@qqbrowser/openclaw-qbot 0.0.128 → 0.0.129

package/dist/audio-transcription-runner-BUsb6cqv.js

@@ -1,4 +1,4 @@
 import{H as e,S as t,T as n}from"./subsystem-BLbY429l.js";import{Gc as r,Jo as i,Ko as a,Yo as o,ll as s,qo as c,rl as l,ul as u}from"./auth-profiles-BhXA8Jy2.js";import{N as d,P as f}from"./agent-scope-DAWJwFfl.js";import{xt as p}from"./plugins-DNlgeTTc.js";import{n as m}from"./exec-B3eleY5O.js";import{a as h,l as g,r as _,s as v}from"./windows-spawn-7oINn5ao.js";import{i as y,n as b,s as ee,t as te}from"./errors-6SQWM9dj.js";import{n as ne,r as re,t as ie}from"./model-catalog-BLdaFmIo.js";import{a as x,n as ae,t as oe}from"./fetch-CY5G3PDq.js";import{n as se}from"./fetch-timeout-CdYxWG9w.js";import{t as ce}from"./fetch-guard-BaRbr_V6.js";import{t as S}from"./image-D-R3N1it.js";import{n as le,r as ue,t as de}from"./api-key-rotation-D8WsZ43x.js";import{r as fe}from"./proxy-fetch-gWETR3cl.js";import C from"node:process";import{fileURLToPath as pe}from"node:url";import me from"node:os";import w from"node:path";import{constants as he}from"node:fs";import T from"node:fs/promises";import ge from"node:crypto";function _e(e){let t=e?.trim();if(t){if(t.startsWith(`file://`))try{return pe(t)}catch{return}return t}}function ve(e){let t=Array.isArray(e.MediaPaths)?e.MediaPaths:void 0,n=Array.isArray(e.MediaUrls)?e.MediaUrls:void 0,r=Array.isArray(e.MediaTypes)?e.MediaTypes:void 0,i=(t,n)=>{let i=r?.[n];return(typeof i==`string`?i.trim():``)||(t===1?e.MediaType:void 0)};if(t&&t.length>0){let r=t.length,a=n&&n.length>0?n:void 0;return t.map((t,n)=>({path:t?.trim()||void 0,url:a?.[n]??e.MediaUrl,mime:i(r,n),index:n})).filter(e=>!!(e.path?.trim()||e.url?.trim()))}if(n&&n.length>0){let e=n.length;return n.map((t,n)=>({path:void 0,url:t?.trim()||void 0,mime:i(e,n),index:n})).filter(e=>!!e.url?.trim())}let a=e.MediaPath?.trim(),o=e.MediaUrl?.trim();return!a&&!o?[]:[{path:a||void 0,url:o||void 0,mime:e.MediaType,index:0}]}function E(e){let t=g(e.mime);if(t===`image`||t===`audio`||t===`video`)return t;let n=h(e.path??e.url);return n?[`.mp4`,`.mov`,`.mkv`,`.webm`,`.avi`,`.m4v`].includes(n)?`video`:v(e.path??e.url)?`audio`:[`.png`,`.jpg`,`.jpeg`,`.webp`,`.gif`,`.bmp`,`.tiff`,`.tif`].includes(n)?`image`:`unknown`:`unknown`}function ye(e){return E(e)===`video`}function D(e){return E(e)===`audio`}function be(e){return E(e)===`image`}function xe(e,t){let n=Array.isArray(e)?e.filter(O):[];if(!t||t===`first`)return n;if(t===`last`)return[...n].toReversed();if(t===`path`){let e=n.filter(e=>e.path),t=n.filter(e=>!e.path);return[...e,...t]}if(t===`url`){let e=n.filter(e=>e.url),t=n.filter(e=>!e.url);return[...e,...t]}return n}function O(e){if(!e||typeof e!=`object`)return!1;let t=e;return!(typeof t.index!=`number`||t.path!==void 0&&typeof t.path!=`string`||t.url!==void 0&&typeof t.url!=`string`||t.mime!==void 0&&typeof t.mime!=`string`||t.alreadyTranscribed!==void 0&&typeof t.alreadyTranscribed!=`boolean`)}function Se(e){let{capability:t,attachments:n,policy:r}=e,i=(Array.isArray(n)?n.filter(O):[]).filter(e=>t===`audio`&&e.alreadyTranscribed?!1:t===`image`?be(e):t===`audio`?D(e):ye(e));if(i.length===0)return[];let a=xe(i,r?.prefer),o=r?.mode??`first`,s=r?.maxAttachments??1;return o===`all`?a.slice(0,Math.max(1,s)):a.slice(0,1)}const k=new Set,Ce=new Set([`ERR_OUT_OF_MEMORY`,`ERR_SCRIPT_EXECUTION_TIMEOUT`,`ERR_WORKER_OUT_OF_MEMORY`,`ERR_WORKER_UNCAUGHT_EXCEPTION`,`ERR_WORKER_INITIALIZATION_FAILED`]),we=new Set([`INVALID_CONFIG`,`MISSING_API_KEY`,`MISSING_CREDENTIALS`]),Te=new Set([`ECONNRESET`,`ECONNREFUSED`,`ENOTFOUND`,`ETIMEDOUT`,`ESOCKETTIMEDOUT`,`ECONNABORTED`,`EPIPE`,`EHOSTUNREACH`,`ENETUNREACH`,`EAI_AGAIN`,`UND_ERR_CONNECT_TIMEOUT`,`UND_ERR_DNS_RESOLVE_FAILED`,`UND_ERR_CONNECT`,`UND_ERR_SOCKET`,`UND_ERR_HEADERS_TIMEOUT`,`UND_ERR_BODY_TIMEOUT`,`EPROTO`,`ERR_SSL_WRONG_VERSION_NUMBER`,`ERR_SSL_PROTOCOL_RETURNED_AN_ERROR`]),Ee=new Set([`AbortError`,`ConnectTimeoutError`,`HeadersTimeoutError`,`BodyTimeoutError`,`TimeoutError`]),De=/\b(ECONNRESET|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ESOCKETTIMEDOUT|ECONNABORTED|EPIPE|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|EPROTO|UND_ERR_CONNECT_TIMEOUT|UND_ERR_DNS_RESOLVE_FAILED|UND_ERR_CONNECT|UND_ERR_SOCKET|UND_ERR_HEADERS_TIMEOUT|UND_ERR_BODY_TIMEOUT)\b/i,Oe=[`getaddrinfo`,`socket hang up`,`client network socket disconnected before secure tls connection was established`,`network error`,`network is unreachable`,`temporary failure in name resolution`,`tlsv1 alert`,`ssl routines`,`packet length too long`,`write eproto`];function ke(e){return e===`fetch failed`?!0:/:\s*fetch failed$/.test(e)}function Ae(e){if(!(!e||typeof e!=`object`))return e.cause}function je(e){let t=b(e);if(t)return t.trim().toUpperCase();if(!e||typeof e!=`object`)return;let n=e.errno;if(typeof n==`string`&&n.trim())return n.trim().toUpperCase();if(typeof n==`number`&&Number.isFinite(n))return String(n)}function A(e){return b(e)||b(Ae(e))}function j(e){return!e||typeof e!=`object`?!1:(`name`in e?String(e.name):``)===`AbortError`||(`message`in e&&typeof e.message==`string`?e.message:``)===`This operation was aborted`}function Me(e){let t=A(e);return t!==void 0&&Ce.has(t)}function Ne(e){let t=A(e);return t!==void 0&&we.has(t)}function Pe(e){if(!e)return!1;for(let t of te(e,e=>{let t=[e.cause,e.reason,e.original,e.error,e.data];return Array.isArray(e.errors)&&t.push(...e.errors),t})){let e=je(t);if(e&&Te.has(e))return!0;let n=ee(t);if(n&&Ee.has(n))return!0;if(!t||typeof t!=`object`)continue;let r=t.message,i=typeof r==`string`?r.toLowerCase().trim():``;if(i&&(De.test(i)||ke(i)||Oe.some(e=>i.includes(e))))return!0}return!1}function Fe(e){return k.add(e),()=>{k.delete(e)}}function Ie(e){for(let t of k)try{if(t(e))return!0}catch(e){console.error(`[openclaw] Unhandled rejection handler failed:`,e instanceof Error?e.stack??e.message:e)}return!1}function Le(){C.on(`unhandledRejection`,(e,t)=>{if(!Ie(e)){if(j(e)){console.warn(`[openclaw] Suppressed AbortError:`,y(e));return}if(Me(e)){console.error(`[openclaw] FATAL unhandled rejection:`,y(e)),C.exit(1);return}if(Ne(e)){console.error(`[openclaw] CONFIGURATION ERROR - requires fix:`,y(e)),C.exit(1);return}if(Pe(e)){console.warn(`[openclaw] Non-fatal unhandled rejection (continuing):`,y(e));return}console.error(`[openclaw] Unhandled promise rejection:`,y(e)),C.exit(1)}})}function Re(e){return e.replace(/[^a-zA-Z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``)||`tmp`}function ze(e){if(!e)return``;let t=((e.startsWith(`.`)?e:`.${e}`).match(/[a-zA-Z0-9._-]+$/)?.[0]??``).replace(/^[._-]+/,``);return t?`.${t}`:``}function Be(t){return t??e()}function M(e){let t=Re(e.prefix),n=ze(e.extension),r=e.now,i=typeof r==`number`&&Number.isFinite(r)?Math.trunc(r):Date.now(),a=e.uuid?.trim()||ge.randomUUID();return w.join(Be(e.tmpDir),`${t}-${i}-${a}${n}`)}var N=class extends Error{constructor(e,t){super(t),this.reason=e,this.name=`MediaUnderstandingSkipError`}};function Ve(e){return e instanceof N}function P(e,t){return(e?.trim()||t).replace(/\/+$/,``)}async function F(e,t,n,r,i){return await ce({url:e,fetchImpl:r,init:t,timeoutMs:n,policy:i?.ssrfPolicy,lookupFn:i?.lookupFn,pinDns:i?.pinDns})}async function I(e){return F(e.url,{method:`POST`,headers:e.headers,body:e.body},e.timeoutMs,e.fetchFn,e.allowPrivateNetwork?{ssrfPolicy:{allowPrivateNetwork:!0}}:void 0)}async function L(e){return F(e.url,{method:`POST`,headers:e.headers,body:JSON.stringify(e.body)},e.timeoutMs,e.fetchFn,e.allowPrivateNetwork?{ssrfPolicy:{allowPrivateNetwork:!0}}:void 0)}async function He(e){try{let t=(await e.text()).replace(/\s+/g,` `).trim();return t?t.length<=300?t:`${t.slice(0,300)}…`:void 0}catch{return}}async function R(e,t){if(e.ok)return;let n=await He(e),r=n?