@qlingzzy/qling 1.0.0

package/dist/config.js

@@ -0,0 +1,690 @@
+import { readFile } from "fs/promises";
+import { existsSync } from "fs";
+import * as os from "os";
+import * as path from "path";
+import YAML from "yaml";
+const HOME = os.homedir();
+const DEFAULT_STATE_DIR = path.join(HOME, ".qling");
+const DEFAULT_CACHE_DIR = path.join(DEFAULT_STATE_DIR, "cache");
+export function buildDefaultConfig() {
+    return {
+        llm: {
+            provider: "deepseek",
+            model: "deepseek-chat",
+            endpoint: "https://api.deepseek.com",
+            api_key: "",
+            request_timeout_ms: 120000,
+        },
+        runtime: {
+            workspace_dir: process.cwd(),
+            file_cache_dir: DEFAULT_CACHE_DIR,
+            file_state_dir: DEFAULT_STATE_DIR,
+            max_steps: 50,
+            parse_retries: 2,
+            max_token_budget: 120000,
+            tool_repeat_limit: 6,
+            timeout_ms: 300000,
+        },
+        features: {
+            semantic_memory: false,
+            workflow_runtime: false,
+            vision_tool: false,
+            dashboard: false,
+            dynamic_discovery: false,
+            tool_spec_boost: false,
+        },
+        logging: {
+            level: "info",
+            format: "text",
+            inspect_prompt: false,
+            inspect_request: false,
+            inspect_dump_dir: path.join(DEFAULT_STATE_DIR, "dump"),
+        },
+        tools: {
+            bash: { enabled: true },
+            read: { enabled: true },
+            write: { enabled: true },
+            todo: { enabled: true },
+            skill: { enabled: true },
+            search: { enabled: true },
+            planner: { enabled: true },
+            url_fetch: { enabled: true },
+        },
+        memory: {
+            wal_enabled: true,
+            projection_interval_ms: 5000,
+            dream_llm_enabled: true,
+            dream_turn_threshold: 24,
+            max_memories: 1000,
+            semantic: {
+                provider: "openai",
+                model: "text-embedding-3-small",
+                dim: 1536,
+                top_k: 5,
+                rebuild_policy: "incremental",
+            },
+        },
+        workflow: {
+            checkpoint_dir: path.join(DEFAULT_STATE_DIR, "workflows"),
+            retry_policy: {
+                max_attempts: 3,
+                initial_delay_ms: 1000,
+                backoff_factor: 2,
+            },
+            max_parallel_states: 1,
+        },
+        vision: {
+            provider: "openai",
+            model: "gpt-4o",
+            max_image_size_mb: 10,
+            timeout_ms: 60000,
+        },
+        dashboard: {
+            enabled: false,
+            port: 9999,
+            auth_mode: "none",
+        },
+        discovery: {
+            local_dirs: [path.join(DEFAULT_STATE_DIR, "plugins")],
+            remote_manifests: [],
+            allow_unsigned: false,
+        },
+        guard: {
+            enabled: true,
+            network: {
+                url_fetch: {
+                    allowed_url_prefixes: ["https://"],
+                    deny_private_ips: true,
+                    follow_redirects: false,
+                },
+            },
+            redaction: {
+                enabled: true,
+                patterns: [],
+            },
+            audit: {
+                jsonl_path: path.join(DEFAULT_STATE_DIR, "guard", "audit", "guard_audit.jsonl"),
+            },
+            rate_limit: {
+                enabled: false,
+                max_per_minute: 30,
+            },
+            content_filter: {
+                enabled: false,
+                pii_detection: true,
+                injection_detection: true,
+                custom_patterns: [],
+            },
+            permissions: {
+                default: "allow",
+                rules: [],
+            },
+        },
+        mcp: {
