@gguf/claw 2026.2.4 → 2026.2.5

package/dist/{onboard-skills-fL84FI8F.js → onboard-skills-s8J5xbUr.js}

@@ -1,19 +1,17 @@
-import { _r as loadModelCatalog, ct as detectBinary, gt as openUrl, xt as resolveNodeManagerOptions } from "./reply-CoztdrN_.js";
-import { a as resolveAgentModelPrimary, c as resolveDefaultAgentId, r as resolveAgentDir, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-CrgUOY3f.js";
-import { c as defaultRuntime } from "./subsystem-46MXi6Ip.js";
-import { f as resolveConfigDir, h as resolveUserPath, s as ensureDir, t as CONFIG_DIR } from "./utils-Dg0Xbl6w.js";
-import { t as runCommandWithTimeout } from "./exec-CTo4hK94.js";
-import { n as resolveOpenClawPackageRootSync, t as resolveOpenClawPackageRoot } from "./openclaw-root-CJKDUIBP.js";
-import { $ as exchangeChutesCodeForTokens, A as getCustomProviderApiKey, E as SYNTHETIC_DEFAULT_MODEL_REF, G as resolveAuthProfileOrder, H as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, P as resolveEnvApiKey, Q as CHUTES_AUTHORIZE_ENDPOINT, S as VENICE_DEFAULT_MODEL_REF, a as modelKey, at as listProfilesForProvider, bt as DEFAULT_MODEL, ct as upsertAuthProfile, et as generateChutesPkce, ht as resolveOpenClawAgentDir, l as resolveConfiguredModelRef, lt as ensureAuthProfileStore, n as buildModelAliasIndex, o as normalizeProviderId, t as buildAllowedModelSet, tt as parseOAuthCallbackInput, xt as DEFAULT_PROVIDER } from "./model-selection-Cp1maz7B.js";
-import { t as formatCliCommand } from "./command-format-BQK1OIvH.js";
-import { _ as resolveSkillKey, d as hasBinary, i as loadWorkspaceSkillEntries, t as resolveSkillsInstallPreferences } from "./skills-C4b1FA1e.js";
-import { J as fetchWithSsrFGuard } from "./deliver-Bsvrattg.js";
-import { t as resolveBrewExecutable } from "./brew-0HRgjHZw.js";
-import { $ as setVeniceApiKey, A as applySyntheticProviderConfig, B as OPENROUTER_DEFAULT_MODEL_REF, C as applyMoonshotConfig, D as applyOpenrouterConfig, E as applyMoonshotProviderConfigCn, F as applyXiaomiConfig, G as setCloudflareAiGatewayConfig, H as XIAOMI_DEFAULT_MODEL_REF, I as applyXiaomiProviderConfig, J as setMinimaxApiKey, K as setGeminiApiKey, L as applyZaiConfig, M as applyVeniceProviderConfig, N as applyVercelAiGatewayConfig, O as applyOpenrouterProviderConfig, P as applyVercelAiGatewayProviderConfig, Q as setSyntheticApiKey, R as KIMI_CODING_MODEL_REF, S as applyKimiCodeProviderConfig, T as applyMoonshotProviderConfig, U as ZAI_DEFAULT_MODEL_REF, V as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, W as setAnthropicApiKey, X as setOpencodeZenApiKey, Y as setMoonshotApiKey, Z as setOpenrouterApiKey, _ as applyMinimaxProviderConfig, at as validateAnthropicSetupToken, b as applyCloudflareAiGatewayProviderConfig, d as resolvePluginProviders, et as setVercelAiGatewayApiKey, f as applyOpencodeZenConfig, g as applyMinimaxConfig, h as applyMinimaxApiProviderConfig, i as formatTokenK, it as buildTokenProfileId, j as applyVeniceConfig, k as applySyntheticConfig, l as createVpsAwareOAuthHandlers, m as applyMinimaxApiConfig, nt as setZaiApiKey, p as applyOpencodeZenProviderConfig, q as setKimiCodingApiKey, rt as writeOAuthCredentials, t as githubCopilotLoginCommand, tt as setXiaomiApiKey, u as isRemoteEnvironment, v as applyAuthProfileConfig, w as applyMoonshotConfigCn, x as applyKimiCodeConfig, y as applyCloudflareAiGatewayConfig, z as MOONSHOT_DEFAULT_MODEL_REF } from "./github-copilot-auth-BoRchp_Q.js";