`: ${n}`:``;throw Error(`${t} (HTTP ${e.status})${r}`)}function Ue(e,t){let n=e?.trim();if(!n)throw Error(t);return n}const We=i(x(),a);function Ge(e){return typeof e==`string`?e:e instanceof URL?e.toString():e.url}var Ke=class{constructor(e,t){this.entries=new Map,this.attachments=e,this.localPathRoots=i(t?.localPathRoots,We);for(let t of e)this.entries.set(t.index,{attachment:t})}async getBuffer(e){let t=await this.ensureEntry(e.attachmentIndex);if(t.buffer){if(t.buffer.length>e.maxBytes)throw new N(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);return{buffer:t.buffer,mime:t.bufferMime,fileName:t.bufferFileName??`media-${e.attachmentIndex+1}`,size:t.buffer.length}}if(t.resolvedPath){let n=await this.ensureLocalStat(t);if(t.resolvedPath){if(n!==void 0&&n>e.maxBytes)throw new N(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);let r=await T.readFile(t.resolvedPath);return t.buffer=r,t.bufferMime=t.bufferMime??t.attachment.mime??await _({buffer:r,filePath:t.resolvedPath}),t.bufferFileName=w.basename(t.resolvedPath)||`media-${e.attachmentIndex+1}`,{buffer:r,mime:t.bufferMime,fileName:t.bufferFileName,size:r.length}}}let n=t.attachment.url?.trim();if(!n)throw new N(`empty`,`Attachment ${e.attachmentIndex+1} has no path or URL.`);try{let r=await ae({url:n,fetchImpl:(t,n)=>se(Ge(t),n??{},e.timeoutMs,fetch),maxBytes:e.maxBytes});return t.buffer=r.buffer,t.bufferMime=t.attachment.mime??r.contentType??await _({buffer:r.buffer,filePath:r.fileName??n}),t.bufferFileName=r.fileName??`media-${e.attachmentIndex+1}`,{buffer:r.buffer,mime:t.bufferMime,fileName:t.bufferFileName,size:r.buffer.length}}catch(t){throw t instanceof oe&&t.code===`max_bytes`?new N(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`):j(t)?new N(`timeout`,`Attachment ${e.attachmentIndex+1} timed out while fetching.`):t}}async getPath(e){let t=await this.ensureEntry(e.attachmentIndex);if(t.resolvedPath){if(e.maxBytes){let n=await this.ensureLocalStat(t);if(t.resolvedPath&&n!==void 0&&n>e.maxBytes)throw new N(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`)}if(t.resolvedPath)return{path:t.resolvedPath}}if(t.tempPath){if(e.maxBytes&&t.buffer&&t.buffer.length>e.maxBytes)throw new N(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);return{path:t.tempPath,cleanup:t.tempCleanup}}let n=e.maxBytes??1/0,r=await this.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:n,timeoutMs:e.timeoutMs}),i=M({prefix:`openclaw-media`,extension:w.extname(r.fileName||``)||``});return await T.writeFile(i,r.buffer),t.tempPath=i,t.tempCleanup=async()=>{await T.unlink(i).catch(()=>{})},{path:i,cleanup:t.tempCleanup}}async cleanup(){let e=[];for(let t of this.entries.values())t.tempCleanup&&=(e.push(Promise.resolve(t.tempCleanup())),void 0);await Promise.all(e)}async ensureEntry(e){let t=this.entries.get(e);if(t)return t.resolvedPath||=this.resolveLocalPath(t.attachment),t;let n=this.attachments.find(t=>t.index===e)??{index:e},r={attachment:n,resolvedPath:this.resolveLocalPath(n)};return this.entries.set(e,r),r}resolveLocalPath(e){let t=_e(e.path);if(t)return w.isAbsolute(t)?t:w.resolve(t)}async ensureLocalStat(e){if(e.resolvedPath){if(!c({filePath:e.resolvedPath,roots:this.localPathRoots})){e.resolvedPath=void 0,n()&&t(`Blocked attachment path outside allowed roots: ${e.attachment.path??e.attachment.url??`(unknown)`}`);return}if(e.statSize!==void 0)return e.statSize;try{let r=e.resolvedPath,i=await T.stat(r);if(!i.isFile()){e.resolvedPath=void 0;return}let a=await T.realpath(r).catch(()=>r);if(!c({filePath:a,roots:await this.getCanonicalLocalPathRoots()})){e.resolvedPath=void 0,n()&&t(`Blocked canonicalized attachment path outside allowed roots: ${a}`);return}return e.resolvedPath=a,e.statSize=i.size,i.size}catch(r){e.resolvedPath=void 0,n()&&t(`Failed to read attachment ${e.attachment.index+1}: ${String(r)}`);return}}}async getCanonicalLocalPathRoots(){return this.canonicalLocalPathRoots||=(async()=>i(this.localPathRoots,await Promise.all(this.localPathRoots.map(async e=>e.includes(`*`)?e:await T.realpath(e).catch(()=>e)))))(),await this.canonicalLocalPathRoots}};const z=1024*1024,qe={image:500,audio:void 0,video:500},Je={image:10*z,audio:20*z,video:50*z},Ye={image:60,audio:60,video:120},Xe={image:`Describe the image.`,audio:`Transcribe the audio.`,video:`Describe the video.`};70*z;const Ze={groq:`whisper-large-v3-turbo`,openai:`gpt-4o-mini-transcribe`,deepgram:`nova-3`,mistral:`voxtral-mini-latest`},Qe=[`openai`,`groq`,`deepgram`,`google`,`mistral`],$e=[`openai`,`anthropic`,`google`,`minimax`,`minimax-portal`,`zai`],et=[`google`,`moonshot`],B={openai:`gpt-5-mini`,anthropic:`claude-opus-4-6`,google:`gemini-3-flash-preview`,minimax:`MiniMax-VL-01`,"minimax-portal":`MiniMax-VL-01`,zai:`glm-4.6v`},tt=5*z;async function V(e){if(!e)return!1;try{return await T.stat(e),!0}catch{return!1}}function nt(e){let t=e.trim(),n=t.lastIndexOf(`{`);if(n===-1)return null;let r=t.slice(n);try{return JSON.parse(r)}catch{return null}}function rt(e){let t=nt(e);if(!t||typeof t!=`object`)return null;let n=t.response;return typeof n==`string`&&n.trim()||null}const it={id:`anthropic`,capabilities:[`image`],describeImage:S};function at(e){return e?.trim()||`nova-3`}async function ot(e){let t=e.fetchFn??fetch,n=P(e.baseUrl,`https://api.deepgram.com/v1`),r=!!e.baseUrl?.trim(),i=at(e.model),a=new URL(`${n}/listen`);if(a.searchParams.set(`model`,i),e.language?.trim()&&a.searchParams.set(`language`,e.language.trim()),e.query)for(let[t,n]of Object.entries(e.query))n!==void 0&&a.searchParams.set(t,String(n));let o=new Headers(e.headers);o.has(`authorization`)||o.set(`authorization`,`Token ${e.apiKey}`),o.has(`content-type`)||o.set(`content-type`,e.mime??`application/octet-stream`);let s=new Uint8Array(e.buffer),{response:c,release:l}=await I({url:a.toString(),headers:o,body:s,timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{return await R(c,`Audio transcription failed`),{text:Ue((await c.json()).results?.channels?.[0]?.alternatives?.[0]?.transcript,`Audio transcription response missing transcript`),model:i}}finally{await l()}}const st={id:`deepgram`,capabilities:[`audio`],transcribeAudio:ot};async function ct(e){let t=e.fetchFn??fetch,n=P(e.baseUrl,e.defaultBaseUrl),r=!!e.baseUrl?.trim(),i=(()=>{let t=e.model?.trim();return t?l(t):e.defaultModel})(),a=`${n}/models/${i}:generateContent`,o=ue(e.apiKey),s=new Headers(e.headers);for(let[e,t]of Object.entries(o.headers))s.has(e)||s.set(e,t);let{response:c,release:u}=await L({url:a,headers:s,body:{contents:[{role:`user`,parts:[{text:e.prompt?.trim()||e.defaultPrompt},{inline_data:{mime_type:e.mime??e.defaultMime,data:e.buffer.toString(`base64`)}}]}]},timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{await R(c,e.httpErrorLabel);let t=((await c.json()).candidates?.[0]?.content?.parts??[]).map(e=>e?.text?.trim()).filter(Boolean).join(`
 `);if(!t)throw Error(e.missingTextError);return{text:t,model:i}}finally{await u()}}async function lt(e){let{text:t,model:n}=await ct({...e,defaultBaseUrl:`https://generativelanguage.googleapis.com/v1beta`,defaultModel:`gemini-3-flash-preview`,defaultPrompt:`Transcribe the audio.`,defaultMime:`audio/wav`,httpErrorLabel:`Audio transcription failed`,missingTextError:`Audio transcription response missing text`});return{text:t,model:n}}async function ut(e){let{text:t,model:n}=await ct({...e,defaultBaseUrl:`https://generativelanguage.googleapis.com/v1beta`,defaultModel:`gemini-3-flash-preview`,defaultPrompt:`Describe the video.`,defaultMime:`video/mp4`,httpErrorLabel:`Video description failed`,missingTextError:`Video description response missing text`});return{text:t,model:n}}const dt={id:`google`,capabilities:[`image`,`audio`,`video`],describeImage:S,transcribeAudio:lt,describeVideo:ut};function ft(e){return e?.trim()||`gpt-4o-mini-transcribe`}async function H(e){let t=e.fetchFn??fetch,n=P(e.baseUrl,`https://api.openai.com/v1`),r=!!e.baseUrl?.trim(),i=`${n}/audio/transcriptions`,a=ft(e.model),o=new FormData,s=e.fileName?.trim()||w.basename(e.fileName)||`audio`,c=new Uint8Array(e.buffer),l=new Blob([c],{type:e.mime??`application/octet-stream`});o.append(`file`,l,s),o.append(`model`,a),e.language?.trim()&&o.append(`language`,e.language.trim()),e.prompt?.trim()&&o.append(`prompt`,e.prompt.trim());let u=new Headers(e.headers);u.has(`authorization`)||u.set(`authorization`,`Bearer ${e.apiKey}`);let{response:d,release:f}=await I({url:i,headers:u,body:o,timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{return await R(d,`Audio transcription failed`),{text:Ue((await d.json()).text,`Audio transcription response missing text`),model:a}}finally{await f()}}const pt={id:`groq`,capabilities:[`audio`],transcribeAudio:e=>H({...e,baseUrl:e.baseUrl??`https://api.groq.com/openai/v1`})},mt={id:`minimax`,capabilities:[`image`],describeImage:S},ht={id:`minimax-portal`,capabilities:[`image`],describeImage:S},gt={id:`mistral`,capabilities:[`audio`],transcribeAudio:e=>H({...e,baseUrl:e.baseUrl??`https://api.mistral.ai/v1`})};function _t(e){return e?.trim()||`kimi-k2.5`}function vt(e){return e?.trim()||`Describe the video.`}function yt(e){let t=e.choices?.[0]?.message;if(!t)return null;if(typeof t.content==`string`&&t.content.trim())return t.content.trim();if(Array.isArray(t.content)){let e=t.content.map(e=>typeof e.text==`string`?e.text.trim():``).filter(Boolean).join(`
