@hybridaione/hybridclaw 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -2,6 +2,140 @@
 
 ## Unreleased
 
+## [0.18.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.18.0) - 2026-05-13
+
+### Added
+
+- **GA4 reporting skill**: Bundled `ga4` adds production Google Analytics 4
+  Data API reporting, request planning/review, gateway-injected bearer auth,
+  service-account support, traffic-source, landing-page, time-series, revenue,
+  session, and key-event reports, plus eval scenarios.
+- **Hermes3000 long-form writing skill**: Bundled `hermes3000-writing` can
+  authenticate through the gateway secret rail, manage portal-backed book
+  projects, draft and revise chapters, update consistency memory, and export
+  DOCX/PDF/EPUB/HTML deliverables without exposing JWTs to the agent context.
+- **Video-from-script skill**: Bundled `video.from-script` turns approved
+  avatar, voice, and script briefs into HeyGen MP4 jobs with planning, guarded
+  async render start, status polling, optional download, and credit-spend
+  approval gates.
+- **Firecrawl self-host adapter**: The Firecrawl skill now supports
+  self-hosted Firecrawl origins alongside managed API mode, including optional
+  self-host auth for scrape, crawl, map, and extraction workflows.
+- **Per-agent authenticated SearXNG search**: Agents can bind their own
+  SearXNG base URL and bearer-token SecretRef, with bearer injection routed
+  through the gateway HTTP proxy so tokens stay out of model context.
+- **Reviewed skill unblock controls**: Blocked skills now appear in CLI, web,
+  and gateway skill listings, and local operators can run `skill unblock` or
+  use the Admin Skills page to record a reviewed scanner-bypass marker for an
+  installed copy.
+- **Browser stealth host policy**: Camofox stealth browsing is deny-by-default
+  unless workspace policy explicitly allowlists the target host with
+  `browser.stealth.rules`.
+- **Node version guardrails**: Source checkouts now include `.node-version`,
+  `.nvmrc`, and a `check:node` preflight so local builds and tests fail fast
+  when they are not running on Node.js 22.
+
+### Changed
+
+- **SecretRef handling is store-first**: Runtime SecretRefs now accept the
+  encrypted `store` source for new configuration. Legacy Browser Use Cloud
+  env-backed refs are canonicalized to stored SecretRefs, and malformed legacy
+  refs produce explicit configuration errors.
+- **HybridAI auth diagnostics are clearer**: Provider discovery, health, bot
+  lookup, and doctor output distinguish auth, configuration, and remote service
+  failures more cleanly.
+- **Web chat scrolling respects user position**: The chat UI now sticks to the
+  bottom only when appropriate, preserves pinned scroll position while users
+  read older content, and exposes a jump-to-latest affordance.
+- **Console model-provider typing is narrower**: The chat model switcher no
+  longer shares broader gateway provider types that were not part of the
+  console UI contract.
+- **Trace-judge live CI is less brittle**: Main-branch CI no longer blocks on
+  missing trace-judge live secrets.
+
+### Fixed
+
+- **SearXNG bearer leakage risk**: SearXNG bearer values are no longer exposed
+  through runtime env forwarding; configured SecretRefs are resolved only by
+  the gateway proxy at request time.
+- **Camofox navigation scope**: Stealth browser sessions now enforce both safe
+  navigation schemes and host allowlisting before visiting a URL.
+- **Browser credential fills**: SecretRef-backed browser fills require a
+  resolvable page URL and calling skill name so host, selector, skill, and
+  agent policy can be evaluated.
+
+## [0.17.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.17.0) - 2026-05-12
+
+### Added
+
+- **Native media generation tools**: The container runtime now exposes
+  `image_generate` and `video_generate` with provider adapters, managed output
+  persistence, reference-media validation, usage metering, and bundled
+  `image-generation` / `video-generation` skills. Image generation supports GPT
+  Image, Gemini/Nano Banana, Grok, and FLUX families where configured; video
+  generation supports OpenAI Sora and Google Veo families where configured.
+- **New business and research skills**: Bundled skills now cover Airtable base
+  and record work, FastBill invoicing, Firecrawl scrape/crawl/map/extract
+  workflows, HeyGen avatar video generation and translation, Google Ads
+  campaign operations, and SearXNG-backed `search.web`, `search.news`, and
+  `search.images` workflows.
+- **Threema Gateway channel**: HybridClaw can send outbound Threema Basic-mode
+  text messages with setup docs, CLI configuration, doctor/status visibility,
+  prompt hints, target validation, and delivery tests.
+- **Camofox browser provider**: Browser automation can use a Camofox-backed
+  provider with persistent profile support and the same provider factory path
+  as local Playwright and Browser Use Cloud.
+- **A2A inbound and trust surfaces**: JSON-RPC Agent Card inbound delivery,
+  additional delegation envelope fields, a public-key trust ledger, and an
+  admin A2A trust route extend the federation substrate.
+- **Remote policy authority**: Signed remote policy updates can flow over the
+  federation path with validation, audit records, and targeted tests.
+- **Board card store**: The gateway now has a persisted card-store substrate
+  for future admin work-board and agent-team coordination surfaces.
+- **Trace-judge and anomaly evaluation path**: Skill trace judging gained a
+  subscriber pattern, an offline eval gate, and a behavioral anomaly reranker
+  for tool-call sequences.
+
+### Changed
+
+- **Admin console polish and performance**: Admin pages moved toward a shared
+  `Card` primitive, the Usage rollup gained skeleton and metric loading states,
+  live channel transport status is shown through toasts, the `/` command panel
+  was rebuilt for better keyboard/a11y behavior, and expensive all-session
+  scans/config fetches were removed from hot paths.
+- **Vitest configuration is project-based**: Unit, integration, e2e, and live
+  test configuration now share one project-aware Vitest setup instead of
+  separate config files.
+- **Browser credential handling is narrower**: Browser form fills now route
+  through SecretRef injection gates rather than exposing credential material to
+  the model or broad browser action context.
+- **A2A delegation bearer auth**: Outbound A2A uses signed delegation JWTs as
+  the HTTP bearer credential. `bearerTokenRef` remains a required explicit
+  opt-in gate for non-loopback peer URLs, but its secret value is not sent on
+  the wire.
+- **NPM supply-chain controls are stricter**: Workspace install and release
+  flows now enforce newer npm behavior, harden CI setup, and keep package-lock
+  metadata aligned with the release pipeline.
+
+### Fixed
+
+- **A2A delegation revocation cleanup**: Expired delegation-token revocation
+  records are pruned when new revocations are written, preventing stale
+  short-lived token revocations from accumulating indefinitely.
+- **Skill blocking is visible**: Blocked skills are surfaced instead of being
+  hidden behind silent resolution failures.
+- **Media path display-prefix handling**: Host paths that merely share a
+  display prefix are no longer remapped as if they were inside the sandboxed
+  media root.
+- **Context ring source accuracy**: The web chat context ring reads usage from
+  the correct source after session and UI routing changes.
+- **Auxiliary model token limits**: Auxiliary provider calls honor configured
+  max-token limits.
+- **Console IME composition safety**: Chat composer key handling ignores IME
+  composition events so slash/submit shortcuts do not interrupt text entry.
+- **Release publish compatibility**: Release workflows invoke npm 11 on Node
+  22 so npm package promotion uses the expected toolchain.
+
 ## [0.16.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.16.0) - 2026-05-07
 
 ### Added

package/README.md

@@ -5,7 +5,7 @@
 [![npm](https://img.shields.io/npm/v/@hybridaione/hybridclaw)](https://www.npmjs.com/package/@hybridaione/hybridclaw)
 [![Node](https://img.shields.io/badge/node-22.x-5FA04E?logo=node.js&logoColor=white)](https://nodejs.org/en/download)
 [![License](https://img.shields.io/github/license/HybridAIOne/hybridclaw)](https://github.com/HybridAIOne/hybridclaw/blob/main/LICENSE)
-[![Docs](https://img.shields.io/badge/docs-hybridclaw.io-blue)](https://www.hybridclaw.io/docs/)
+[![Docs](https://img.shields.io/badge/docs-GitHub%20Pages-blue)](https://hybridaione.github.io/hybridclaw/docs/)
 [![Powered by HybridAI](https://img.shields.io/badge/powered%20by-HybridAI-blueviolet)](https://hybridai.one)
 [![Discord](https://img.shields.io/badge/Discord-join%20chat-5865F2?logo=discord&logoColor=white)](https://discord.gg/jsVW4vJw27)
 
@@ -23,22 +23,22 @@ Connect it to Discord, Slack, Signal, WhatsApp, Telegram, Microsoft Teams,
 email, Twilio voice, or the web. Run it locally, deploy it for business
 workflows, and keep your agents, secrets, and data under your control.
 
