("--cloudflare-ai-gateway-api-key <key>", "Cloudflare AI Gateway API key").option("--moonshot-api-key <key>", "Moonshot API key").option("--kimi-code-api-key <key>", "Kimi Coding API key").option("--gemini-api-key <key>", "Gemini API key").option("--zai-api-key <key>", "Z.AI API key").option("--xiaomi-api-key <key>", "Xiaomi API key").option("--minimax-api-key <key>", "MiniMax API key").option("--synthetic-api-key <key>", "Synthetic API key").option("--venice-api-key <key>", "Venice API key").option("--opencode-zen-api-key <key>", "OpenCode Zen API key").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false).action(async (opts, command) => {
+	program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.openclaw.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.openclaw/workspace)").option("--reset", "Reset config + credentials + sessions + workspace before running wizard").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--auth-choice <choice>", "Auth: setup-token|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|cloudflare-ai-gateway-api-key|moonshot-api-key|moonshot-api-key-cn|kimi-code-api-key|synthetic-api-key|venice-api-key|gemini-api-key|zai-api-key|xiaomi-api-key|xai-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip").option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--anthropic-api-key <key>", "Anthropic API key").option("--openai-api-key <key>", "OpenAI API key").option("--openrouter-api-key <key>", "OpenRouter API key").option("--ai-gateway-api-key <key>", "Vercel AI Gateway API key").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID").option("--cloudflare-ai-gateway-api-key <key>", "Cloudflare AI Gateway API key").option("--moonshot-api-key <key>", "Moonshot API key").option("--kimi-code-api-key <key>", "Kimi Coding API key").option("--gemini-api-key <key>", "Gemini API key").option("--zai-api-key <key>", "Z.AI API key").option("--xiaomi-api-key <key>", "Xiaomi API key").option("--minimax-api-key <key>", "MiniMax API key").option("--synthetic-api-key <key>", "Synthetic API key").option("--venice-api-key <key>", "Venice API key").option("--opencode-zen-api-key <key>", "OpenCode Zen API key").option("--xai-api-key <key>", "xAI API key").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false).action(async (opts, command) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			const installDaemon = resolveInstallDaemonFlag(command, { installDaemon: Boolean(opts.installDaemon) });
 			const gatewayPort = typeof opts.gatewayPort === "string" ? Number.parseInt(opts.gatewayPort, 10) : void 0;
@@ -5018,6 +5141,7 @@ function registerOnboardCommand(program) {
 				syntheticApiKey: opts.syntheticApiKey,
 				veniceApiKey: opts.veniceApiKey,
 				opencodeZenApiKey: opts.opencodeZenApiKey,
+				xaiApiKey: opts.xaiApiKey,
 				gatewayPort: typeof gatewayPort === "number" && Number.isFinite(gatewayPort) ? gatewayPort : void 0,
 				gatewayBind: opts.gatewayBind,
 				gatewayAuth: opts.gatewayAuth,
@@ -5651,6 +5775,8 @@ function configureProgramHelp(program, ctx) {
 	program.name(CLI_NAME).description("").version(ctx.programVersion).option("--dev", "Dev profile: isolate state under ~/.openclaw-dev, default gateway port 19001, and shift derived ports (browser/canvas)").option("--profile <name>", "Use a named profile (isolates OPENCLAW_STATE_DIR/OPENCLAW_CONFIG_PATH under ~/.openclaw-<name>)");
 	program.option("--no-color", "Disable ANSI colors", false);
 	program.configureHelp({
+		sortSubcommands: true,
+		sortOptions: true,
 		optionTerm: (option) => theme.option(option.flags),
 		subcommandTerm: (cmd) => theme.command(cmd.name())
 	});

package/dist/{installs-C5cjVarj.js → installs-BhEjOqPy.js}

@@ -1,9 +1,10 @@
-import { m as resolveUserPath, t as CONFIG_DIR } from "./utils-PmTbZoD1.js";
-import { t as runCommandWithTimeout } from "./exec-BIMFe4XS.js";
-import { a as MANIFEST_KEY } from "./manifest-registry-tuAcHxrV.js";
-import { a as resolvePackedRootDir, i as resolveArchiveKind, n as fileExists, r as readJsonFile, t as extractArchive } from "./archive-mFgwsll-.js";
-import path from "node:path";
+import { h as resolveUserPath, t as CONFIG_DIR } from "./utils-CKSrBNwq.js";
+import { t as runCommandWithTimeout } from "./exec-HEWTMJ7j.js";
+import { a as MANIFEST_KEY } from "./manifest-registry-DHaa1SJb.js";
+import { a as resolvePackedRootDir, i as resolveArchiveKind, n as fileExists, r as readJsonFile, t as extractArchive } from "./archive-Dy3Ezb-5.js";
+import { t as scanDirectoryWithSummary } from "./skill-scanner-BoGjHXUZ.js";
 import os from "node:os";
+import path from "node:path";
 import fs from "node:fs/promises";
 
