@gguf/claw 2026.2.9 → 2026.2.13

package/dist/{pi-embedded-helpers-BTkXgwJ7.js → pi-embedded-helpers-ZI1UCSRM.js}

@@ -1,18 +1,13 @@
 import { i as resolveGatewayPort, t as STATE_DIR } from "./paths-BZtyHNCi.js";
-import { c as normalizeAccountId$1, d as resolveAgentIdFromSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, n as DEFAULT_AGENT_ID, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey } from "./session-key-nXYQSv-a.js";
-import { f as normalizeE164, g as resolveUserPath, m as resolveConfigDir, o as escapeRegExp, t as CONFIG_DIR } from "./utils-dp_OM900.js";
-import { S as requireActivePluginRegistry, _ as getChatChannelMeta, b as normalizeChatChannelId, h as CHAT_CHANNEL_ORDER, l as createSubsystemLogger, m as CHANNEL_IDS, n as runExec, u as defaultRuntime, v as normalizeAnyChannelId, x as getActivePluginRegistry } from "./exec-CiH_vkWn.js";
-import { C as resolveOpenClawPackageRootSync, _ as DEFAULT_TOOLS_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, f as DEFAULT_AGENT_WORKSPACE_DIR, g as DEFAULT_SOUL_FILENAME, h as DEFAULT_IDENTITY_FILENAME, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, v as DEFAULT_USER_FILENAME, y as ensureAgentWorkspace } from "./agent-scope-Dp8sREli.js";
-import { t as parseBooleanValue } from "./boolean-M-esQJt6.js";
-import { W as isTruthyEnvValue } from "./model-auth-BqjMkNFs.js";
-import { t as formatCliCommand } from "./command-format-BUxhT1xL.js";
-import { D as resolveWhatsAppAccount, f as loadPluginManifestRegistry, g as resolveMemorySlotDecision, h as resolveEnableState, i as writeConfigFile, m as normalizePluginsConfig, o as parseByteSize, t as loadConfig } from "./config-ethqi73X.js";
-import { n as LEGACY_MANIFEST_KEYS, r as MANIFEST_KEY, t as parseDurationMs } from "./parse-duration-De_tAQSe.js";
-import { C as DEFAULT_AI_SNAPSHOT_MAX_CHARS, D as DEFAULT_OPENCLAW_BROWSER_ENABLED, E as DEFAULT_OPENCLAW_BROWSER_COLOR, O as DEFAULT_OPENCLAW_BROWSER_PROFILE_NAME, S as DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS, T as DEFAULT_BROWSER_EVALUATE_ENABLED, a as resolveOpenClawUserDataDir, c as captureScreenshot, d as normalizeCdpWsUrl, f as snapshotAria, g as stopChromeExtensionRelayServer, h as ensureChromeExtensionRelayServer, i as launchOpenClawChrome, l as createTargetViaCdp, m as getHeadersWithAuth, n as isChromeCdpReady, o as stopOpenClawChrome, p as appendCdpPath, r as isChromeReachable, s as resolveBrowserExecutableForPlatform, v as isLoopbackHost, w as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME, x as DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH } from "./chrome-CxRJz4ZD.js";
-import { t as parseFrontmatterBlock } from "./frontmatter-xwTm0734.js";
-import { n as formatErrorMessage, t as extractErrorCode } from "./errors-D3tYRJWG.js";
-import { r as resolveSessionTranscriptPath, t as resolveDefaultSessionStorePath } from "./paths-MnZaxqPw.js";
-import { t as emitSessionTranscriptUpdate } from "./transcript-events-BlIONGVn.js";
+import { C as resolveOpenClawPackageRootSync, D as buildAgentMainSessionKey, M as normalizeAgentId, N as normalizeMainKey, P as resolveAgentIdFromSessionKey, T as DEFAULT_AGENT_ID, _ as DEFAULT_TOOLS_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, f as DEFAULT_AGENT_WORKSPACE_DIR, g as DEFAULT_SOUL_FILENAME, h as DEFAULT_IDENTITY_FILENAME, j as normalizeAccountId$1, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, v as DEFAULT_USER_FILENAME, w as DEFAULT_ACCOUNT_ID, y as ensureAgentWorkspace } from "./agent-scope-DASgjz2_.js";
+import { F as normalizeE164, L as resolveConfigDir, S as requireActivePluginRegistry, _ as getChatChannelMeta, b as normalizeChatChannelId, h as CHAT_CHANNEL_ORDER, k as escapeRegExp, l as createSubsystemLogger, m as CHANNEL_IDS, n as runExec, ot as resolvePreferredOpenClawTmpDir, u as defaultRuntime, v as normalizeAnyChannelId, w as CONFIG_DIR, x as getActivePluginRegistry, z as resolveUserPath } from "./exec-_PSUrMP8.js";
+import { G as parseBooleanValue, W as isTruthyEnvValue } from "./model-auth-BvODRbV0.js";
+import { t as formatCliCommand } from "./command-format-qUVxzqYm.js";
+import { _ as normalizePluginsConfig, f as loadPluginManifestRegistry, h as MANIFEST_KEY, i as writeConfigFile, j as resolveWhatsAppAccount, m as LEGACY_MANIFEST_KEYS, o as parseByteSize, t as loadConfig, u as parseDurationMs, v as resolveEnableState, y as resolveMemorySlotDecision } from "./config-D8pgDSNo.js";
+import { A as DEFAULT_OPENCLAW_BROWSER_PROFILE_NAME, C as DEFAULT_AI_SNAPSHOT_EFFICIENT_DEPTH, D as DEFAULT_BROWSER_EVALUATE_ENABLED, E as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME, O as DEFAULT_OPENCLAW_BROWSER_COLOR, T as DEFAULT_AI_SNAPSHOT_MAX_CHARS, _ as ensureChromeExtensionRelayServer, a as resolveOpenClawUserDataDir, b as isLoopbackHost, c as captureScreenshot, d as normalizeCdpWsUrl, f as snapshotAria, h as getHeadersWithAuth, i as launchOpenClawChrome, k as DEFAULT_OPENCLAW_BROWSER_ENABLED, l as createTargetViaCdp, n as isChromeCdpReady, o as stopOpenClawChrome, p as appendCdpPath, r as isChromeReachable, s as resolveBrowserExecutableForPlatform, v as stopChromeExtensionRelayServer, w as DEFAULT_AI_SNAPSHOT_EFFICIENT_MAX_CHARS } from "./chrome-n_3rtK2c.js";
+import { n as formatErrorMessage, t as extractErrorCode } from "./errors-B91HIDPD.js";
+import { n as resolveSessionFilePath, t as resolveDefaultSessionStorePath } from "./paths-SFzVNGbc.js";
+import { t as emitSessionTranscriptUpdate } from "./transcript-events-BHS7QoRl.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -23,6 +18,7 @@ import { fileURLToPath } from "node:url";
 import { CURRENT_SESSION_VERSION, SessionManager, formatSkillsForPrompt, loadSkillsFromDir } from "@mariozechner/pi-coding-agent";
 import crypto, { createHash } from "node:crypto";
 import { fileTypeFromBuffer } from "file-type";
+import YAML from "yaml";
 import express from "express";
 import { lookup } from "node:dns";
 import { lookup as lookup$1 } from "node:dns/promises";
@@ -1334,6 +1330,108 @@ function resolveSandboxConfigForAgent(cfg, agentId) {
 	};
 }
 
+//#endregion
+//#region src/markdown/frontmatter.ts
+function stripQuotes(value) {
+	if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+	return value;
+}
+function coerceFrontmatterValue(value) {
+	if (value === null || value === void 0) return;
+	if (typeof value === "string") return value.trim();
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (typeof value === "object") try {
+		return JSON.stringify(value);
+	} catch {
+		return;
+	}
+}
+function parseYamlFrontmatter(block) {
+	try {
+		const parsed = YAML.parse(block);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+		const result = {};
+		for (const [rawKey, value] of Object.entries(parsed)) {
+			const key = rawKey.trim();
+			if (!key) continue;
+			const coerced = coerceFrontmatterValue(value);
+			if (coerced === void 0) continue;
+			result[key] = coerced;
+		}
+		return result;
+	} catch {
+		return null;
+	}
+}
+function extractMultiLineValue(lines, startIndex) {
+	const match = lines[startIndex].match(/^([\w-]+):\s*(.*)$/);
+	if (!match) return {
+		value: "",
+		linesConsumed: 1
+	};
+	const inlineValue = match[2].trim();
+	if (inlineValue) return {
+		value: inlineValue,
+		linesConsumed: 1
+	};
+	const valueLines = [];
+	let i = startIndex + 1;
+	while (i < lines.length) {
+		const line = lines[i];
+		if (line.length > 0 && !line.startsWith(" ") && !line.startsWith("	")) break;
+		valueLines.push(line);
+		i++;
+	}
+	return {
+		value: valueLines.join("\n").trim(),
+		linesConsumed: i - startIndex
+	};
+}
+function parseLineFrontmatter(block) {
+	const frontmatter = {};
+	const lines = block.split("\n");
+	let i = 0;
+	while (i < lines.length) {
+		const match = lines[i].match(/^([\w-]+):\s*(.*)$/);
+		if (!match) {
+			i++;
+			continue;
+		}
+		const key = match[1];
+		const inlineValue = match[2].trim();
+		if (!key) {
+			i++;
+			continue;
+		}
+		if (!inlineValue && i + 1 < lines.length) {
+			const nextLine = lines[i + 1];
+			if (nextLine.startsWith(" ") || nextLine.startsWith("	")) {
+				const { value, linesConsumed } = extractMultiLineValue(lines, i);
+				if (value) frontmatter[key] = value;
+				i += linesConsumed;
+				continue;
+			}
+		}
+		const value = stripQuotes(inlineValue);
+		if (value) frontmatter[key] = value;
+		i++;
+	}
+	return frontmatter;
+}
+function parseFrontmatterBlock(content) {
+	const normalized = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+	if (!normalized.startsWith("---")) return {};
