@gguf/claw 2026.2.9 → 2026.2.13

package/dist/{config-CQt4vGxI.js → config-7NCznPmF.js}

@@ -1,13 +1,14 @@
 import { a as resolveOAuthDir, n as resolveConfigPath, r as resolveDefaultConfigCandidates, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-rb94mUrR.js";
-import { M as normalizeAgentId, T as DEFAULT_AGENT_ID, c as resolveDefaultAgentId, j as normalizeAccountId, s as resolveAgentWorkspaceDir, w as DEFAULT_ACCOUNT_ID } from "./agent-scope-Dpav7C-i.js";
-import { A as isPlainObject, I as resolveConfigDir, N as jidToE164, R as resolveUserPath, Z as success, j as isRecord, m as CHANNEL_IDS, nt as getChildLogger, q as info, u as defaultRuntime, y as normalizeChatChannelId } from "./exec-Bas1hoSJ.js";
-import { D as shouldEnableShellEnvFallback, E as shouldDeferShellEnvFallback, T as resolveShellEnvFallbackTimeoutMs, U as DEFAULT_CONTEXT_TOKENS, s as parseModelRef, w as loadShellEnvFallback } from "./model-selection-DlV6wnTr.js";
+import { M as normalizeAgentId, T as DEFAULT_AGENT_ID, c as resolveDefaultAgentId, j as normalizeAccountId, s as resolveAgentWorkspaceDir, w as DEFAULT_ACCOUNT_ID } from "./agent-scope-okUOVjE5.js";
+import { A as isPlainObject$1, I as resolveConfigDir, N as jidToE164, R as resolveUserPath, Z as success, j as isRecord, m as CHANNEL_IDS, nt as getChildLogger, q as info, u as defaultRuntime, y as normalizeChatChannelId } from "./exec-EKUaAU91.js";
+import { D as shouldEnableShellEnvFallback, E as shouldDeferShellEnvFallback, T as resolveShellEnvFallbackTimeoutMs, U as DEFAULT_CONTEXT_TOKENS, s as parseModelRef, w as loadShellEnvFallback } from "./model-selection-vC82fEiP.js";
 import { createRequire } from "node:module";
 import path from "node:path";
 import fs from "node:fs";
 import os from "node:os";
 import JSON5 from "json5";
 import fs$1 from "node:fs/promises";
+import { isDeepStrictEqual } from "node:util";
 import { fileURLToPath } from "node:url";
 import crypto from "node:crypto";
 import dotenv from "dotenv";
@@ -49,6 +50,9 @@ function maybeRestoreCredsFromBackup(authDir) {
 		if (!backupRaw) return;
 		JSON.parse(backupRaw);
 		fs.copyFileSync(backupPath, credsPath);
+		try {
+			fs.chmodSync(credsPath, 384);
+		} catch {}
 		logger.warn({ credsPath }, "restored corrupted WhatsApp creds.json from backup");
 	} catch {}
 }
@@ -765,7 +769,7 @@ function substituteString(value, env, configPath) {
 function substituteAny(value, env, path) {
 	if (typeof value === "string") return substituteString(value, env, path);
 	if (Array.isArray(value)) return value.map((item, index) => substituteAny(item, env, `${path}[${index}]`));
-	if (isPlainObject(value)) {
+	if (isPlainObject$1(value)) {
 		const result = {};
 		for (const [key, val] of Object.entries(value)) result[key] = substituteAny(val, env, path ? `${path}.${key}` : key);
 		return result;
@@ -835,7 +839,7 @@ var CircularIncludeError = class extends ConfigIncludeError {
 /** Deep merge: arrays concatenate, objects merge recursively, primitives: source wins */
 function deepMerge(target, source) {
 	if (Array.isArray(target) && Array.isArray(source)) return [...target, ...source];
-	if (isPlainObject(target) && isPlainObject(source)) {
+	if (isPlainObject$1(target) && isPlainObject$1(source)) {
 		const result = { ...target };
 		for (const key of Object.keys(source)) result[key] = key in result ? deepMerge(result[key], source[key]) : source[key];
 		return result;
@@ -852,7 +856,7 @@ var IncludeProcessor = class IncludeProcessor {
 	}
 	process(obj) {
 		if (Array.isArray(obj)) return obj.map((item) => this.process(item));
-		if (!isPlainObject(obj)) return obj;
+		if (!isPlainObject$1(obj)) return obj;
 		if (!(INCLUDE_KEY in obj)) return this.processObject(obj);
 		return this.processInclude(obj);
 	}
@@ -866,7 +870,7 @@ var IncludeProcessor = class IncludeProcessor {
 		const otherKeys = Object.keys(obj).filter((k) => k !== INCLUDE_KEY);
 		const included = this.resolveInclude(includeValue);
 		if (otherKeys.length === 0) return included;
-		if (!isPlainObject(included)) throw new ConfigIncludeError("Sibling keys require included content to be an object", typeof includeValue === "string" ? includeValue : INCLUDE_KEY);
+		if (!isPlainObject$1(included)) throw new ConfigIncludeError("Sibling keys require included content to be an object", typeof includeValue === "string" ? includeValue : INCLUDE_KEY);
 		const rest = {};
 		for (const key of otherKeys) rest[key] = this.process(obj[key]);
 		return deepMerge(included, rest);
@@ -929,6 +933,30 @@ function resolveConfigIncludes(obj, configPath, resolver = defaultResolver) {
 	return new IncludeProcessor(configPath, resolver).process(obj);
 }
 
+//#endregion
+//#region src/infra/exec-safety.ts
+const SHELL_METACHARS = /[;&|`$<>]/;
+const CONTROL_CHARS = /[\r\n]/;
+const QUOTE_CHARS = /["']/;
+const BARE_NAME_PATTERN = /^[A-Za-z0-9._+-]+$/;