+            servers: {},
+            connection_timeout_ms: 10000,
+            call_timeout_ms: 30000,
+        },
+        metrics: {
+            enabled: false,
+            dir: path.join(DEFAULT_STATE_DIR, "metrics"),
+            flush_interval_ms: 10000,
+            retention_days: 30,
+        },
+        channels: {
+            default: "console",
+            telegram: {
+                token: "",
+                poll_interval_ms: 3000,
+                allowed_chat_ids: [],
+            },
+            slack: {
+                bot_token: "",
+                app_token: "",
+                channel_ids: [],
+                poll_interval_ms: 3000,
+            },
+        },
+        routes: {
+            main_loop: {
+                profile: "default",
+                fallback_profiles: [],
+            },
+            plan_create: {
+                profile: "default",
+                fallback_profiles: ["default"],
+            },
+            verify: {
+                profile: "default",
+                fallback_profiles: ["default"],
+            },
+        },
+        agents: {
+            isolation: {
+                mode: "worktree",
+                require_git: true,
+                non_git_policy: "warn",
+            },
+        },
+    };
+}
+export async function loadQlingConfig(cli, env = process.env) {
+    const warnings = [];
+    const defaults = buildDefaultConfig();
+    let fromFile = {};
+    let usedConfigPath;
+    const configPath = resolveConfigPath(cli.configPath);
+    if (cli.configPath && configPath && !existsSync(configPath)) {
+        throw new Error(`config file not found: ${configPath}`);
+    }
+    if (configPath && existsSync(configPath)) {
+        const raw = await readFile(configPath, "utf-8");
+        const expanded = expandEnvTemplate(raw, env, warnings);
+        fromFile = parseConfigByExt(configPath, expanded);
+        usedConfigPath = configPath;
+    }
+    const fromEnv = buildEnvConfig(env, defaults);
+    const merged = deepMerge(deepMerge(defaults, fromFile), fromEnv);
+    const withCli = applyCliOverrides(merged, cli);
+    applyPermissionModeCompat(withCli);
+    normalizeAgentsIsolationConfig(withCli);
+    normalizeRuntimeRoots(withCli);
+    await mergeLocalMcpStore(withCli, warnings);
+    return {
+        config: withCli,
+        warnings,
+        usedConfigPath,
+    };
+}
+/** 合并 ~/.qling/mcp-servers.json；env/config 中同名 server 优先 */
+async function mergeLocalMcpStore(config, warnings) {
+    try {
+        const { loadMcpStore, defaultMcpStorePath } = await import("./mcp/store.js");
+        const storePath = defaultMcpStorePath(config.runtime.file_state_dir);
+        const store = await loadMcpStore(storePath);
+        const storeCount = Object.keys(store.servers).length;
+        if (storeCount === 0)
+            return;
+        config.mcp.servers = {
+            ...store.servers,
+            ...config.mcp.servers,
+        };
+    }
+    catch (err) {
+        warnings.push(`mcp store merge skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export function applyConfigToProcessEnv(config) {
+    process.env.QLING_LLM_PROVIDER = config.llm.provider;
+    process.env.QLING_LLM_MODEL = config.llm.model;
+    process.env.QLING_LLM_ENDPOINT = config.llm.endpoint;
+    process.env.QLING_LLM_REQUEST_TIMEOUT_MS = String(config.llm.request_timeout_ms);
+    if (config.llm.api_key) {
+        process.env.QLING_LLM_API_KEY = config.llm.api_key;
+    }
+    if (config.runtime.workspace_dir) {
+        process.env.QLING_WORKSPACE_DIR = config.runtime.workspace_dir;
+    }
+    else {
+        delete process.env.QLING_WORKSPACE_DIR;
+    }
+    process.env.QLING_FILE_CACHE_DIR = config.runtime.file_cache_dir;
+    process.env.QLING_FILE_STATE_DIR = config.runtime.file_state_dir;
+    process.env.QLING_GUARD_ENABLED = String(config.guard.enabled);
+    process.env.QLING_GUARD_NETWORK_URL_FETCH_ALLOWED_URL_PREFIXES =