-import { a as enablePluginInConfig } from "./onboard-channels-CJCy7TTQ.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-CSCMqNZP.js";
-import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-BIhjVRG1.js";
-import { fileURLToPath } from "node:url";
+import { Et as resolveNodeManagerOptions, pt as detectBinary, xr as loadModelCatalog, xt as openUrl } from "./reply-B8pOiUNN.js";
+import { f as resolveConfigDir, h as resolveUserPath, s as ensureDir, t as CONFIG_DIR } from "./utils-CKSrBNwq.js";
+import { t as runCommandWithTimeout } from "./exec-HEWTMJ7j.js";
+import { a as resolveAgentModelPrimary, c as resolveDefaultAgentId, r as resolveAgentDir, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-CMs5Y7l-.js";
+import { I as resolveEnvApiKey, J as resolveAuthProfileOrder, M as getCustomProviderApiKey, O as SYNTHETIC_DEFAULT_MODEL_REF, W as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, at as listProfilesForProvider, bt as DEFAULT_PROVIDER, ct as upsertAuthProfile, d as resolveConfiguredModelRef, et as CHUTES_AUTHORIZE_ENDPOINT, lt as ensureAuthProfileStore, mt as resolveOpenClawAgentDir, nt as generateChutesPkce, o as modelKey, r as buildModelAliasIndex, rt as parseOAuthCallbackInput, s as normalizeProviderId, t as buildAllowedModelSet, tt as exchangeChutesCodeForTokens, u as resolveAllowlistModelKey, w as VENICE_DEFAULT_MODEL_REF, yt as DEFAULT_MODEL } from "./model-selection-DMUrNhQP.js";
+import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
+import { _ as resolveSkillKey, d as hasBinary, i as loadWorkspaceSkillEntries, t as resolveSkillsInstallPreferences } from "./skills-D5JDj3TR.js";
+import { Y as fetchWithSsrFGuard } from "./deliver-C3bnXkg5.js";
+import { t as resolveBrewExecutable } from "./brew-CAcErcKz.js";
+import { $ as setVeniceApiKey, A as applySyntheticProviderConfig, B as OPENROUTER_DEFAULT_MODEL_REF, C as applyMoonshotConfig, D as applyOpenrouterConfig, E as applyMoonshotProviderConfigCn, F as applyXaiConfig, G as setCloudflareAiGatewayConfig, H as XIAOMI_DEFAULT_MODEL_REF, I as applyXaiProviderConfig, J as setMinimaxApiKey, K as setGeminiApiKey, L as applyXiaomiConfig, M as applyVeniceProviderConfig, N as applyVercelAiGatewayConfig, O as applyOpenrouterProviderConfig, P as applyVercelAiGatewayProviderConfig, Q as setSyntheticApiKey, R as applyXiaomiProviderConfig, S as applyKimiCodeProviderConfig, T as applyMoonshotProviderConfig, U as ZAI_DEFAULT_MODEL_REF, V as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, W as setAnthropicApiKey, X as setOpencodeZenApiKey, Y as setMoonshotApiKey, Z as setOpenrouterApiKey, _ as applyMinimaxProviderConfig, at as KIMI_CODING_MODEL_REF, b as applyCloudflareAiGatewayProviderConfig, ct as buildTokenProfileId, d as resolvePluginProviders, et as setVercelAiGatewayApiKey, f as applyOpencodeZenConfig, g as applyMinimaxConfig, h as applyMinimaxApiProviderConfig, i as formatTokenK, it as writeOAuthCredentials, j as applyVeniceConfig, k as applySyntheticConfig, l as createVpsAwareOAuthHandlers, lt as validateAnthropicSetupToken, m as applyMinimaxApiConfig, nt as setXiaomiApiKey, ot as MOONSHOT_DEFAULT_MODEL_REF, p as applyOpencodeZenProviderConfig, q as setKimiCodingApiKey, rt as setZaiApiKey, st as XAI_DEFAULT_MODEL_REF, t as githubCopilotLoginCommand, tt as setXaiApiKey, u as isRemoteEnvironment, v as applyAuthProfileConfig, w as applyMoonshotConfigCn, x as applyKimiCodeConfig, y as applyCloudflareAiGatewayConfig, z as applyZaiConfig } from "./github-copilot-auth-C8Uf0Q03.js";