-[Quick Start](https://www.hybridclaw.io/docs/getting-started/quickstart) ·
-[Installation](https://www.hybridclaw.io/docs/getting-started/installation) ·
-[Configuration](https://www.hybridclaw.io/docs/reference/configuration) ·
-[Migration](https://www.hybridclaw.io/docs/reference/commands#migration) ·
+[Quick Start](https://hybridaione.github.io/hybridclaw/docs/getting-started/quickstart) ·
+[Installation](https://hybridaione.github.io/hybridclaw/docs/getting-started/installation) ·
+[Configuration](https://hybridaione.github.io/hybridclaw/docs/reference/configuration) ·
+[Migration](https://hybridaione.github.io/hybridclaw/docs/reference/commands#migration) ·
 [Contributing](./CONTRIBUTING.md) ·
 [Support](./SUPPORT.md)
 
 ## Pick your path
 
 - Want the shortest path to a running assistant? Start with
-  [Quick Start](https://www.hybridclaw.io/docs/getting-started/quickstart).
+  [Quick Start](https://hybridaione.github.io/hybridclaw/docs/getting-started/quickstart).
 - Want the full setup flow with providers, channels, and admin surfaces? Start
-  with [Installation](https://www.hybridclaw.io/docs/getting-started/installation)
-  and [Authentication](https://www.hybridclaw.io/docs/getting-started/authentication).
+  with [Installation](https://hybridaione.github.io/hybridclaw/docs/getting-started/installation)
+  and [Authentication](https://hybridaione.github.io/hybridclaw/docs/getting-started/authentication).
 - Want to migrate from OpenClaw or Hermes? Start with the
-  [migration commands](https://www.hybridclaw.io/docs/reference/commands#migration).
+  [migration commands](https://hybridaione.github.io/hybridclaw/docs/reference/commands#migration).
 - Want to contribute from source? Start with [CONTRIBUTING.md](./CONTRIBUTING.md)
   and the maintainer docs under [docs/content/README.md](./docs/content/README.md).
 
@@ -98,7 +98,7 @@ listening on `http://127.0.0.1:9090`.
 
 Release notes live in [CHANGELOG.md](./CHANGELOG.md), and the browsable
 operator and maintainer manual lives at
-[hybridclaw.io/docs](https://www.hybridclaw.io/docs/).
+[hybridaione.github.io/hybridclaw/docs](https://hybridaione.github.io/hybridclaw/docs/).
 
 ## See it in Action
 
@@ -110,6 +110,8 @@ Once the gateway is running, open HybridClaw locally:
 - Web Chat shows live context-window usage, accepts `/context`, and lets you
   switch the active agent and model from the composer; active agent switching is
   preserved across session reloads and UI route changes
+- Web Chat keeps scrolling pinned when you read older messages and shows a
+  jump-to-latest affordance when new output arrives below the current viewport
 - Web Chat accepts `/btw <question>` side questions while a primary run is
   active, so you can ask an ephemeral follow-up without interrupting the
   current run
@@ -137,6 +139,8 @@ Once the gateway is running, open HybridClaw locally:
   browser.
 - `/admin/statistics` reports message, session, token, cost, and channel trends
   across a selected date range.
+- The Usage rollup surfaces loading skeletons, cost metrics, and per-model
+  spend summaries without scanning every stored session on page load.
 - `/admin/agent-scoreboard` ranks agents by observed skill scores, reliability,
   timing, best skills, and CV links.
 - `hybridclaw agent config` accepts generated JSON payloads to upsert agent
@@ -148,6 +152,8 @@ Once the gateway is running, open HybridClaw locally:
 - `/admin/approvals` manages approval policies from the browser.
 - Approval policy evaluation runs through a hook-fed rule pipeline, so
   workspace policy ordering and plugin tool-use hooks share one approval path.
+- `/admin/a2a-trust` shows the local A2A public-key trust ledger for paired
+  peer instances.
 - `/admin/gateway` reloads runtime config and refreshes secrets from the
   browser, and shows public URL plus tunnel status, without tearing down the
   enclosing workspace container; keep `hybridclaw gateway restart` for
@@ -182,8 +188,8 @@ Once the gateway is running, open HybridClaw locally:
   the active run and returns control to the prompt.
 - `hybridclaw doctor` checks runtime health including resource hygiene
   maintenance for stale gateway artifacts. `hybridclaw doctor browser-use`
-  checks the local browser automation substrate and can install missing
-  Playwright Chromium support with `--fix`.
+  checks the local Playwright browser automation substrate and can install
+  missing Chromium support with `--fix`.
 - `hybridclaw onboarding` and related local setup flows can restore the last
   known-good saved config snapshot or roll back to a tracked revision when
   `config.json` becomes invalid.
@@ -192,6 +198,9 @@ Once the gateway is running, open HybridClaw locally:
 - `hybridclaw skill install <source>`, `skill upgrade`, `skill revisions`, and
   `skill rollback` manage packaged business skills with manifests, audit
   events, and snapshots.
+- `hybridclaw skill list blocked` and `hybridclaw skill unblock <name>` let
+  local operators review scanner-blocked skills and record a bypass marker for
+  the installed copy when the finding has been accepted.
 - The bundled tutorials cover owner, GTM, marketing, sales, DevRel, content,
   invoicing, webinar, and release-launch workflows that can run from the TUI,
   web chat, or connected channels.
@@ -220,6 +229,12 @@ Once the gateway is running, open HybridClaw locally:
 - Brave, Perplexity, and Tavily web-search credentials can live in the
   encrypted runtime secret store and are passed into host or container agent
   runtimes from the active config.
+- Web search can also target a self-hosted SearXNG instance through
+  `web.search.searxngBaseUrl` or `SEARXNG_BASE_URL`; authenticated instances
+  use store-backed SearXNG bearer SecretRefs, and agents can override the
+  global SearXNG base URL and bearer SecretRef for tenant-specific search.
+  Bundled `search.web`, `search.news`, and `search.images` skills prefer that
+  sovereign search path.
 - Google OAuth credentials for Workspace skills live in the encrypted runtime
   secret store; agent runtimes receive short-lived access tokens for `gog` and
   `gws` instead of long-lived refresh tokens.
@@ -237,12 +252,19 @@ Once the gateway is running, open HybridClaw locally:
   credentials, supported channels, and per-agent autonomy policy.
 - Bundled skills include API-backed Google Workspace workflows (`gog`, `gws`),
   Salesforce inspection, GitHub issue queue processing (`gh-issues`),
-  monthly SaaS invoice harvesting (`download-platform-invoices`),
-  natural-language warehouse SQL (`warehouse-sql`), brand-voice drafting, and
-  editable Excalidraw diagram creation.
-- Browser automation can use local persistent Playwright profiles or Browser
-  Use Cloud sessions with encrypted `BROWSER_USE_API_KEY` storage, usage
-  metering, and shared navigation guards.
+  monthly SaaS invoice harvesting (`download-platform-invoices`), Airtable,
+  FastBill, managed or self-hosted Firecrawl, Google Ads, GA4 reporting,
+  HeyGen, Hermes3000 long-form writing, natural-language warehouse SQL
+  (`warehouse-sql`), brand-voice drafting, and editable Excalidraw diagram
+  creation.
+- Native media tools generate images and videos through configured providers,
+  persist the resulting artifacts, and expose the same capability through the
+  bundled `image-generation`, `video-generation`, and `video.from-script`
+  skills.
+- Browser automation can use local persistent Playwright profiles, Camofox
+  profiles, or Browser Use Cloud sessions with encrypted `BROWSER_USE_API_KEY`
+  storage, usage metering, shared navigation guards, SecretRef-gated credential
+  fills, and deny-by-default host allowlisting for Camofox stealth mode.
 - The repo-shipped `brand-voice` plugin can flag, rewrite, or block final
   responses that violate configured voice rules before they reach users.
 - Built-in office skills handle longer PDF creation flows cleanly: the bundled
@@ -305,66 +327,67 @@ Once the gateway is running, open HybridClaw locally:
 
 ## Architecture
 
-- **Gateway service** (Node.js) — shared message/command handlers, SQLite persistence (KV + semantic + knowledge graph + canonical sessions + usage events), scheduler, heartbeat, web/API, loopback OpenAI-compatible API, and channel integrations for Discord, Slack, Signal, Microsoft Teams, Telegram, iMessage, WhatsApp, Twilio voice, and email
+- **Gateway service** (Node.js) — shared message/command handlers, SQLite persistence (KV + semantic + knowledge graph + canonical sessions + usage events), scheduler, heartbeat, web/API, loopback OpenAI-compatible API, A2A peer trust, board-card storage, and channel integrations for Discord, Slack, Signal, Threema, Microsoft Teams, Telegram, iMessage, WhatsApp, Twilio voice, and email
 - **TUI client** — thin client over HTTP (`/api/chat`, `/api/command`) with
   a structured startup banner that surfaces model, sandbox, gateway, and
   chatbot context before the first prompt, live delegate status/progress,
   an interactive approval picker for pending approvals, and an exit summary
   with a ready-to-run resume command
-- **Container** (Docker, ephemeral) — HybridAI API client, sandboxed tool executor, and preinstalled browser automation runtime with cursor-aware snapshots for JS-heavy custom UI
+- **Container** (Docker, ephemeral) — HybridAI API client, sandboxed tool executor, native media-generation tools, web/search adapters, and preinstalled browser automation runtime with cursor-aware snapshots for JS-heavy custom UI
 - Communication via file-based IPC (input.json / output.json)
 
 ## Documentation
 
 Browse the full manual at
-[hybridclaw.io/docs](https://www.hybridclaw.io/docs/).
+[hybridaione.github.io/hybridclaw/docs](https://hybridaione.github.io/hybridclaw/docs/).
 