+        JSON.stringify(config.guard.network.url_fetch.allowed_url_prefixes);
+    process.env.QLING_GUARD_NETWORK_URL_FETCH_DENY_PRIVATE_IPS = String(config.guard.network.url_fetch.deny_private_ips);
+    process.env.QLING_GUARD_NETWORK_URL_FETCH_FOLLOW_REDIRECTS = String(config.guard.network.url_fetch.follow_redirects);
+    process.env.QLING_GUARD_REDACTION_ENABLED = String(config.guard.redaction.enabled);
+    process.env.QLING_GUARD_REDACTION_PATTERNS = JSON.stringify(config.guard.redaction.patterns);
+    process.env.QLING_GUARD_AUDIT_JSONL_PATH = config.guard.audit.jsonl_path;
+    process.env.QLING_GUARD_RATE_LIMIT_ENABLED = String(config.guard.rate_limit.enabled);
+    process.env.QLING_GUARD_RATE_LIMIT_MAX_PER_MINUTE = String(config.guard.rate_limit.max_per_minute);
+    process.env.QLING_GUARD_CONTENT_FILTER_ENABLED = String(config.guard.content_filter.enabled);
+    process.env.QLING_GUARD_CONTENT_FILTER_PII = String(config.guard.content_filter.pii_detection);
+    process.env.QLING_GUARD_CONTENT_FILTER_INJECTION = String(config.guard.content_filter.injection_detection);
+    process.env.QLING_GUARD_CONTENT_FILTER_CUSTOM = JSON.stringify(config.guard.content_filter.custom_patterns);
+    process.env.QLING_GUARD_PERMISSIONS_DEFAULT = config.guard.permissions.default;
+    process.env.QLING_GUARD_PERMISSIONS_RULES = JSON.stringify(config.guard.permissions.rules);
+    process.env.QLING_PERMISSIONS_MODE = config.guard.permissions.default;
+    // Memory (Phase 3)
+    process.env.QLING_MEMORY_WAL_ENABLED = String(config.memory.wal_enabled);
+    process.env.QLING_MEMORY_PROJECTION_INTERVAL_MS = String(config.memory.projection_interval_ms);
+    process.env.QLING_MEMORY_DREAM_LLM_ENABLED = String(config.memory.dream_llm_enabled);
+    process.env.QLING_MEMORY_DREAM_TURN_THRESHOLD = String(config.memory.dream_turn_threshold);
+    process.env.QLING_MEMORY_MAX_MEMORIES = String(config.memory.max_memories);
+    process.env.QLING_MEMORY_SEMANTIC_PROVIDER = config.memory.semantic.provider;
+    process.env.QLING_MEMORY_SEMANTIC_MODEL = config.memory.semantic.model;
+    process.env.QLING_MEMORY_SEMANTIC_DIM = String(config.memory.semantic.dim);
+    process.env.QLING_MEMORY_SEMANTIC_TOP_K = String(config.memory.semantic.top_k);
+    process.env.QLING_MEMORY_SEMANTIC_REBUILD_POLICY = config.memory.semantic.rebuild_policy;
+    // Features
+    process.env.QLING_FEATURES_SEMANTIC_MEMORY = String(config.features.semantic_memory);
+    process.env.QLING_FEATURES_WORKFLOW_RUNTIME = String(config.features.workflow_runtime);
+    process.env.QLING_FEATURES_VISION_TOOL = String(config.features.vision_tool);
+    process.env.QLING_FEATURES_DASHBOARD = String(config.features.dashboard);
+    process.env.QLING_FEATURES_DYNAMIC_DISCOVERY = String(config.features.dynamic_discovery);
+    process.env.QLING_FEATURES_TOOL_SPEC_BOOST = String(config.features.tool_spec_boost);
+    // Workflow
+    process.env.QLING_WORKFLOW_CHECKPOINT_DIR = config.workflow.checkpoint_dir;
+    process.env.QLING_WORKFLOW_RETRY_POLICY_MAX_ATTEMPTS = String(config.workflow.retry_policy.max_attempts);
+    process.env.QLING_WORKFLOW_RETRY_POLICY_INITIAL_DELAY_MS = String(config.workflow.retry_policy.initial_delay_ms);
+    process.env.QLING_WORKFLOW_RETRY_POLICY_BACKOFF_FACTOR = String(config.workflow.retry_policy.backoff_factor);
+    process.env.QLING_WORKFLOW_MAX_PARALLEL_STATES = String(config.workflow.max_parallel_states);
+    // Vision
+    process.env.QLING_VISION_PROVIDER = config.vision.provider;
+    process.env.QLING_VISION_MODEL = config.vision.model;
+    process.env.QLING_VISION_MAX_IMAGE_SIZE_MB = String(config.vision.max_image_size_mb);
+    process.env.QLING_VISION_TIMEOUT_MS = String(config.vision.timeout_ms);
+    // Dashboard
+    process.env.QLING_DASHBOARD_ENABLED = String(config.dashboard.enabled);
+    process.env.QLING_DASHBOARD_PORT = String(config.dashboard.port);
+    process.env.QLING_DASHBOARD_AUTH_MODE = config.dashboard.auth_mode;