+import { a as enablePluginInConfig } from "./onboard-channels-DKT27PdN.js";
+import { t as scanDirectoryWithSummary } from "./skill-scanner-BoGjHXUZ.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-CEvVUD3U.js";
+import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-D9Al4QRv.js";
 import path from "node:path";
 import fs from "node:fs";
 import { randomBytes } from "node:crypto";
@@ -24,6 +22,12 @@ import { Readable } from "node:stream";
 
 //#region src/commands/auth-choice-options.ts
 const AUTH_CHOICE_GROUP_DEFS = [
+	{
+		value: "xai",
+		label: "xAI (Grok)",
+		hint: "API key",
+		choices: ["xai-api-key"]
+	},
 	{
 		value: "openai",
 		label: "OpenAI",
@@ -151,6 +155,10 @@ function buildAuthChoiceOptions(params) {
 		value: "openrouter-api-key",
 		label: "OpenRouter API key"
 	});
+	options.push({
+		value: "xai-api-key",
+		label: "xAI (Grok) API key"
+	});
 	options.push({
 		value: "ai-gateway-api-key",
 		label: "Vercel AI Gateway API key"
@@ -398,6 +406,28 @@ async function applyAuthChoiceAnthropic(params) {
 	return null;
 }
 
+//#endregion
+//#region src/commands/model-allowlist.ts
+function ensureModelAllowlistEntry(params) {
+	const rawModelRef = params.modelRef.trim();
+	if (!rawModelRef) return params.cfg;
+	const models = { ...params.cfg.agents?.defaults?.models };
+	const keySet = new Set([rawModelRef]);
+	const canonicalKey = resolveAllowlistModelKey(rawModelRef, params.defaultProvider ?? DEFAULT_PROVIDER);
+	if (canonicalKey) keySet.add(canonicalKey);
+	for (const key of keySet) models[key] = { ...models[key] };
+	return {
+		...params.cfg,
+		agents: {
+			...params.cfg.agents,
+			defaults: {
+				...params.cfg.agents?.defaults,
+				models
+			}
+		}
+	};
+}
+
 //#endregion
 //#region src/commands/auth-choice.default-model.ts
 async function applyDefaultModelChoice(params) {
@@ -406,10 +436,13 @@ async function applyDefaultModelChoice(params) {
 		if (params.noteDefault) await params.prompter.note(`Default model set to ${params.noteDefault}`, "Model configured");
 		return { config: next };
 	}
-	const next = params.applyProviderConfig(params.config);
+	const nextWithModel = ensureModelAllowlistEntry({
+		cfg: params.applyProviderConfig(params.config),
+		modelRef: params.defaultModel
+	});
 	await params.noteAgentModel(params.defaultModel);
 	return {
-		config: next,
+		config: nextWithModel,
 		agentModelOverride: params.defaultModel
 	};
 }
@@ -446,7 +479,7 @@ function applyGoogleGeminiModelDefault(cfg) {
 
 //#endregion
 //#region src/commands/opencode-zen-model-default.ts
-const OPENCODE_ZEN_DEFAULT_MODEL = "opencode/claude-opus-4-5";
+const OPENCODE_ZEN_DEFAULT_MODEL = "opencode/claude-opus-4-6";
 
 //#endregion
 //#region src/commands/auth-choice.apply.api-providers.ts
@@ -1047,7 +1080,7 @@ async function applyAuthChoiceApiProviders(params) {
 		if (!hasCredential) await params.prompter.note([
 			"OpenCode Zen provides access to Claude, GPT, Gemini, and more models.",
 			"Get your API key at: https://opencode.ai/auth",
-			"Requires an active OpenCode Zen subscription."
+			"OpenCode Zen bills per request. Check your OpenCode dashboard for details."