+	const endIndex = normalized.indexOf("\n---", 3);
+	if (endIndex === -1) return {};
+	const block = normalized.slice(4, endIndex);
+	const lineParsed = parseLineFrontmatter(block);
+	const yamlParsed = parseYamlFrontmatter(block);
+	if (yamlParsed === null) return lineParsed;
+	const merged = { ...yamlParsed };
+	for (const [key, value] of Object.entries(lineParsed)) if (value.startsWith("{") || value.startsWith("[")) merged[key] = value;
+	return merged;
+}
+
 //#endregion
 //#region src/agents/skills/frontmatter.ts
 function parseFrontmatter(content) {
@@ -1479,8 +1577,16 @@ function isBundledSkillAllowed(entry, allowlist) {
 }
 function hasBinary(bin) {
 	const parts = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
-	for (const part of parts) {
-		const candidate = path.join(part, bin);
+	const winPathExt = process.env.PATHEXT;
+	const winExtensions = winPathExt !== void 0 ? winPathExt.split(";").filter(Boolean) : [
+		".EXE",
+		".CMD",
+		".BAT",
+		".COM"
+	];
+	const extensions = process.platform === "win32" ? ["", ...winExtensions] : [""];
+	for (const part of parts) for (const ext of extensions) {
+		const candidate = path.join(part, bin + ext);
 		try {
 			fs$1.accessSync(candidate, fs$1.constants.X_OK);
 			return true;
@@ -1581,6 +1687,83 @@ function applySkillEnvOverridesFromSnapshot(params) {
 	};
 }
 
+//#endregion
+//#region src/agents/sandbox-paths.ts
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+const HTTP_URL_RE = /^https?:\/\//i;
+const DATA_URL_RE = /^data:/i;
+function normalizeUnicodeSpaces(str) {
+	return str.replace(UNICODE_SPACES, " ");
+}
+function expandPath(filePath) {
+	const normalized = normalizeUnicodeSpaces(filePath);
+	if (normalized === "~") return os.homedir();
+	if (normalized.startsWith("~/")) return os.homedir() + normalized.slice(1);
+	return normalized;
+}
+function resolveToCwd(filePath, cwd) {
+	const expanded = expandPath(filePath);
+	if (path.isAbsolute(expanded)) return expanded;
+	return path.resolve(cwd, expanded);
+}
+function resolveSandboxPath(params) {
+	const resolved = resolveToCwd(params.filePath, params.cwd);
+	const rootResolved = path.resolve(params.root);
+	const relative = path.relative(rootResolved, resolved);
+	if (!relative || relative === "") return {
+		resolved,
+		relative: ""
+	};
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Path escapes sandbox root (${shortPath(rootResolved)}): ${params.filePath}`);
+	return {
+		resolved,
+		relative
+	};
+}
+async function assertSandboxPath(params) {
+	const resolved = resolveSandboxPath(params);
+	await assertNoSymlink(resolved.relative, path.resolve(params.root));
+	return resolved;
+}
+function assertMediaNotDataUrl(media) {
+	const raw = media.trim();
+	if (DATA_URL_RE.test(raw)) throw new Error("data: URLs are not supported for media. Use buffer instead.");
+}
+async function resolveSandboxedMediaSource(params) {
+	const raw = params.media.trim();
+	if (!raw) return raw;
+	if (HTTP_URL_RE.test(raw)) return raw;
+	let candidate = raw;
+	if (/^file:\/\//i.test(candidate)) try {
+		candidate = fileURLToPath(candidate);
+	} catch {
+		throw new Error(`Invalid file:// URL for sandboxed media: ${raw}`);
+	}
+	return (await assertSandboxPath({
+		filePath: candidate,
+		cwd: params.sandboxRoot,
+		root: params.sandboxRoot
+	})).resolved;
+}
+async function assertNoSymlink(relative, root) {
+	if (!relative) return;
+	const parts = relative.split(path.sep).filter(Boolean);
+	let current = root;
+	for (const part of parts) {
+		current = path.join(current, part);
+		try {
+			if ((await fs.lstat(current)).isSymbolicLink()) throw new Error(`Symlink not allowed in sandbox path: ${current}`);
+		} catch (err) {
+			if (err.code === "ENOENT") return;
+			throw err;
+		}
+	}
+}
+function shortPath(value) {
+	if (value.startsWith(os.homedir())) return `~${value.slice(os.homedir().length)}`;
+	return value;
+}
+
 //#endregion
 //#region src/agents/skills/bundled-dir.ts
 function looksLikeSkillsDir(dir) {
@@ -1738,7 +1921,7 @@ function loadSkillEntries(workspaceDir, opts) {
 		return [];
 	};
 	const managedSkillsDir = opts?.managedSkillsDir ?? path.join(CONFIG_DIR, "skills");
-	const workspaceSkillsDir = path.join(workspaceDir, "skills");
+	const workspaceSkillsDir = path.resolve(workspaceDir, "skills");
 	const bundledSkillsDir = opts?.bundledSkillsDir ?? resolveBundledSkillsDir();
 	const extraDirs = (opts?.config?.skills?.load?.extraDirs ?? []).map((d) => typeof d === "string" ? d.trim() : "").filter(Boolean);
 	const pluginSkillDirs = resolvePluginSkillDirs({
@@ -1760,6 +1943,14 @@ function loadSkillEntries(workspaceDir, opts) {
 		dir: managedSkillsDir,
 		source: "openclaw-managed"
 	});
+	const personalAgentsSkills = loadSkills({
+		dir: path.resolve(os.homedir(), ".agents", "skills"),
+		source: "agents-skills-personal"
+	});
+	const projectAgentsSkills = loadSkills({
+		dir: path.resolve(workspaceDir, ".agents", "skills"),
+		source: "agents-skills-project"
+	});
 	const workspaceSkills = loadSkills({
 		dir: workspaceSkillsDir,
 		source: "openclaw-workspace"
@@ -1768,6 +1959,8 @@ function loadSkillEntries(workspaceDir, opts) {
 	for (const skill of extraSkills) merged.set(skill.name, skill);
 	for (const skill of bundledSkills) merged.set(skill.name, skill);
 	for (const skill of managedSkills) merged.set(skill.name, skill);
+	for (const skill of personalAgentsSkills) merged.set(skill.name, skill);
+	for (const skill of projectAgentsSkills) merged.set(skill.name, skill);
 	for (const skill of workspaceSkills) merged.set(skill.name, skill);
 	return Array.from(merged.values()).map((skill) => {
 		let frontmatter = {};
@@ -1814,6 +2007,36 @@ function resolveSkillsPromptForRun(params) {
 function loadWorkspaceSkillEntries(workspaceDir, opts) {
 	return loadSkillEntries(workspaceDir, opts);
 }
+function resolveUniqueSyncedSkillDirName(base, used) {
+	if (!used.has(base)) {
+		used.add(base);
+		return base;
+	}
+	for (let index = 2; index < 1e4; index += 1) {
+		const candidate = `${base}-${index}`;
+		if (!used.has(candidate)) {
+			used.add(candidate);
+			return candidate;
+		}
+	}
+	let fallbackIndex = 1e4;
+	let fallback = `${base}-${fallbackIndex}`;
+	while (used.has(fallback)) {
+		fallbackIndex += 1;
+		fallback = `${base}-${fallbackIndex}`;
+	}
+	used.add(fallback);
+	return fallback;
+}
+function resolveSyncedSkillDestinationPath(params) {
+	const sourceDirName = path.basename(params.entry.skill.baseDir).trim();
+	if (!sourceDirName || sourceDirName === "." || sourceDirName === "..") return null;
+	return resolveSandboxPath({
+		filePath: resolveUniqueSyncedSkillDirName(sourceDirName, params.usedDirNames),
+		cwd: params.targetSkillsDir,
+		root: params.targetSkillsDir
+	}).resolved;
+}
 async function syncSkillsToWorkspace(params) {
 	const sourceDir = resolveUserPath(params.sourceWorkspaceDir);
 	const targetDir = resolveUserPath(params.targetWorkspaceDir);
@@ -1830,8 +2053,24 @@ async function syncSkillsToWorkspace(params) {
 			force: true
 		});
 		await fsp.mkdir(targetSkillsDir, { recursive: true });
+		const usedDirNames = /* @__PURE__ */ new Set();
 		for (const entry of entries) {
-			const dest = path.join(targetSkillsDir, entry.skill.name);
+			let dest = null;
+			try {
+				dest = resolveSyncedSkillDestinationPath({
+					targetSkillsDir,
+					entry,
+					usedDirNames
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : JSON.stringify(error);
+				console.warn(`[skills] Failed to resolve safe destination for ${entry.skill.name}: ${message}`);
+				continue;
+			}
+			if (!dest) {
+				console.warn(`[skills] Failed to resolve safe destination for ${entry.skill.name}: invalid source directory name`);
+				continue;
+			}
 			try {
 				await fsp.cp(entry.skill.baseDir, dest, {
 					recursive: true,
@@ -1944,7 +2183,7 @@ function isModuleNotFoundError(err) {
 }
 async function loadPwAiModule(mode) {
 	try {
-		return await import("./pw-ai-CQ4-gUNR.js");
+		return await import("./pw-ai-6GzTgK5g.js");
 	} catch (err) {
 		if (mode === "soft") return null;
 		if (isModuleNotFoundError(err)) return null;
@@ -2289,12 +2528,16 @@ function registerBrowserAgentActRoutes(app, ctx) {
 					const fn = toStringOrEmpty(body.fn);
 					if (!fn) return jsonError(res, 400, "fn is required");
 					const ref = toStringOrEmpty(body.ref) || void 0;
-					const result = await pw.evaluateViaPlaywright({
+					const evalTimeoutMs = toNumber(body.timeoutMs);
+					const evalRequest = {
 						cdpUrl,
 						targetId: tab.targetId,
 						fn,
-						ref
-					});