+    // Discovery
+    process.env.QLING_DISCOVERY_LOCAL_DIRS = JSON.stringify(config.discovery.local_dirs);
+    process.env.QLING_DISCOVERY_REMOTE_MANIFESTS = JSON.stringify(config.discovery.remote_manifests);
+    process.env.QLING_DISCOVERY_ALLOW_UNSIGNED = String(config.discovery.allow_unsigned);
+    // MCP (Phase 4)
+    process.env.QLING_MCP_SERVERS = JSON.stringify(config.mcp.servers);
+    process.env.QLING_MCP_CONNECTION_TIMEOUT_MS = String(config.mcp.connection_timeout_ms);
+    process.env.QLING_MCP_CALL_TIMEOUT_MS = String(config.mcp.call_timeout_ms);
+    // Metrics (Phase 5)
+    process.env.QLING_METRICS_ENABLED = String(config.metrics.enabled);
+    process.env.QLING_METRICS_DIR = config.metrics.dir;
+    process.env.QLING_METRICS_FLUSH_INTERVAL_MS = String(config.metrics.flush_interval_ms);
+    process.env.QLING_METRICS_RETENTION_DAYS = String(config.metrics.retention_days);
+    // Channels (Phase 5)
+    process.env.QLING_CHANNEL_DEFAULT = config.channels.default;
+    process.env.QLING_CHANNEL_TELEGRAM_TOKEN = config.channels.telegram.token;
+    process.env.QLING_CHANNEL_TELEGRAM_POLL_INTERVAL_MS = String(config.channels.telegram.poll_interval_ms);
+    process.env.QLING_CHANNEL_TELEGRAM_ALLOWED_CHAT_IDS = JSON.stringify(config.channels.telegram.allowed_chat_ids);
+    process.env.QLING_CHANNEL_SLACK_BOT_TOKEN = config.channels.slack.bot_token;
+    process.env.QLING_CHANNEL_SLACK_APP_TOKEN = config.channels.slack.app_token;
+    process.env.QLING_CHANNEL_SLACK_CHANNEL_IDS = JSON.stringify(config.channels.slack.channel_ids);
+    process.env.QLING_CHANNEL_SLACK_POLL_INTERVAL_MS = String(config.channels.slack.poll_interval_ms);
+    process.env.QLING_AGENTS_ISOLATION_MODE = config.agents.isolation.mode;
+    process.env.QLING_AGENTS_ISOLATION_REQUIRE_GIT = String(config.agents.isolation.require_git);
+    process.env.QLING_AGENTS_ISOLATION_NON_GIT_POLICY = config.agents.isolation.non_git_policy;
+}
+export function guardConfigFromEnv(env = process.env) {
+    const defaults = buildDefaultConfig().guard;
+    const prefixes = parseStringArray(env.QLING_GUARD_NETWORK_URL_FETCH_ALLOWED_URL_PREFIXES, defaults.network.url_fetch.allowed_url_prefixes);
+    const redactionPatterns = parseStringArray(env.QLING_GUARD_REDACTION_PATTERNS, defaults.redaction.patterns);
+    return {
+        enabled: parseBoolean(env.QLING_GUARD_ENABLED, defaults.enabled),
+        network: {
+            url_fetch: {
+                allowed_url_prefixes: prefixes,
+                deny_private_ips: parseBoolean(env.QLING_GUARD_NETWORK_URL_FETCH_DENY_PRIVATE_IPS, defaults.network.url_fetch.deny_private_ips),
+                follow_redirects: parseBoolean(env.QLING_GUARD_NETWORK_URL_FETCH_FOLLOW_REDIRECTS, defaults.network.url_fetch.follow_redirects),
+            },
+        },
+        redaction: {
+            enabled: parseBoolean(env.QLING_GUARD_REDACTION_ENABLED, defaults.redaction.enabled),
+            patterns: redactionPatterns,
+        },
+        audit: {
+            jsonl_path: env.QLING_GUARD_AUDIT_JSONL_PATH ?? defaults.audit.jsonl_path,
+        },
+        rate_limit: {
+            enabled: parseBoolean(env.QLING_GUARD_RATE_LIMIT_ENABLED, defaults.rate_limit.enabled),
+            max_per_minute: parseNumber(env.QLING_GUARD_RATE_LIMIT_MAX_PER_MINUTE, defaults.rate_limit.max_per_minute),
+        },
+        content_filter: {
+            enabled: parseBoolean(env.QLING_GUARD_CONTENT_FILTER_ENABLED, defaults.content_filter.enabled),
+            pii_detection: parseBoolean(env.QLING_GUARD_CONTENT_FILTER_PII, defaults.content_filter.pii_detection),
+            injection_detection: parseBoolean(env.QLING_GUARD_CONTENT_FILTER_INJECTION, defaults.content_filter.injection_detection),
+            custom_patterns: parseStringArray(env.QLING_GUARD_CONTENT_FILTER_CUSTOM, defaults.content_filter.custom_patterns),
+        },
+        permissions: {