 		].join("\n"), "OpenCode Zen");
 		const envKey = resolveEnvApiKey("opencode");
 		if (envKey) {
@@ -1623,7 +1656,7 @@ function upsertSharedEnvVar(params) {
 
 //#endregion
 //#region src/commands/openai-codex-model-default.ts
-const OPENAI_CODEX_DEFAULT_MODEL = "openai-codex/gpt-5.2";
+const OPENAI_CODEX_DEFAULT_MODEL = "openai-codex/gpt-5.3-codex";
 function shouldSetOpenAICodexModel(model) {
 	const trimmed = model?.trim();
 	if (!trimmed) return true;
@@ -1659,12 +1692,59 @@ function applyOpenAICodexModelDefault(cfg) {
 	};
 }
 
+//#endregion
+//#region src/commands/openai-model-default.ts
+const OPENAI_DEFAULT_MODEL = "openai/gpt-5.1-codex";
+function applyOpenAIProviderConfig(cfg) {
+	const next = ensureModelAllowlistEntry({
+		cfg,
+		modelRef: OPENAI_DEFAULT_MODEL
+	});
+	const models = { ...next.agents?.defaults?.models };
+	models[OPENAI_DEFAULT_MODEL] = {
+		...models[OPENAI_DEFAULT_MODEL],
+		alias: models[OPENAI_DEFAULT_MODEL]?.alias ?? "GPT"
+	};
+	return {
+		...next,
+		agents: {
+			...next.agents,
+			defaults: {
+				...next.agents?.defaults,
+				models
+			}
+		}
+	};
+}
+function applyOpenAIConfig(cfg) {
+	const next = applyOpenAIProviderConfig(cfg);
+	return {
+		...next,
+		agents: {
+			...next.agents,
+			defaults: {
+				...next.agents?.defaults,
+				model: next.agents?.defaults?.model && typeof next.agents.defaults.model === "object" ? {
+					...next.agents.defaults.model,
+					primary: OPENAI_DEFAULT_MODEL
+				} : { primary: OPENAI_DEFAULT_MODEL }
+			}
+		}
+	};
+}
+
 //#endregion
 //#region src/commands/auth-choice.apply.openai.ts
 async function applyAuthChoiceOpenAI(params) {
 	let authChoice = params.authChoice;
 	if (authChoice === "apiKey" && params.opts?.tokenProvider === "openai") authChoice = "openai-api-key";
 	if (authChoice === "openai-api-key") {
+		let nextConfig = params.config;
+		let agentModelOverride;
+		const noteAgentModel = async (model) => {
+			if (!params.agentId) return;
+			await params.prompter.note(`Default model set to ${model} for agent "${params.agentId}".`, "Model configured");
+		};
 		const envKey = resolveEnvApiKey("openai");
 		if (envKey) {
 			if (await params.prompter.confirm({
@@ -1677,7 +1757,22 @@ async function applyAuthChoiceOpenAI(params) {
 				});
 				if (!process.env.OPENAI_API_KEY) process.env.OPENAI_API_KEY = envKey.apiKey;
 				await params.prompter.note(`Copied OPENAI_API_KEY to ${result.path} for launchd compatibility.`, "OpenAI API key");
-				return { config: params.config };
+				const applied = await applyDefaultModelChoice({
+					config: nextConfig,
+					setDefaultModel: params.setDefaultModel,
+					defaultModel: OPENAI_DEFAULT_MODEL,
+					applyDefaultConfig: applyOpenAIConfig,
+					applyProviderConfig: applyOpenAIProviderConfig,
+					noteDefault: OPENAI_DEFAULT_MODEL,
+					noteAgentModel,
+					prompter: params.prompter
+				});
+				nextConfig = applied.config;
+				agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
+				return {
+					config: nextConfig,
+					agentModelOverride
+				};
 			}
 		}
 		let key;
@@ -1693,7 +1788,22 @@ async function applyAuthChoiceOpenAI(params) {
 		});
 		process.env.OPENAI_API_KEY = trimmed;
 		await params.prompter.note(`Saved OPENAI_API_KEY to ${result.path} for launchd compatibility.`, "OpenAI API key");
-		return { config: params.config };
+		const applied = await applyDefaultModelChoice({
+			config: nextConfig,
+			setDefaultModel: params.setDefaultModel,
+			defaultModel: OPENAI_DEFAULT_MODEL,
+			applyDefaultConfig: applyOpenAIConfig,
+			applyProviderConfig: applyOpenAIProviderConfig,
+			noteDefault: OPENAI_DEFAULT_MODEL,
+			noteAgentModel,
+			prompter: params.prompter
+		});
+		nextConfig = applied.config;
+		agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
+		return {
+			config: nextConfig,
+			agentModelOverride
+		};
 	}
 	if (params.authChoice === "openai-codex") {
 		let nextConfig = params.config;