+function isLikelyPath(value) {
+	if (value.startsWith(".") || value.startsWith("~")) return true;
+	if (value.includes("/") || value.includes("\\")) return true;
+	return /^[A-Za-z]:[\\/]/.test(value);
+}
+function isSafeExecutableValue(value) {
+	if (!value) return false;
+	const trimmed = value.trim();
+	if (!trimmed) return false;
+	if (trimmed.includes("\0")) return false;
+	if (CONTROL_CHARS.test(trimmed)) return false;
+	if (SHELL_METACHARS.test(trimmed)) return false;
+	if (QUOTE_CHARS.test(trimmed)) return false;
+	if (isLikelyPath(trimmed)) return true;
+	if (trimmed.startsWith("-")) return false;
+	return BARE_NAME_PATTERN.test(trimmed);
+}
+
 //#endregion
 //#region src/config/legacy.shared.ts
 const getRecord = (value) => isRecord(value) ? value : null;
@@ -950,16 +978,16 @@ const mergeMissing = (target, source) => {
 		if (isRecord(existing) && isRecord(value)) mergeMissing(existing, value);
 	}
 };
-const AUDIO_TRANSCRIPTION_CLI_ALLOWLIST = new Set(["whisper"]);
 const mapLegacyAudioTranscription = (value) => {
 	const transcriber = getRecord(value);
 	const command = Array.isArray(transcriber?.command) ? transcriber?.command : null;
 	if (!command || command.length === 0) return null;
-	const rawExecutable = String(command[0] ?? "").trim();
+	if (typeof command[0] !== "string") return null;
+	if (!command.every((part) => typeof part === "string")) return null;
+	const rawExecutable = command[0].trim();
 	if (!rawExecutable) return null;
-	const executableName = rawExecutable.split(/[\\/]/).pop() ?? rawExecutable;
-	if (!AUDIO_TRANSCRIPTION_CLI_ALLOWLIST.has(executableName)) return null;
-	const args = command.slice(1).map((part) => String(part));
+	if (!isSafeExecutableValue(rawExecutable)) return null;
+	const args = command.slice(1);
 	const timeoutSeconds = typeof transcriber?.timeoutSeconds === "number" ? transcriber?.timeoutSeconds : void 0;
 	const result = {
 		command: rawExecutable,
@@ -1423,30 +1451,35 @@ const LEGACY_CONFIG_MIGRATIONS_PART_2 = [
 						mediaAudio.models = [mapped];
 						changes.push("Moved routing.transcribeAudio → tools.media.audio.models.");
 					} else changes.push("Removed routing.transcribeAudio (tools.media.audio.models already set).");
-				} else changes.push("Removed routing.transcribeAudio (unsupported transcription CLI).");
+				} else changes.push("Removed routing.transcribeAudio (invalid or empty command).");
 				delete routing.transcribeAudio;
 			}
+			if (Object.keys(routing).length === 0) delete raw.routing;
+		}
+	},
+	{
+		id: "audio.transcription-v2",
+		describe: "Move audio.transcription to tools.media.audio.models",
+		apply: (raw, changes) => {
 			const audio = getRecord(raw.audio);
-			if (audio?.transcription !== void 0) {
-				const mapped = mapLegacyAudioTranscription(audio.transcription);
-				if (mapped) {
-					const mediaAudio = ensureRecord(ensureRecord(ensureRecord(raw, "tools"), "media"), "audio");
-					if ((Array.isArray(mediaAudio.models) ? mediaAudio.models : []).length === 0) {
-						mediaAudio.enabled = true;
-						mediaAudio.models = [mapped];
-						changes.push("Moved audio.transcription → tools.media.audio.models.");
-					} else changes.push("Removed audio.transcription (tools.media.audio.models already set).");
-					delete audio.transcription;
-					if (Object.keys(audio).length === 0) delete raw.audio;
-					else raw.audio = audio;
-				} else {
-					delete audio.transcription;
-					changes.push("Removed audio.transcription (unsupported transcription CLI).");
-					if (Object.keys(audio).length === 0) delete raw.audio;
-					else raw.audio = audio;
-				}
+			if (audio?.transcription === void 0) return;
+			const mapped = mapLegacyAudioTranscription(audio.transcription);
+			if (mapped) {
+				const mediaAudio = ensureRecord(ensureRecord(ensureRecord(raw, "tools"), "media"), "audio");
+				if ((Array.isArray(mediaAudio.models) ? mediaAudio.models : []).length === 0) {
+					mediaAudio.enabled = true;
+					mediaAudio.models = [mapped];
+					changes.push("Moved audio.transcription → tools.media.audio.models.");
+				} else changes.push("Removed audio.transcription (tools.media.audio.models already set).");
+				delete audio.transcription;
+				if (Object.keys(audio).length === 0) delete raw.audio;
+				else raw.audio = audio;
+			} else {
+				delete audio.transcription;
+				changes.push("Removed audio.transcription (invalid or empty command).");
+				if (Object.keys(audio).length === 0) delete raw.audio;
+				else raw.audio = audio;
 			}
-			if (Object.keys(routing).length === 0) delete raw.routing;
 		}
 	}
 ];
@@ -1771,6 +1804,26 @@ function findLegacyConfigIssues(raw) {
 	return issues;
 }
 
+//#endregion
+//#region src/config/merge-patch.ts
+function applyMergePatch(base, patch) {
+	if (!isPlainObject$1(patch)) return patch;