 - Getting started:
-  [Installation](https://www.hybridclaw.io/docs/getting-started/installation),
-  [Authentication](https://www.hybridclaw.io/docs/getting-started/authentication), and
-  [Quick Start](https://www.hybridclaw.io/docs/getting-started/quickstart)
+  [Installation](https://hybridaione.github.io/hybridclaw/docs/getting-started/installation),
+  [Authentication](https://hybridaione.github.io/hybridclaw/docs/getting-started/authentication), and
+  [Quick Start](https://hybridaione.github.io/hybridclaw/docs/getting-started/quickstart)
 - Enterprise deployment:
-  [Runtime Internals](https://www.hybridclaw.io/docs/developer-guide/runtime) and
-  [Architecture](https://www.hybridclaw.io/docs/developer-guide/architecture)
+  [Runtime Internals](https://hybridaione.github.io/hybridclaw/docs/developer-guide/runtime) and
+  [Architecture](https://hybridaione.github.io/hybridclaw/docs/developer-guide/architecture)
 - Operations:
-  [Remote Access](https://www.hybridclaw.io/docs/guides/remote-access)
+  [Remote Access](https://hybridaione.github.io/hybridclaw/docs/guides/remote-access)
 - Security:
   [SECURITY.md](./SECURITY.md) and [TRUST_MODEL.md](./TRUST_MODEL.md)
 - Migration:
-  [Commands: Migration](https://www.hybridclaw.io/docs/reference/commands#migration) and
-  [FAQ](https://www.hybridclaw.io/docs/reference/faq#can-i-migrate-an-existing-openclaw-or-hermes-agent-home)
+  [Commands: Migration](https://hybridaione.github.io/hybridclaw/docs/reference/commands#migration) and
+  [FAQ](https://hybridaione.github.io/hybridclaw/docs/reference/faq#can-i-migrate-an-existing-openclaw-or-hermes-agent-home)
 - Channels:
-  [Connect Your First Channel](https://www.hybridclaw.io/docs/getting-started/first-channel),
-  [Overview](https://www.hybridclaw.io/docs/channels/overview),
-  [Twilio Voice](https://www.hybridclaw.io/docs/guides/twilio-voice),
-  [Discord](https://www.hybridclaw.io/docs/channels/discord),
-  [Slack](https://www.hybridclaw.io/docs/channels/slack),
-  [Telegram](https://www.hybridclaw.io/docs/channels/telegram),
-  [Signal](https://www.hybridclaw.io/docs/channels/signal),
-  [Email](https://www.hybridclaw.io/docs/channels/email),
-  [WhatsApp](https://www.hybridclaw.io/docs/channels/whatsapp),
-  [iMessage](https://www.hybridclaw.io/docs/channels/imessage), and
-  [Microsoft Teams](https://www.hybridclaw.io/docs/channels/msteams)
+  [Connect Your First Channel](https://hybridaione.github.io/hybridclaw/docs/getting-started/first-channel),
+  [Overview](https://hybridaione.github.io/hybridclaw/docs/channels/overview),
+  [Twilio Voice](https://hybridaione.github.io/hybridclaw/docs/guides/twilio-voice),
+  [Discord](https://hybridaione.github.io/hybridclaw/docs/channels/discord),
+  [Slack](https://hybridaione.github.io/hybridclaw/docs/channels/slack),
+  [Telegram](https://hybridaione.github.io/hybridclaw/docs/channels/telegram),
+  [Signal](https://hybridaione.github.io/hybridclaw/docs/channels/signal),
+  [Threema](https://hybridaione.github.io/hybridclaw/docs/channels/threema),
+  [Email](https://hybridaione.github.io/hybridclaw/docs/channels/email),
+  [WhatsApp](https://hybridaione.github.io/hybridclaw/docs/channels/whatsapp),
+  [iMessage](https://hybridaione.github.io/hybridclaw/docs/channels/imessage), and
+  [Microsoft Teams](https://hybridaione.github.io/hybridclaw/docs/channels/msteams)
 - Tutorials:
-  [Practical Workflows](https://www.hybridclaw.io/docs/tutorials) for owner,
+  [Practical Workflows](https://hybridaione.github.io/hybridclaw/docs/tutorials) for owner,
   GTM, marketing, sales, DevRel, content, invoicing, webinar, and release
   launch workflows
 - Skills and plugins:
-  [Extensibility](https://www.hybridclaw.io/docs/extensibility),
-  [Bundled Skills](https://www.hybridclaw.io/docs/guides/bundled-skills),
-  [Plugin System](https://www.hybridclaw.io/docs/extensibility/plugins),
-  [Memory Plugins](https://www.hybridclaw.io/docs/extensibility/memory-plugins),
-  [ByteRover Memory Plugin](https://www.hybridclaw.io/docs/extensibility/byterover-memory-plugin),
-  [GBrain Plugin](https://www.hybridclaw.io/docs/extensibility/gbrain-plugin),
-  [Mem0 Memory Plugin](https://www.hybridclaw.io/docs/extensibility/mem0-memory-plugin),
-  [Honcho Memory Plugin](https://www.hybridclaw.io/docs/extensibility/honcho-memory-plugin), and
-  [MemPalace Memory Plugin](https://www.hybridclaw.io/docs/extensibility/mempalace-memory-plugin)
+  [Extensibility](https://hybridaione.github.io/hybridclaw/docs/extensibility),
+  [Bundled Skills](https://hybridaione.github.io/hybridclaw/docs/guides/bundled-skills),
+  [Plugin System](https://hybridaione.github.io/hybridclaw/docs/extensibility/plugins),
+  [Memory Plugins](https://hybridaione.github.io/hybridclaw/docs/extensibility/memory-plugins),
+  [ByteRover Memory Plugin](https://hybridaione.github.io/hybridclaw/docs/extensibility/byterover-memory-plugin),
+  [GBrain Plugin](https://hybridaione.github.io/hybridclaw/docs/extensibility/gbrain-plugin),
+  [Mem0 Memory Plugin](https://hybridaione.github.io/hybridclaw/docs/extensibility/mem0-memory-plugin),
+  [Honcho Memory Plugin](https://hybridaione.github.io/hybridclaw/docs/extensibility/honcho-memory-plugin), and
+  [MemPalace Memory Plugin](https://hybridaione.github.io/hybridclaw/docs/extensibility/mempalace-memory-plugin)
 - Configuration:
-  [Configuration Reference](https://www.hybridclaw.io/docs/reference/configuration)
+  [Configuration Reference](https://hybridaione.github.io/hybridclaw/docs/reference/configuration)
 - CLI reference:
-  [Commands](https://www.hybridclaw.io/docs/reference/commands),
-  [Diagnostics](https://www.hybridclaw.io/docs/reference/diagnostics), and
-  [FAQ](https://www.hybridclaw.io/docs/reference/faq)
+  [Commands](https://hybridaione.github.io/hybridclaw/docs/reference/commands),
+  [Diagnostics](https://hybridaione.github.io/hybridclaw/docs/reference/diagnostics), and
+  [FAQ](https://hybridaione.github.io/hybridclaw/docs/reference/faq)
 