@@ -1769,6 +1879,66 @@ async function applyAuthChoiceQwenPortal(params) {
 	});
 }
 
+//#endregion
+//#region src/commands/auth-choice.apply.xai.ts
+async function applyAuthChoiceXAI(params) {
+	if (params.authChoice !== "xai-api-key") return null;
+	let nextConfig = params.config;
+	let agentModelOverride;
+	const noteAgentModel = async (model) => {
+		if (!params.agentId) return;
+		await params.prompter.note(`Default model set to ${model} for agent "${params.agentId}".`, "Model configured");
+	};
+	let hasCredential = false;
+	const optsKey = params.opts?.xaiApiKey?.trim();
+	if (optsKey) {
+		setXaiApiKey(normalizeApiKeyInput(optsKey), params.agentDir);
+		hasCredential = true;
+	}
+	if (!hasCredential) {
+		const envKey = resolveEnvApiKey("xai");
+		if (envKey) {
+			if (await params.prompter.confirm({
+				message: `Use existing XAI_API_KEY (${envKey.source}, ${formatApiKeyPreview(envKey.apiKey)})?`,
+				initialValue: true
+			})) {
+				setXaiApiKey(envKey.apiKey, params.agentDir);
+				hasCredential = true;
+			}
+		}
+	}
+	if (!hasCredential) {
+		const key = await params.prompter.text({
+			message: "Enter xAI API key",
+			validate: validateApiKeyInput
+		});
+		setXaiApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+	}
+	nextConfig = applyAuthProfileConfig(nextConfig, {
+		profileId: "xai:default",
+		provider: "xai",
+		mode: "api_key"
+	});
+	{
+		const applied = await applyDefaultModelChoice({
+			config: nextConfig,
+			setDefaultModel: params.setDefaultModel,
+			defaultModel: XAI_DEFAULT_MODEL_REF,
+			applyDefaultConfig: applyXaiConfig,
+			applyProviderConfig: applyXaiProviderConfig,
+			noteDefault: XAI_DEFAULT_MODEL_REF,
+			noteAgentModel,
+			prompter: params.prompter
+		});
+		nextConfig = applied.config;
+		agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
+	}
+	return {
+		config: nextConfig,
+		agentModelOverride
+	};
+}
+
 //#endregion
 //#region src/commands/auth-choice.apply.ts
 async function applyAuthChoice(params) {
@@ -1782,7 +1952,8 @@ async function applyAuthChoice(params) {
 		applyAuthChoiceGoogleAntigravity,
 		applyAuthChoiceGoogleGeminiCli,
 		applyAuthChoiceCopilotProxy,
-		applyAuthChoiceQwenPortal
+		applyAuthChoiceQwenPortal,
+		applyAuthChoiceXAI
 	];
 	for (const handler of handlers) {
 		const result = await handler(params);
@@ -1864,6 +2035,7 @@ const PREFERRED_PROVIDER_BY_AUTH_CHOICE = {
 	"minimax-api-lightning": "minimax",
 	minimax: "lmstudio",
 	"opencode-zen": "opencode",
+	"xai-api-key": "xai",
 	"qwen-portal": "qwen-portal",
 	"minimax-portal": "minimax-portal"
 };
@@ -1871,145 +2043,6 @@ function resolvePreferredProviderForAuthChoice(choice) {
 	return PREFERRED_PROVIDER_BY_AUTH_CHOICE[choice];
 }
 
-//#endregion
-//#region src/infra/control-ui-assets.ts
-function resolveControlUiRepoRoot(argv1 = process.argv[1]) {
-	if (!argv1) return null;
-	const normalized = path.resolve(argv1);
-	const parts = normalized.split(path.sep);
-	const srcIndex = parts.lastIndexOf("src");
-	if (srcIndex !== -1) {
-		const root = parts.slice(0, srcIndex).join(path.sep);
-		if (fs.existsSync(path.join(root, "ui", "vite.config.ts"))) return root;
-	}
-	let dir = path.dirname(normalized);
-	for (let i = 0; i < 8; i++) {
-		if (fs.existsSync(path.join(dir, "package.json")) && fs.existsSync(path.join(dir, "ui", "vite.config.ts"))) return dir;
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-async function resolveControlUiDistIndexPath(argv1 = process.argv[1]) {
-	if (!argv1) return null;
-	const normalized = path.resolve(argv1);
-	const distDir = path.dirname(normalized);
-	if (path.basename(distDir) === "dist") return path.join(distDir, "control-ui", "index.html");
-	const packageRoot = await resolveOpenClawPackageRoot({ argv1: normalized });
-	if (!packageRoot) return null;
-	return path.join(packageRoot, "dist", "control-ui", "index.html");
-}
-function addCandidate(candidates, value) {
-	if (!value) return;
-	candidates.add(path.resolve(value));
-}