+	const result = isPlainObject$1(base) ? { ...base } : {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === null) {
+			delete result[key];
+			continue;
+		}
+		if (isPlainObject$1(value)) {
+			const baseValue = result[key];
+			result[key] = applyMergePatch(isPlainObject$1(baseValue) ? baseValue : {}, value);
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
+
 //#endregion
 //#region src/config/normalize-paths.ts
 const PATH_VALUE_RE = /^~(?=$|[\\/])/;
@@ -1789,11 +1842,11 @@ function normalizeAny(key, value) {
 		return value.map((entry) => {
 			if (typeof entry === "string") return normalizeChildren ? normalizeStringValue(key, entry) : entry;
 			if (Array.isArray(entry)) return normalizeAny(void 0, entry);
-			if (isPlainObject(entry)) return normalizeAny(void 0, entry);
+			if (isPlainObject$1(entry)) return normalizeAny(void 0, entry);
 			return entry;
 		});
 	}
-	if (!isPlainObject(value)) return value;
+	if (!isPlainObject$1(value)) return value;
 	for (const [childKey, childValue] of Object.entries(value)) {
 		const next = normalizeAny(childKey, childValue);
 		if (next !== childValue) value[childKey] = next;
@@ -1844,7 +1897,7 @@ function setConfigValueAtPath(root, path, value) {
 	for (let idx = 0; idx < path.length - 1; idx += 1) {
 		const key = path[idx];
 		const next = cursor[key];
-		if (!isPlainObject(next)) cursor[key] = {};
+		if (!isPlainObject$1(next)) cursor[key] = {};
 		cursor = cursor[key];
 	}
 	cursor[path[path.length - 1]] = value;
@@ -1855,7 +1908,7 @@ function unsetConfigValueAtPath(root, path) {
 	for (let idx = 0; idx < path.length - 1; idx += 1) {
 		const key = path[idx];
 		const next = cursor[key];
-		if (!isPlainObject(next)) return false;
+		if (!isPlainObject$1(next)) return false;
 		stack.push({
 			node: cursor,
 			key
@@ -1868,7 +1921,7 @@ function unsetConfigValueAtPath(root, path) {
 	for (let idx = stack.length - 1; idx >= 0; idx -= 1) {
 		const { node, key } = stack[idx];
 		const child = node[key];
-		if (isPlainObject(child) && Object.keys(child).length === 0) delete node[key];
+		if (isPlainObject$1(child) && Object.keys(child).length === 0) delete node[key];
 		else break;
 	}
 	return true;
@@ -1876,7 +1929,7 @@ function unsetConfigValueAtPath(root, path) {
 function getConfigValueAtPath(root, path) {
 	let cursor = root;
 	for (const key of path) {
-		if (!isPlainObject(cursor)) return;
+		if (!isPlainObject$1(cursor)) return;
 		cursor = cursor[key];
 	}
 	return cursor;
@@ -1886,7 +1939,7 @@ function getConfigValueAtPath(root, path) {
 //#region src/config/runtime-overrides.ts
 let overrides = {};
 function mergeOverrides(base, override) {
-	if (!isPlainObject(base) || !isPlainObject(override)) return override;
+	if (!isPlainObject$1(base) || !isPlainObject$1(override)) return override;
 	const next = { ...base };
 	for (const [key, value] of Object.entries(override)) {
 		if (value === void 0) continue;
@@ -1979,6 +2032,46 @@ const normalizePluginsConfig = (config) => {
 		entries: normalizePluginEntries(config?.entries)
 	};
 };
+const hasExplicitMemorySlot = (plugins) => Boolean(plugins?.slots && Object.prototype.hasOwnProperty.call(plugins.slots, "memory"));
+const hasExplicitMemoryEntry = (plugins) => Boolean(plugins?.entries && Object.prototype.hasOwnProperty.call(plugins.entries, "memory-core"));
+const hasExplicitPluginConfig = (plugins) => {
+	if (!plugins) return false;
+	if (typeof plugins.enabled === "boolean") return true;
+	if (Array.isArray(plugins.allow) && plugins.allow.length > 0) return true;
+	if (Array.isArray(plugins.deny) && plugins.deny.length > 0) return true;
+	if (plugins.load?.paths && Array.isArray(plugins.load.paths) && plugins.load.paths.length > 0) return true;
+	if (plugins.slots && Object.keys(plugins.slots).length > 0) return true;
+	if (plugins.entries && Object.keys(plugins.entries).length > 0) return true;
+	return false;
+};
+function applyTestPluginDefaults(cfg, env = process.env) {
+	if (!env.VITEST) return cfg;
+	const plugins = cfg.plugins;
+	if (hasExplicitPluginConfig(plugins)) {
+		if (hasExplicitMemorySlot(plugins) || hasExplicitMemoryEntry(plugins)) return cfg;
+		return {
+			...cfg,
+			plugins: {
+				...plugins,
+				slots: {
+					...plugins?.slots,
+					memory: "none"
+				}
+			}
+		};
+	}
+	return {
+		...cfg,
+		plugins: {
+			...plugins,
+			enabled: false,
+			slots: {
+				...plugins?.slots,
+				memory: "none"
+			}
+		}
+	};
+}
 function resolveEnableState(id, origin, config) {
 	if (!config.enabled) return {
 		enabled: false,
@@ -2574,28 +2667,8 @@ function parseDurationMs(raw, opts) {
 }
 
 //#endregion
-//#region src/infra/exec-safety.ts
-const SHELL_METACHARS = /[;&|`$<>]/;
-const CONTROL_CHARS = /[\r\n]/;
-const QUOTE_CHARS = /["']/;
-const BARE_NAME_PATTERN = /^[A-Za-z0-9._+-]+$/;
-function isLikelyPath(value) {
-	if (value.startsWith(".") || value.startsWith("~")) return true;