 `).trim();if(e)return e}return typeof t.reasoning_content==`string`&&t.reasoning_content.trim()?t.reasoning_content.trim():null}async function bt(e){let t=e.fetchFn??fetch,n=P(e.baseUrl,`https://api.moonshot.ai/v1`),r=_t(e.model),i=e.mime??`video/mp4`,a=vt(e.prompt),o=`${n}/chat/completions`,s=new Headers(e.headers);s.has(`content-type`)||s.set(`content-type`,`application/json`),s.has(`authorization`)||s.set(`authorization`,`Bearer ${e.apiKey}`);let{response:c,release:l}=await L({url:o,headers:s,body:{model:r,messages:[{role:`user`,content:[{type:`text`,text:a},{type:`video_url`,video_url:{url:`data:${i};base64,${e.buffer.toString(`base64`)}`}}]}]},timeoutMs:e.timeoutMs,fetchFn:t});try{await R(c,`Moonshot video description failed`);let e=yt(await c.json());if(!e)throw Error(`Moonshot video description response missing content`);return{text:e,model:r}}finally{await l()}}const xt=[pt,{id:`openai`,capabilities:[`image`,`audio`],describeImage:S,transcribeAudio:H},dt,it,mt,ht,{id:`moonshot`,capabilities:[`image`,`video`],describeImage:S,describeVideo:bt},gt,{id:`zai`,capabilities:[`image`],describeImage:S},st];function U(e){let t=r(e);return t===`gemini`?`google`:t}function St(e){let t=new Map;for(let e of xt)t.set(U(e.id),e);if(e)for(let[n,r]of Object.entries(e)){let e=U(n),i=t.get(e),a=i?{...i,...r,capabilities:r.capabilities??i.capabilities}:r;t.set(e,a)}return t}function W(e,t){return t.get(U(e))}function Ct(e){let t=e?.trim().toLowerCase();if(t===`allow`)return`allow`;if(t===`deny`)return`deny`}function G(e){return e?.trim().toLowerCase()||void 0}function K(e){return p(e??void 0)}function wt(e){let t=e.scope;if(!t)return`allow`;let n=G(e.channel),r=K(e.chatType),i=G(e.sessionKey)??``;for(let e of t.rules??[]){if(!e)continue;let t=Ct(e.action)??`allow`,a=e.match??{},o=G(a.channel),s=K(a.chatType),c=G(a.keyPrefix);if(!(o&&o!==n)&&!(s&&s!==r)&&!(c&&!i.startsWith(c)))return t}return Ct(t.default)??`allow`}function Tt(e,t){let n=typeof e==`number`&&Number.isFinite(e)?e:t;return Math.max(1e3,Math.floor(n*1e3))}function Et(e,t,n){let r=t?.trim()||Xe[e];return!n||e===`audio`?r:`${r} Respond in at most ${n} characters.`}function Dt(e){let{capability:t,entry:n,cfg:r}=e,i=n.maxChars??e.config?.maxChars??r.tools?.media?.[t]?.maxChars;return typeof i==`number`?i:qe[t]}function Ot(e){let t=e.entry.maxBytes??e.config?.maxBytes??e.cfg.tools?.media?.[e.capability]?.maxBytes;return typeof t==`number`?t:Je[e.capability]}function kt(e){return wt({scope:e.scope,sessionKey:e.ctx.SessionKey,channel:e.ctx.Surface??e.ctx.Provider,chatType:K(e.ctx.ChatType)})}function At(e){if((e.entry.type??(e.entry.command?`cli`:`provider`))===`cli`)return;let t=U(e.entry.provider??``);if(t)return e.providerRegistry.get(t)?.capabilities}function jt(e){let{cfg:r,capability:i,config:a}=e,o=r.tools?.media?.models??[],s=[...(a?.models??[]).map(e=>({entry:e,source:`capability`})),...o.map(e=>({entry:e,source:`shared`}))];return s.length===0?[]:s.filter(({entry:r,source:a})=>{let o=r.capabilities&&r.capabilities.length>0?r.capabilities:a===`shared`?At({entry:r,providerRegistry:e.providerRegistry}):void 0;return!o||o.length===0?a===`shared`?(n()&&t(`Skipping shared media model without capabilities: ${r.provider??r.command??`unknown`}`),!1):!0:o.includes(i)}).map(({entry:e})=>e)}function Mt(e){let t=e.tools?.media?.concurrency;return typeof t==`number`&&Number.isFinite(t)&&t>0?Math.floor(t):2}function Nt(e){return e==null?``:typeof e==`string`?e:typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`?String(e):typeof e==`symbol`||typeof e==`function`?e.toString():Array.isArray(e)?e.flatMap(e=>e==null?[]:typeof e==`string`?[e]:typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`?[String(e)]:[]).join(`,`):``}function Pt(e,t){return e?e.replace(/{{\s*(\w+)\s*}}/g,(e,n)=>{let r=t[n];return Nt(r)}):``}function Ft(e){return Math.ceil(e/3)*4}function It(e){let t=Math.floor(4/3*e);return Math.min(t,73400320)}function q(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function J(e,t){let n=e.trim();return!t||n.length<=t?n:n.slice(0,t).trim()}function Lt(e){let t=e=>{let n=e.trim();if(!n)return null;let r=n[0];if(r!==`{`&&r!==`"`)return null;try{let e=JSON.parse(n);if(typeof e==`string`)return t(e);if(e&&typeof e==`object`){let t=e.text;if(typeof t==`string`&&t.trim())return t.trim()}}catch{}return null},n=t(e);if(n)return n;let r=e.split(`
-`).map(e=>e.trim()).filter(Boolean);for(let e=r.length-1;e>=0;--e){let n=t(r[e]??``);if(n)return n}return null}function Rt(e){return w.parse(e).name}function Y(e,t){for(let n=0;n<e.length;n+=1)if(t.includes(e[n]??``)){let t=e[n+1];if(t)return t}}function zt(e,t){return e.some(e=>t.includes(e))}function Bt(e,t){let n=Y(e,[`--output_dir`,`-o`]),r=Y(e,[`--output_format`]);if(!n||!r||!r.split(`,`).map(e=>e.trim()).includes(`txt`))return null;let i=w.parse(t).name;return w.join(n,`${i}.txt`)}function Vt(e){if(!zt(e,[`-otxt`,`--output-txt`]))return null;let t=Y(e,[`-of`,`--output-file`]);return t?`${t}.txt`:null}function Ht(e,t){let n=Y(e,[`--output-dir`]),r=Y(e,[`--output-format`]);if(!n||r&&r!==`txt`)return null;let i=w.parse(t).name;return w.join(n,`${i}.txt`)}async function Ut(e){let t=Rt(e.command),n=t===`whisper-cli`?Vt(e.args):t===`whisper`?Bt(e.args,e.mediaPath):t===`parakeet-mlx`?Ht(e.args,e.mediaPath):null;if(n&&await V(n))try{let e=await T.readFile(n,`utf8`);if(e.trim())return e.trim()}catch{}if(t===`gemini`){let t=rt(e.stdout);if(t)return t}if(t===`sherpa-onnx-offline`){let t=Lt(e.stdout);if(t)return t}return e.stdout.trim()}function Wt(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Gt(e){if(!e)return;let t={};return typeof e.detectLanguage==`boolean`&&(t.detect_language=e.detectLanguage),typeof e.punctuate==`boolean`&&(t.punctuate=e.punctuate),typeof e.smartFormat==`boolean`&&(t.smart_format=e.smartFormat),Object.keys(t).length>0?t:void 0}function Kt(e){let t={...e};return`detectLanguage`in t&&(t.detect_language=t.detectLanguage,delete t.detectLanguage),`smartFormat`in t&&(t.smart_format=t.smartFormat,delete t.smartFormat),t}function qt(e){let{providerId:t,config:n,entry:r}=e,i=Wt({...n?.providerOptions?.[t],...r.providerOptions?.[t]});if(t!==`deepgram`)return i;let a=Kt(i??{}),o=Gt({...n?.deepgram,...r.deepgram});for(let[e,t]of Object.entries(o??{}))a[e]===void 0&&(a[e]=t);return Object.keys(a).length>0?a:void 0}function X(e){if(e.entryType===`cli`){let t=e.entry.command?.trim();return{type:`cli`,provider:t??`cli`,model:e.entry.model??t,outcome:e.outcome,reason:e.reason}}let t=e.entry.provider?.trim();return{type:`provider`,provider:(t?U(t):void 0)??t,model:e.entry.model,outcome:e.outcome,reason:e.reason}}function Jt(e){let{capability:t,entry:n,cfg:r}=e,i=Ot({capability:t,entry:n,cfg:r,config:e.config}),a=Dt({capability:t,entry:n,cfg:r,config:e.config});return{maxBytes:i,maxChars:a,timeoutMs:Tt(n.timeoutSeconds??e.config?.timeoutSeconds??r.tools?.media?.