-function resolveControlUiRootOverrideSync(rootOverride) {
-	const resolved = path.resolve(rootOverride);
-	try {
-		const stats = fs.statSync(resolved);
-		if (stats.isFile()) return path.basename(resolved) === "index.html" ? path.dirname(resolved) : null;
-		if (stats.isDirectory()) {
-			const indexPath = path.join(resolved, "index.html");
-			return fs.existsSync(indexPath) ? resolved : null;
-		}
-	} catch {
-		return null;
-	}
-	return null;
-}
-function resolveControlUiRootSync(opts = {}) {
-	const candidates = /* @__PURE__ */ new Set();
-	const argv1 = opts.argv1 ?? process.argv[1];
-	const cwd = opts.cwd ?? process.cwd();
-	const moduleDir = opts.moduleUrl ? path.dirname(fileURLToPath(opts.moduleUrl)) : null;
-	const argv1Dir = argv1 ? path.dirname(path.resolve(argv1)) : null;
-	const execDir = (() => {
-		try {
-			const execPath = opts.execPath ?? process.execPath;
-			return path.dirname(fs.realpathSync(execPath));
-		} catch {
-			return null;
-		}
-	})();
-	const packageRoot = resolveOpenClawPackageRootSync({
-		argv1,
-		moduleUrl: opts.moduleUrl,
-		cwd
-	});
-	addCandidate(candidates, execDir ? path.join(execDir, "control-ui") : null);
-	if (moduleDir) {
-		addCandidate(candidates, path.join(moduleDir, "control-ui"));
-		addCandidate(candidates, path.join(moduleDir, "../control-ui"));
-		addCandidate(candidates, path.join(moduleDir, "../../dist/control-ui"));
-	}
-	if (argv1Dir) {
-		addCandidate(candidates, path.join(argv1Dir, "dist", "control-ui"));
-		addCandidate(candidates, path.join(argv1Dir, "control-ui"));
-	}
-	if (packageRoot) addCandidate(candidates, path.join(packageRoot, "dist", "control-ui"));
-	addCandidate(candidates, path.join(cwd, "dist", "control-ui"));
-	for (const dir of candidates) {
-		const indexPath = path.join(dir, "index.html");
-		if (fs.existsSync(indexPath)) return dir;
-	}
-	return null;
-}
-function summarizeCommandOutput(text) {
-	const lines = text.split(/\r?\n/g).map((l) => l.trim()).filter(Boolean);
-	if (!lines.length) return;
-	const last = lines.at(-1);
-	if (!last) return;
-	return last.length > 240 ? `${last.slice(0, 239)}…` : last;
-}
-async function ensureControlUiAssetsBuilt(runtime = defaultRuntime, opts) {
-	const indexFromDist = await resolveControlUiDistIndexPath(process.argv[1]);
-	if (indexFromDist && fs.existsSync(indexFromDist)) return {
-		ok: true,
-		built: false
-	};
-	const repoRoot = resolveControlUiRepoRoot(process.argv[1]);
-	if (!repoRoot) return {
-		ok: false,
-		built: false,
-		message: `${indexFromDist ? `Missing Control UI assets at ${indexFromDist}` : "Missing Control UI assets"}. Build them with \`pnpm ui:build\` (auto-installs UI deps).`
-	};
-	const indexPath = path.join(repoRoot, "dist", "control-ui", "index.html");
-	if (fs.existsSync(indexPath)) return {
-		ok: true,
-		built: false
-	};
-	const uiScript = path.join(repoRoot, "scripts", "ui.js");
-	if (!fs.existsSync(uiScript)) return {
-		ok: false,
-		built: false,
-		message: `Control UI assets missing but ${uiScript} is unavailable.`
-	};
-	runtime.log("Control UI assets missing; building (ui:build, auto-installs UI deps)…");
-	const build = await runCommandWithTimeout([
-		process.execPath,
-		uiScript,
-		"build"
-	], {
-		cwd: repoRoot,
-		timeoutMs: opts?.timeoutMs ?? 10 * 6e4
-	});
-	if (build.code !== 0) return {
-		ok: false,
-		built: false,
-		message: `Control UI build failed: ${summarizeCommandOutput(build.stderr) ?? `exit ${build.code}`}`
-	};
-	if (!fs.existsSync(indexPath)) return {
-		ok: false,
-		built: true,
-		message: `Control UI build completed but ${indexPath} is still missing.`
-	};
-	return {
-		ok: true,
-		built: true
-	};
-}
-
 //#endregion
 //#region src/commands/model-picker.ts
 const KEEP_VALUE = "__keep__";
@@ -2202,7 +2235,7 @@ async function promptModelAllowlist(params) {
 		const raw = await params.prompter.text({
 			message: params.message ?? "Allowlist models (comma-separated provider/model; blank to keep current)",