-	if (value.includes("/") || value.includes("\\")) return true;
-	return /^[A-Za-z]:[\\/]/.test(value);
-}
-function isSafeExecutableValue(value) {
-	if (!value) return false;
-	const trimmed = value.trim();
-	if (!trimmed) return false;
-	if (trimmed.includes("\0")) return false;
-	if (CONTROL_CHARS.test(trimmed)) return false;
-	if (SHELL_METACHARS.test(trimmed)) return false;
-	if (QUOTE_CHARS.test(trimmed)) return false;
-	if (isLikelyPath(trimmed)) return true;
-	if (trimmed.startsWith("-")) return false;
-	return BARE_NAME_PATTERN.test(trimmed);
-}
+//#region src/config/zod-schema.sensitive.ts
+const sensitive = z.registry();
 
 //#endregion
 //#region src/config/zod-schema.core.ts
@@ -2632,7 +2705,7 @@ const ModelDefinitionSchema = z.object({
 }).strict();
 const ModelProviderSchema = z.object({
 	baseUrl: z.string().min(1),
-	apiKey: z.string().optional(),
+	apiKey: z.string().optional().register(sensitive),
 	auth: z.union([
 		z.literal("api-key"),
 		z.literal("aws-sdk"),
@@ -2747,7 +2820,7 @@ const TtsConfigSchema = z.object({
 		allowSeed: z.boolean().optional()
 	}).strict().optional(),
 	elevenlabs: z.object({
-		apiKey: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
 		baseUrl: z.string().optional(),
 		voiceId: z.string().optional(),
 		modelId: z.string().optional(),
@@ -2767,7 +2840,7 @@ const TtsConfigSchema = z.object({
 		}).strict().optional()
 	}).strict().optional(),
 	openai: z.object({
-		apiKey: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
 		model: z.string().optional(),
 		voice: z.string().optional()
 	}).strict().optional(),
@@ -2856,6 +2929,7 @@ const QueueModeBySurfaceSchema = z.object({
 	whatsapp: QueueModeSchema.optional(),
 	telegram: QueueModeSchema.optional(),
 	discord: QueueModeSchema.optional(),
+	irc: QueueModeSchema.optional(),
 	slack: QueueModeSchema.optional(),
 	mattermost: QueueModeSchema.optional(),
 	signal: QueueModeSchema.optional(),
@@ -3115,17 +3189,17 @@ const ToolsWebSearchSchema = z.object({
 		z.literal("perplexity"),
 		z.literal("grok")
 	]).optional(),
-	apiKey: z.string().optional(),
+	apiKey: z.string().optional().register(sensitive),
 	maxResults: z.number().int().positive().optional(),
 	timeoutSeconds: z.number().int().positive().optional(),
 	cacheTtlMinutes: z.number().nonnegative().optional(),
 	perplexity: z.object({
-		apiKey: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
 		baseUrl: z.string().optional(),
 		model: z.string().optional()
 	}).strict().optional(),
 	grok: z.object({
-		apiKey: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
 		model: z.string().optional(),
 		inlineCitations: z.boolean().optional()
 	}).strict().optional()
@@ -3243,7 +3317,7 @@ const MemorySearchSchema = z.object({
 	]).optional(),
 	remote: z.object({
 		baseUrl: z.string().optional(),
-		apiKey: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
 		headers: z.record(z.string(), z.string()).optional(),
 		batch: z.object({
 			enabled: z.boolean().optional(),
@@ -3552,7 +3626,8 @@ const BindingsSchema = z.array(z.object({
 			id: z.string()
 		}).strict().optional(),
 		guildId: z.string().optional(),
-		teamId: z.string().optional()
+		teamId: z.string().optional(),
+		roles: z.array(z.string()).optional()
 	}).strict()
 }).strict()).optional();
 const BroadcastStrategySchema = z.enum(["parallel", "sequential"]);
@@ -3591,7 +3666,8 @@ const HookMappingSchema = z.object({
 	action: z.union([z.literal("wake"), z.literal("agent")]).optional(),
 	wakeMode: z.union([z.literal("now"), z.literal("next-heartbeat")]).optional(),
 	name: z.string().optional(),
-	sessionKey: z.string().optional(),
+	agentId: z.string().optional(),
+	sessionKey: z.string().optional().register(sensitive),
 	messageTemplate: z.string().optional(),
 	textTemplate: z.string().optional(),
 	deliver: z.boolean().optional(),
@@ -3601,6 +3677,7 @@ const HookMappingSchema = z.object({
 		z.literal("whatsapp"),
 		z.literal("telegram"),
 		z.literal("discord"),
+		z.literal("irc"),
 		z.literal("slack"),
 		z.literal("signal"),
 		z.literal("imessage"),
@@ -3623,7 +3700,7 @@ const InternalHookHandlerSchema = z.object({
 const HookConfigSchema = z.object({
 	enabled: z.boolean().optional(),
 	env: z.record(z.string(), z.string()).optional()
-}).strict();
+}).passthrough();
 const HookInstallRecordSchema = z.object({
 	source: z.union([
 		z.literal("npm"),
@@ -3649,7 +3726,7 @@ const HooksGmailSchema = z.object({
 	label: z.string().optional(),
 	topic: z.string().optional(),
 	subscription: z.string().optional(),
-	pushToken: z.string().optional(),
+	pushToken: z.string().optional().register(sensitive),
 	hookUrl: z.string().optional(),
 	includeBody: z.boolean().optional(),
 	maxBytes: z.number().int().positive().optional(),
@@ -3822,7 +3899,7 @@ const TelegramAccountSchemaBase = z.object({
 	customCommands: z.array(TelegramCustomCommandSchema).optional(),