[t]?.timeoutSeconds,Ye[t]),prompt:Et(t,n.prompt??e.config?.prompt??r.tools?.media?.[t]?.prompt,a)}}async function Yt(e){let t=await u({provider:e.providerId,cfg:e.cfg,profileId:e.entry.profile,preferredProfile:e.entry.preferredProfile,agentDir:e.agentDir});return{apiKeys:de({provider:e.providerId,primaryApiKey:s(t,e.providerId)}),providerConfig:e.cfg.models?.providers?.[e.providerId]}}async function Xt(e){let{apiKeys:t,providerConfig:n}=await Yt({providerId:e.providerId,cfg:e.cfg,entry:e.entry,agentDir:e.agentDir}),r=e.entry.baseUrl??e.config?.baseUrl??n?.baseUrl,i={...q(n?.headers),...q(e.config?.headers),...q(e.entry.headers)};return{apiKeys:t,baseUrl:r,headers:Object.keys(i).length>0?i:void 0}}function Zt(e){let t=Array.isArray(e.attachments)?e.attachments:[],n=t.length,r=t.filter(e=>e?.chosen?.outcome===`success`).length,i=t.find(e=>e?.chosen)?.chosen,a=typeof i?.provider==`string`?i.provider.trim():void 0,o=typeof i?.model==`string`?i.model.trim():void 0,s=a?o?`${a}/${o}`:a:void 0,c=t.flatMap(e=>(Array.isArray(e?.attempts)?e.attempts:[]).map(e=>typeof e?.reason==`string`?e.reason:void 0).filter(e=>!!e)).find(e=>e.trim().length>0),l=c?c.split(`:`)[0]?.trim():void 0,u=n>0?` (${r}/${n})`:``,d=s?` via ${s}`:``,f=l?` reason=${l}`:``;return`${e.capability}: ${e.outcome}${u}${d}${f}`}function Qt(e){if(!(e.size>=1024))throw new N(`tooSmall`,`Audio attachment ${e.attachmentIndex+1} is too small (${e.size} bytes, minimum 1024)`)}async function $t(e){let{entry:t,capability:n,cfg:r}=e,i=t.provider?.trim();if(!i)throw Error(`Provider entry missing provider for ${n}`);let a=U(i),{maxBytes:o,maxChars:s,timeoutMs:c,prompt:l}=Jt({capability:n,entry:t,cfg:r,config:e.config});if(n===`image`){if(!e.agentDir)throw Error(`Image understanding requires agentDir`);let n=t.model?.trim();if(!n)throw Error(`Image understanding requires model id`);let r=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),i=W(a,e.providerRegistry),u={buffer:r.buffer,fileName:r.fileName,mime:r.mime,model:n,provider:a,prompt:l,timeoutMs:c,profile:t.profile,preferredProfile:t.preferredProfile,agentDir:e.agentDir,cfg:e.cfg},d=await(i?.describeImage??S)(u);return{kind:`image.description`,attachmentIndex:e.attachmentIndex,text:J(d.text,s),provider:a,model:d.model??n}}let u=W(a,e.providerRegistry);if(!u)throw Error(`Media provider not available: ${a}`);let d=fe();if(n===`audio`){if(!u.transcribeAudio)throw Error(`Audio transcription provider "${a}" not available.`);let n=u.transcribeAudio,i=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c});Qt({size:i.size,attachmentIndex:e.attachmentIndex});let{apiKeys:f,baseUrl:p,headers:m}=await Xt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),h=qt({providerId:a,config:e.config,entry:t}),g=t.model?.trim()||Ze[a]||t.model,_=await le({provider:a,apiKeys:f,execute:async a=>n({buffer:i.buffer,fileName:i.fileName,mime:i.mime,apiKey:a,baseUrl:p,headers:m,model:g,language:t.language??e.config?.language??r.tools?.media?.audio?.language,prompt:l,query:h,timeoutMs:c,fetchFn:d})});return{kind:`audio.transcription`,attachmentIndex:e.attachmentIndex,text:J(_.text,s),provider:a,model:_.model??g}}if(!u.describeVideo)throw Error(`Video understanding provider "${a}" not available.`);let f=u.describeVideo,p=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),m=Ft(p.size),h=It(o);if(m>h)throw new N(`maxBytes`,`Video attachment ${e.attachmentIndex+1} base64 payload ${m} exceeds ${h}`);let{apiKeys:g,baseUrl:_,headers:v}=await Xt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),y=await le({provider:a,apiKeys:g,execute:e=>f({buffer:p.buffer,fileName:p.fileName,mime:p.mime,apiKey:e,baseUrl:_,headers:v,model:t.model,prompt:l,timeoutMs:c,fetchFn:d})});return{kind:`video.description`,attachmentIndex:e.attachmentIndex,text:J(y.text,s),provider:a,model:y.model??t.model}}async function en(r){let{entry:i,capability:a,cfg:o,ctx:s}=r,c=i.command?.trim(),l=i.args??[];if(!c)throw Error(`CLI entry missing command for ${a}`);let{maxBytes:u,maxChars:d,timeoutMs:f,prompt:p}=Jt({capability:a,entry:i,cfg:o,config:r.config}),h=await r.cache.getPath({attachmentIndex:r.attachmentIndex,maxBytes:u,timeoutMs:f});a===`audio`&&Qt({size:(await T.stat(h.path)).size,attachmentIndex:r.attachmentIndex});let g=await T.mkdtemp(w.join(e(),`openclaw-media-cli-`)),_=h.path,v=w.join(g,w.parse(_).name),y={...s,MediaPath:_,MediaDir:w.dirname(_),OutputDir:g,OutputBase:v,Prompt:p,MaxChars:d},b=[c,...l].map((e,t)=>t===0?e:Pt(e,y));try{n()&&t(`Media understanding via CLI: ${b.join(` `)}`);let{stdout:e}=await m(b[0],b.slice(1),{timeoutMs:f,maxBuffer:tt}),i=J(await Ut({command:c,args:b.slice(1),stdout:e,mediaPath:_}),d);return i?{kind:a===`audio`?`audio.transcription`:`${a}.description`,attachmentIndex:r.attachmentIndex,text:i,provider:`cli`,model:c}:null}finally{await T.rm(g,{recursive:!0,force:!0}).catch(()=>{})}}function Z(e){return St(e)}function Q(e){return ve(e)}function tn(e){return i(x(),o({cfg:e.cfg,accountId:e.ctx.AccountId}))}function nn(e,t){return new Ke(e,t)}const rn=new Map,an=new Map;function on(e){if(!e.startsWith(`~`))return e;let t=me.homedir();return e===`~`?t:e.startsWith(`~/`)?w.join(t,e.slice(2)):e}function sn(e){return e.includes(`/`)||e.includes(`\\`)}function cn(e){if(process.platform!==`win32`||w.extname(e))return[e];let t=(process.env.PATHEXT??`.EXE;.CMD;.BAT;.COM`).split(`;`).map(e=>e.trim()).filter(Boolean).map(e=>e.startsWith(`.`)?e:`.${e}`);return[e,...Array.from(new Set(t)).map(t=>`${e}${t}`)]}async function ln(e){try{return(await T.stat(e)).isFile()?(process.platform===`win32`||await T.access(e,he.X_OK),!0):!1}catch{return!1}}async function un(e){let t=rn.get(e);if(t)return t;let n=(async()=>{let t=on(e.trim());if(t&&sn(t)){for(let e of cn(t))if(await ln(e))return e}let n=e.trim();if(!n)return null;let r=(process.env.PATH??``).split(w.delimiter),i=cn(n);for(let e of r){let t=on(e.trim().replace(/^"(.*)"$/,`$1`));if(t)for(let e of i){let n=w.join(t,e);if(await ln(n))return n}}return null})();return rn.set(e,n),n}async function $(e){return!!await un(e)}async function dn(){let e=an.get(`gemini`);if(e)return e;let t=(async()=>{if(!await $(`gemini`))return!1;try{let{stdout:e}=await m(`gemini`,[`--output-format`,`json`,`ok`],{timeoutMs:8e3});return!!(rt(e)??e.toLowerCase().includes(`ok`))}catch{return!1}})();return an.set(`gemini`,t),t}async function fn(){if(!await $(`whisper-cli`))return null;let e=process.env.WHISPER_CPP_MODEL?.trim(),t=e&&await V(e)?e:`/opt/homebrew/share/whisper-cpp/for-tests-ggml-tiny.bin`;return await V(t)?{type:`cli`,command:`whisper-cli`,args:[`-m`,t,`-otxt`,`-of`,`{{OutputBase}}`,`-np`,`-nt`,`{{MediaPath}}`]}:null}async function pn(){return await $(`whisper`)?{type:`cli`,command:`whisper`,args:[`--model`,`turbo`,`--output_format`,`txt`,`--output_dir`,`{{OutputDir}}`,`--verbose`,`False`,`{{MediaPath}}`]}:null}async function mn(){if(!await $(`sherpa-onnx-offline`))return null;let e=process.env.SHERPA_ONNX_MODEL_DIR?.trim();if(!e)return null;let t=w.join(e,`tokens.txt`),n=w.join(e,`encoder.onnx`),r=w.join(e,`decoder.onnx`),i=w.join(e,`joiner.onnx`);return!await V(t)||!await V(n)||!await V(r)||!await V(i)?null:{type:`cli`,command:`sherpa-onnx-offline`,args:[`--tokens=${t}`,`--encoder=${n}`,`--decoder=${r}`,`--joiner=${i}`,`{{MediaPath}}`]}}async function hn(){return await mn()||await fn()||await pn()}async function gn(e){return await dn()?{type:`cli`,command:`gemini`,args:[`--output-format`,`json`,`--allowed-tools`,`read_many_files`,`--include-directories`,`{{MediaDir}}`,`{{Prompt}}`,`Use read_many_files to read {{MediaPath}} and respond with only the text output.