 			initialValue: existingKeys.join(", "),
-			placeholder: "openai-codex/gpt-5.2, anthropic/claude-opus-4-5"
+			placeholder: `${OPENAI_CODEX_DEFAULT_MODEL}, anthropic/claude-opus-4-6`
 		});
 		const parsed = String(raw ?? "").split(",").map((value) => value.trim()).filter((value) => value.length > 0);
 		if (parsed.length === 0) return {};
@@ -2859,6 +2892,33 @@ function formatInstallFailureMessage(result) {
 	if (!summary) return `Install failed (${code})`;
 	return `Install failed (${code}): ${summary}`;
 }
+function withWarnings(result, warnings) {
+	if (warnings.length === 0) return result;
+	return {
+		...result,
+		warnings: warnings.slice()
+	};
+}
+function formatScanFindingDetail(rootDir, finding) {
+	const relativePath = path.relative(rootDir, finding.file);
+	const filePath = relativePath && relativePath !== "." && !relativePath.startsWith("..") ? relativePath : path.basename(finding.file);
+	return `${finding.message} (${filePath}:${finding.line})`;
+}
+async function collectSkillInstallScanWarnings(entry) {
+	const warnings = [];
+	const skillName = entry.skill.name;
+	const skillDir = path.resolve(entry.skill.baseDir);
+	try {
+		const summary = await scanDirectoryWithSummary(skillDir);
+		if (summary.critical > 0) {
+			const criticalDetails = summary.findings.filter((finding) => finding.severity === "critical").map((finding) => formatScanFindingDetail(skillDir, finding)).join("; ");
+			warnings.push(`WARNING: Skill "${skillName}" contains dangerous code patterns: ${criticalDetails}`);
+		} else if (summary.warn > 0) warnings.push(`Skill "${skillName}" has ${summary.warn} suspicious code pattern(s). Run "openclaw security audit --deep" for details.`);
+	} catch (err) {
+		warnings.push(`Skill "${skillName}" code safety scan failed (${String(err)}). Installation continues; run "openclaw security audit --deep" after install.`);
+	}
+	return warnings;
+}
 function resolveInstallId(spec, index) {
 	return (spec.id ?? `${spec.kind}-${index}`).trim();
 }
@@ -3093,61 +3153,62 @@ async function installSkill(params) {
 		code: null
 	};
 	const spec = findInstallSpec(entry, params.installId);
-	if (!spec) return {
+	const warnings = await collectSkillInstallScanWarnings(entry);
+	if (!spec) return withWarnings({
 		ok: false,
 		message: `Installer not found: ${params.installId}`,
 		stdout: "",
 		stderr: "",
 		code: null
-	};
-	if (spec.kind === "download") return await installDownloadSpec({
+	}, warnings);
+	if (spec.kind === "download") return withWarnings(await installDownloadSpec({
 		entry,
 		spec,
 		timeoutMs
-	});
+	}), warnings);
 	const command = buildInstallCommand(spec, resolveSkillsInstallPreferences(params.config));
-	if (command.error) return {
+	if (command.error) return withWarnings({
 		ok: false,
 		message: command.error,
 		stdout: "",
 		stderr: "",
 		code: null
-	};
+	}, warnings);
 	const brewExe = hasBinary("brew") ? "brew" : resolveBrewExecutable();
-	if (spec.kind === "brew" && !brewExe) return {
+	if (spec.kind === "brew" && !brewExe) return withWarnings({
 		ok: false,
 		message: "brew not installed",
 		stdout: "",
 		stderr: "",
 		code: null
-	};
+	}, warnings);
 	if (spec.kind === "uv" && !hasBinary("uv")) if (brewExe) {
 		const brewResult = await runCommandWithTimeout([
 			brewExe,
 			"install",
 			"uv"
 		], { timeoutMs });
-		if (brewResult.code !== 0) return {
+		if (brewResult.code !== 0) return withWarnings({
 			ok: false,
 			message: "Failed to install uv (brew)",
 			stdout: brewResult.stdout.trim(),
 			stderr: brewResult.stderr.trim(),
 			code: brewResult.code
-		};
-	} else return {
+		}, warnings);
+	} else return withWarnings({
 		ok: false,
 		message: "uv not installed (install via brew)",
 		stdout: "",
 		stderr: "",
 		code: null
-	};
-	if (!command.argv || command.argv.length === 0) return {
+	}, warnings);
+	if (!command.argv || command.argv.length === 0) return withWarnings({
 		ok: false,
 		message: "invalid install command",