+						ref,
+						signal: req.signal
+					};
+					if (evalTimeoutMs !== void 0) evalRequest.timeoutMs = evalTimeoutMs;
+					const result = await pw.evaluateViaPlaywright(evalRequest);
 					return res.json({
 						ok: true,
 						targetId: tab.targetId,
@@ -2497,6 +2740,7 @@ function registerBrowserAgentActRoutes(app, ctx) {
 
 //#endregion
 //#region src/browser/routes/agent.debug.ts
+const DEFAULT_TRACE_DIR = resolvePreferredOpenClawTmpDir();
 function registerBrowserAgentDebugRoutes(app, ctx) {
 	app.get("/console", async (req, res) => {
 		const profileCtx = resolveProfileContext(req, res, ctx);
@@ -2607,7 +2851,7 @@ function registerBrowserAgentDebugRoutes(app, ctx) {
 			const pw = await requirePwAi(res, "trace stop");
 			if (!pw) return;
 			const id = crypto.randomUUID();
-			const dir = "/tmp/openclaw";
+			const dir = DEFAULT_TRACE_DIR;
 			await fs.mkdir(dir, { recursive: true });
 			const tracePath = out.trim() || path.join(dir, `browser-trace-${id}.zip`);
 			await pw.traceStopViaPlaywright({
@@ -2650,6 +2894,22 @@ function normalizeHostnameSet(values) {
 	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
 	return new Set(values.map((value) => normalizeHostname(value)).filter(Boolean));
 }
+function normalizeHostnameAllowlist(values) {
+	if (!values || values.length === 0) return [];
+	return Array.from(new Set(values.map((value) => normalizeHostname(value)).filter((value) => value !== "*" && value !== "*." && value.length > 0)));
+}
+function isHostnameAllowedByPattern(hostname, pattern) {
+	if (pattern.startsWith("*.")) {
+		const suffix = pattern.slice(2);
+		if (!suffix || hostname === suffix) return false;
+		return hostname.endsWith(`.${suffix}`);
+	}
+	return hostname === pattern;
+}
+function matchesHostnameAllowlist(hostname, allowlist) {
+	if (allowlist.length === 0) return true;
+	return allowlist.some((pattern) => isHostnameAllowedByPattern(hostname, pattern));
+}
 function parseIpv4(address) {
 	const parts = address.split(".");
 	if (parts.length !== 4) return null;
@@ -2750,7 +3010,10 @@ async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
 	const normalized = normalizeHostname(hostname);
 	if (!normalized) throw new Error("Invalid hostname");
 	const allowPrivateNetwork = Boolean(params.policy?.allowPrivateNetwork);
-	const isExplicitAllowed = normalizeHostnameSet(params.policy?.allowedHostnames).has(normalized);
+	const allowedHostnames = normalizeHostnameSet(params.policy?.allowedHostnames);
+	const hostnameAllowlist = normalizeHostnameAllowlist(params.policy?.hostnameAllowlist);
+	const isExplicitAllowed = allowedHostnames.has(normalized);
+	if (!matchesHostnameAllowlist(normalized, hostnameAllowlist)) throw new SsrFBlockedError(`Blocked hostname (not in allowlist): ${hostname}`);
 	if (!allowPrivateNetwork && !isExplicitAllowed) {
 		if (isBlockedHostname(normalized)) throw new SsrFBlockedError(`Blocked hostname: ${hostname}`);
 		if (isPrivateIpAddress(normalized)) throw new SsrFBlockedError("Blocked: private/internal IP address");
@@ -2771,9 +3034,6 @@ async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
 		})
 	};
 }
-async function resolvePinnedHostname(hostname, lookupFn = lookup$1) {
-	return await resolvePinnedHostnameWithPolicy(hostname, { lookupFn });
-}
 function createPinnedDispatcher(pinned) {
 	return new Agent({ connect: { lookup: pinned.lookup } });
 }
@@ -4471,7 +4731,7 @@ function normalizeWsUrl(raw, cdpBaseUrl) {
 }
 async function fetchJson(url, timeoutMs = 1500, init) {
 	const ctrl = new AbortController();
-	const t = setTimeout(() => ctrl.abort(), timeoutMs);
+	const t = setTimeout(ctrl.abort.bind(ctrl), timeoutMs);
 	try {
 		const headers = getHeadersWithAuth(url, init?.headers || {});
 		const res = await fetch(url, {
@@ -4487,7 +4747,7 @@ async function fetchJson(url, timeoutMs = 1500, init) {
 }
 async function fetchOk(url, timeoutMs = 1500, init) {
 	const ctrl = new AbortController();
-	const t = setTimeout(() => ctrl.abort(), timeoutMs);
+	const t = setTimeout(ctrl.abort.bind(ctrl), timeoutMs);
 	try {
 		const headers = getHeadersWithAuth(url, init?.headers || {});
 		const res = await fetch(url, {
@@ -4762,11 +5022,11 @@ function createProfileContext(opts, profile) {
 		const userDataDir = resolveOpenClawUserDataDir(profile.name);
 		const profileState = getProfileState();
 		if (await isHttpReachable(300) && !profileState.running) try {
-			await (await import("./pw-ai-CQ4-gUNR.js")).closePlaywrightBrowserConnection();
+			await (await import("./pw-ai-6GzTgK5g.js")).closePlaywrightBrowserConnection();
 		} catch {}
 		if (profileState.running) await stopRunningBrowser();
 		try {
-			await (await import("./pw-ai-CQ4-gUNR.js")).closePlaywrightBrowserConnection();
+			await (await import("./pw-ai-6GzTgK5g.js")).closePlaywrightBrowserConnection();
 		} catch {}
 		if (!fs$1.existsSync(userDataDir)) return {
 			moved: false,
@@ -4882,6 +5142,16 @@ async function startBrowserBridgeServer(params) {
 	const host = params.host ?? "127.0.0.1";
 	const port = params.port ?? 0;
 	const app = express();
+	app.use((req, res, next) => {
+		const ctrl = new AbortController();
+		const abort = () => ctrl.abort(/* @__PURE__ */ new Error("request aborted"));
+		req.once("aborted", abort);
+		res.once("close", () => {
+			if (!res.writableEnded) abort();
+		});
+		req.signal = ctrl.signal;
+		next();
+	});
 	app.use(express.json({ limit: "1mb" }));
 	const authToken = params.authToken?.trim();
 	if (authToken) app.use((req, res, next) => {
@@ -5050,26 +5320,55 @@ function resolveSandboxAgentId(scopeKey) {
 
 //#endregion
 //#region src/agents/sandbox/docker.ts
-const HOT_CONTAINER_WINDOW_MS = 300 * 1e3;
-function execDocker(args, opts) {
+function createAbortError() {
+	const err = /* @__PURE__ */ new Error("Aborted");
+	err.name = "AbortError";
+	return err;
+}
+function execDockerRaw(args, opts) {
 	return new Promise((resolve, reject) => {
 		const child = spawn("docker", args, { stdio: [
-			"ignore",
+			"pipe",
 			"pipe",
 			"pipe"
 		] });
-		let stdout = "";
-		let stderr = "";
+		const stdoutChunks = [];
+		const stderrChunks = [];
+		let aborted = false;
+		const signal = opts?.signal;
+		const handleAbort = () => {
+			if (aborted) return;
+			aborted = true;
+			child.kill("SIGTERM");
+		};
+		if (signal) if (signal.aborted) handleAbort();
+		else signal.addEventListener("abort", handleAbort);
 		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
+			stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
 		});
 		child.stderr?.on("data", (chunk) => {
-			stderr += chunk.toString();
+			stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+		});
+		child.on("error", (error) => {
+			if (signal) signal.removeEventListener("abort", handleAbort);
+			reject(error);
 		});
 		child.on("close", (code) => {
+			if (signal) signal.removeEventListener("abort", handleAbort);
+			const stdout = Buffer.concat(stdoutChunks);
+			const stderr = Buffer.concat(stderrChunks);
+			if (aborted || signal?.aborted) {
+				reject(createAbortError());
+				return;
+			}
 			const exitCode = code ?? 0;
 			if (exitCode !== 0 && !opts?.allowFailure) {
-				reject(new Error(stderr.trim() || `docker ${args.join(" ")} failed`));
+				const message = stderr.length > 0 ? stderr.toString("utf8").trim() : "";
+				reject(Object.assign(new Error(message || `docker ${args.join(" ")} failed`), {
+					code: exitCode,
+					stdout,
+					stderr
+				}));
 				return;
 			}
 			resolve({
@@ -5078,8 +5377,20 @@ function execDocker(args, opts) {
 				code: exitCode
 			});
 		});
+		const stdin = child.stdin;
+		if (stdin) if (opts?.input !== void 0) stdin.end(opts.input);
+		else stdin.end();
 	});
 }
+const HOT_CONTAINER_WINDOW_MS = 300 * 1e3;
+async function execDocker(args, opts) {
+	const result = await execDockerRaw(args, opts);
+	return {
+		stdout: result.stdout.toString("utf8"),
+		stderr: result.stderr.toString("utf8"),
+		code: result.code
+	};
+}
 async function readDockerPort(containerName, port) {
 	const result = await execDocker([
 		"port",
@@ -5167,6 +5478,10 @@ function buildSandboxCreateArgs(params) {
 	for (const entry of params.cfg.tmpfs) args.push("--tmpfs", entry);
 	if (params.cfg.network) args.push("--network", params.cfg.network);
 	if (params.cfg.user) args.push("--user", params.cfg.user);
+	for (const [key, value] of Object.entries(params.cfg.env ?? {})) {
+		if (!key.trim()) continue;
+		args.push("--env", key + "=" + value);
+	}
 	for (const cap of params.cfg.capDrop) args.push("--cap-drop", cap);