 //#region src/plugins/install.ts
@@ -27,6 +28,15 @@ function validatePluginId(pluginId) {
 	if (pluginId.includes("/") || pluginId.includes("\\")) return "invalid plugin name: path separators not allowed";
 	return null;
 }
+function isPathInside(basePath, candidatePath) {
+	const base = path.resolve(basePath);
+	const candidate = path.resolve(candidatePath);
+	const rel = path.relative(base, candidate);
+	return rel === "" || !rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel);
+}
+function extensionUsesSkippedScannerPath(entry) {
+	return entry.split(/[\\/]+/).filter(Boolean).some((segment) => segment === "node_modules" || segment.startsWith(".") && segment !== "." && segment !== "..");
+}
 async function ensureOpenClawExtensions(manifest) {
 	const extensions = manifest[MANIFEST_KEY]?.extensions;
 	if (!Array.isArray(extensions)) throw new Error("package.json missing openclaw.extensions");
@@ -95,6 +105,26 @@ async function installPluginFromPackageDir(params) {
 		ok: false,
 		error: `plugin id mismatch: expected ${params.expectedPluginId}, got ${pluginId}`
 	};
+	const packageDir = path.resolve(params.packageDir);
+	const forcedScanEntries = [];
+	for (const entry of extensions) {
+		const resolvedEntry = path.resolve(packageDir, entry);
+		if (!isPathInside(packageDir, resolvedEntry)) {
+			logger.warn?.(`extension entry escapes plugin directory and will not be scanned: ${entry}`);
+			continue;
+		}
+		if (extensionUsesSkippedScannerPath(entry)) logger.warn?.(`extension entry is in a hidden/node_modules path and will receive targeted scan coverage: ${entry}`);
+		forcedScanEntries.push(resolvedEntry);
+	}
+	try {
+		const scanSummary = await scanDirectoryWithSummary(params.packageDir, { includeFiles: forcedScanEntries });
+		if (scanSummary.critical > 0) {
+			const criticalDetails = scanSummary.findings.filter((f) => f.severity === "critical").map((f) => `${f.message} (${f.file}:${f.line})`).join("; ");
+			logger.warn?.(`WARNING: Plugin "${pluginId}" contains dangerous code patterns: ${criticalDetails}`);
+		} else if (scanSummary.warn > 0) logger.warn?.(`Plugin "${pluginId}" has ${scanSummary.warn} suspicious code pattern(s). Run "openclaw security audit --deep" for details.`);
+	} catch (err) {
+		logger.warn?.(`Plugin "${pluginId}" code safety scan failed (${String(err)}). Installation continues; run "openclaw security audit --deep" after install.`);
+	}
 	const extensionsDir = params.extensionsDir ? resolveUserPath(params.extensionsDir) : path.join(CONFIG_DIR, "extensions");
 	await fs.mkdir(extensionsDir, { recursive: true });
 	const targetDirResult = resolveSafeInstallDir(extensionsDir, pluginId);
@@ -136,7 +166,14 @@ async function installPluginFromPackageDir(params) {
 			error: `failed to copy plugin: ${String(err)}`
 		};
 	}
-	for (const entry of extensions) if (!await fileExists(path.resolve(targetDir, entry))) logger.warn?.(`extension entry not found: ${entry}`);
+	for (const entry of extensions) {
+		const resolvedEntry = path.resolve(targetDir, entry);
+		if (!isPathInside(targetDir, resolvedEntry)) {
+			logger.warn?.(`extension entry escapes plugin directory: ${entry}`);
+			continue;
+		}
+		if (!await fileExists(resolvedEntry)) logger.warn?.(`extension entry not found: ${entry}`);
+	}
 	const deps = manifest.dependencies ?? {};
 	if (Object.keys(deps).length > 0) {
 		logger.info?.("Installing plugin dependencies…");