 ## Contributing
 

package/SECURITY.md

@@ -148,6 +148,56 @@ Verification command:
 hybridclaw audit verify <sessionId>
 ```
 
+### 6) npm Supply-Chain Controls
+
+HybridClaw treats npm lockfiles and package-manager configuration as security
+controls:
+
+- `.npmrc` enforces exact saves, strict engines, and a seven-day minimum release
+  age.
+- `package.json` requires npm 11.10+ because older npm versions do not enforce
+  the release-age policy.
+- CI upgrades to the pinned npm version before running `npm ci`, so pull
+  requests and release publishes use the same install policy as local
+  development.
+- Docker builds install the pinned npm version before npm install steps. The
+  gateway image copies the repository `.npmrc` before `npm ci`; the agent image
+  materializes the same safe npm config inside its isolated Docker context.
+- CI runs `npm audit signatures` after installs to verify npm registry
+  signatures and available provenance attestations for installed packages.
+- Release publishing uses npm provenance through the trusted-publishing-capable
+  npm CLI. The npm package should be configured on npmjs.com to use trusted
+  publishing and to disallow token-based publishes after the OIDC workflow is
+  verified.
+
+Dependency updates should use `npm ci` for verification and keep
+`package-lock.json` changes reviewable. Avoid unconstrained interactive or
+ad-hoc `npm update` runs; use the lockfile-only update script below so npm's
+configured release-age gate applies and the resulting diff can be reviewed. Do
+not add git, tarball, or non-registry dependencies without a specific security
+review. The current WhatsApp channel dependency chain includes a pinned GitHub
+dependency from `@whiskeysockets/baileys` to `libsignal`; replacing that
+dependency with a registry-only package should be prioritized before enabling
+npm's `allow-git` restriction.
+
+Recommended dependency update workflow:
+
+```bash
+npm install --global npm@11.10.0 --no-audit --fund=false
+npm run deps:update-lockfile
+git diff -- package.json package-lock.json container/package.json container/package-lock.json
+npm run deps:verify
+npm run typecheck
+npm run test:unit
+```
+
+`deps:update-lockfile` regenerates the root/workspace lockfile and the standalone
+container lockfile through npm's configured seven-day release-age filter.
+`deps:verify` then performs clean installs from those lockfiles and verifies npm
+registry signatures. Review lockfile diffs before merging; unexpected new
+maintainers, new install scripts, git/tarball URLs, or large transitive churn
+should be treated as security review triggers.
+
 ## Incident Response
 
 If compromise is suspected:
@@ -157,6 +207,8 @@ If compromise is suspected:
 3. Review mount allowlist, workspace files, and `sessionRouting.identityLinks`.
 4. Inspect denied/authorization events with `hybridclaw audit approvals --denied`.
 5. Validate audit integrity with `hybridclaw audit verify`.
+6. If compromise may involve npm install-time malware, rotate npm, GitHub, SSH,
+   cloud, and registry credentials reachable from the affected host or runner.
 
 ## Reporting A Vulnerability
 

package/config.example.json

@@ -1,5 +1,5 @@
 {
-  "version": 26,
+  "version": 28,
   "security": {
     "trustModelAccepted": false,
     "trustModelAcceptedAt": "",
@@ -15,6 +15,27 @@
       "health_check_interval_ms": 30000
     }
   },
+  "browser": {
+    "provider": "local",
+    "local": {
+      "profileRoot": "",
+      "headed": false
+    },
+    "camofox": {
+      "profileRoot": "",
+      "headed": false,
+      "launchOptions": {}
+    },
+    "browserUseCloud": {
+      "apiKeyRef": {
+        "source": "store",
+        "id": "BROWSER_USE_API_KEY"
+      },
+      "baseUrl": "",
+      "browser": {},
+      "pricing": {}
+    }
+  },
   "skills": {
     "extraDirs": [],
     "disabled": [],
@@ -24,6 +45,7 @@
       "signal": [],
       "slack": [],
       "telegram": [],
+      "threema": [],
       "voice": [],
       "whatsapp": [],
       "email": []
@@ -39,6 +61,7 @@
     "signal": "",
     "slack": "",
     "telegram": "",
+    "threema": "",
     "voice": "This is a live phone call. Produce plain spoken text only.\nKeep each reply short and conversational, usually one or two short sentences.\nAbsolutely no markdown, bullets, numbered lists, headings, code fences, tables, JSON, or decorative formatting.\nDo not narrate internal reasoning, planning, tool usage, or stage directions. Say only what the caller should hear.\nDo not spell punctuation, formatting marks, or raw URLs unless the caller explicitly asks for exact characters.",
     "whatsapp": "",
     "email": "",
@@ -185,6 +208,16 @@
     "reconnectIntervalMs": 5000,
     "outboundDelayMs": 350
   },
+  "threema": {
+    "enabled": false,
+    "apiBaseUrl": "https://msgapi.threema.ch",
+    "identity": "",
+    "secret": "",
+    "dmPolicy": "allowlist",
+    "allowFrom": [],
+    "textChunkLimit": 3500,
+    "outboundDelayMs": 350
+  },
   "whatsapp": {
     "dmPolicy": "pairing",
     "groupPolicy": "disabled",

package/console/dist/assets/chat-C4lYYG3X.css

@@ -0,0 +1 @@
+._srOnly_jfnet_1{clip:rect(0, 0, 0, 0);white-space:nowrap;border-width:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}._chatPage_ebl64_1{--chat-hover-bg:color-mix(in srgb, var(--muted) 94%, var(--foreground) 6%);width:100%;max-width:100vw;height:var(--chat-visual-viewport-height,100dvh);min-height:0;display:flex;overflow:hidden}._chatPage_ebl64_1>div{height:100%;min-height:0}.layout:has(._chatPage_ebl64_1){width:100%;max-width:100vw;min-height:0;height:var(--chat-visual-viewport-height,100dvh);overflow:hidden}html:has(.chatPage){width:100%;max-width:100vw;overflow-x:hidden}body:has(.chatPage){width:100%;max-width:100vw;overflow-x:hidden}#root:has(.chatPage){width:100%;max-width:100vw;overflow-x:hidden}._chatSidebarHeader_ebl64_36{justify-content:space-between;align-items:center;gap:8px;padding:0 4px;display:flex}._chatSidebarContent_ebl64_44{flex-direction:column;gap:8px;padding:0 4px;display:flex;overflow:hidden}._newChatButton_ebl64_52{appearance:none;width:100%;color:inherit;font:inherit;border-radius:var(--radius-sm);cursor:pointer;text-align:left;background:0 0;border:none;align-items:center;gap:12px;padding:18px 8px;font-weight:500;transition:background .12s;display:flex}._newChatButton_ebl64_52:hover{background:var(--chat-hover-bg)}._newChatButton_ebl64_52>span:first-child{justify-content:center;width:20px;font-size:1.25rem;line-height:1;display:inline-flex}._sidebarLabel_ebl64_82{text-transform:uppercase;letter-spacing:.08em;color:var(--muted-foreground);margin:12px 0 4px;padding:0 6px;font-size:.7rem;font-weight:700}._sidebarListHeader_ebl64_92{justify-content:space-between;align-items:center;gap:8px;display:flex}._sidebarScopeToggle_ebl64_99{border:1px solid var(--line-strong);border-radius:var(--radius-sm);background:var(--muted);align-items:center;padding:2px;display:inline-flex}._sidebarScopeButton_ebl64_108{appearance:none;border-radius:calc(var(--radius-sm) - 2px);color:var(--muted-foreground);font:inherit;cursor:pointer;background:0 0;border:0;padding:5px 8px;font-size:.72rem;font-weight:600;line-height:1;transition:background .12s,color .12s,box-shadow .12s}._sidebarScopeButton_ebl64_108:hover{color:var(--text)}._sidebarScopeButtonActive_ebl64_130{background:var(--primary);color:var(--primary-foreground);box-shadow:0 1px 2px #0f172a2e, 0 0 0 1px color-mix(in srgb, var(--primary) 