 	configWrites: z.boolean().optional(),
 	dmPolicy: DmPolicySchema.optional().default("pairing"),
-	botToken: z.string().optional(),
+	botToken: z.string().optional().register(sensitive),
 	tokenFile: z.string().optional(),
 	replyToMode: ReplyToModeSchema.optional(),
 	groups: z.record(z.string(), TelegramGroupSchema.optional()).optional(),
@@ -3848,8 +3925,9 @@ const TelegramAccountSchemaBase = z.object({
 	network: z.object({ autoSelectFamily: z.boolean().optional() }).strict().optional(),
 	proxy: z.string().optional(),
 	webhookUrl: z.string().optional(),
-	webhookSecret: z.string().optional(),
+	webhookSecret: z.string().optional().register(sensitive),
 	webhookPath: z.string().optional(),
+	webhookHost: z.string().optional(),
 	actions: z.object({
 		reactions: z.boolean().optional(),
 		sendMessage: z.boolean().optional(),
@@ -3936,6 +4014,7 @@ const DiscordGuildChannelSchema = z.object({
 	skills: z.array(z.string()).optional(),
 	enabled: z.boolean().optional(),
 	users: z.array(z.union([z.string(), z.number()])).optional(),
+	roles: z.array(z.union([z.string(), z.number()])).optional(),
 	systemPrompt: z.string().optional(),
 	includeThreadStarter: z.boolean().optional(),
 	autoThread: z.boolean().optional()
@@ -3952,6 +4031,7 @@ const DiscordGuildSchema = z.object({
 		"allowlist"
 	]).optional(),
 	users: z.array(z.union([z.string(), z.number()])).optional(),
+	roles: z.array(z.union([z.string(), z.number()])).optional(),
 	channels: z.record(z.string(), DiscordGuildChannelSchema.optional()).optional()
 }).strict();
 const DiscordAccountSchema = z.object({
@@ -3961,7 +4041,7 @@ const DiscordAccountSchema = z.object({
 	enabled: z.boolean().optional(),
 	commands: ProviderCommandsSchema,
 	configWrites: z.boolean().optional(),
-	token: z.string().optional(),
+	token: z.string().optional().register(sensitive),
 	allowBots: z.boolean().optional(),
 	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
 	historyLimit: z.number().int().min(0).optional(),
@@ -4012,7 +4092,7 @@ const DiscordAccountSchema = z.object({
 	}).strict().optional(),
 	pluralkit: z.object({
 		enabled: z.boolean().optional(),
-		token: z.string().optional()
+		token: z.string().optional().register(sensitive)
 	}).strict().optional(),
 	responsePrefix: z.string().optional()
 }).strict();
@@ -4105,7 +4185,8 @@ const SlackChannelSchema = z.object({
 }).strict();
 const SlackThreadSchema = z.object({
 	historyScope: z.enum(["thread", "channel"]).optional(),
-	inheritParent: z.boolean().optional()
+	inheritParent: z.boolean().optional(),
+	initialHistoryLimit: z.number().int().min(0).optional()
 }).strict();
 const SlackReplyToModeByChatTypeSchema = z.object({
 	direct: ReplyToModeSchema.optional(),
@@ -4115,16 +4196,16 @@ const SlackReplyToModeByChatTypeSchema = z.object({
 const SlackAccountSchema = z.object({
 	name: z.string().optional(),
 	mode: z.enum(["socket", "http"]).optional(),
-	signingSecret: z.string().optional(),
+	signingSecret: z.string().optional().register(sensitive),
 	webhookPath: z.string().optional(),
 	capabilities: z.array(z.string()).optional(),
 	markdown: MarkdownConfigSchema,
 	enabled: z.boolean().optional(),
 	commands: ProviderCommandsSchema,
 	configWrites: z.boolean().optional(),
-	botToken: z.string().optional(),
-	appToken: z.string().optional(),
-	userToken: z.string().optional(),
+	botToken: z.string().optional().register(sensitive),
+	appToken: z.string().optional().register(sensitive),
+	userToken: z.string().optional().register(sensitive),
 	userTokenReadOnly: z.boolean().optional().default(true),
 	allowBots: z.boolean().optional(),
 	requireMention: z.boolean().optional(),
@@ -4170,7 +4251,7 @@ const SlackAccountSchema = z.object({
 }).strict();
 const SlackConfigSchema = SlackAccountSchema.extend({
 	mode: z.enum(["socket", "http"]).optional().default("socket"),
-	signingSecret: z.string().optional(),
+	signingSecret: z.string().optional().register(sensitive),
 	webhookPath: z.string().optional().default("/slack/events"),
 	accounts: z.record(z.string(), SlackAccountSchema.optional()).optional()
 }).superRefine((value, ctx) => {
@@ -4260,6 +4341,84 @@ const SignalConfigSchema = SignalAccountSchemaBase.extend({ accounts: z.record(z
 		message: "channels.signal.dmPolicy=\"open\" requires channels.signal.allowFrom to include \"*\""
 	});
 });
+const IrcGroupSchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	skills: z.array(z.string()).optional(),
+	enabled: z.boolean().optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	systemPrompt: z.string().optional()
+}).strict();
+const IrcNickServSchema = z.object({
+	enabled: z.boolean().optional(),
+	service: z.string().optional(),
+	password: z.string().optional().register(sensitive),
+	passwordFile: z.string().optional(),
+	register: z.boolean().optional(),
+	registerEmail: z.string().optional()