`]}:null}async function _n(e){let{cfg:t,agentDir:n,providerRegistry:r,capability:i}=e,a=async(e,a)=>{let o=W(e,r);if(!o||i===`audio`&&!o.transcribeAudio||i===`image`&&!o.describeImage||i===`video`&&!o.describeVideo)return null;try{return await u({provider:e,cfg:t,agentDir:n}),{type:`provider`,provider:e,model:a}}catch{return null}};if(i===`image`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of $e){let t=B[e],n=await a(e,t);if(n)return n}return null}if(i===`video`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of et){let t=await a(e,void 0);if(t)return t}return null}let o=e.activeModel?.provider?.trim();if(o){let t=await a(o,e.activeModel?.model);if(t)return t}for(let e of Qe){let t=await a(e,void 0);if(t)return t}return null}function vn(e){let t=[],n=f(e.agents?.defaults?.imageModel);n?.trim()&&t.push(n.trim());for(let n of d(e.agents?.defaults?.imageModel))n?.trim()&&t.push(n.trim());if(t.length===0)return[];let r=[];for(let e of t){let t=e.indexOf(`/`);t<=0||t>=e.length-1||r.push({type:`provider`,provider:e.slice(0,t),model:e.slice(t+1)})}return r}async function yn(e){let t=await xn(e);if(t)return[t];if(e.capability===`audio`){let e=await hn();if(e)return[e]}if(e.capability===`image`){let t=vn(e.cfg);if(t.length>0)return t}let n=await gn(e.capability);if(n)return[n];let r=await _n(e);return r?[r]:[]}async function bn(e){let t=Z(),n=e=>{if(!e||e.type===`cli`)return null;let t=e.provider;if(!t)return null;let n=e.model??B[t];return n?{provider:t,model:n}:null};return n(await xn({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))||n(await _n({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))}async function xn(e){let t=e.activeModel?.provider?.trim();if(!t)return null;let n=U(t);if(!n)return null;let r=W(n,e.providerRegistry);if(!r||e.capability===`audio`&&!r.transcribeAudio||e.capability===`image`&&!r.describeImage||e.capability===`video`&&!r.describeVideo)return null;try{await u({provider:n,cfg:e.cfg,agentDir:e.agentDir})}catch{return null}return{type:`provider`,provider:n,model:e.activeModel?.model}}async function Sn(e){let{entries:r,capability:i}=e,a=[];for(let o of r){let r=o.type??(o.command?`cli`:`provider`);try{let t=r===`cli`?await en({capability:i,entry:o,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,config:e.config}):await $t({capability:i,entry:o,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,agentDir:e.agentDir,providerRegistry:e.providerRegistry,config:e.config});if(t){let e=X({entry:o,entryType:r,outcome:`success`});return t.provider&&(e.provider=t.provider),t.model&&(e.model=t.model),a.push(e),{output:t,attempts:a}}a.push(X({entry:o,entryType:r,outcome:`skipped`,reason:`empty output`}))}catch(e){if(Ve(e)){a.push(X({entry:o,entryType:r,outcome:`skipped`,reason:`${e.reason}: ${e.message}`})),n()&&t(`Skipping ${i} model due to ${e.reason}: ${e.message}`);continue}a.push(X({entry:o,entryType:r,outcome:`failed`,reason:String(e)})),n()&&t(`${i} understanding failed: ${String(e)}`)}}return{output:null,attempts:a}}async function Cn(e){let{capability:r,cfg:i,ctx:a}=e,o=e.config??i.tools?.media?.[r];if(o?.enabled===!1)return{outputs:[],decision:{capability:r,outcome:`disabled`,attachments:[]}};let s=o?.attachments,c=Se({capability:r,attachments:e.media,policy:s});if(c.length===0)return{outputs:[],decision:{capability:r,outcome:`no-attachment`,attachments:[]}};if(kt({scope:o?.scope,ctx:a})===`deny`)return n()&&t(`${r} understanding disabled by scope policy.`),{outputs:[],decision:{capability:r,outcome:`scope-deny`,attachments:c.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let l=e.activeModel?.provider?.trim();if(r===`image`&&l&&re(ie(await ne({config:i}),l,e.activeModel?.model??``))){n()&&t(`Skipping image understanding: primary model supports vision natively`);let i=e.activeModel?.model?.trim();return{outputs:[],decision:{capability:r,outcome:`skipped`,attachments:c.map(e=>{let t={type:`provider`,provider:l,model:i||void 0,outcome:`skipped`,reason:`primary model supports vision natively`};return{attachmentIndex:e.index,attempts:[t],chosen:t}})}}}let u=jt({cfg:i,capability:r,config:o,providerRegistry:e.providerRegistry});if(u.length===0&&(u=await yn({cfg:i,agentDir:e.agentDir,providerRegistry:e.providerRegistry,capability:r,activeModel:e.activeModel})),u.length===0)return{outputs:[],decision:{capability:r,outcome:`skipped`,attachments:c.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let d=[],f=[];for(let t of c){let{output:n,attempts:s}=await Sn({capability:r,cfg:i,ctx:a,attachmentIndex:t.index,agentDir:e.agentDir,providerRegistry:e.providerRegistry,cache:e.attachments,entries:u,config:o});n&&d.push(n),f.push({attachmentIndex:t.index,attempts:s,chosen:s.find(e=>e.outcome===`success`)})}let p={capability:r,outcome:d.length>0?`success`:`skipped`,attachments:f};return n()&&t(`Media understanding ${Zt(p)}`),{outputs:d,decision:p}}async function wn(e){let t=e.attachments??Q(e.ctx);if(t.length===0)return{transcript:void 0,attachments:t};let n=Z(e.providers),r=nn(t,e.localPathRoots?{localPathRoots:e.localPathRoots}:void 0);try{return{transcript:(await Cn({capability:`audio`,cfg:e.cfg,ctx:e.ctx,attachments:r,media:t,agentDir:e.agentDir,providerRegistry:n,config:e.cfg.tools?.media?.audio,activeModel:e.activeModel})).outputs.find(e=>e.kind===`audio.transcription`)?.text?.trim()||void 0,attachments:t}}finally{await r.cleanup()}}export{E as S,Le as _,bn as a,_e as b,Pt as c,K as d,wt as f,M as g,B as h,Q as i,Mt as l,tt as m,Z as n,tn as o,$e as p,nn as r,Cn as s,wn as t,Tt as u,Fe as v,ve as x,D as y};
+`).map(e=>e.trim()).filter(Boolean);for(let e=r.length-1;e>=0;--e){let n=t(r[e]??``);if(n)return n}return null}function Rt(e){return w.parse(e).name}function Y(e,t){for(let n=0;n<e.length;n+=1)if(t.includes(e[n]??``)){let t=e[n+1];if(t)return t}}function zt(e,t){return e.some(e=>t.includes(e))}function Bt(e,t){let n=Y(e,[`--output_dir`,`-o`]),r=Y(e,[`--output_format`]);if(!n||!r||!r.split(`,`).map(e=>e.trim()).includes(`txt`))return null;let i=w.parse(t).name;return w.join(n,`${i}.txt`)}function Vt(e){if(!zt(e,[`-otxt`,`--output-txt`]))return null;let t=Y(e,[`-of`,`--output-file`]);return t?`${t}.txt`:null}function Ht(e,t){let n=Y(e,[`--output-dir`]),r=Y(e,[`--output-format`]);if(!n||r&&r!==`txt`)return null;let i=w.parse(t).name;return w.join(n,`${i}.txt`)}async function Ut(e){let t=Rt(e.command),n=t===`whisper-cli`?Vt(e.args):t===`whisper`?Bt(e.args,e.mediaPath):t===`parakeet-mlx`?Ht(e.args,e.mediaPath):null;if(n&&await V(n))try{let e=await T.readFile(n,`utf8`);if(e.trim())return e.trim()}catch{}if(t===`gemini`){let t=rt(e.stdout);if(t)return t}if(t===`sherpa-onnx-offline`){let t=Lt(e.stdout);if(t)return t}return e.stdout.trim()}function Wt(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Gt(e){if(!e)return;let t={};return typeof e.detectLanguage==`boolean`&&(t.detect_language=e.detectLanguage),typeof e.punctuate==`boolean`&&(t.punctuate=e.punctuate),typeof e.smartFormat==`boolean`&&(t.smart_format=e.smartFormat),Object.keys(t).length>0?t:void 0}function Kt(e){let t={...e};return`detectLanguage`in t&&(t.detect_language=t.detectLanguage,delete t.detectLanguage),`smartFormat`in t&&(t.smart_format=t.smartFormat,delete t.smartFormat),t}function qt(e){let{providerId:t,config:n,entry:r}=e,i=Wt({...n?.providerOptions?.[t],...r.providerOptions?.[t]});if(t!==`deepgram`)return i;let a=Kt(i??{}),o=Gt({...n?.deepgram,...r.deepgram});for(let[e,t]of Object.entries(o??{}))a[e]===void 0&&(a[e]=t);return Object.keys(a).length>0?a:void 0}function X(e){if(e.entryType===`cli`){let t=e.entry.command?.trim();return{type:`cli`,provider:t??`cli`,model:e.entry.model??t,outcome:e.outcome,reason:e.reason}}let t=e.entry.provider?.trim();return{type:`provider`,provider:(t?U(t):void 0)??t,model:e.entry.model,outcome:e.outcome,reason:e.reason}}function Jt(e){let{capability:t,entry:n,cfg:r}=e,i=Ot({capability:t,entry:n,cfg:r,config:e.config}),a=Dt({capability:t,entry:n,cfg:r,config:e.config});return{maxBytes:i,maxChars:a,timeoutMs:Tt(n.timeoutSeconds??e.config?.timeoutSeconds??r.tools?.media?.[t]?.timeoutSeconds,Ye[t]),prompt:Et(t,n.prompt??e.config?.prompt??r.tools?.media?.