70%, var(--background));font-weight:700}._sidebarScopeButtonActive_ebl64_130:hover{color:var(--primary-foreground)}._sessionList_ebl64_143{flex-direction:column;gap:2px;margin:0;padding:0;list-style:none;display:flex}._sessionItem_ebl64_152{appearance:none;border-radius:var(--radius-sm);cursor:pointer;text-align:left;width:100%;font:inherit;color:inherit;background:0 0;border:0;flex-direction:column;gap:2px;padding:8px 10px;transition:background .12s;display:flex;overflow:hidden}._sessionItem_ebl64_152:hover{background:var(--chat-hover-bg)}._sessionItemPending_ebl64_174{animation:1s ease-in-out infinite _sessionPulse_ebl64_1}@keyframes _sessionPulse_ebl64_1{0%,to{opacity:1}50%{opacity:.5}}._sessionTitle_ebl64_188{color:var(--text);white-space:nowrap;text-overflow:ellipsis;font-size:.875rem;font-weight:500;overflow:hidden}._sessionTime_ebl64_197{color:var(--muted-foreground);font-size:.72rem}._sessionSnippet_ebl64_202{color:var(--muted-foreground);white-space:nowrap;text-overflow:ellipsis;font-size:.76rem;overflow:hidden}._sessionItemActive_ebl64_210 ._sessionTitle_ebl64_188,._sessionItemActive_ebl64_210 ._sessionSnippet_ebl64_202{color:var(--primary)}._sidebarSearchWrap_ebl64_215{padding:10px 0 4px}._sidebarSearch_ebl64_215{border:1px solid var(--line-strong);border-radius:var(--radius-sm);background:var(--panel-bg);width:100%;color:var(--text);font:inherit;padding:9px 11px}._sidebarSearch_ebl64_215::placeholder{color:var(--muted-foreground)}._sidebarSearch_ebl64_215:focus{outline:2px solid var(--accent-soft);outline-offset:1px;border-color:var(--ring)}._sidebarStatus_ebl64_239{color:var(--muted-foreground);padding:6px 10px;font-size:.82rem}aside[data-state=collapsed] ._newChatButton_ebl64_52{justify-content:center;gap:0;padding:10px 8px}aside[data-state=collapsed] ._newChatButton_ebl64_52>span:not(:first-child),aside[data-state=collapsed] ._sidebarSearchWrap_ebl64_215,aside[data-state=collapsed] ._chatSidebarContent_ebl64_44{display:none}._chatMobileTrigger_ebl64_258{margin-right:auto;display:inline-flex}._chatTopbar_ebl64_263{z-index:50;flex-shrink:0;justify-content:flex-end;align-items:center;gap:10px;min-width:0;max-width:100%;padding:24px 24px 0;display:flex;position:relative;overflow:visible}._mobileQrButton_ebl64_277{appearance:none;border:1px solid var(--line);border-radius:var(--radius-sm);background:var(--panel-bg);width:36px;height:36px;color:var(--muted-foreground);cursor:pointer;justify-content:center;align-items:center;display:inline-flex}._mobileQrButton_ebl64_277:hover{color:var(--primary);border-color:color-mix(in srgb, var(--primary) 42%, var(--line))}._mobileQrButton_ebl64_277:disabled{opacity:.55;cursor:wait}._mobileQrIcon_ebl64_301{grid-template-rows:repeat(2,7px);grid-template-columns:repeat(2,7px);gap:3px;display:grid}._mobileQrIcon_ebl64_301 span{border:2px solid;border-radius:2px}._mobileQrOverlay_ebl64_313{z-index:80;background:#02061773;justify-content:center;align-items:center;padding:18px;display:flex;position:fixed;inset:0}._mobileQrDialog_ebl64_324{border:1px solid var(--line);border-radius:var(--radius-md);background:var(--panel-bg);width:min(360px,100%);padding:18px;box-shadow:0 18px 55px #0f172a38}._mobileQrHeader_ebl64_333{justify-content:space-between;align-items:center;gap:12px;margin-bottom:14px;display:flex}._mobileQrHeader_ebl64_333 h2{margin:0;font-size:1rem;font-weight:650}._mobileQrClose_ebl64_347{appearance:none;border:1px solid var(--line);border-radius:var(--radius-sm);width:32px;height:32px;color:var(--muted-foreground);cursor:pointer;font:inherit;background:0 0;line-height:1}._mobileQrImage_ebl64_360{border:1px solid var(--line);border-radius:var(--radius-sm);background:#fff;justify-content:center;padding:12px;display:flex}._mobileQrImage_ebl64_360 img{width:min(260px,100%);height:auto}._mobileQrLink_ebl64_374{color:var(--primary);text-align:center;word-break:break-word;margin-top:12px;font-size:.86rem;display:block}._chatMain_ebl64_383{background:var(--page-bg);flex-direction:column;flex:auto;min-width:0;height:100%;min-height:0;display:flex;position:relative;overflow:hidden}._messageArea_ebl64_395{overscroll-behavior:contain;overflow-anchor:none;flex:auto;min-width:0;min-height:0;padding:16px 24px 12px;overflow:hidden auto}._messageList_ebl64_408{flex-direction:column;gap:12px;width:100%;min-width:0;max-width:100%;display:flex}._sidebarCollapseButton_ebl64_417{align-self:center}._emptyState_ebl64_421{flex-direction:column;flex:auto;justify-content:center;align-items:center;min-height:0;padding:48px 24px;display:flex}._greeting_ebl64_431{color:var(--muted-foreground);text-align:center;letter-spacing:-.02em;font-size:clamp(1.6rem,3vw,2.2rem);font-weight:700;line-height:1.3}._messageBlock_ebl64_440{flex-direction:column;gap:6px;width:100%;min-width:0;max-width:100%;display:flex}._jumpToLatest_ebl64_452{left:50%;bottom:calc(var(--chat-composer-height,132px) + 12px);border:1px solid var(--line-strong);background:var(--panel-bg);color:var(--text);font:inherit;cursor:pointer;box-shadow:var(--shadow-raised);z-index:40;border-radius:999px;align-items:center;gap:6px;padding:6px 14px;font-size:.82rem;font-weight:500;transition:background .12s;display:inline-flex;position:absolute;transform:translate(-50%)}._jumpToLatest_ebl64_452:hover{background:var(--chat-hover-bg)}._jumpToLatest_ebl64_452:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:2px}._jumpToLatest_ebl64_452 span:first-child{font-weight:700;line-height:1}._messageBlockUser_ebl64_488{align-items:flex-end}._messageBlockAssistant_ebl64_492,._messageBlockSystem_ebl64_493{align-items:flex-start}._agentLabel_ebl64_497{color:var(--muted-foreground);align-items:center;gap:8px;padding:0 4px;font-size:.82rem;font-weight:600;display:flex}._agentAvatar_ebl64_507{object-fit:cover;border-radius:999px;width:32px;height:32px}._agentInitial_ebl64_514{background:var(--primary);width:32px;height:32px;color:var(--primary-foreground);border-radius:999px;justify-content:center;align-items:center;font-size:.86rem;font-weight:700;display:flex}._bubble_ebl64_527{word-wrap:break-word;overflow-wrap:break-word;border-radius:14px;min-width:0;max-width:85%;padding:10px 14px;font-size:.92rem;line-height:1.55}._bubbleUser_ebl64_538{background:linear-gradient(135deg, var(--primary), var(--ring));color:var(--primary-foreground);border-bottom-right-radius:4px}._bubbleAssistant_ebl64_544{background:var(--card);color:var(--card-foreground);border:1px solid var(--line);box-shadow:var(--shadow-card);border-bottom-left-radius:4px}._bubbleSystem_ebl64_552{background:var(--accent-soft);color:var(--accent-foreground);text-align:center;align-self:center;max-width:90%;font-size:.84rem}._markdownContent_ebl64_561{overflow-wrap:anywhere;min-width:0;max-width:100%;line-height:1.6}._markdownContent_ebl64_561 h1,._markdownContent_ebl64_561 h2,._markdownContent_ebl64_561 h3{color:var(--foreground);letter-spacing:-.02em;margin:.6em 0 .3em;font-weight:600}._markdownContent_ebl64_561 h1{font-size:1.25rem}._markdownContent_ebl64_561 h2{font-size:1.12rem}._markdownContent_ebl64_561 h3{font-size:1rem}._markdownContent_ebl64_561 p{margin:.4em 0}._markdownContent_ebl64_561 ul,._markdownContent_ebl64_561 ol{margin:.4em 0;padding-left:20px}._markdownContent_ebl64_561 li{margin:2px 0}._markdownContent_ebl64_561 blockquote{border-left:3px solid var(--line-strong);color:var(--muted-foreground);margin:.5em 0;padding:4px 12px}._markdownContent_ebl64_561 code{background:var(--muted);color:var(--foreground);border-radius:4px;padding:2px 5px;font-size:.86em}._markdownContent_ebl64_561 