+            default: resolvePermissionMode(env.QLING_GUARD_PERMISSIONS_DEFAULT ?? env.QLING_PERMISSIONS_MODE, defaults.permissions.default),
+            rules: parsePermissionRules(env.QLING_GUARD_PERMISSIONS_RULES, defaults.permissions.rules),
+        },
+    };
+}
+function resolveConfigPath(input) {
+    if (input && input.trim()) {
+        return path.resolve(input.trim());
+    }
+    const candidates = ["qling.config.yaml", "qling.config.yml", "qling.config.json"];
+    for (const p of candidates) {
+        const abs = path.resolve(process.cwd(), p);
+        if (existsSync(abs))
+            return abs;
+    }
+    return undefined;
+}
+function parseConfigByExt(filePath, raw) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === ".yaml" || ext === ".yml") {
+        return YAML.parse(raw) ?? {};
+    }
+    return JSON.parse(raw);
+}
+function expandEnvTemplate(raw, env, warnings) {
+    return raw.replace(/\$\{([A-Z0-9_]+)\}/g, (_match, name) => {
+        const val = env[name];
+        if (val === undefined) {
+            warnings.push(`Missing env variable in config template: ${name}`);
+            return "";
+        }
+        return val;
+    });
+}
+function buildEnvConfig(env, defaults) {
+    const flatDefaults = flattenObject(defaults);
+    const acc = {};
+    for (const [key, defaultValue] of Object.entries(flatDefaults)) {
+        const envName = toQlingEnvName(key);
+        const raw = env[envName];
+        if (raw === undefined)
+            continue;
+        setByPath(acc, key, parseEnvValue(raw, defaultValue));
+    }
+    applyLegacyRuntimeEnvAliases(acc, env);
+    if (env.QLING_PERMISSIONS_MODE !== undefined) {
+        setByPath(acc, "guard.permissions.default", resolvePermissionMode(env.QLING_PERMISSIONS_MODE, defaults.guard.permissions.default));
+    }
+    if (env.QLING_GUARD_CONTENT_FILTER_CUSTOM !== undefined) {
+        setByPath(acc, "guard.content_filter.custom_patterns", parseStringArray(env.QLING_GUARD_CONTENT_FILTER_CUSTOM, defaults.guard.content_filter.custom_patterns));
+    }
+    return acc;
+}
+function applyLegacyRuntimeEnvAliases(acc, env) {
+    if (env.QLING_WORKSPACE_DIR !== undefined) {
+        setByPath(acc, "runtime.workspace_dir", env.QLING_WORKSPACE_DIR);
+    }
+    if (env.QLING_FILE_CACHE_DIR !== undefined) {
+        setByPath(acc, "runtime.file_cache_dir", env.QLING_FILE_CACHE_DIR);
+    }
+    if (env.QLING_FILE_STATE_DIR !== undefined) {
+        setByPath(acc, "runtime.file_state_dir", env.QLING_FILE_STATE_DIR);
+    }
+}
+function toQlingEnvName(keyPath) {
+    return `QLING_${keyPath.replace(/[.-]/g, "_").toUpperCase()}`;
+}
+function parseEnvValue(raw, defaultValue) {
+    if (typeof defaultValue === "boolean") {
+        return /^(1|true|yes|on)$/i.test(raw.trim());
+    }
+    if (typeof defaultValue === "number") {
+        const n = Number(raw);
+        return Number.isFinite(n) ? n : defaultValue;
+    }
+    if (Array.isArray(defaultValue)) {
+        const trimmed = raw.trim();
+        if (trimmed.startsWith("[") || trimmed.startsWith("{")) {
+            try {
+                const parsed = JSON.parse(trimmed);
+                return Array.isArray(parsed) ? parsed : defaultValue;
+            }
+            catch {
+                return defaultValue;
+            }
+        }
+        return trimmed
+            .split(",")
+            .map((v) => v.trim())
+            .filter(Boolean);
+    }
+    if (typeof defaultValue === "object" && defaultValue !== null) {
+        try {
+            const parsed = JSON.parse(raw);
+            return typeof parsed === "object" && parsed !== null ? parsed : defaultValue;
+        }
+        catch {
+            return defaultValue;
+        }
+    }
+    return raw;
+}
+function parseBoolean(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    return /^(1|true|yes|on)$/i.test(raw.trim());
+}
+function parseNumber(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : fallback;
+}
+function parsePermissionRules(raw, fallback) {