+}).strict();
+const IrcAccountSchemaBase = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
+	host: z.string().optional(),
+	port: z.number().int().min(1).max(65535).optional(),
+	tls: z.boolean().optional(),
+	nick: z.string().optional(),
+	username: z.string().optional(),
+	realname: z.string().optional(),
+	password: z.string().optional().register(sensitive),
+	passwordFile: z.string().optional(),
+	nickserv: IrcNickServSchema.optional(),
+	channels: z.array(z.string()).optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	groups: z.record(z.string(), IrcGroupSchema.optional()).optional(),
+	mentionPatterns: z.array(z.string()).optional(),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional()
+}).strict();
+const IrcAccountSchema = IrcAccountSchemaBase.superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.irc.dmPolicy=\"open\" requires channels.irc.allowFrom to include \"*\""
+	});
+	if (value.nickserv?.register && !value.nickserv.registerEmail?.trim()) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["nickserv", "registerEmail"],
+		message: "channels.irc.nickserv.register=true requires channels.irc.nickserv.registerEmail"
+	});
+});
+const IrcConfigSchema = IrcAccountSchemaBase.extend({ accounts: z.record(z.string(), IrcAccountSchema.optional()).optional() }).superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.irc.dmPolicy=\"open\" requires channels.irc.allowFrom to include \"*\""
+	});
+	if (value.nickserv?.register && !value.nickserv.registerEmail?.trim()) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["nickserv", "registerEmail"],
+		message: "channels.irc.nickserv.register=true requires channels.irc.nickserv.registerEmail"
+	});
+});
 const IMessageAccountSchemaBase = z.object({
 	name: z.string().optional(),
 	capabilities: z.array(z.string()).optional(),
@@ -4340,7 +4499,7 @@ const BlueBubblesAccountSchemaBase = z.object({
 	configWrites: z.boolean().optional(),
 	enabled: z.boolean().optional(),
 	serverUrl: z.string().optional(),
-	password: z.string().optional(),
+	password: z.string().optional().register(sensitive),
 	webhookPath: z.string().optional(),
 	dmPolicy: DmPolicySchema.optional().default("pairing"),
 	allowFrom: z.array(BlueBubblesAllowFromEntry).optional(),
@@ -4399,7 +4558,7 @@ const MSTeamsConfigSchema = z.object({
 	markdown: MarkdownConfigSchema,
 	configWrites: z.boolean().optional(),
 	appId: z.string().optional(),
-	appPassword: z.string().optional(),
+	appPassword: z.string().optional().register(sensitive),
 	tenantId: z.string().optional(),
 	webhook: z.object({
 		port: z.number().int().positive().optional(),
@@ -4547,6 +4706,7 @@ const ChannelsSchema = z.object({
 	whatsapp: WhatsAppConfigSchema.optional(),
 	telegram: TelegramConfigSchema.optional(),
 	discord: DiscordConfigSchema.optional(),
+	irc: IrcConfigSchema.optional(),
 	googlechat: GoogleChatConfigSchema.optional(),
 	slack: SlackConfigSchema.optional(),
 	signal: SignalConfigSchema.optional(),
@@ -4730,6 +4890,11 @@ const MemoryQmdLimitsSchema = z.object({
 }).strict();
 const MemoryQmdSchema = z.object({
 	command: z.string().optional(),
+	searchMode: z.union([
+		z.literal("query"),
+		z.literal("search"),
+		z.literal("vsearch")
+	]).optional(),
 	includeDefaultMemory: z.boolean().optional(),
 	paths: z.array(MemoryQmdPathSchema).optional(),
 	sessions: MemoryQmdSessionSchema.optional(),
@@ -4890,7 +5055,11 @@ const OpenClawSchema = z.object({
 	hooks: z.object({
 		enabled: z.boolean().optional(),
 		path: z.string().optional(),
-		token: z.string().optional(),
+		token: z.string().optional().register(sensitive),
+		defaultSessionKey: z.string().optional(),
+		allowRequestSessionKey: z.boolean().optional(),
+		allowedSessionKeyPrefixes: z.array(z.string()).optional(),
+		allowedAgentIds: z.array(z.string()).optional(),
 		maxBodyBytes: z.number().int().positive().optional(),
 		presets: z.array(z.string()).optional(),
 		transformsDir: z.string().optional(),
@@ -4929,7 +5098,7 @@ const OpenClawSchema = z.object({
 		voiceAliases: z.record(z.string(), z.string()).optional(),
 		modelId: z.string().optional(),
 		outputFormat: z.string().optional(),
-		apiKey: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
 		interruptOnSpeech: z.boolean().optional()
 	}).strict().optional(),
 	gateway: z.object({
@@ -4952,11 +5121,15 @@ const OpenClawSchema = z.object({
 		}).strict().optional(),
 		auth: z.object({
 			mode: z.union([z.literal("token"), z.literal("password")]).optional(),
-			token: z.string().optional(),
-			password: z.string().optional(),
+			token: z.string().optional().register(sensitive),
+			password: z.string().optional().register(sensitive),
 			allowTailscale: z.boolean().optional()
 		}).strict().optional(),
 		trustedProxies: z.array(z.string()).optional(),
+		tools: z.object({
+			deny: z.array(z.string()).optional(),