pre{background:var(--terminal);color:var(--terminal-foreground);border-radius:var(--radius-sm);margin:.5em 0;padding:12px 14px;font-size:.84rem;line-height:1.5;overflow-x:auto}._markdownContent_ebl64_561 pre code{color:inherit;font-size:inherit;background:0 0;border-radius:0;padding:0}._markdownContent_ebl64_561 hr{border:none;border-top:1px solid var(--line);margin:.8em 0}._markdownContent_ebl64_561 a{color:var(--primary);text-decoration:none}._markdownContent_ebl64_561 a:hover{text-decoration:underline}._markdownContent_ebl64_561 table{border-collapse:collapse;width:100%;margin:.5em 0;font-size:.86rem}._markdownContent_ebl64_561 th,._markdownContent_ebl64_561 td{border:1px solid var(--line);text-align:left;padding:6px 10px}._markdownContent_ebl64_561 th{background:var(--muted);font-weight:600}._markdownContent_ebl64_561 tbody tr:nth-child(2n){background:var(--muted)}._messageActions_ebl64_675{gap:4px;padding:0 4px;display:flex}._messageActions_ebl64_675 ._actionButton_ebl64_681{width:24px;height:24px;min-height:unset;color:var(--muted-foreground);background:0 0;border-color:#0000;border-radius:999px;font-size:.82rem}._messageActions_ebl64_675 ._actionButton_ebl64_681:hover:not(:disabled):not([data-disabled]){background:var(--chat-hover-bg);color:var(--foreground)}._actionButtonSuccess_ebl64_697{color:var(--success)}._branchSwitcher_ebl64_701{color:var(--muted-foreground);align-items:center;gap:4px;padding:0 4px;font-size:.75rem;display:inline-flex}._branchButton_ebl64_710{width:22px;height:22px;min-height:unset;border-radius:999px;font-size:.8rem}._branchButton_ebl64_710:hover:not(:disabled):not([data-disabled]){background:var(--chat-hover-bg);color:var(--text)}._branchButton_ebl64_710:disabled{opacity:.4;cursor:default}._approvalActions_ebl64_728{flex-wrap:wrap;gap:6px;margin-top:8px;display:flex}._approvalAllow_ebl64_735{border-color:var(--success-border);background:var(--success-soft);color:var(--success)}._artifactCard_ebl64_741{border:1px solid var(--line);border-radius:var(--radius-sm);background:var(--muted);flex-direction:column;align-items:center;gap:10px;width:fit-content;max-width:100%;margin-top:8px;padding:10px 14px;display:flex}._artifactCardWithPreview_ebl64_755{align-items:stretch;width:min(720px,100%)}._artifactHeader_ebl64_760{align-items:center;gap:10px;min-width:0;display:flex}._artifactFilename_ebl64_767{color:var(--text);white-space:nowrap;text-overflow:ellipsis;min-width:0;font-size:.84rem;font-weight:500;overflow:hidden}._artifactBadge_ebl64_777{background:var(--accent-soft);color:var(--accent-foreground);border-radius:4px;flex-shrink:0;padding:2px 6px;font-size:.7rem;font-weight:500}._artifactDownload_ebl64_787{color:var(--primary);cursor:pointer;background:0 0;border:none;flex-shrink:0;margin-left:auto;padding:0;font-size:.82rem;text-decoration:none}._artifactDownload_ebl64_787:hover{text-decoration:underline}._artifactDownload_ebl64_787:disabled{opacity:.6;cursor:default;text-decoration:none}._artifactPreview_ebl64_809{border-radius:var(--radius-sm);max-width:100%;overflow:hidden}._artifactPreview_ebl64_809 img{border-radius:var(--radius-sm);max-width:100%;display:block}._artifactPdfPreview_ebl64_821{border:1px solid var(--line);background:#fff;width:100%;height:min(60vh,560px);min-height:360px}._artifactPdfPreview_ebl64_821 iframe{background:#fff;border:0;width:100%;height:100%;display:block}._thinking_ebl64_837{align-items:center;gap:4px;padding:10px 14px;display:flex}._thinkingDot_ebl64_844{background:var(--muted-foreground);border-radius:999px;width:7px;height:7px;animation:1.2s ease-in-out infinite _thinkingBounce_ebl64_1}._thinkingDot_ebl64_844:nth-child(2){animation-delay:.15s}._thinkingDot_ebl64_844:nth-child(3){animation-delay:.3s}@keyframes _thinkingBounce_ebl64_1{0%,80%,to{opacity:.4;transform:scale(.6)}40%{opacity:1;transform:scale(1)}}._composerWrapper_ebl64_873{flex-shrink:0;min-width:0;max-width:100%;margin-top:auto;padding:0 24px 20px;overflow:hidden}._composer_ebl64_873{border:1px solid var(--line-strong);background:var(--panel-bg);width:100%;min-width:0;max-width:100%;box-shadow:var(--shadow-raised);border-radius:16px;flex-direction:column;gap:8px;padding:12px 16px;transition:border-color .15s;display:flex}._pendingMediaRow_ebl64_897{flex-wrap:wrap;gap:6px;padding:10px 14px 0;display:flex}._mediaChip_ebl64_904{background:var(--muted);color:var(--text);border-radius:6px;align-items:center;gap:4px;max-width:180px;padding:4px 8px;font-size:.78rem;display:inline-flex}._mediaChipName_ebl64_916{white-space:nowrap;text-overflow:ellipsis;overflow:hidden}._mediaChipRemove_ebl64_922{width:16px;height:16px;color:var(--muted-foreground);cursor:pointer;background:0 0;border:none;border-radius:999px;flex-shrink:0;justify-content:center;align-items:center;font-size:.7rem;display:flex}._mediaChipRemove_ebl64_922:hover{color:var(--danger)}._composerRow_ebl64_941{align-items:flex-end;gap:8px;padding:10px 14px;display:flex}._composerActions_ebl64_948{justify-content:space-between;align-items:center;gap:8px;display:flex}._composerLeftActions_ebl64_955{align-items:center;gap:12px;min-width:0;display:flex}._composerInput_ebl64_962{resize:none;min-height:36px;max-height:180px;color:var(--text);background:0 0;border:none;outline:none;flex:auto;padding:0;font-size:.92rem;line-height:36px}._composerInput_ebl64_962:not(:placeholder-shown){padding:6px 0;line-height:1.5}._composerInput_ebl64_962::placeholder{color:var(--muted-foreground)}._attachButton_ebl64_985,._sendButton_ebl64_986{cursor:pointer;border:none;border-radius:999px;flex-shrink:0;justify-content:center;align-items:center;width:36px;height:36px;transition:background .12s,color .12s;display:flex}._attachButton_ebl64_985:focus-visible,._sendButton_ebl64_986:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:2px}._attachButton_ebl64_985{color:var(--muted-foreground);background:0 0;font-size:1.2rem}._attachButton_ebl64_985:hover{background:var(--chat-hover-bg);color:var(--text)}._composerPill_ebl64_1021{max-width:220px;height:36px;color:var(--muted-foreground);font:inherit;cursor:pointer;text-overflow:ellipsis;white-space:nowrap;background:0 0;border:none;border-radius:999px;outline:none;align-items:center;gap:8px;padding:0 16px;font-size:.78rem;font-weight:500;line-height:36px;transition:background .12s,color .12s;display:inline-flex;position:relative;overflow:hidden}._composerPill_ebl64_1021:hover:not(:disabled):not([data-disabled]),._composerPill_ebl64_1021:focus,._composerPill_ebl64_1021:focus-within,._composerPill_ebl64_1021[data-state=open]{background:var(--chat-hover-bg);color:var(--text)}._composerPill_ebl64_1021:disabled,._composerPill_ebl64_1021[data-disabled]{opacity:.55;cursor:default}._agentSelect_ebl64_1063{appearance:none;max-width:180px;height:36px;color:inherit;font:inherit;font-size:inherit;font-weight:inherit;cursor:pointer;text-overflow:ellipsis;white-space:nowrap;background:0 0;border:none;outline:none;padding:0;line-height:36px;overflow:hidden}._agentSelect_ebl64_1063:disabled{cursor:default}._composerPillChevron_ebl64_1086{opacity:.7;flex-shrink:0;align-items:center;transition:transform .16s;display:inline-flex}._composerPill_ebl64_1021[data-state=open] ._composerPillChevron_ebl64_1086{opacity:1;transform:rotate(180deg)}._sendButton_ebl64_986{color:var(--muted-foreground);border:1px solid var(--line-strong);background:0 0;font-size:.9rem}._sendButton_ebl64_986:hover:not(:disabled){background:var(--chat-hover-bg);color:var(--text)}._sendButton_ebl64_986:disabled{opacity:.5;cursor:default}._sendButton_ebl64_986._stopping_ebl64_1116{background:var(--danger-soft);color:var(--danger)}._slashSuggestions_ebl64_1121{background:var(--popover);border:1px