+    if (!raw)
+        return fallback;
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+            return parsed.filter((r) => typeof r === "object" &&
+                typeof r.tool_pattern === "string" &&
+                ["allow", "deny", "ask"].includes(r.decision));
+        }
+    }
+    catch {
+        // ignore
+    }
+    return fallback;
+}
+function parseStringArray(raw, fallback) {
+    if (!raw)
+        return fallback;
+    const trimmed = raw.trim();
+    if (trimmed.startsWith("[")) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (Array.isArray(parsed)) {
+                return parsed.map((v) => String(v)).filter(Boolean);
+            }
+        }
+        catch {
+            return fallback;
+        }
+    }
+    return trimmed
+        .split(",")
+        .map((v) => v.trim())
+        .filter(Boolean);
+}
+function resolvePermissionMode(raw, fallback) {
+    if (!raw)
+        return fallback;
+    const normalized = String(raw).trim().toLowerCase();
+    if (normalized === "allow" || normalized === "deny" || normalized === "ask") {
+        return normalized;
+    }
+    return fallback;
+}
+function applyPermissionModeCompat(config) {
+    const raw = config?.permissions?.mode;
+    const mapped = resolvePermissionMode(raw, config.guard.permissions.default);
+    config.guard.permissions.default = mapped;
+}
+function normalizeAgentsIsolationConfig(config) {
+    const defaults = buildDefaultConfig().agents.isolation;
+    const isolation = config?.agents?.isolation ?? {};
+    const modeRaw = String(isolation.mode ?? defaults.mode).toLowerCase();
+    const nonGitPolicyRaw = String(isolation.non_git_policy ?? defaults.non_git_policy).toLowerCase();
+    config.agents = config.agents ?? { isolation: defaults };
+    config.agents.isolation.mode = modeRaw === "off" ? "off" : "worktree";
+    config.agents.isolation.require_git =
+        typeof isolation.require_git === "boolean" ? isolation.require_git : defaults.require_git;
+    config.agents.isolation.non_git_policy =
+        nonGitPolicyRaw === "deny" || nonGitPolicyRaw === "off" ? nonGitPolicyRaw : "warn";
+}
+function applyCliOverrides(config, cli) {
+    const next = deepClone(config);
+    if (cli.workspaceDir)
+        next.runtime.workspace_dir = path.resolve(cli.workspaceDir);
+    if (cli.noWorkspace)
+        next.runtime.workspace_dir = null;
+    if (cli.fileCacheDir)
+        next.runtime.file_cache_dir = path.resolve(cli.fileCacheDir);
+    if (cli.fileStateDir)
+        next.runtime.file_state_dir = path.resolve(cli.fileStateDir);
+    if (cli.inspectPrompt !== undefined)
+        next.logging.inspect_prompt = cli.inspectPrompt;
+    if (cli.inspectRequest !== undefined)
+        next.logging.inspect_request = cli.inspectRequest;
+    if (cli.logFormat)
+        next.logging.format = cli.logFormat;
+    if (cli.logLevel)
+        next.logging.level = cli.logLevel;
+    if (cli.model)
+        next.llm.model = cli.model;
+    if (cli.provider)
+        next.llm.provider = cli.provider;
+    if (cli.endpoint)
+        next.llm.endpoint = cli.endpoint;
+    if (cli.apiKey)
+        next.llm.api_key = cli.apiKey;
+    return next;
+}
+function normalizeRuntimeRoots(config) {
+    config.runtime.file_state_dir = path.resolve(config.runtime.file_state_dir);
+    config.runtime.file_cache_dir = path.resolve(config.runtime.file_cache_dir);
+    if (config.runtime.workspace_dir) {
+        config.runtime.workspace_dir = path.resolve(config.runtime.workspace_dir);
+    }
+    if (!config.runtime.file_cache_dir.startsWith(config.runtime.file_state_dir)) {
+        config.runtime.file_cache_dir = path.join(config.runtime.file_state_dir, "cache");
+    }
+}
+function flattenObject(input, parent = "", out = {}) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        if (parent)
+            out[parent] = input;
+        return out;
+    }
+    const obj = input;
+    for (const [k, v] of Object.entries(obj)) {