 	args.push("--security-opt", "no-new-privileges");
 	if (params.cfg.seccompProfile) args.push("--security-opt", `seccomp=${params.cfg.seccompProfile}`);
@@ -5304,7 +5619,7 @@ async function waitForSandboxCdp(params) {
 	while (Date.now() < deadline) {
 		try {
 			const ctrl = new AbortController();
-			const t = setTimeout(() => ctrl.abort(), 1e3);
+			const t = setTimeout(ctrl.abort.bind(ctrl), 1e3);
 			try {
 				if ((await fetch(url, { signal: ctrl.signal })).ok) return true;
 			} finally {
@@ -5355,7 +5670,10 @@ async function ensureSandboxBrowser(params) {
 		await ensureSandboxBrowserImage(params.cfg.browser.image ?? DEFAULT_SANDBOX_BROWSER_IMAGE);
 		const args = buildSandboxCreateArgs({
 			name: containerName,
-			cfg: params.cfg.docker,
+			cfg: {
+				...params.cfg.docker,
+				network: "bridge"
+			},
 			scopeKey: params.scopeKey,
 			labels: { "openclaw.sandboxBrowser": "1" }
 		});
@@ -5433,6 +5751,142 @@ async function ensureSandboxBrowser(params) {
 	};
 }
 
+//#endregion
+//#region src/agents/sandbox/fs-bridge.ts
+function createSandboxFsBridge(params) {
+	return new SandboxFsBridgeImpl(params.sandbox);
+}
+var SandboxFsBridgeImpl = class {
+	constructor(sandbox) {
+		this.sandbox = sandbox;
+	}
+	resolvePath(params) {
+		return resolveSandboxFsPath({
+			sandbox: this.sandbox,
+			filePath: params.filePath,
+			cwd: params.cwd
+		});
+	}
+	async readFile(params) {
+		const target = this.resolvePath(params);
+		return (await this.runCommand("set -eu; cat -- \"$1\"", {
+			args: [target.containerPath],
+			signal: params.signal
+		})).stdout;
+	}
+	async writeFile(params) {
+		this.ensureWriteAccess("write files");
+		const target = this.resolvePath(params);
+		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
+		const script = params.mkdir === false ? "set -eu; cat >\"$1\"" : "set -eu; dir=$(dirname -- \"$1\"); if [ \"$dir\" != \".\" ]; then mkdir -p -- \"$dir\"; fi; cat >\"$1\"";
+		await this.runCommand(script, {
+			args: [target.containerPath],
+			stdin: buffer,
+			signal: params.signal
+		});
+	}
+	async mkdirp(params) {
+		this.ensureWriteAccess("create directories");
+		const target = this.resolvePath(params);
+		await this.runCommand("set -eu; mkdir -p -- \"$1\"", {
+			args: [target.containerPath],
+			signal: params.signal
+		});
+	}
+	async remove(params) {
+		this.ensureWriteAccess("remove files");
+		const target = this.resolvePath(params);
+		const flags = [params.force === false ? "" : "-f", params.recursive ? "-r" : ""].filter(Boolean);
+		const rmCommand = flags.length > 0 ? `rm ${flags.join(" ")}` : "rm";
+		await this.runCommand(`set -eu; ${rmCommand} -- "$1"`, {
+			args: [target.containerPath],
+			signal: params.signal
+		});
+	}
+	async rename(params) {
+		this.ensureWriteAccess("rename files");
+		const from = this.resolvePath({
+			filePath: params.from,
+			cwd: params.cwd
+		});
+		const to = this.resolvePath({
+			filePath: params.to,
+			cwd: params.cwd
+		});
+		await this.runCommand("set -eu; dir=$(dirname -- \"$2\"); if [ \"$dir\" != \".\" ]; then mkdir -p -- \"$dir\"; fi; mv -- \"$1\" \"$2\"", {
+			args: [from.containerPath, to.containerPath],
+			signal: params.signal
+		});
+	}
+	async stat(params) {
+		const target = this.resolvePath(params);
+		const result = await this.runCommand("set -eu; stat -c \"%F|%s|%Y\" -- \"$1\"", {
+			args: [target.containerPath],
+			signal: params.signal,
+			allowFailure: true
+		});
+		if (result.code !== 0) {
+			const stderr = result.stderr.toString("utf8");
+			if (stderr.includes("No such file or directory")) return null;
+			const message = stderr.trim() || `stat failed with code ${result.code}`;
+			throw new Error(`stat failed for ${target.containerPath}: ${message}`);
+		}
+		const [typeRaw, sizeRaw, mtimeRaw] = result.stdout.toString("utf8").trim().split("|");
+		const size = Number.parseInt(sizeRaw ?? "0", 10);
+		const mtime = Number.parseInt(mtimeRaw ?? "0", 10) * 1e3;
+		return {
+			type: coerceStatType(typeRaw),
+			size: Number.isFinite(size) ? size : 0,
+			mtimeMs: Number.isFinite(mtime) ? mtime : 0
+		};
+	}
+	async runCommand(script, options = {}) {
+		const dockerArgs = [
+			"exec",
+			"-i",
+			this.sandbox.containerName,
+			"sh",
+			"-c",
+			script,
+			"moltbot-sandbox-fs"
+		];
+		if (options.args?.length) dockerArgs.push(...options.args);
+		return execDockerRaw(dockerArgs, {
+			input: options.stdin,
+			allowFailure: options.allowFailure,
+			signal: options.signal
+		});
+	}
+	ensureWriteAccess(action) {
+		if (!allowsWrites(this.sandbox.workspaceAccess)) throw new Error(`Sandbox workspace (${this.sandbox.workspaceAccess}) does not allow ${action}.`);
+	}
+};
+function allowsWrites(access) {
+	return access === "rw";
+}
+function resolveSandboxFsPath(params) {
+	const root = params.sandbox.workspaceDir;
+	const cwd = params.cwd ?? root;
+	const { resolved, relative } = resolveSandboxPath({
+		filePath: params.filePath,
+		cwd,
+		root
+	});
+	const normalizedRelative = relative ? relative.split(path.sep).filter(Boolean).join(path.posix.sep) : "";
+	return {
+		hostPath: resolved,
+		relativePath: normalizedRelative,
+		containerPath: normalizedRelative ? path.posix.join(params.sandbox.containerWorkdir, normalizedRelative) : params.sandbox.containerWorkdir
+	};
+}
+function coerceStatType(typeRaw) {
+	if (!typeRaw) return "other";
+	const normalized = typeRaw.trim().toLowerCase();
+	if (normalized.includes("directory")) return "directory";
+	if (normalized.includes("file")) return "file";
+	return "other";
+}
+
 //#endregion
 //#region src/agents/sandbox/prune.ts
 let lastPruneAtMs = 0;
@@ -5578,55 +6032,18 @@ function resolveConversationLabel(ctx) {
 	return `${base} id:${id}`;
 }
 
-//#endregion
-//#region src/imessage/accounts.ts
-function resolveAccountConfig(cfg, accountId) {
-	const accounts = cfg.channels?.imessage?.accounts;
-	if (!accounts || typeof accounts !== "object") return;
-	return accounts[accountId];
-}
-function mergeIMessageAccountConfig(cfg, accountId) {
-	const { accounts: _ignored, ...base } = cfg.channels?.imessage ?? {};
-	const account = resolveAccountConfig(cfg, accountId) ?? {};
-	return {
-		...base,
-		...account
-	};
-}
-function resolveIMessageAccount(params) {
-	const accountId = normalizeAccountId$1(params.accountId);
-	const baseEnabled = params.cfg.channels?.imessage?.enabled !== false;
-	const merged = mergeIMessageAccountConfig(params.cfg, accountId);
-	const accountEnabled = merged.enabled !== false;
-	const configured = Boolean(merged.cliPath?.trim() || merged.dbPath?.trim() || merged.service || merged.region?.trim() || merged.allowFrom && merged.allowFrom.length > 0 || merged.groupAllowFrom && merged.groupAllowFrom.length > 0 || merged.dmPolicy || merged.groupPolicy || typeof merged.includeAttachments === "boolean" || typeof merged.mediaMaxMb === "number" || typeof merged.textChunkLimit === "number" || merged.groups && Object.keys(merged.groups).length > 0);
-	return {
-		accountId,
-		enabled: baseEnabled && accountEnabled,
-		name: merged.name?.trim() || void 0,
-		config: merged,
-		configured
-	};
-}
-
-//#endregion
-//#region src/slack/threading-tool-context.ts
-function buildSlackThreadingToolContext(params) {
-	const configuredReplyToMode = resolveSlackReplyToMode(resolveSlackAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}), params.context.ChatType);
-	const effectiveReplyToMode = params.context.ThreadLabel ? "all" : configuredReplyToMode;
-	const threadId = params.context.MessageThreadId ?? params.context.ReplyToId;
-	return {
-		currentChannelId: params.context.To?.startsWith("channel:") ? params.context.To.slice(8) : void 0,
-		currentThreadTs: threadId != null ? String(threadId) : void 0,
-		replyToMode: effectiveReplyToMode,
-		hasRepliedRef: params.hasRepliedRef
-	};
-}
-
 //#endregion
 //#region src/config/group-policy.ts
+function resolveChannelGroupConfig(groups, groupId, caseInsensitive = false) {
+	if (!groups) return;
+	const direct = groups[groupId];
+	if (direct) return direct;
+	if (!caseInsensitive) return;
+	const target = groupId.toLowerCase();
+	const matchedKey = Object.keys(groups).find((key) => key !== "*" && key.toLowerCase() === target);
+	if (!matchedKey) return;
+	return groups[matchedKey];
+}
 function normalizeSenderKey(value) {
 	const trimmed = value.trim();
 	if (!trimmed) return "";
@@ -5678,11 +6095,11 @@ function resolveChannelGroupPolicy(params) {
 	const groups = resolveChannelGroups(cfg, channel, params.accountId);
 	const allowlistEnabled = Boolean(groups && Object.keys(groups).length > 0);