solid var(--line);border-radius:var(--radius-md);box-shadow:var(--shadow-popover);overflow:hidden}._slashSuggestionsScroll_ebl64_1129{max-height:220px}._slashSuggestionsList_ebl64_1133{outline:none}._suggestionItem_ebl64_1137{cursor:pointer;border-left:2px solid #0000;flex-direction:column;justify-content:center;gap:2px;min-width:0;min-height:44px;padding:10px 14px;transition:background .1s;display:flex}._suggestionItemActive_ebl64_1152{background:color-mix(in srgb, var(--primary) 14%, transparent);border-left-color:var(--primary)}._suggestionItemSub_ebl64_1157{padding-left:28px}._suggestionLabel_ebl64_1161{color:var(--text);white-space:nowrap;text-overflow:ellipsis;font-size:.86rem;font-weight:500;overflow:hidden}._suggestionLabelMono_ebl64_1170{font-family:var(--font-mono,ui-monospace, SFMono-Regular, Menlo, monospace);color:var(--muted-foreground);font-size:.82rem}._suggestionMatch_ebl64_1176{color:inherit;text-underline-offset:3px;background:0 0;font-weight:700;text-decoration:underline;text-decoration-thickness:1px}._suggestionDesc_ebl64_1185{color:var(--muted-foreground);white-space:nowrap;text-overflow:ellipsis;font-size:.76rem;overflow:hidden}._suggestionEmpty_ebl64_1193{color:var(--muted-foreground);padding:14px;font-size:.82rem}@media (width<=768px){._suggestionItem_ebl64_1137{min-height:48px;padding:12px 14px}}._errorBanner_ebl64_1210{border-radius:var(--radius-sm);background:var(--danger-soft);border:1px solid var(--danger-border);color:var(--danger);width:calc(100% - 48px);max-width:860px;margin:0 auto;padding:8px 14px;font-size:.84rem}._editArea_ebl64_1224{resize:vertical;border:1px solid var(--line-strong);border-radius:var(--radius-sm);background:var(--panel-bg);width:100%;min-height:48px;max-height:200px;color:var(--text);padding:8px 10px;font-family:inherit;font-size:.92rem;line-height:1.5}._editButtons_ebl64_1239{gap:6px;margin-top:6px;display:flex}@media (width<=900px){._chatPage_ebl64_1{width:100vw;max-width:100vw;position:fixed;inset:0}._chatPage_ebl64_1,._chatPage_ebl64_1 *{max-width:100vw}._chatPage_ebl64_1{height:var(--chat-visual-viewport-height,100svh)}._chatMain_ebl64_383{flex:0 0 100vw;width:100vw;max-width:100vw}._chatTopbar_ebl64_263{width:100vw;padding:8px 16px 0}._messageArea_ebl64_395{width:100vw;max-width:100vw;padding:16px 16px calc(var(--chat-composer-height,150px) + 12px)}._messageList_ebl64_408,._messageBlock_ebl64_440{width:100%;max-width:100%;overflow-x:clip}._bubble_ebl64_527,._bubbleUser_ebl64_538,._bubbleAssistant_ebl64_544{max-width:min(95%,100vw - 32px)}._composerWrapper_ebl64_873{z-index:45;background:var(--page-bg);padding:0 16px;position:fixed;bottom:0;left:0;right:0}._slashSuggestionsScroll_ebl64_1129{max-height:40vh}}@media (width<=480px){._bubbleUser_ebl64_538,._bubbleAssistant_ebl64_544{max-width:95%}._messageArea_ebl64_395{padding:12px 8px calc(var(--chat-composer-height,150px) + 12px)}._composerWrapper_ebl64_873{padding:0 12px}._emptyState_ebl64_421 h1{font-size:1.2rem}}@media (prefers-reduced-motion:reduce){._thinkingDot_ebl64_844,._sessionItemPending_ebl64_174{animation:none}}._root_16nbt_1{flex-direction:column;min-width:0;min-height:0;display:flex;position:relative;overflow:hidden}._viewport_16nbt_10{scrollbar-width:none;-ms-overflow-style:none;outline:none;flex:auto;width:100%;min-width:0;height:100%;min-height:0;overflow:hidden scroll}._viewport_16nbt_10::-webkit-scrollbar{width:0;height:0;display:none}._scrollbar_16nbt_29{opacity:0;touch-action:none;-webkit-user-select:none;user-select:none;background:0 0;flex-direction:column;width:8px;padding:0;transition:opacity .16s;display:flex;position:absolute;top:4px;bottom:4px;right:2px}._scrollbar_16nbt_29[data-state=visible]{opacity:.6}._root_16nbt_1:hover ._scrollbar_16nbt_29[data-state=visible],._scrollbar_16nbt_29[data-state=visible]:hover,._scrollbar_16nbt_29[data-state=visible]:focus-within{opacity:1}._thumb_16nbt_55{background:color-mix(in srgb, var(--text) 26%, transparent);cursor:grab;will-change:transform;border-radius:999px;width:100%;min-height:20px;transition:background .12s}._thumb_16nbt_55:hover{background:color-mix(in srgb, var(--text) 38%, transparent)}._thumb_16nbt_55:active{background:color-mix(in srgb, var(--text) 48%, transparent);cursor:grabbing}._trigger_1fi1d_1{border:1px solid var(--line,var(--panel-bg));background-color:var(--panel-bg);max-width:220px;height:32px;color:var(--text);font:inherit;cursor:pointer;border-radius:999px;outline:none;align-items:center;gap:6px;padding:0 10px 0 12px;font-size:.78rem;font-weight:500;line-height:1;transition:background-color .12s,color .12s,border-color .12s;display:inline-flex}._trigger_1fi1d_1:hover:not([data-disabled]),._trigger_1fi1d_1[data-state=open]{background-color:color-mix(in srgb, var(--panel-bg) 80%, var(--text) 20%);border-color:color-mix(in srgb, var(--text) 22%, var(--panel-bg))}._trigger_1fi1d_1:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:2px}._trigger_1fi1d_1[data-disabled]{opacity:.55;cursor:default}._value_1fi1d_40{text-overflow:ellipsis;white-space:nowrap;flex:auto;min-width:0;overflow:hidden}._value_1fi1d_40[data-placeholder]{color:var(--muted-foreground)}._icon_1fi1d_52{color:currentColor;opacity:.7;flex-shrink:0;align-items:center;transition:transform .16s;display:inline-flex}._trigger_1fi1d_1[data-state=open] ._icon_1fi1d_52{opacity:1;transform:rotate(180deg)}._popup_1fi1d_66{z-index:1000;box-sizing:border-box;contain:layout style;border:1px solid color-mix(in srgb, var(--text) 28%, var(--panel-bg));background-color:var(--popover,var(--card,var(--panel-bg)));width:min(420px,100vw - 16px);height:min(440px,100vh - 32px);box-shadow:var(--shadow-popover);color:var(--text);border-radius:14px;outline:none;flex-direction:column;font-size:.82rem;transition:width .16s;animation:.12s ease-out _select-in_1fi1d_1;display:flex;position:fixed;overflow:hidden}._popup_1fi1d_66:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:2px}:root[data-theme=dark] ._popup_1fi1d_66{background-color:#1c2536}:root[data-theme=light] ._popup_1fi1d_66{background-color:#fff}@keyframes _select-in_1fi1d_1{0%{opacity:0;transform:translateY(-4px)}to{opacity:1;transform:translateY(0)}}._popupHeader_1fi1d_111{border-bottom:1px solid color-mix(in srgb, var(--text) 12%, transparent);flex-shrink:0;padding:8px 8px 6px}._popupBodyPlain_1fi1d_117,._popupBody_1fi1d_117{flex:auto;min-width:0;min-height:0;display:flex}._popupRail_1fi1d_131{box-sizing:border-box;border-right:1px solid color-mix(in srgb, var(--text) 12%, transparent);scrollbar-width:none;flex-direction:column;flex-grow:0;flex-shrink:0;align-items:center;gap:2px;width:48px;padding:6px 4px;display:flex;overflow:hidden auto}._popupRail_1fi1d_131::-webkit-scrollbar{display:none}._listScroll_1fi1d_151{flex:auto;min-width:0;min-height:0}._list_1fi1d_151{outline:none;padding:6px}._list_1fi1d_151:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:-2px;border-radius:12px}._group_1fi1d_168{display:block}._group_1fi1d_168+._group_1fi1d_168{margin-top:4px}._groupLabel_1fi1d_176{color:var(--muted-foreground);letter-spacing:.01em;padding:8px 10px 4px;font-size:.72rem;font-weight:500}._separator_1fi1d_184{background:color-mix(in srgb, var(--text) 12%, transparent);height:1px;margin:4px 6px}._empty_1fi1d_190{color:var(--muted-foreground);text-align:center;padding:18px 12px;font-size:.82rem}._item_1fi1d_197{min-height:34px;color:var(--text);cursor:pointer;-webkit-user-select:none;user-select:none;border-radius:8px;outline:none;align-items:center;gap:10px;padding:6px 