+        const key = parent ? `${parent}.${k}` : k;
+        if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+            flattenObject(v, key, out);
+        }
+        else {
+            out[key] = v;
+        }
+    }
+    return out;
+}
+function setByPath(target, keyPath, value) {
+    const parts = keyPath.split(".");
+    let cur = target;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const p = parts[i];
+        if (typeof cur[p] !== "object" || cur[p] === null || Array.isArray(cur[p])) {
+            cur[p] = {};
+        }
+        cur = cur[p];
+    }
+    cur[parts[parts.length - 1]] = value;
+}
+function deepClone(v) {
+    return structuredClone(v);
+}
+function deepMerge(base, override) {
+    if (override === undefined || override === null)
+        return deepClone(base);
+    if (typeof base !== "object" || base === null)
+        return deepClone(override);
+    if (typeof override !== "object" || override === null)
+        return deepClone(override);
+    if (Array.isArray(base) || Array.isArray(override))
+        return deepClone(override);
+    const out = { ...base };
+    for (const [k, v] of Object.entries(override)) {
+        if (v === undefined)
+            continue;
+        const cur = out[k];
+        if (typeof cur === "object" &&
+            cur !== null &&
+            !Array.isArray(cur) &&
+            typeof v === "object" &&
+            v !== null &&
+            !Array.isArray(v)) {
+            out[k] = deepMerge(cur, v);
+        }
+        else {
+            out[k] = deepClone(v);
+        }
+    }
+    return out;
+}
+/* ===== Runtime Secret Scanner (20260617) ===== */
+const SECRET_VAR_NAME_REGEXES = [
+    /API_KEY$/i,
+    /^API_KEY$/i,
+    /TOKEN$/i,
+    /SECRET$/i,
+    /AUTH_TOKEN$/i,
+    /ACCESS_KEY$/i,
+    /PRIVATE_KEY$/i,
+];
+/**
+ * Pure scanner for a single .env file content.
+ * Returns only varName + file. NEVER includes or logs the secret value.
+ */
+export function scanDotEnvContent(filePath, content) {
+    const hits = [];
+    const lines = content.split(/\r?\n/);
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const eqIdx = line.indexOf('=');
+        if (eqIdx <= 0)
+            continue;
+        const varName = line.slice(0, eqIdx).trim();
+        const value = line.slice(eqIdx + 1).trim();
+        if (!value)
+            continue;
+        const looksLikeSecret = SECRET_VAR_NAME_REGEXES.some((re) => re.test(varName));
+        if (looksLikeSecret) {
+            hits.push({ file: filePath, varName });
+        }
+    }
+    return hits;
+}
+/**
+ * Scan common runtime locations for plaintext secrets in .env files.
+ * Locations: ~/.qling/.env and process.cwd()/.env
+ * Only reports hits; never emits values.
+ */
+/** 参与密钥扫描的 env 文件名（相对目录） */
+export const SECRET_ENV_FILENAMES = [
+    ".env",
+    ".env.local",
+    ".env.development",
+    ".env.production",
+    ".env.test",
+    ".env.development.local",
+    ".env.production.local",
+];
+export function listSecretScanCandidatePaths(cwd = process.cwd(), stateDir) {
+    const home = os.homedir();
+    const qlingDir = stateDir || path.join(home, ".qling");
+    const paths = [path.join(qlingDir, ".env")];
+    for (const name of SECRET_ENV_FILENAMES) {
+        paths.push(path.join(cwd, name));
+    }
+    // 去重
+    return Array.from(new Set(paths.map((p) => path.resolve(p))));
+}
+export async function scanRuntimeDotEnvSecrets(stateDir) {
+    const { readFile } = await import("fs/promises");
+    const hits = [];
+    const candidates = listSecretScanCandidatePaths(process.cwd(), stateDir);
+    for (const p of candidates) {
+        try {
+            if (existsSync(p)) {
+                const content = await readFile(p, "utf8");
+                hits.push(...scanDotEnvContent(p, content));
+            }
+        }
+        catch {
+            // best-effort scanner, ignore unreadable files
+        }
+    }
+    return hits;
+}