+			allow: z.array(z.string()).optional()
+		}).strict().optional(),
 		tailscale: z.object({
 			mode: z.union([
 				z.literal("off"),
@@ -4968,8 +5141,8 @@ const OpenClawSchema = z.object({
 		remote: z.object({
 			url: z.string().optional(),
 			transport: z.union([z.literal("ssh"), z.literal("direct")]).optional(),
-			token: z.string().optional(),
-			password: z.string().optional(),
+			token: z.string().optional().register(sensitive),
+			password: z.string().optional().register(sensitive),
 			tlsFingerprint: z.string().optional(),
 			sshTarget: z.string().optional(),
 			sshIdentity: z.string().optional()
@@ -4995,8 +5168,10 @@ const OpenClawSchema = z.object({
 			responses: z.object({
 				enabled: z.boolean().optional(),
 				maxBodyBytes: z.number().int().positive().optional(),
+				maxUrlParts: z.number().int().nonnegative().optional(),
 				files: z.object({
 					allowUrl: z.boolean().optional(),
+					urlAllowlist: z.array(z.string()).optional(),
 					allowedMimes: z.array(z.string()).optional(),
 					maxBytes: z.number().int().positive().optional(),
 					maxChars: z.number().int().positive().optional(),
@@ -5010,6 +5185,7 @@ const OpenClawSchema = z.object({
 				}).strict().optional(),
 				images: z.object({
 					allowUrl: z.boolean().optional(),
+					urlAllowlist: z.array(z.string()).optional(),
 					allowedMimes: z.array(z.string()).optional(),
 					maxBytes: z.number().int().positive().optional(),
 					maxRedirects: z.number().int().nonnegative().optional(),
@@ -5049,7 +5225,7 @@ const OpenClawSchema = z.object({
 		}).strict().optional(),
 		entries: z.record(z.string(), z.object({
 			enabled: z.boolean().optional(),
-			apiKey: z.string().optional(),
+			apiKey: z.string().optional().register(sensitive),
 			env: z.record(z.string(), z.string()).optional(),
 			config: z.record(z.string(), z.unknown()).optional()
 		}).strict()).optional()
@@ -5147,7 +5323,11 @@ function validateIdentityAvatar(config) {
 	}
 	return issues;
 }
-function validateConfigObject(raw) {
+/**
+* Validates config without applying runtime defaults.
+* Use this when you need the raw validated config (e.g., for writing back to file).
+*/
+function validateConfigObjectRaw(raw) {
 	const legacyIssues = findLegacyConfigIssues(raw);
 	if (legacyIssues.length > 0) return {
 		ok: false,
@@ -5179,11 +5359,25 @@ function validateConfigObject(raw) {
 	};
 	return {
 		ok: true,
-		config: applyModelDefaults(applyAgentDefaults(applySessionDefaults(validated.data)))
+		config: validated.data
+	};
+}
+function validateConfigObject(raw) {
+	const result = validateConfigObjectRaw(raw);
+	if (!result.ok) return result;
+	return {
+		ok: true,
+		config: applyModelDefaults(applyAgentDefaults(applySessionDefaults(result.config)))
 	};
 }
 function validateConfigObjectWithPlugins(raw) {
-	const base = validateConfigObject(raw);
+	return validateConfigObjectWithPluginsBase(raw, { applyDefaults: true });
+}
+function validateConfigObjectRawWithPlugins(raw) {
+	return validateConfigObjectWithPluginsBase(raw, { applyDefaults: false });
+}
+function validateConfigObjectWithPluginsBase(raw, opts) {
+	const base = opts.applyDefaults ? validateConfigObject(raw) : validateConfigObjectRaw(raw);
 	if (!base.ok) return {
 		ok: false,
 		issues: base.issues,
@@ -5395,6 +5589,38 @@ function coerceConfig(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return value;
 }
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function cloneUnknown(value) {
+	return structuredClone(value);
+}
+function createMergePatch(base, target) {
+	if (!isPlainObject(base) || !isPlainObject(target)) return cloneUnknown(target);
+	const patch = {};
+	const keys = new Set([...Object.keys(base), ...Object.keys(target)]);
+	for (const key of keys) {
+		const hasBase = key in base;
+		if (!(key in target)) {
+			patch[key] = null;
+			continue;
+		}
+		const targetValue = target[key];
+		if (!hasBase) {
+			patch[key] = cloneUnknown(targetValue);
+			continue;
+		}
+		const baseValue = base[key];
+		if (isPlainObject(baseValue) && isPlainObject(targetValue)) {
+			const childPatch = createMergePatch(baseValue, targetValue);
+			if (isPlainObject(childPatch) && Object.keys(childPatch).length === 0) continue;
+			patch[key] = childPatch;
+			continue;
+		}
+		if (!isDeepStrictEqual(baseValue, targetValue)) patch[key] = cloneUnknown(targetValue);
+	}
+	return patch;
+}
 async function rotateConfigBackups(configPath, ioFs) {
 	if (CONFIG_BACKUP_COUNT <= 1) return;
 	const backupBase = `${configPath}.bak`;
@@ -5548,6 +5774,7 @@ function createConfigIO(overrides = {}) {
 				exists: false,
 				raw: null,
 				parsed: {},
+				resolved: {},
 				valid: true,
 				config: applyTalkApiKey(applyModelDefaults(applyCompactionDefaults(applyContextPruningDefaults(applyAgentDefaults(applySessionDefaults(applyMessageDefaults({}))))))),