10px;font-size:.84rem;line-height:1.3;display:flex;position:relative}._item_1fi1d_197:has(>._itemIndicator_1fi1d_214){padding-left:30px}._item_1fi1d_197[data-highlighted]:not([data-disabled]){background:color-mix(in srgb, var(--panel-bg) 60%, var(--text) 14%)}._item_1fi1d_197[data-state=checked]{font-weight:600}._item_1fi1d_197[data-state=checked]:not([data-highlighted]){background:color-mix(in srgb, var(--panel-bg) 75%, var(--text) 6%)}._item_1fi1d_197[data-disabled]{opacity:.5;cursor:not-allowed}._itemIndicator_1fi1d_214{color:currentColor;justify-content:center;align-items:center;display:none;position:absolute;left:8px}._item_1fi1d_197[data-state=checked]>._itemIndicator_1fi1d_214{display:inline-flex}._itemText_1fi1d_248{text-overflow:ellipsis;white-space:nowrap;flex:auto;min-width:0;overflow:hidden}._itemBody_1fi1d_256{flex-direction:column;flex:auto;align-items:flex-start;gap:1px;min-width:0;display:flex}._itemBody_1fi1d_256>*{text-overflow:ellipsis;white-space:nowrap;max-width:100%;overflow:hidden}._itemSubtitle_1fi1d_272{color:var(--muted-foreground);letter-spacing:.01em;font-size:.7rem;font-weight:400}._itemMeta_1fi1d_279{color:var(--muted-foreground);font-variant-numeric:tabular-nums;flex-shrink:0;align-items:center;gap:6px;font-size:.7rem;display:inline-flex}._search_12ewc_1{background:color-mix(in srgb, var(--panel-bg) 65%, transparent);height:30px;color:var(--muted-foreground);border-radius:8px;align-items:center;gap:8px;padding:0 10px;display:flex}._search_12ewc_1:focus-within{background:color-mix(in srgb, var(--panel-bg) 50%, var(--text) 6%);color:var(--text)}._searchInput_12ewc_17{min-width:0;height:100%;color:var(--text);font:inherit;background:0 0;border:none;outline:none;flex:auto;font-size:.82rem}._searchInput_12ewc_17::placeholder{color:var(--muted-foreground)}._rail_12ewc_33{display:contents}._railItem_12ewc_37{width:36px;height:36px;color:var(--muted-foreground);cursor:pointer;background:0 0;border:none;border-radius:9px;flex-shrink:0;justify-content:center;align-items:center;padding:0;transition:background .12s,color .12s;display:flex}._railItem_12ewc_37:hover:not([data-active]){background:color-mix(in srgb, var(--panel-bg) 60%, var(--text) 14%);color:var(--text)}._railItem_12ewc_37[data-active]{background:color-mix(in srgb, var(--panel-bg) 50%, var(--text) 18%);box-shadow:inset 0 0 0 1px color-mix(in srgb, var(--text) 26%, transparent)}._railItem_12ewc_37:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:1px}._railGlyph_12ewc_70{width:22px;height:22px;color:var(--muted-foreground);filter:grayscale()saturate(0);justify-content:center;align-items:center;line-height:1;display:inline-flex}._railItem_12ewc_37:hover ._railGlyph_12ewc_70,._railItem_12ewc_37[data-active] ._railGlyph_12ewc_70{color:var(--text)}._triggerPill_12ewc_90{color:var(--muted-foreground);background-color:#0000;border-color:#0000;height:36px;padding:0 16px}._triggerPill_12ewc_90:hover:not([data-disabled]),._triggerPill_12ewc_90[data-state=open]{background-color:var(--chat-hover-bg);color:var(--text);border-color:#0000}._triggerLogo_12ewc_105{color:var(--muted-foreground);filter:grayscale()saturate(0);flex-shrink:0;align-items:center;line-height:1;display:inline-flex}._itemLogo_12ewc_114{width:20px;height:20px;color:var(--muted-foreground);filter:grayscale()saturate(0);flex-shrink:0;justify-content:center;align-items:center;line-height:1;display:inline-flex}._wrap_jrif0_1{flex-shrink:0;justify-content:center;align-items:center;width:34px;height:34px;display:inline-flex;position:relative}._trigger_jrif0_11{appearance:none;width:34px;height:34px;color:inherit;cursor:pointer;background:0 0;border:none;border-radius:999px;justify-content:center;align-items:center;padding:0;transition:background .12s;display:flex}._trigger_jrif0_11:hover,._trigger_jrif0_11:focus-visible{background:var(--muted);outline:none}._ring_jrif0_33{transform:rotate(-90deg)}._ringTrack_jrif0_37{fill:none;stroke:var(--line);stroke-width:3.5px}._ringFill_jrif0_43{fill:none;stroke-width:3.5px;stroke-linecap:round;transition:stroke-dashoffset .4s,stroke .2s}._ringFillNominal_jrif0_52{stroke:var(--primary)}._ringFillWarn_jrif0_56{stroke:var(--accent,#d97706)}._ringFillDanger_jrif0_60{stroke:var(--danger,#dc2626)}._ringLabel_jrif0_64{color:var(--muted-foreground);pointer-events:none;letter-spacing:0;justify-content:center;align-items:center;font-size:.62rem;font-weight:700;display:flex;position:absolute;inset:0}._ringLabelUnknown_jrif0_77{font-size:.7rem}._popover_jrif0_81{background:var(--popover);border:1px solid var(--line);border-radius:var(--radius-md);min-width:240px;box-shadow:var(--shadow-popover);color:var(--text);z-index:30;opacity:0;pointer-events:none;flex-direction:column;gap:6px;padding:10px 12px;font-size:.8rem;transition:opacity .15s,transform .15s;display:flex;position:absolute;top:calc(100% + 6px);right:0;transform:translateY(-4px)}._wrap_jrif0_1:hover ._popover_jrif0_81,._wrap_jrif0_1:focus-within ._popover_jrif0_81{opacity:1;pointer-events:auto;transform:translateY(0)}._popoverTitle_jrif0_112{color:var(--text);justify-content:space-between;gap:8px;font-size:.82rem;font-weight:600;display:flex}._popoverTitleValue_jrif0_121{color:var(--muted-foreground);font-weight:500}._popoverRow_jrif0_126{color:var(--muted-foreground);justify-content:space-between;gap:12px;display:flex}._popoverRowValue_jrif0_133{color:var(--text);font-variant-numeric:tabular-nums}._popoverProgress_jrif0_138{background:var(--muted);border-radius:999px;width:100%;height:6px;margin-top:2px;position:relative;overflow:hidden}._popoverProgressFill_jrif0_148{background:var(--primary);transition:width .4s,background .2s;position:absolute;inset:0 auto 0 0}._popoverProgressFillWarn_jrif0_157{background:var(--accent,#d97706)}._popoverProgressFillDanger_jrif0_161{background:var(--danger,#dc2626)}._popoverFoot_jrif0_165{color:var(--muted-foreground);margin-top:2px;font-size:.72rem}._button_kxq2k_1{white-space:nowrap;cursor:pointer;border-radius:var(--radius-sm);box-sizing:border-box;border:1px solid #0000;outline:none;flex-shrink:0;justify-content:center;align-items:center;gap:6px;font-size:.875rem;font-weight:500;line-height:1;text-decoration:none;transition:background .15s,border-color .15s,opacity .15s;display:inline-flex}._button_kxq2k_1:focus-visible{outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent);outline-offset:2px}._button_kxq2k_1:disabled,._button_kxq2k_1[data-disabled]{cursor:default;opacity:.72}._button_kxq2k_1:disabled{pointer-events:none}._button_kxq2k_1[data-loading]{cursor:progress}._button_kxq2k_1 svg{pointer-events:none;flex-shrink:0}._default_kxq2k_50{background:var(--primary);border-color:var(--primary);color:var(--primary-foreground)}._default_kxq2k_50:hover:not(:disabled):not([data-disabled]){opacity:.9}._ghost_kxq2k_60{background:var(--panel-bg);border-color:var(--line-strong);color:var(--text)}._ghost_kxq2k_60:hover:not(:disabled):not([data-disabled]){background:var(--muted)}._outline_kxq2k_70{border-color:var(--line-strong);color:var(--text);background:0 0}._outline_kxq2k_70:hover:not(:disabled):not([data-disabled]){background:var(--muted)}._danger_kxq2k_80{background:var(--danger-soft);border-color:var(--danger-border);color:var(--danger)}._danger_kxq2k_80:hover:not(:disabled):not([data-disabled]){opacity:.85}._sizeDefault_kxq2k_92{min-height:36px;padding:9px 12px}._sizeSm_kxq2k_97{min-height:30px;padding:6px 10px;font-size:.8125rem}._sizeIcon_kxq2k_103{width:36px;height:36px;min-height:unset;padding:0}