[t]?.prompt,a)}}async function Yt(e){let t=await u({provider:e.providerId,cfg:e.cfg,profileId:e.entry.profile,preferredProfile:e.entry.preferredProfile,agentDir:e.agentDir});return{apiKeys:de({provider:e.providerId,primaryApiKey:s(t,e.providerId)}),providerConfig:e.cfg.models?.providers?.[e.providerId]}}async function Xt(e){let{apiKeys:t,providerConfig:n}=await Yt({providerId:e.providerId,cfg:e.cfg,entry:e.entry,agentDir:e.agentDir}),r=e.entry.baseUrl??e.config?.baseUrl??n?.baseUrl,i={...q(n?.headers),...q(e.config?.headers),...q(e.entry.headers)};return{apiKeys:t,baseUrl:r,headers:Object.keys(i).length>0?i:void 0}}function Zt(e){let t=Array.isArray(e.attachments)?e.attachments:[],n=t.length,r=t.filter(e=>e?.chosen?.outcome===`success`).length,i=t.find(e=>e?.chosen)?.chosen,a=typeof i?.provider==`string`?i.provider.trim():void 0,o=typeof i?.model==`string`?i.model.trim():void 0,s=a?o?`${a}/${o}`:a:void 0,c=t.flatMap(e=>(Array.isArray(e?.attempts)?e.attempts:[]).map(e=>typeof e?.reason==`string`?e.reason:void 0).filter(e=>!!e)).find(e=>e.trim().length>0),l=c?c.split(`:`)[0]?.trim():void 0,u=n>0?` (${r}/${n})`:``,d=s?` via ${s}`:``,f=l?` reason=${l}`:``;return`${e.capability}: ${e.outcome}${u}${d}${f}`}function Qt(e){if(!(e.size>=1024))throw new N(`tooSmall`,`Audio attachment ${e.attachmentIndex+1} is too small (${e.size} bytes, minimum 1024)`)}async function $t(e){let{entry:t,capability:n,cfg:r}=e,i=t.provider?.trim();if(!i)throw Error(`Provider entry missing provider for ${n}`);let a=U(i),{maxBytes:o,maxChars:s,timeoutMs:c,prompt:l}=Jt({capability:n,entry:t,cfg:r,config:e.config});if(n===`image`){if(!e.agentDir)throw Error(`Image understanding requires agentDir`);let n=t.model?.trim();if(!n)throw Error(`Image understanding requires model id`);let r=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),i=W(a,e.providerRegistry),u={buffer:r.buffer,fileName:r.fileName,mime:r.mime,model:n,provider:a,prompt:l,timeoutMs:c,profile:t.profile,preferredProfile:t.preferredProfile,agentDir:e.agentDir,cfg:e.cfg},d=await(i?.describeImage??S)(u);return{kind:`image.description`,attachmentIndex:e.attachmentIndex,text:J(d.text,s),provider:a,model:d.model??n}}let u=W(a,e.providerRegistry);if(!u)throw Error(`Media provider not available: ${a}`);let d=fe();if(n===`audio`){if(!u.transcribeAudio)throw Error(`Audio transcription provider "${a}" not available.`);let n=u.transcribeAudio,i=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c});Qt({size:i.size,attachmentIndex:e.attachmentIndex});let{apiKeys:f,baseUrl:p,headers:m}=await Xt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),h=qt({providerId:a,config:e.config,entry:t}),g=t.model?.trim()||Ze[a]||t.model,_=await le({provider:a,apiKeys:f,execute:async a=>n({buffer:i.buffer,fileName:i.fileName,mime:i.mime,apiKey:a,baseUrl:p,headers:m,model:g,language:t.language??e.config?.language??r.tools?.media?.audio?.language,prompt:l,query:h,timeoutMs:c,fetchFn:d})});return{kind:`audio.transcription`,attachmentIndex:e.attachmentIndex,text:J(_.text,s),provider:a,model:_.model??g}}if(!u.describeVideo)throw Error(`Video understanding provider "${a}" not available.`);let f=u.describeVideo,p=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),m=Ft(p.size),h=It(o);if(m>h)throw new N(`maxBytes`,`Video attachment ${e.attachmentIndex+1} base64 payload ${m} exceeds ${h}`);let{apiKeys:g,baseUrl:_,headers:v}=await Xt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),y=await le({provider:a,apiKeys:g,execute:e=>f({buffer:p.buffer,fileName:p.fileName,mime:p.mime,apiKey:e,baseUrl:_,headers:v,model:t.model,prompt:l,timeoutMs:c,fetchFn:d})});return{kind:`video.description`,attachmentIndex:e.attachmentIndex,text:J(y.text,s),provider:a,model:y.model??t.model}}async function en(r){let{entry:i,capability:a,cfg:o,ctx:s}=r,c=i.command?.trim(),l=i.args??[];if(!c)throw Error(`CLI entry missing command for ${a}`);let{maxBytes:u,maxChars:d,timeoutMs:f,prompt:p}=Jt({capability:a,entry:i,cfg:o,config:r.config}),h=await r.cache.getPath({attachmentIndex:r.attachmentIndex,maxBytes:u,timeoutMs:f});a===`audio`&&Qt({size:(await T.stat(h.path)).size,attachmentIndex:r.attachmentIndex});let g=await T.mkdtemp(w.join(e(),`openclaw-media-cli-`)),_=h.path,v=w.join(g,w.parse(_).name),y={...s,MediaPath:_,MediaDir:w.dirname(_),OutputDir:g,OutputBase:v,Prompt:p,MaxChars:d},b=[c,...l].map((e,t)=>t===0?e:Pt(e,y));try{n()&&t(`Media understanding via CLI: ${b.join(` `)}`);let{stdout:e}=await m(b[0],b.slice(1),{timeoutMs:f,maxBuffer:tt}),i=J(await Ut({command:c,args:b.slice(1),stdout:e,mediaPath:_}),d);return i?{kind:a===`audio`?`audio.transcription`:`${a}.description`,attachmentIndex:r.attachmentIndex,text:i,provider:`cli`,model:c}:null}finally{await T.rm(g,{recursive:!0,force:!0}).catch(()=>{})}}function Z(e){return St(e)}function Q(e){return ve(e)}function tn(e){return i(x(),o({cfg:e.cfg,accountId:e.ctx.AccountId}))}function nn(e,t){return new Ke(e,t)}const rn=new Map,an=new Map;function on(e){if(!e.startsWith(`~`))return e;let t=me.homedir();return e===`~`?t:e.startsWith(`~/`)?w.join(t,e.slice(2)):e}function sn(e){return e.includes(`/`)||e.includes(`\\`)}function cn(e){if(process.platform!==`win32`||w.extname(e))return[e];let t=(process.env.PATHEXT??`.EXE;.CMD;.BAT;.COM`).split(`;`).map(e=>e.trim()).filter(Boolean).map(e=>e.startsWith(`.`)?e:`.${e}`);return[e,...Array.from(new Set(t)).map(t=>`${e}${t}`)]}async function ln(e){try{return(await T.stat(e)).isFile()?(process.platform===`win32`||await T.access(e,he.X_OK),!0):!1}catch{return!1}}async function un(e){let t=rn.get(e);if(t)return t;let n=(async()=>{let t=on(e.trim());if(t&&sn(t)){for(let e of cn(t))if(await ln(e))return e}let n=e.trim();if(!n)return null;let r=(process.env.PATH??``).split(w.delimiter),i=cn(n);for(let e of r){let t=on(e.trim().replace(/^"(.*)"$/,`$1`));if(t)for(let e of i){let n=w.join(t,e);if(await ln(n))return n}}return null})();return rn.set(e,n),n}async function $(e){return!!await un(e)}async function dn(){let e=an.get(`gemini`);if(e)return e;let t=(async()=>{if(!await $(`gemini`))return!1;try{let{stdout:e}=await m(`gemini`,[`--output-format`,`json`,`ok`],{timeoutMs:8e3});return!!(rt(e)??e.toLowerCase().includes(`ok`))}catch{return!1}})();return an.set(`gemini`,t),t}async function fn(){if(!await $(`whisper-cli`))return null;let e=process.env.WHISPER_CPP_MODEL?.trim(),t=e&&await V(e)?e:`/opt/homebrew/share/whisper-cpp/for-tests-ggml-tiny.bin`;return await V(t)?{type:`cli`,command:`whisper-cli`,args:[`-m`,t,`-otxt`,`-of`,`{{OutputBase}}`,`-np`,`-nt`,`{{MediaPath}}`]}:null}async function pn(){return await $(`whisper`)?{type:`cli`,command:`whisper`,args:[`--model`,`turbo`,`--output_format`,`txt`,`--output_dir`,`{{OutputDir}}`,`--verbose`,`False`,`{{MediaPath}}`]}:null}async function mn(){if(!await $(`sherpa-onnx-offline`))return null;let e=process.env.SHERPA_ONNX_MODEL_DIR?.trim();if(!e)return null;let t=w.join(e,`tokens.txt`),n=w.join(e,`encoder.onnx`),r=w.join(e,`decoder.onnx`),i=w.join(e,`joiner.onnx`);return!await V(t)||!await V(n)||!await V(r)||!await V(i)?null:{type:`cli`,command:`sherpa-onnx-offline`,args:[`--tokens=${t}`,`--encoder=${n}`,`--decoder=${r}`,`--joiner=${i}`,`{{MediaPath}}`]}}async function hn(){return await mn()||await fn()||await pn()}async function gn(e){return await dn()?{type:`cli`,command:`gemini`,args:[`--output-format`,`json`,`--allowed-tools`,`read_many_files`,`--include-directories`,`{{MediaDir}}`,`{{Prompt}}`,`Use read_many_files to read {{MediaPath}} and respond with only the text output.