 	const normalizedId = params.groupId?.trim();
-	const groupConfig = normalizedId && groups ? groups[normalizedId] : void 0;
+	const groupConfig = normalizedId ? resolveChannelGroupConfig(groups, normalizedId, params.groupIdCaseInsensitive) : void 0;
 	const defaultConfig = groups?.["*"];
 	return {
 		allowlistEnabled,
-		allowed: !allowlistEnabled || allowlistEnabled && Boolean(groups && Object.hasOwn(groups, "*")) || (normalizedId ? Boolean(groups && Object.hasOwn(groups, normalizedId)) : false),
+		allowed: !allowlistEnabled || allowlistEnabled && Boolean(groups && Object.hasOwn(groups, "*")) || Boolean(groupConfig),
 		groupConfig,
 		defaultConfig
 	};
@@ -5718,6 +6135,53 @@ function resolveChannelGroupToolsPolicy(params) {
 	if (defaultConfig?.tools) return defaultConfig.tools;
 }
 
+//#endregion
+//#region src/imessage/accounts.ts
+function resolveAccountConfig(cfg, accountId) {
+	const accounts = cfg.channels?.imessage?.accounts;
+	if (!accounts || typeof accounts !== "object") return;
+	return accounts[accountId];
+}
+function mergeIMessageAccountConfig(cfg, accountId) {
+	const { accounts: _ignored, ...base } = cfg.channels?.imessage ?? {};
+	const account = resolveAccountConfig(cfg, accountId) ?? {};
+	return {
+		...base,
+		...account
+	};
+}
+function resolveIMessageAccount(params) {
+	const accountId = normalizeAccountId$1(params.accountId);
+	const baseEnabled = params.cfg.channels?.imessage?.enabled !== false;
+	const merged = mergeIMessageAccountConfig(params.cfg, accountId);
+	const accountEnabled = merged.enabled !== false;
+	const configured = Boolean(merged.cliPath?.trim() || merged.dbPath?.trim() || merged.service || merged.region?.trim() || merged.allowFrom && merged.allowFrom.length > 0 || merged.groupAllowFrom && merged.groupAllowFrom.length > 0 || merged.dmPolicy || merged.groupPolicy || typeof merged.includeAttachments === "boolean" || typeof merged.mediaMaxMb === "number" || typeof merged.textChunkLimit === "number" || merged.groups && Object.keys(merged.groups).length > 0);
+	return {
+		accountId,
+		enabled: baseEnabled && accountEnabled,
+		name: merged.name?.trim() || void 0,
+		config: merged,
+		configured
+	};
+}
+
+//#endregion
+//#region src/slack/threading-tool-context.ts
+function buildSlackThreadingToolContext(params) {
+	const configuredReplyToMode = resolveSlackReplyToMode(resolveSlackAccount({
+		cfg: params.cfg,
+		accountId: params.accountId
+	}), params.context.ChatType);
+	const effectiveReplyToMode = params.context.ThreadLabel ? "all" : configuredReplyToMode;
+	const threadId = params.context.MessageThreadId ?? params.context.ReplyToId;
+	return {
+		currentChannelId: params.context.To?.startsWith("channel:") ? params.context.To.slice(8) : void 0,
+		currentThreadTs: threadId != null ? String(threadId) : void 0,
+		replyToMode: effectiveReplyToMode,
+		hasRepliedRef: params.hasRepliedRef
+	};
+}
+
 //#endregion
 //#region src/channels/plugins/group-mentions.ts
 function normalizeDiscordSlug(value) {
@@ -6083,6 +6547,52 @@ const DOCKS = {
 			})
 		}
 	},
+	irc: {
+		id: "irc",
+		capabilities: {
+			chatTypes: ["direct", "group"],
+			media: true,
+			blockStreaming: true
+		},
+		outbound: { textChunkLimit: 350 },
+		streaming: { blockStreamingCoalesceDefaults: {
+			minChars: 300,
+			idleMs: 1e3
+		} },
+		config: {
+			resolveAllowFrom: ({ cfg, accountId }) => {
+				const channel = cfg.channels?.irc;
+				const normalized = normalizeAccountId$1(accountId);
+				return ((channel?.accounts?.[normalized] ?? channel?.accounts?.[Object.keys(channel?.accounts ?? {}).find((key) => key.toLowerCase() === normalized.toLowerCase()) ?? ""])?.allowFrom ?? channel?.allowFrom ?? []).map((entry) => String(entry));
+			},
+			formatAllowFrom: ({ allowFrom }) => allowFrom.map((entry) => String(entry).trim()).filter(Boolean).map((entry) => entry.replace(/^irc:/i, "").replace(/^user:/i, "").toLowerCase())
+		},
+		groups: {
+			resolveRequireMention: ({ cfg, accountId, groupId }) => {
+				if (!groupId) return true;
+				return resolveChannelGroupRequireMention({
+					cfg,
+					channel: "irc",
+					groupId,
+					accountId,
+					groupIdCaseInsensitive: true
+				});
+			},
+			resolveToolPolicy: ({ cfg, accountId, groupId, senderId, senderName, senderUsername }) => {
+				if (!groupId) return;
+				return resolveChannelGroupToolsPolicy({
+					cfg,
+					channel: "irc",
+					groupId,
+					accountId,
+					groupIdCaseInsensitive: true,
+					senderId,
+					senderName,
+					senderUsername
+				});
+			}
+		}
+	},
 	googlechat: {
 		id: "googlechat",
 		capabilities: {
@@ -6414,6 +6924,12 @@ function mergeSessionEntry(existing, patch) {
 		updatedAt
 	};
 }
+function resolveFreshSessionTotalTokens(entry) {
+	const total = entry?.totalTokens;
+	if (typeof total !== "number" || !Number.isFinite(total) || total < 0) return;
+	if (entry?.totalTokensFresh === false) return;
+	return total;
+}
 const DEFAULT_RESET_TRIGGERS = ["/new", "/reset"];
 const DEFAULT_IDLE_MINUTES = 60;
 
@@ -6523,6 +7039,160 @@ function resolveSessionKey(scope, ctx, mainKey) {
 	return `agent:${DEFAULT_AGENT_ID}:${raw}`;
 }
 
+//#endregion
+//#region src/agents/session-write-lock.ts
+const HELD_LOCKS = /* @__PURE__ */ new Map();
+const CLEANUP_SIGNALS = [
+	"SIGINT",
+	"SIGTERM",
+	"SIGQUIT",
+	"SIGABRT"
+];
+const CLEANUP_STATE_KEY = Symbol.for("openclaw.sessionWriteLockCleanupState");
+function resolveCleanupState() {
+	const proc = process;
+	if (!proc[CLEANUP_STATE_KEY]) proc[CLEANUP_STATE_KEY] = {
+		registered: false,
+		cleanupHandlers: /* @__PURE__ */ new Map()
+	};
+	return proc[CLEANUP_STATE_KEY];
+}
+function isAlive(pid) {
+	if (!Number.isFinite(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Synchronously release all held locks.
+* Used during process exit when async operations aren't reliable.
+*/
+function releaseAllLocksSync() {
+	for (const [sessionFile, held] of HELD_LOCKS) {
+		try {
+			if (typeof held.handle.close === "function") held.handle.close().catch(() => {});
+		} catch {}
+		try {
+			fs$1.rmSync(held.lockPath, { force: true });
+		} catch {}
+		HELD_LOCKS.delete(sessionFile);
+	}
+}
+function handleTerminationSignal(signal) {
+	releaseAllLocksSync();
+	const cleanupState = resolveCleanupState();
+	if (process.listenerCount(signal) === 1) {
+		const handler = cleanupState.cleanupHandlers.get(signal);
+		if (handler) process.off(signal, handler);
+		try {
+			process.kill(process.pid, signal);
+		} catch {}
+	}
+}
+function registerCleanupHandlers() {
+	const cleanupState = resolveCleanupState();
+	if (cleanupState.registered) return;
+	cleanupState.registered = true;
+	process.on("exit", () => {
+		releaseAllLocksSync();
+	});
+	for (const signal of CLEANUP_SIGNALS) try {
+		const handler = () => handleTerminationSignal(signal);
+		cleanupState.cleanupHandlers.set(signal, handler);
+		process.on(signal, handler);
+	} catch {}
+}
+async function readLockPayload(lockPath) {
+	try {
+		const raw = await fs.readFile(lockPath, "utf8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.pid !== "number") return null;
+		if (typeof parsed.createdAt !== "string") return null;
+		return {
+			pid: parsed.pid,
+			createdAt: parsed.createdAt
+		};
+	} catch {
+		return null;
+	}
+}
+async function acquireSessionWriteLock(params) {
+	registerCleanupHandlers();
+	const timeoutMs = params.timeoutMs ?? 1e4;
+	const staleMs = params.staleMs ?? 1800 * 1e3;
+	const sessionFile = path.resolve(params.sessionFile);
+	const sessionDir = path.dirname(sessionFile);
+	await fs.mkdir(sessionDir, { recursive: true });
+	let normalizedDir = sessionDir;
+	try {
+		normalizedDir = await fs.realpath(sessionDir);
+	} catch {}
+	const normalizedSessionFile = path.join(normalizedDir, path.basename(sessionFile));
+	const lockPath = `${normalizedSessionFile}.lock`;
+	const held = HELD_LOCKS.get(normalizedSessionFile);
+	if (held) {
+		held.count += 1;
+		return { release: async () => {
+			const current = HELD_LOCKS.get(normalizedSessionFile);
+			if (!current) return;
+			current.count -= 1;
+			if (current.count > 0) return;
+			HELD_LOCKS.delete(normalizedSessionFile);
+			await current.handle.close();
+			await fs.rm(current.lockPath, { force: true });
+		} };
+	}
+	const startedAt = Date.now();
+	let attempt = 0;
+	while (Date.now() - startedAt < timeoutMs) {
+		attempt += 1;
+		try {
+			const handle = await fs.open(lockPath, "wx");
+			await handle.writeFile(JSON.stringify({
+				pid: process.pid,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			}, null, 2), "utf8");