 				hash,
@@ -5565,6 +5792,7 @@ function createConfigIO(overrides = {}) {
 				exists: true,
 				raw,
 				parsed: {},
+				resolved: {},
 				valid: false,
 				config: {},
 				hash,
@@ -5588,6 +5816,7 @@ function createConfigIO(overrides = {}) {
 					exists: true,
 					raw,
 					parsed: parsedRes.parsed,
+					resolved: coerceConfig(parsedRes.parsed),
 					valid: false,
 					config: coerceConfig(parsedRes.parsed),
 					hash,
@@ -5610,6 +5839,7 @@ function createConfigIO(overrides = {}) {
 					exists: true,
 					raw,
 					parsed: parsedRes.parsed,
+					resolved: coerceConfig(resolved),
 					valid: false,
 					config: coerceConfig(resolved),
 					hash,
@@ -5629,6 +5859,7 @@ function createConfigIO(overrides = {}) {
 				exists: true,
 				raw,
 				parsed: parsedRes.parsed,
+				resolved: coerceConfig(resolvedConfigRaw),
 				valid: false,
 				config: coerceConfig(resolvedConfigRaw),
 				hash,
@@ -5642,6 +5873,7 @@ function createConfigIO(overrides = {}) {
 				exists: true,
 				raw,
 				parsed: parsedRes.parsed,
+				resolved: coerceConfig(resolvedConfigRaw),
 				valid: true,
 				config: normalizeConfigPaths(applyTalkApiKey(applyModelDefaults(applyAgentDefaults(applySessionDefaults(applyLoggingDefaults(applyMessageDefaults(validated.config))))))),
 				hash,
@@ -5655,6 +5887,7 @@ function createConfigIO(overrides = {}) {
 				exists: true,
 				raw: null,
 				parsed: {},
+				resolved: {},
 				valid: false,
 				config: {},
 				hash: hashConfigRaw(null),
@@ -5669,7 +5902,13 @@ function createConfigIO(overrides = {}) {
 	}
 	async function writeConfigFile(cfg) {
 		clearConfigCache();
-		const validated = validateConfigObjectWithPlugins(cfg);
+		let persistCandidate = cfg;
+		const snapshot = await readConfigFileSnapshot();
+		if (snapshot.valid && snapshot.exists) {
+			const patch = createMergePatch(snapshot.config, cfg);
+			persistCandidate = applyMergePatch(snapshot.resolved, patch);
+		}
+		const validated = validateConfigObjectRawWithPlugins(persistCandidate);
 		if (!validated.ok) {
 			const issue = validated.issues[0];
 			const pathLabel = issue?.path ? issue.path : "<root>";
@@ -5684,7 +5923,7 @@ function createConfigIO(overrides = {}) {
 			recursive: true,
 			mode: 448
 		});
-		const json = JSON.stringify(applyModelDefaults(stampConfigVersion(cfg)), null, 2).trimEnd().concat("\n");
+		const json = JSON.stringify(stampConfigVersion(validated.config), null, 2).trimEnd().concat("\n");
 		const tmp = path.join(dir, `${path.basename(configPath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
 		await deps.fs.promises.writeFile(tmp, json, {
 			encoding: "utf-8",
@@ -5760,4 +5999,4 @@ async function writeConfigFile(cfg) {
 }
 
 //#endregion
-export { resolveWhatsAppAccount as A, unsetConfigOverride as C, unsetConfigValueAtPath as D, setConfigValueAtPath as E, readWebSelfId as F, resolveDefaultWebAuthDir as I, resolveWebCredsBackupPath as L, logWebSelfId as M, logoutWeb as N, resolveAgentMaxConcurrent as O, maybeRestoreCredsFromBackup as P, resolveWebCredsPath as R, setConfigOverride as S, parseConfigPath as T, normalizePluginsConfig as _, validateConfigObjectWithPlugins as a, getConfigOverrides as b, normalizeTelegramCommandName as c, parseDurationMs as d, validateJsonSchemaValue as f, MANIFEST_KEY as g, LEGACY_MANIFEST_KEYS as h, writeConfigFile as i, getWebAuthAgeMs as j, VERSION as k, resolveTelegramCustomCommands as l, discoverOpenClawPlugins as m, readConfigFileSnapshot as n, parseByteSize as o, loadPluginManifestRegistry as p, resolveConfigSnapshotHash as r, TELEGRAM_COMMAND_NAME_PATTERN as s, loadConfig as t, isSafeExecutableValue as u, resolveEnableState as v, getConfigValueAtPath as w, resetConfigOverrides as x, resolveMemorySlotDecision as y, webAuthExists as z };
+export { VERSION as A, webAuthExists as B, unsetConfigOverride as C, unsetConfigValueAtPath as D, setConfigValueAtPath as E, maybeRestoreCredsFromBackup as F, readWebSelfId as I, resolveDefaultWebAuthDir as L, getWebAuthAgeMs as M, logWebSelfId as N, isSafeExecutableValue as O, logoutWeb as P, resolveWebCredsBackupPath as R, setConfigOverride as S, parseConfigPath as T, normalizePluginsConfig as _, validateConfigObjectWithPlugins as a, getConfigOverrides as b, normalizeTelegramCommandName as c, validateJsonSchemaValue as d, loadPluginManifestRegistry as f, applyTestPluginDefaults as g, MANIFEST_KEY as h, writeConfigFile as i, resolveWhatsAppAccount as j, resolveAgentMaxConcurrent as k, resolveTelegramCustomCommands as l, LEGACY_MANIFEST_KEYS as m, readConfigFileSnapshot as n, parseByteSize as o, discoverOpenClawPlugins as p, resolveConfigSnapshotHash as r, TELEGRAM_COMMAND_NAME_PATTERN as s, loadConfig as t, parseDurationMs as u, resolveEnableState as v, getConfigValueAtPath as w, resetConfigOverrides as x, resolveMemorySlotDecision as y, resolveWebCredsPath as z };