`]}:null}async function _n(e){let{cfg:t,agentDir:n,providerRegistry:r,capability:i}=e,a=async(e,a)=>{let o=W(e,r);if(!o||i===`audio`&&!o.transcribeAudio||i===`image`&&!o.describeImage||i===`video`&&!o.describeVideo)return null;try{return await u({provider:e,cfg:t,agentDir:n}),{type:`provider`,provider:e,model:a}}catch{return null}};if(i===`image`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of $e){let t=B[e],n=await a(e,t);if(n)return n}return null}if(i===`video`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of et){let t=await a(e,void 0);if(t)return t}return null}let o=e.activeModel?.provider?.trim();if(o){let t=await a(o,e.activeModel?.model);if(t)return t}for(let e of Qe){let t=await a(e,void 0);if(t)return t}return null}function vn(e){let t=[],n=f(e.agents?.defaults?.imageModel);n?.trim()&&t.push(n.trim());for(let n of d(e.agents?.defaults?.imageModel))n?.trim()&&t.push(n.trim());if(t.length===0)return[];let r=[];for(let e of t){let t=e.indexOf(`/`);t<=0||t>=e.length-1||r.push({type:`provider`,provider:e.slice(0,t),model:e.slice(t+1)})}return r}async function yn(e){let t=await xn(e);if(t)return[t];if(e.capability===`audio`){let e=await hn();if(e)return[e]}if(e.capability===`image`){let t=vn(e.cfg);if(t.length>0)return t}let n=await gn(e.capability);if(n)return[n];let r=await _n(e);return r?[r]:[]}async function bn(e){let t=Z(),n=e=>{if(!e||e.type===`cli`)return null;let t=e.provider;if(!t)return null;let n=e.model??B[t];return n?{provider:t,model:n}:null};return n(await xn({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))||n(await _n({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))}async function xn(e){let t=e.activeModel?.provider?.trim();if(!t)return null;let n=U(t);if(!n)return null;let r=W(n,e.providerRegistry);if(!r||e.capability===`audio`&&!r.transcribeAudio||e.capability===`image`&&!r.describeImage||e.capability===`video`&&!r.describeVideo)return null;try{await u({provider:n,cfg:e.cfg,agentDir:e.agentDir})}catch{return null}return{type:`provider`,provider:n,model:e.activeModel?.model}}async function Sn(e){let{entries:r,capability:i}=e,a=[];for(let o of r){let r=o.type??(o.command?`cli`:`provider`);try{let t=r===`cli`?await en({capability:i,entry:o,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,config:e.config}):await $t({capability:i,entry:o,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,agentDir:e.agentDir,providerRegistry:e.providerRegistry,config:e.config});if(t){let e=X({entry:o,entryType:r,outcome:`success`});return t.provider&&(e.provider=t.provider),t.model&&(e.model=t.model),a.push(e),{output:t,attempts:a}}a.push(X({entry:o,entryType:r,outcome:`skipped`,reason:`empty output`}))}catch(e){if(Ve(e)){a.push(X({entry:o,entryType:r,outcome:`skipped`,reason:`${e.reason}: ${e.message}`})),n()&&t(`Skipping ${i} model due to ${e.reason}: ${e.message}`);continue}a.push(X({entry:o,entryType:r,outcome:`failed`,reason:String(e)})),n()&&t(`${i} understanding failed: ${String(e)}`)}}return{output:null,attempts:a}}async function Cn(e){let{capability:r,cfg:i,ctx:a}=e,o=e.config??i.tools?.media?.[r];if(o?.enabled===!1)return{outputs:[],decision:{capability:r,outcome:`disabled`,attachments:[]}};let s=o?.attachments,c=Se({capability:r,attachments:e.media,policy:s});if(c.length===0)return{outputs:[],decision:{capability:r,outcome:`no-attachment`,attachments:[]}};if(kt({scope:o?.scope,ctx:a})===`deny`)return n()&&t(`${r} understanding disabled by scope policy.`),{outputs:[],decision:{capability:r,outcome:`scope-deny`,attachments:c.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let l=e.activeModel?.provider?.trim();if(r===`image`&&l&&re(ie(await ne({config:i}),l,e.activeModel?.model??``))){n()&&t(`Skipping image understanding: primary model supports vision natively`);let i=e.activeModel?.model?.trim();return{outputs:[],decision:{capability:r,outcome:`skipped`,attachments:c.map(e=>{let t={type:`provider`,provider:l,model:i||void 0,outcome:`skipped`,reason:`primary model supports vision natively`};return{attachmentIndex:e.index,attempts:[t],chosen:t}})}}}let u=jt({cfg:i,capability:r,config:o,providerRegistry:e.providerRegistry});if(u.length===0&&(u=await yn({cfg:i,agentDir:e.agentDir,providerRegistry:e.providerRegistry,capability:r,activeModel:e.activeModel})),u.length===0)return{outputs:[],decision:{capability:r,outcome:`skipped`,attachments:c.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let d=[],f=[];for(let t of c){let{output:n,attempts:s}=await Sn({capability:r,cfg:i,ctx:a,attachmentIndex:t.index,agentDir:e.agentDir,providerRegistry:e.providerRegistry,cache:e.attachments,entries:u,config:o});n&&d.push(n),f.push({attachmentIndex:t.index,attempts:s,chosen:s.find(e=>e.outcome===`success`)})}let p={capability:r,outcome:d.length>0?`success`:`skipped`,attachments:f};return n()&&t(`Media understanding ${Zt(p)}`),{outputs:d,decision:p}}async function wn(e){let t=e.attachments??Q(e.ctx);if(t.length===0)return{transcript:void 0,attachments:t};let n=Z(e.providers),r=nn(t,e.localPathRoots?{localPathRoots:e.localPathRoots}:void 0);try{return{transcript:(await Cn({capability:`audio`,cfg:e.cfg,ctx:e.ctx,attachments:r,media:t,agentDir:e.agentDir,providerRegistry:n,config:e.cfg.tools?.media?.audio,activeModel:e.activeModel})).outputs.find(e=>e.kind===`audio.transcription`)?.text?.trim()||void 0,attachments:t}}finally{await r.cleanup()}}export{E as S,Le as _,bn as a,_e as b,Pt as c,K as d,wt as f,M as g,B as h,Q as i,Mt as l,tt as m,Z as n,tn as o,$e as p,nn as r,Cn as s,wn as t,Tt as u,Fe as v,ve as x,D as y};

package/dist/audio-transcription-runner-C_31Yoq0.js

@@ -1,4 +1,4 @@
 import{f as e,g as t,m as n,nt as r,rt as i,u as a}from"./paths-CrCoPIVK.js";import{E as o,d as s,m as c,t as l}from"./subsystem-Bc2XrjUz.js";import{Hs as u,Ka as d,Kr as f,Za as p,b as m,c as h,co as g,do as _,g as v,lo as y,uo as b,x}from"./model-selection-qkByRv5A.js";import{D as ee,t as S}from"./image-BKPxWO_2.js";import{a as C,n as te,t as ne}from"./fetch-xT2jRpqs.js";import{n as re}from"./fetch-timeout-DoOI_izT.js";import{t as ie}from"./fetch-guard-ChVqc0HF.js";import{n as w,r as ae,t as oe}from"./api-key-rotation-dNu0GxPN.js";import{r as se}from"./proxy-fetch-BZ9O8Dvj.js";import T from"node:fs/promises";import ce from"node:os";import E from"node:path";import{constants as le}from"node:fs";import{fileURLToPath as ue}from"node:url";import de from"node:crypto";import"node:process";const fe=l(`model-catalog`);let D=null,pe=!1,me=()=>import(`./pi-model-discovery-BzqdozHB.js`).then(e=>e.r);const he=`openai-codex`,O=`openai`,ge=new Set([`kilocode`]),_e=[{provider:O,id:`gpt-5.4`,templateIds:[`gpt-5.2`]},{provider:O,id:`gpt-5.4-pro`,templateIds:[`gpt-5.2-pro`,`gpt-5.2`]},{provider:he,id:`gpt-5.4`,templateIds:[`gpt-5.3-codex`,`gpt-5.2-codex`]},{provider:he,id:`gpt-5.3-codex-spark`,templateIds:[`gpt-5.3-codex`]}];function ve(e){let t=(t,n)=>e.find(e=>e.provider.toLowerCase()===t.toLowerCase()&&e.id.toLowerCase()===n.toLowerCase());for(let n of _e){if(t(n.provider,n.id))continue;let r=n.templateIds.map(e=>t(n.provider,e)).find(e=>e!==void 0);r&&e.push({...r,id:n.id,name:n.id})}}function ye(e){if(!Array.isArray(e))return;let t=e.filter(e=>e===`text`||e===`image`||e===`document`);return t.length>0?t:void 0}function be(e){let t=e.models?.providers;if(!t||typeof t!=`object`)return[];let n=[];for(let[e,r]of Object.entries(t)){let t=e.toLowerCase().trim();if(!ge.has(t)||!r||typeof r!=`object`)continue;let i=r.models;if(Array.isArray(i))for(let e of i){if(!e||typeof e!=`object`)continue;let r=e.id;if(typeof r!=`string`)continue;let i=r.trim();if(!i)continue;let a=e.name,o=(typeof a==`string`?a:i).trim()||i,s=e.contextWindow,c=typeof s==`number`&&s>0?s:void 0,l=e.reasoning,u=typeof l==`boolean`?l:void 0,d=ye(e.input);n.push({id:i,name:o,provider:t,contextWindow:c,reasoning:u,input:d})}}return n}function xe(e){let t=be(e.config);if(t.length===0)return;let n=new Set(e.models.map(e=>`${e.provider.toLowerCase().trim()}::${e.id.toLowerCase().trim()}`));for(let r of t){let t=`${r.provider.toLowerCase().trim()}::${r.id.toLowerCase().trim()}`;n.has(t)||(e.models.push(r),n.add(t))}}async function Se(e){return e?.useCache===!1&&(D=null),D||(D=(async()=>{let t=[],n=e=>e.sort((e,t)=>{let n=e.provider.localeCompare(t.provider);return n===0?e.name.localeCompare(t.name):n});try{let r=e?.config??p();await ee(r);let i=await me(),a=u(),{join:o}=await import(`node:path`),s=i.discoverAuthStorage(a),c=new i.ModelRegistry(s,o(a,`models.json`)),l=Array.isArray(c)?c:c.getAll();for(let e of l){let n=String(e?.id??