+			HELD_LOCKS.set(normalizedSessionFile, {
+				count: 1,
+				handle,
+				lockPath
+			});
+			return { release: async () => {
+				const current = HELD_LOCKS.get(normalizedSessionFile);
+				if (!current) return;
+				current.count -= 1;
+				if (current.count > 0) return;
+				HELD_LOCKS.delete(normalizedSessionFile);
+				await current.handle.close();
+				await fs.rm(current.lockPath, { force: true });
+			} };
+		} catch (err) {
+			if (err.code !== "EEXIST") throw err;
+			const payload = await readLockPayload(lockPath);
+			const createdAt = payload?.createdAt ? Date.parse(payload.createdAt) : NaN;
+			const stale = !Number.isFinite(createdAt) || Date.now() - createdAt > staleMs;
+			const alive = payload?.pid ? isAlive(payload.pid) : false;
+			if (stale || !alive) {
+				await fs.rm(lockPath, { force: true });
+				continue;
+			}
+			const delay = Math.min(1e3, 50 * attempt);
+			await new Promise((r) => setTimeout(r, delay));
+		}
+	}
+	const payload = await readLockPayload(lockPath);
+	const owner = payload?.pid ? `pid=${payload.pid}` : "unknown";
+	throw new Error(`session file locked (timeout ${timeoutMs}ms): ${owner} ${lockPath}`);
+}
+const __testing = {
+	cleanupSignals: [...CLEANUP_SIGNALS],
+	handleTerminationSignal,
+	releaseAllLocksSync
+};
+
 //#endregion
 //#region src/utils/account-id.ts
 function normalizeAccountId(value) {
@@ -6699,7 +7369,7 @@ function loadSessionStore(storePath, opts = {}) {
 	let mtimeMs = getFileMtimeMs(storePath);
 	try {
 		const raw = fs$1.readFileSync(storePath, "utf-8");
-		const parsed = JSON5.parse(raw);
+		const parsed = JSON.parse(raw);
 		if (isSessionStoreRecord(parsed)) store = parsed;
 		mtimeMs = getFileMtimeMs(storePath) ?? mtimeMs;
 	} catch {}
@@ -6952,47 +7622,98 @@ async function updateSessionStore(storePath, mutator, opts) {
 		return result;
 	});
 }
-async function withSessionStoreLock(storePath, fn, opts = {}) {
-	const timeoutMs = opts.timeoutMs ?? 1e4;
-	const pollIntervalMs = opts.pollIntervalMs ?? 25;
-	const staleMs = opts.staleMs ?? 3e4;
-	const lockPath = `${storePath}.lock`;
-	const startedAt = Date.now();
-	await fs$1.promises.mkdir(path.dirname(storePath), { recursive: true });
-	while (true) try {
-		const handle = await fs$1.promises.open(lockPath, "wx");
-		try {
-			await handle.writeFile(JSON.stringify({
-				pid: process.pid,
-				startedAt: Date.now()
-			}), "utf-8");
-		} catch {}
-		await handle.close();
-		break;
-	} catch (err) {
-		const code = err && typeof err === "object" && "code" in err ? String(err.code) : null;
-		if (code === "ENOENT") {
-			await fs$1.promises.mkdir(path.dirname(storePath), { recursive: true }).catch(() => void 0);
-			await new Promise((r) => setTimeout(r, pollIntervalMs));
-			continue;
-		}
-		if (code !== "EEXIST") throw err;
-		const now = Date.now();
-		if (now - startedAt > timeoutMs) throw new Error(`timeout acquiring session store lock: ${lockPath}`, { cause: err });
-		try {
-			if (now - (await fs$1.promises.stat(lockPath)).mtimeMs > staleMs) {
-				await fs$1.promises.unlink(lockPath);
+const LOCK_QUEUES = /* @__PURE__ */ new Map();
+function lockTimeoutError(storePath) {
+	return /* @__PURE__ */ new Error(`timeout waiting for session store lock: ${storePath}`);
+}
+function getOrCreateLockQueue(storePath) {
+	const existing = LOCK_QUEUES.get(storePath);
+	if (existing) return existing;
+	const created = {
+		running: false,
+		pending: []
+	};
+	LOCK_QUEUES.set(storePath, created);
+	return created;
+}
+function removePendingTask(queue, task) {
+	const idx = queue.pending.indexOf(task);
+	if (idx >= 0) queue.pending.splice(idx, 1);
+}
+async function drainSessionStoreLockQueue(storePath) {
+	const queue = LOCK_QUEUES.get(storePath);
+	if (!queue || queue.running) return;
+	queue.running = true;
+	try {
+		while (queue.pending.length > 0) {
+			const task = queue.pending.shift();
+			if (!task || task.timedOut) continue;
+			if (task.timer) clearTimeout(task.timer);
+			task.started = true;
+			const remainingTimeoutMs = task.timeoutAt != null ? Math.max(0, task.timeoutAt - Date.now()) : Number.POSITIVE_INFINITY;
+			if (task.timeoutAt != null && remainingTimeoutMs <= 0) {
+				task.timedOut = true;
+				task.reject(lockTimeoutError(storePath));
 				continue;
 			}
-		} catch {}
-		await new Promise((r) => setTimeout(r, pollIntervalMs));
-	}
-	try {
-		return await fn();
+			let lock;
+			let result;
+			let failed;
+			let hasFailure = false;
+			try {
+				lock = await acquireSessionWriteLock({
+					sessionFile: storePath,
+					timeoutMs: remainingTimeoutMs,
+					staleMs: task.staleMs
+				});
+				result = await task.fn();
+			} catch (err) {
+				hasFailure = true;
+				failed = err;
+			} finally {
+				await lock?.release().catch(() => void 0);
+			}
+			if (hasFailure) {
+				task.reject(failed);
+				continue;
+			}
+			task.resolve(result);
+		}
 	} finally {
-		await fs$1.promises.unlink(lockPath).catch(() => void 0);
+		queue.running = false;
+		if (queue.pending.length === 0) LOCK_QUEUES.delete(storePath);
+		else queueMicrotask(() => {
+			drainSessionStoreLockQueue(storePath);
+		});
 	}
 }
+async function withSessionStoreLock(storePath, fn, opts = {}) {
+	const timeoutMs = opts.timeoutMs ?? 1e4;
+	const staleMs = opts.staleMs ?? 3e4;
+	opts.pollIntervalMs;
+	const hasTimeout = timeoutMs > 0 && Number.isFinite(timeoutMs);
+	const timeoutAt = hasTimeout ? Date.now() + timeoutMs : void 0;
+	const queue = getOrCreateLockQueue(storePath);
+	return await new Promise((resolve, reject) => {
+		const task = {
+			fn: async () => await fn(),
+			resolve: (value) => resolve(value),
+			reject,
+			timeoutAt,
+			staleMs,
+			started: false,
+			timedOut: false
+		};
+		if (hasTimeout) task.timer = setTimeout(() => {
+			if (task.started || task.timedOut) return;
+			task.timedOut = true;
+			removePendingTask(queue, task);
+			reject(lockTimeoutError(storePath));
+		}, timeoutMs);
+		queue.pending.push(task);
+		drainSessionStoreLockQueue(storePath);
+	});
+}
 async function updateSessionStoreEntry(params) {
 	const { storePath, sessionKey, update } = params;
 	return await withSessionStoreLock(storePath, async () => {
@@ -7139,7 +7860,15 @@ async function appendAssistantMessageToSessionTranscript(params) {
 		ok: false,
 		reason: `unknown sessionKey: ${sessionKey}`
 	};
-	const sessionFile = entry.sessionFile?.trim() || resolveSessionTranscriptPath(entry.sessionId, params.agentId);
+	let sessionFile;
+	try {
+		sessionFile = resolveSessionFilePath(entry.sessionId, entry, { sessionsDir: path.dirname(storePath) });
+	} catch (err) {
+		return {
+			ok: false,
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
 	await ensureSessionHeader({
 		sessionFile,
 		sessionId: entry.sessionId
@@ -7346,7 +8075,7 @@ async function resolveSandboxContext(params) {
 		cfg,
 		evaluateEnabled: params.config?.browser?.evaluateEnabled ?? DEFAULT_BROWSER_EVALUATE_ENABLED
 	});
-	return {
+	const sandboxContext = {
 		enabled: true,
 		sessionKey: rawSessionKey,
 		workspaceDir,
@@ -7359,6 +8088,8 @@ async function resolveSandboxContext(params) {
 		browserAllowHostControl: cfg.browser.allowHostControl,
 		browser: browser ?? void 0
 	};
+	sandboxContext.fsBridge = createSandboxFsBridge({ sandbox: sandboxContext });
+	return sandboxContext;
 }
 async function ensureSandboxWorkspaceForSession(params) {
 	const rawSessionKey = params.sessionKey?.trim();
@@ -7395,7 +8126,12 @@ async function ensureSandboxWorkspaceForSession(params) {
 
 //#endregion
 //#region src/agents/pi-embedded-helpers/errors.ts
-const BILLING_ERROR_USER_MESSAGE = "⚠️ API provider returned a billing error — your API key has run out of credits or has an insufficient balance. Check your provider's billing dashboard and top up or switch to a different API key.";
+function formatBillingErrorMessage(provider) {
+	const providerName = provider?.trim();
+	if (providerName) return `⚠️ ${providerName} returned a billing error — your API key has run out of credits or has an insufficient balance. Check your ${providerName} billing dashboard and top up or switch to a different API key.`;
+	return "⚠️ API provider returned a billing error — your API key has run out of credits or has an insufficient balance. Check your provider's billing dashboard and top up or switch to a different API key.";
+}
+const BILLING_ERROR_USER_MESSAGE = formatBillingErrorMessage();
 function isContextOverflowError(errorMessage) {
 	if (!errorMessage) return false;
 	const lower = errorMessage.toLowerCase();