 		stdout: "",
 		stderr: "",
 		code: null
-	};
+	}, warnings);
 	if (spec.kind === "brew" && brewExe && command.argv[0] === "brew") command.argv[0] = brewExe;
 	if (spec.kind === "go" && !hasBinary("go")) if (brewExe) {
 		const brewResult = await runCommandWithTimeout([
@@ -3155,20 +3216,20 @@ async function installSkill(params) {
 			"install",
 			"go"
 		], { timeoutMs });
-		if (brewResult.code !== 0) return {
+		if (brewResult.code !== 0) return withWarnings({
 			ok: false,
 			message: "Failed to install go (brew)",
 			stdout: brewResult.stdout.trim(),
 			stderr: brewResult.stderr.trim(),
 			code: brewResult.code
-		};
-	} else return {
+		}, warnings);
+	} else return withWarnings({
 		ok: false,
 		message: "go not installed (install via brew)",
 		stdout: "",
 		stderr: "",
 		code: null
-	};
+	}, warnings);
 	let env;
 	if (spec.kind === "go" && brewExe) {
 		const brewBin = await resolveBrewBinDir(timeoutMs, brewExe);
@@ -3195,13 +3256,13 @@ async function installSkill(params) {
 		}
 	})();
 	const success = result.code === 0;
-	return {
+	return withWarnings({
 		ok: success,
 		message: success ? "Installed" : formatInstallFailureMessage(result),
 		stdout: result.stdout.trim(),
 		stderr: result.stderr.trim(),
 		code: result.code
-	};
+	}, warnings);
 }
 
 //#endregion
@@ -3296,16 +3357,20 @@ async function setupSkills(cfg, workspaceDir, runtime, prompter) {
 				installId,
 				config: next
 			});
-			if (result.ok) spin.stop(`Installed ${name}`);
-			else {
-				const code = result.code == null ? "" : ` (exit ${result.code})`;
-				const detail = summarizeInstallFailure(result.message);
-				spin.stop(`Install failed: ${name}${code}${detail ? ` — ${detail}` : ""}`);
-				if (result.stderr) runtime.log(result.stderr.trim());
-				else if (result.stdout) runtime.log(result.stdout.trim());
-				runtime.log(`Tip: run \`${formatCliCommand("openclaw doctor")}\` to review skills + requirements.`);
-				runtime.log("Docs: https://docs.openclaw.ai/skills");
+			const warnings = result.warnings ?? [];
+			if (result.ok) {
+				spin.stop(warnings.length > 0 ? `Installed ${name} (with warnings)` : `Installed ${name}`);
+				for (const warning of warnings) runtime.log(warning);
+				continue;
 			}
+			const code = result.code == null ? "" : ` (exit ${result.code})`;
+			const detail = summarizeInstallFailure(result.message);
+			spin.stop(`Install failed: ${name}${code}${detail ? ` — ${detail}` : ""}`);
+			for (const warning of warnings) runtime.log(warning);
+			if (result.stderr) runtime.log(result.stderr.trim());
+			else if (result.stdout) runtime.log(result.stdout.trim());
+			runtime.log(`Tip: run \`${formatCliCommand("openclaw doctor")}\` to review skills + requirements.`);
+			runtime.log("Docs: https://docs.openclaw.ai/skills");
 		}
 	}
 	for (const skill of missing) {
@@ -3324,4 +3389,4 @@ async function setupSkills(cfg, workspaceDir, runtime, prompter) {
 }
 
 //#endregion
-export { applyGoogleGeminiModelDefault as _, applyModelAllowlist as a, promptDefaultModel as c, resolveControlUiRootOverrideSync as d, resolveControlUiRootSync as f, upsertSharedEnvVar as g, applyAuthChoice as h, discoverGatewayBeacons as i, promptModelAllowlist as l, warnIfModelConfigLooksOff as m, installSkill as n, applyModelFallbacksFromSelection as o, resolvePreferredProviderForAuthChoice as p, promptRemoteGatewayConfig as r, applyPrimaryModel as s, setupSkills as t, ensureControlUiAssetsBuilt as u, promptAuthChoiceGrouped as v };
+export { applyModelAllowlist as a, promptDefaultModel as c, warnIfModelConfigLooksOff as d, applyAuthChoice as f, promptAuthChoiceGrouped as g, applyGoogleGeminiModelDefault as h, discoverGatewayBeacons as i, promptModelAllowlist as l, upsertSharedEnvVar as m, installSkill as n, applyModelFallbacksFromSelection as o, applyOpenAIConfig as p, promptRemoteGatewayConfig as r, applyPrimaryModel as s, setupSkills as t, resolvePreferredProviderForAuthChoice as u };