@@ -7404,24 +8140,49 @@ function isContextOverflowError(errorMessage) {
 	return lower.includes("request_too_large") || lower.includes("request exceeds the maximum size") || lower.includes("context length exceeded") || lower.includes("maximum context length") || lower.includes("prompt is too long") || lower.includes("exceeds model context window") || hasRequestSizeExceeds && hasContextWindow || lower.includes("context overflow:") || lower.includes("413") && lower.includes("too large");
 }
 const CONTEXT_WINDOW_TOO_SMALL_RE = /context window.*(too small|minimum is)/i;
-const CONTEXT_OVERFLOW_HINT_RE = /context.*overflow|context window.*(too (?:large|long)|exceed|over|limit|max(?:imum)?|requested|sent|tokens)|(?:prompt|request|input).*(too (?:large|long)|exceed|over|limit|max(?:imum)?)/i;
+const CONTEXT_OVERFLOW_HINT_RE = /context.*overflow|context window.*(too (?:large|long)|exceed|over|limit|max(?:imum)?|requested|sent|tokens)|prompt.*(too (?:large|long)|exceed|over|limit|max(?:imum)?)|(?:request|input).*(?:context|window|length|token).*(too (?:large|long)|exceed|over|limit|max(?:imum)?)/i;
+const RATE_LIMIT_HINT_RE = /rate limit|too many requests|requests per (?:minute|hour|day)|quota|throttl|429\b/i;
 function isLikelyContextOverflowError(errorMessage) {
 	if (!errorMessage) return false;
 	if (CONTEXT_WINDOW_TOO_SMALL_RE.test(errorMessage)) return false;
+	if (isRateLimitErrorMessage(errorMessage)) return false;
 	if (isContextOverflowError(errorMessage)) return true;
+	if (RATE_LIMIT_HINT_RE.test(errorMessage)) return false;
 	return CONTEXT_OVERFLOW_HINT_RE.test(errorMessage);
 }
 function isCompactionFailureError(errorMessage) {
 	if (!errorMessage) return false;
 	const lower = errorMessage.toLowerCase();
 	if (!(lower.includes("summarization failed") || lower.includes("auto-compaction") || lower.includes("compaction failed") || lower.includes("compaction"))) return false;
-	return isContextOverflowError(errorMessage) || lower.includes("context overflow");
+	if (isLikelyContextOverflowError(errorMessage)) return true;
+	return lower.includes("context overflow");
 }
 const ERROR_PAYLOAD_PREFIX_RE = /^(?:error|api\s*error|apierror|openai\s*error|anthropic\s*error|gateway\s*error)[:\s-]+/i;
 const FINAL_TAG_RE = /<\s*\/?\s*final\s*>/gi;
 const ERROR_PREFIX_RE = /^(?:error|api\s*error|openai\s*error|anthropic\s*error|gateway\s*error|request failed|failed|exception)[:\s-]+/i;
 const CONTEXT_OVERFLOW_ERROR_HEAD_RE = /^(?:context overflow:|request_too_large\b|request size exceeds\b|request exceeds the maximum size\b|context length exceeded\b|maximum context length\b|prompt is too long\b|exceeds model context window\b)/i;
 const HTTP_STATUS_PREFIX_RE = /^(?:http\s*)?(\d{3})\s+(.+)$/i;
+const HTTP_STATUS_CODE_PREFIX_RE = /^(?:http\s*)?(\d{3})(?:\s+([\s\S]+))?$/i;
+const HTML_ERROR_PREFIX_RE = /^\s*(?:<!doctype\s+html\b|<html\b)/i;
+const CLOUDFLARE_HTML_ERROR_CODES = new Set([
+	521,
+	522,
+	523,
+	524,
+	525,
+	526,
+	530
+]);
+const TRANSIENT_HTTP_ERROR_CODES = new Set([
+	500,
+	502,
+	503,
+	521,
+	522,
+	523,
+	524,
+	529
+]);
 const HTTP_ERROR_HINTS = [
 	"error",
 	"bad request",
@@ -7439,6 +8200,31 @@ const HTTP_ERROR_HINTS = [
 	"too many requests",
 	"permission"
 ];
+function extractLeadingHttpStatus(raw) {
+	const match = raw.match(HTTP_STATUS_CODE_PREFIX_RE);
+	if (!match) return null;
+	const code = Number(match[1]);
+	if (!Number.isFinite(code)) return null;
+	return {
+		code,
+		rest: (match[2] ?? "").trim()
+	};
+}
+function isCloudflareOrHtmlErrorPage(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return false;
+	const status = extractLeadingHttpStatus(trimmed);
+	if (!status || status.code < 500) return false;
+	if (CLOUDFLARE_HTML_ERROR_CODES.has(status.code)) return true;
+	return status.code < 600 && HTML_ERROR_PREFIX_RE.test(status.rest) && /<\/html>/i.test(status.rest);
+}
+function isTransientHttpError(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return false;
+	const status = extractLeadingHttpStatus(trimmed);
+	if (!status) return false;
+	return TRANSIENT_HTTP_ERROR_CODES.has(status.code);
+}
 function stripFinalTagsFromText(text) {
 	if (!text) return text;
 	return text.replace(FINAL_TAG_RE, "");
@@ -7461,6 +8247,7 @@ function collapseConsecutiveDuplicateBlocks(text) {
 	return result.join("\n\n");
 }
 function isLikelyHttpErrorText(raw) {
+	if (isCloudflareOrHtmlErrorPage(raw)) return true;
 	const match = raw.match(HTTP_STATUS_PREFIX_RE);
 	if (!match) return false;
 	const code = Number(match[1]);
@@ -7550,6 +8337,8 @@ function parseApiErrorInfo(raw) {
 function formatRawAssistantErrorForUi(raw) {
 	const trimmed = (raw ?? "").trim();
 	if (!trimmed) return "LLM request failed with an unknown error.";
+	const leadingStatus = extractLeadingHttpStatus(trimmed);
+	if (leadingStatus && isCloudflareOrHtmlErrorPage(trimmed)) return `The AI service is temporarily unavailable (HTTP ${leadingStatus.code}). Please try again in a moment.`;
 	const httpMatch = trimmed.match(HTTP_STATUS_PREFIX_RE);
 	if (httpMatch) {
 		const rest = httpMatch[2].trim();
@@ -7583,7 +8372,7 @@ function formatAssistantErrorText(msg, opts) {
 	const invalidRequest = raw.match(/"type":"invalid_request_error".*?"message":"([^"]+)"/);
 	if (invalidRequest?.[1]) return `LLM request rejected: ${invalidRequest[1]}`;
 	if (isOverloadedErrorMessage(raw)) return "The AI service is temporarily overloaded. Please try again in a moment.";
-	if (isBillingErrorMessage(raw)) return BILLING_ERROR_USER_MESSAGE;
+	if (isBillingErrorMessage(raw)) return formatBillingErrorMessage(opts?.provider);
 	if (isLikelyHttpErrorText(raw) || isRawApiErrorPayload(raw)) return formatRawAssistantErrorForUi(raw);
 	if (raw.length > 600) console.warn("[formatAssistantErrorText] Long error truncated:", raw.slice(0, 200));
 	return raw.length > 600 ? `${raw.slice(0, 600)}…` : raw;
@@ -7628,7 +8417,7 @@ const ERROR_PATTERNS = {
 		"context deadline exceeded"
 	],
 	billing: [
-		/\b402\b/,
+		/["']?(?:status|code)["']?\s*[:=]\s*402\b|\bhttp\s*402\b|\berror(?:\s+code)?\s*[:=]?\s*402\b|\b(?:got|returned|received)\s+(?:a\s+)?402\b|^\s*402\s+payment/i,
 		"payment required",
 		"insufficient credits",
 		"credit balance",
@@ -7734,6 +8523,7 @@ function isAuthAssistantError(msg) {
 function classifyFailoverReason(raw) {
 	if (isImageDimensionErrorMessage(raw)) return null;
 	if (isImageSizeError(raw)) return null;
+	if (isTransientHttpError(raw)) return "timeout";
 	if (isRateLimitErrorMessage(raw)) return "rate_limit";
 	if (isOverloadedErrorMessage(raw)) return "rate_limit";
 	if (isCloudCodeAssistFormatError(raw)) return "format";
@@ -8153,7 +8943,7 @@ async function sanitizeToolResultImages(result, label, opts = {}) {
 //#region src/agents/pi-embedded-helpers/images.ts
 async function sanitizeSessionMessagesImages(messages, label, options) {
 	const allowNonImageSanitization = (options?.sanitizeMode ?? "full") === "full";
-	const sanitizedIds = allowNonImageSanitization && options?.sanitizeToolCallIds ? sanitizeToolCallIdsForCloudCodeAssist(messages, options.toolCallIdMode) : messages;
+	const sanitizedIds = options?.sanitizeToolCallIds ? sanitizeToolCallIdsForCloudCodeAssist(messages, options.toolCallIdMode) : messages;
 	const out = [];
 	for (const msg of sanitizedIds) {
 		if (!msg || typeof msg !== "object") {
@@ -8266,6 +9056,7 @@ function isBinaryThinkingProvider(provider) {
 const XHIGH_MODEL_REFS = [
 	"openai/gpt-5.2",
 	"openai-codex/gpt-5.3-codex",
+	"openai-codex/gpt-5.3-codex-spark",
 	"openai-codex/gpt-5.2-codex",
 	"openai-codex/gpt-5.1-codex",
 	"github-copilot/gpt-5.2-codex",
@@ -8563,4 +9354,4 @@ function validateAnthropicTurns(messages) {
 }
 
 //#endregion
-export { isCacheEnabled as $, expandToolGroups as $t, isCloudCodeAssistFormatError as A, resolveSignalAccount as An, getImageMetadata as At, parseImageSizeError as B, listBindings as Bn, resolvePinnedHostnameWithPolicy as Bt, BILLING_ERROR_USER_MESSAGE as C, isAudioFileName as Cn, resolveConversationLabel as Ct, getApiErrorPayloadFingerprint as D, maxBytesForKind as Dn, resolveBrowserConfig as Dt, formatRawAssistantErrorForUi as E, MAX_IMAGE_BYTES$1 as En, registerBrowserRoutes as Et, isLikelyContextOverflowError as F, normalizeWhatsAppTarget as Fn, saveMediaBuffer as Ft, appendAssistantMessageToSessionTranscript as G, listEnabledDiscordAccounts as Gn, resolvePluginSkillDirs as Gt, ensureSandboxWorkspaceForSession as H, resolveSlackAppToken as Hn, buildWorkspaceSkillSnapshot as Ht, isRateLimitAssistantError as I, listEnabledTelegramAccounts as In, SsrFBlockedError as It, readSessionUpdatedAt as J, resolveSandboxConfigForAgent as Jt, resolveMirroredTranscriptText as K, resolveDiscordAccount as Kn, applySkillEnvOverrides as Kt, isRawApiErrorPayload as L, listTelegramAccountIds as Ln, closeDispatcher as Lt, isContextOverflowError as M, listChannelPlugins as Mn, optimizeImageToPng as Mt, isFailoverAssistantError as N, normalizeChannelId as Nn, resizeToJpeg as Nt, isAuthAssistantError as O, mediaKindFromMime as On, resolveProfile as Ot, isFailoverErrorMessage as P, isWhatsAppGroupJid as Pn, getMediaDir as Pt, updateSessionStoreEntry as Q, expandPolicyWithPluginGroups as Qt, isTimeoutErrorMessage as R, resolveTelegramAccount as Rn, createPinnedDispatcher as Rt, isGoogleModelApi as S, imageMimeFromFormat as Sn, resolveIMessageAccount as St, formatAssistantErrorText as T, kindFromMime as Tn, createBrowserRouteContext as Tt, resolveSandboxContext as U, resolveSlackBotToken as Un, loadWorkspaceSkillEntries as Ut, sanitizeUserFacingText as V, resolveSlackAccount as Vn, buildWorkspaceSkillCommandSpecs as Vt, resolveSandboxRuntimeStatus as W, normalizeChatType as Wn, resolveSkillsPromptForRun as Wt, updateLastRoute as X, buildPluginToolGroups as Xt, recordSessionMetaFromInbound as Y, applyOwnerOnlyToolPolicy as Yt, updateSessionStore as Z, collectExplicitAllowlist as Zt, sanitizeSessionMessagesImages as _, GATEWAY_CLIENT_MODES as _n, getChannelDock as _t, formatXHighModelHint as a, resolveBootstrapMaxChars as an, normalizeSessionDeliveryFields as at, downgradeOpenAIReasoningBlocks as b, extensionForMime as bn, resolveChannelGroupRequireMention as bt, normalizeReasoningLevel as c, isDeliverableMessageChannel as cn, evaluateSessionFreshness as ct, normalizeVerboseLevel as d, isMarkdownCapableMessageChannel as dn, resolveSessionResetType as dt, normalizeToolName as en, resolveCacheTtlMs as et, resolveResponseUsageMode as f, listDeliverableMessageChannels as fn, resolveThreadFlag as ft, normalizeTextForComparison as g, GATEWAY_CLIENT_IDS as gn, deriveSessionMetaPatch as gt, isMessagingToolDuplicateNormalized as h, resolveMessageChannel as hn, resolveMainSessionKey as ht, formatThinkingLevels as i, ensureSessionHeader$1 as in, normalizeDeliveryContext as it, isCompactionFailureError as j, getChannelPlugin as jn, hasAlphaChannel as jt, isBillingAssistantError as k, listEnabledSignalAccounts as kn, convertHeicToJpeg as kt, normalizeThinkLevel as l, isGatewayMessageChannel as ln, resolveChannelResetConfig as lt, isMessagingToolDuplicate as m, resolveGatewayMessageChannel as mn, resolveExplicitAgentSessionKey as mt, validateGeminiTurns as n, stripPluginOnlyAllowlist as nn, deliveryContextKey as nt, listThinkingLevels as o, sanitizeGoogleTurnOrdering as on, normalizeAccountId as ot, supportsXHighThinking as p, normalizeMessageChannel as pn, DEFAULT_RESET_TRIGGERS as pt, loadSessionStore as q, normalizeDiscordToken as qn, applySkillEnvOverridesFromSnapshot as qt, pickFallbackThinkingLevel as r, buildBootstrapContextFiles as rn, mergeDeliveryContext as rt, normalizeElevatedLevel as s, INTERNAL_MESSAGE_CHANNEL as sn, resolveSessionKey as st, validateAnthropicTurns as t, resolveToolProfilePolicy as tn, deliveryContextFromSession as tt, normalizeUsageDisplay as u, isInternalMessageChannel as un, resolveSessionResetPolicy as ut, sanitizeImageBlocks as v, GATEWAY_CLIENT_NAMES as vn, listChannelDocks as vt, classifyFailoverReason as w, isGifMedia as wn, resolveGroupSessionKey as wt, isAntigravityClaude as x, getFileExtension as xn, resolveChannelGroupToolsPolicy as xt, sanitizeToolResultImages as y, detectMime as yn, resolveChannelGroupPolicy as yt, parseImageDimensionError as z, resolveTelegramToken as zn, resolvePinnedHostname as zt };
+export { updateSessionStore as $, normalizeDiscordToken as $n, applySkillEnvOverridesFromSnapshot as $t, isBillingAssistantError as A, isGifMedia as An, registerBrowserRoutes as At, isTransientHttpError as B, isWhatsAppGroupJid as Bn, SsrFBlockedError as Bt, BILLING_ERROR_USER_MESSAGE as C, GATEWAY_CLIENT_MODES as Cn, resolveIMessageAccount as Ct, formatRawAssistantErrorForUi as D, getFileExtension as Dn, resolveConversationLabel as Dt, formatBillingErrorMessage as E, extensionForMime as En, resolveChannelGroupToolsPolicy as Et, isFailoverErrorMessage as F, listEnabledSignalAccounts as Fn, hasAlphaChannel as Ft, resolveSandboxContext as G, resolveTelegramToken as Gn, buildWorkspaceSkillSnapshot as Gt, parseImageSizeError as H, listEnabledTelegramAccounts as Hn, createPinnedDispatcher as Ht, isLikelyContextOverflowError as I, resolveSignalAccount as In, optimizeImageToPng as It, resolveMirroredTranscriptText as J, resolveSlackAppToken as Jn, resolvePluginSkillDirs as Jt, resolveSandboxRuntimeStatus as K, listBindings as Kn, loadWorkspaceSkillEntries as Kt, isRateLimitAssistantError as L, getChannelPlugin as Ln, resizeToJpeg as Lt, isCompactionFailureError as M, MAX_IMAGE_BYTES$1 as Mn, resolveProfile as Mt, isContextOverflowError as N, maxBytesForKind as Nn, convertHeicToJpeg as Nt, getApiErrorPayloadFingerprint as O, imageMimeFromFormat as On, resolveGroupSessionKey as Ot, isFailoverAssistantError as P, mediaKindFromMime as Pn, getImageMetadata as Pt, updateLastRoute as Q, resolveDiscordAccount as Qn, applySkillEnvOverrides as Qt, isRawApiErrorPayload as R, listChannelPlugins as Rn, getMediaDir as Rt, isGoogleModelApi as S, GATEWAY_CLIENT_IDS as Sn, listChannelDocks as St, formatAssistantErrorText as T, detectMime as Tn, resolveChannelGroupRequireMention as Tt, sanitizeUserFacingText as U, listTelegramAccountIds as Un, resolvePinnedHostnameWithPolicy as Ut, parseImageDimensionError as V, normalizeWhatsAppTarget as Vn, closeDispatcher as Vt, ensureSandboxWorkspaceForSession as W, resolveTelegramAccount as Wn, buildWorkspaceSkillCommandSpecs as Wt, readSessionUpdatedAt as X, normalizeChatType as Xn, assertSandboxPath as Xt, loadSessionStore as Y, resolveSlackBotToken as Yn, assertMediaNotDataUrl as Yt, recordSessionMetaFromInbound as Z, listEnabledDiscordAccounts as Zn, resolveSandboxedMediaSource as Zt, sanitizeSessionMessagesImages as _, isMarkdownCapableMessageChannel as _n, resolveFreshSessionTotalTokens as _t, formatXHighModelHint as a, expandToolGroups as an, mergeDeliveryContext as at, downgradeOpenAIReasoningBlocks as b, resolveGatewayMessageChannel as bn, deriveSessionMetaPatch as bt, normalizeReasoningLevel as c, stripPluginOnlyAllowlist as cn, normalizeAccountId as ct, normalizeVerboseLevel as d, resolveBootstrapMaxChars as dn, evaluateSessionFreshness as dt, resolveSandboxConfigForAgent as en, updateSessionStoreEntry as et, resolveResponseUsageMode as f, sanitizeGoogleTurnOrdering as fn, resolveChannelResetConfig as ft, normalizeTextForComparison as g, isInternalMessageChannel as gn, DEFAULT_RESET_TRIGGERS as gt, isMessagingToolDuplicateNormalized as h, isGatewayMessageChannel as hn, resolveThreadFlag as ht, formatThinkingLevels as i, expandPolicyWithPluginGroups as in, deliveryContextKey as it, isCloudCodeAssistFormatError as j, kindFromMime as jn, resolveBrowserConfig as jt, isAuthAssistantError as k, isAudioFileName as kn, createBrowserRouteContext as kt, normalizeThinkLevel as l, buildBootstrapContextFiles as ln, acquireSessionWriteLock as lt, isMessagingToolDuplicate as m, isDeliverableMessageChannel as mn, resolveSessionResetType as mt, validateGeminiTurns as n, buildPluginToolGroups as nn, resolveCacheTtlMs as nt, listThinkingLevels as o, normalizeToolName as on, normalizeDeliveryContext as ot, supportsXHighThinking as p, INTERNAL_MESSAGE_CHANNEL as pn, resolveSessionResetPolicy as pt, appendAssistantMessageToSessionTranscript as q, resolveSlackAccount as qn, resolveSkillsPromptForRun as qt, pickFallbackThinkingLevel as r, collectExplicitAllowlist as rn, deliveryContextFromSession as rt, normalizeElevatedLevel as s, resolveToolProfilePolicy as sn, normalizeSessionDeliveryFields as st, validateAnthropicTurns as t, applyOwnerOnlyToolPolicy as tn, isCacheEnabled as tt, normalizeUsageDisplay as u, ensureSessionHeader$1 as un, resolveSessionKey as ut, sanitizeImageBlocks as v, listDeliverableMessageChannels as vn, resolveExplicitAgentSessionKey as vt, classifyFailoverReason as w, GATEWAY_CLIENT_NAMES as wn, resolveChannelGroupPolicy as wt, isAntigravityClaude as x, resolveMessageChannel as xn, getChannelDock as xt, sanitizeToolResultImages as y, normalizeMessageChannel as yn, resolveMainSessionKey as yt, isTimeoutErrorMessage as z, normalizeChannelId as zn, saveMediaBuffer as zt };