``).trim();if(!n)continue;let r=String(e?.provider??``).trim();if(!r)continue;let i=String(e?.name??n).trim()||n,a=typeof e?.contextWindow==`number`&&e.contextWindow>0?e.contextWindow:void 0,o=typeof e?.reasoning==`boolean`?e.reasoning:void 0,s=Array.isArray(e?.input)?e.input:void 0;t.push({id:n,name:i,provider:r,contextWindow:a,reasoning:o,input:s})}return xe({config:r,models:t}),ve(t),t.length===0&&(D=null),n(t)}catch(e){return pe||(pe=!0,fe.warn(`Failed to load model catalog: ${String(e)}`)),D=null,t.length>0?n(t):[]}})(),D)}function Ce(e){return e?.input?.includes(`image`)??!1}function we(e,t,n){let r=t.toLowerCase().trim(),i=n.toLowerCase().trim();return e.find(e=>e.provider.toLowerCase()===r&&e.id.toLowerCase()===i)}function Te(e){let t=e?.trim();if(t){if(t.startsWith(`file://`))try{return ue(t)}catch{return}return t}}function k(e){let t=Array.isArray(e.MediaPaths)?e.MediaPaths:void 0,n=Array.isArray(e.MediaUrls)?e.MediaUrls:void 0,r=Array.isArray(e.MediaTypes)?e.MediaTypes:void 0,i=(t,n)=>{let i=r?.[n];return(typeof i==`string`?i.trim():``)||(t===1?e.MediaType:void 0)};if(t&&t.length>0){let r=t.length,a=n&&n.length>0?n:void 0;return t.map((t,n)=>({path:t?.trim()||void 0,url:a?.[n]??e.MediaUrl,mime:i(r,n),index:n})).filter(e=>!!(e.path?.trim()||e.url?.trim()))}if(n&&n.length>0){let e=n.length;return n.map((t,n)=>({path:void 0,url:t?.trim()||void 0,mime:i(e,n),index:n})).filter(e=>!!e.url?.trim())}let a=e.MediaPath?.trim(),o=e.MediaUrl?.trim();return!a&&!o?[]:[{path:a||void 0,url:o||void 0,mime:e.MediaType,index:0}]}function A(r){let i=t(r.mime);if(i===`image`||i===`audio`||i===`video`)return i;let a=e(r.path??r.url);return a?[`.mp4`,`.mov`,`.mkv`,`.webm`,`.avi`,`.m4v`].includes(a)?`video`:n(r.path??r.url)?`audio`:[`.png`,`.jpg`,`.jpeg`,`.webp`,`.gif`,`.bmp`,`.tiff`,`.tif`].includes(a)?`image`:`unknown`:`unknown`}function Ee(e){return A(e)===`video`}function De(e){return A(e)===`audio`}function Oe(e){return A(e)===`image`}function ke(e,t){let n=Array.isArray(e)?e.filter(Ae):[];if(!t||t===`first`)return n;if(t===`last`)return[...n].toReversed();if(t===`path`){let e=n.filter(e=>e.path),t=n.filter(e=>!e.path);return[...e,...t]}if(t===`url`){let e=n.filter(e=>e.url),t=n.filter(e=>!e.url);return[...e,...t]}return n}function Ae(e){if(!e||typeof e!=`object`)return!1;let t=e;return!(typeof t.index!=`number`||t.path!==void 0&&typeof t.path!=`string`||t.url!==void 0&&typeof t.url!=`string`||t.mime!==void 0&&typeof t.mime!=`string`||t.alreadyTranscribed!==void 0&&typeof t.alreadyTranscribed!=`boolean`)}function je(e){let{capability:t,attachments:n,policy:r}=e,i=(Array.isArray(n)?n.filter(Ae):[]).filter(e=>t===`audio`&&e.alreadyTranscribed?!1:t===`image`?Oe(e):t===`audio`?De(e):Ee(e));if(i.length===0)return[];let a=ke(i,r?.prefer),o=r?.mode??`first`,s=r?.maxAttachments??1;return o===`all`?a.slice(0,Math.max(1,s)):a.slice(0,1)}const Me=new Set;function Ne(e){return!e||typeof e!=`object`?!1:(`name`in e?String(e.name):``)===`AbortError`||(`message`in e&&typeof e.message==`string`?e.message:``)===`This operation was aborted`}function Pe(e){return Me.add(e),()=>{Me.delete(e)}}function Fe(e){return e.replace(/[^a-zA-Z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``)||`tmp`}function Ie(e){if(!e)return``;let t=((e.startsWith(`.`)?e:`.${e}`).match(/[a-zA-Z0-9._-]+$/)?.[0]??``).replace(/^[._-]+/,``);return t?`.${t}`:``}function Le(e){return e??o()}function Re(e){let t=Fe(e.prefix),n=Ie(e.extension),r=e.now,i=typeof r==`number`&&Number.isFinite(r)?Math.trunc(r):Date.now(),a=e.uuid?.trim()||de.randomUUID();return E.join(Le(e.tmpDir),`${t}-${i}-${a}${n}`)}var j=class extends Error{constructor(e,t){super(t),this.reason=e,this.name=`MediaUnderstandingSkipError`}};function ze(e){return e instanceof j}function M(e,t){return(e?.trim()||t).replace(/\/+$/,``)}async function N(e,t,n,r,i){return await ie({url:e,fetchImpl:r,init:t,timeoutMs:n,policy:i?.ssrfPolicy,lookupFn:i?.lookupFn,pinDns:i?.pinDns})}async function Be(e){return N(e.url,{method:`POST`,headers:e.headers,body:e.body},e.timeoutMs,e.fetchFn,e.allowPrivateNetwork?{ssrfPolicy:{allowPrivateNetwork:!0}}:void 0)}async function Ve(e){return N(e.url,{method:`POST`,headers:e.headers,body:JSON.stringify(e.body)},e.timeoutMs,e.fetchFn,e.allowPrivateNetwork?{ssrfPolicy:{allowPrivateNetwork:!0}}:void 0)}async function He(e){try{let t=(await e.text()).replace(/\s+/g,` `).trim();return t?t.length<=300?t:`${t.slice(0,300)}…`:void 0}catch{return}}async function P(e,t){if(e.ok)return;let n=await He(e),r=n?`: ${n}`:``;throw Error(`${t} (HTTP ${e.status})${r}`)}function F(e,t){let n=e?.trim();if(!n)throw Error(t);return n}const Ue=b(C(),g);function We(e){return typeof e==`string`?e:e instanceof URL?e.toString():e.url}var Ge=class{constructor(e,t){this.entries=new Map,this.attachments=e,this.localPathRoots=b(t?.localPathRoots,Ue);for(let t of e)this.entries.set(t.index,{attachment:t})}async getBuffer(e){let t=await this.ensureEntry(e.attachmentIndex);if(t.buffer){if(t.buffer.length>e.maxBytes)throw new j(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);return{buffer:t.buffer,mime:t.bufferMime,fileName:t.bufferFileName??`media-${e.attachmentIndex+1}`,size:t.buffer.length}}if(t.resolvedPath){let n=await this.ensureLocalStat(t);if(t.resolvedPath){if(n!==void 0&&n>e.maxBytes)throw new j(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);let r=await T.readFile(t.resolvedPath);return t.buffer=r,t.bufferMime=t.bufferMime??t.attachment.mime??await a({buffer:r,filePath:t.resolvedPath}),t.bufferFileName=E.basename(t.resolvedPath)||`media-${e.attachmentIndex+1}`,{buffer:r,mime:t.bufferMime,fileName:t.bufferFileName,size:r.length}}}let n=t.attachment.url?.trim();if(!n)throw new j(`empty`,`Attachment ${e.attachmentIndex+1} has no path or URL.`);try{let r=await te({url:n,fetchImpl:(t,n)=>re(We(t),n??{},e.timeoutMs,fetch),maxBytes:e.maxBytes});return t.buffer=r.buffer,t.bufferMime=t.attachment.mime??r.contentType??await a({buffer:r.buffer,filePath:r.fileName??n}),t.bufferFileName=r.fileName??`media-${e.attachmentIndex+1}`,{buffer:r.buffer,mime:t.bufferMime,fileName:t.bufferFileName,size:r.buffer.length}}catch(t){throw t instanceof ne&&t.code===`max_bytes`?new j(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`):Ne(t)?new j(`timeout`,`Attachment ${e.attachmentIndex+1} timed out while fetching.`):t}}async getPath(e){let t=await this.ensureEntry(e.attachmentIndex);if(t.resolvedPath){if(e.maxBytes){let n=await this.ensureLocalStat(t);if(t.resolvedPath&&n!==void 0&&n>e.maxBytes)throw new j(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`)}if(t.resolvedPath)return{path:t.resolvedPath}}if(t.tempPath){if(e.maxBytes&&t.buffer&&t.buffer.length>e.maxBytes)throw new j(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);return{path:t.tempPath,cleanup:t.tempCleanup}}let n=e.maxBytes??1/0,r=await this.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:n,timeoutMs:e.timeoutMs}),i=Re({prefix:`openclaw-media`,extension:E.extname(r.fileName||``)||``});return await T.writeFile(i,r.buffer),t.tempPath=i,t.tempCleanup=async()=>{await T.unlink(i).catch(()=>{})},{path:i,cleanup:t.tempCleanup}}async cleanup(){let e=[];for(let t of this.entries.values())t.tempCleanup&&=(e.push(Promise.resolve(t.tempCleanup())),void 0);await Promise.all(e)}async ensureEntry(e){let t=this.entries.get(e);if(t)return t.resolvedPath||=this.resolveLocalPath(t.attachment),t;let n=this.attachments.find(t=>t.index===e)??{index:e},r={attachment:n,resolvedPath:this.resolveLocalPath(n)};return this.entries.set(e,r),r}resolveLocalPath(e){let t=Te(e.path);if(t)return E.isAbsolute(t)?t:E.resolve(t)}async ensureLocalStat(e){if(e.resolvedPath){if(!y({filePath:e.resolvedPath,roots:this.localPathRoots})){e.resolvedPath=void 0,c()&&s(`Blocked attachment path outside allowed roots: ${e.attachment.path??e.attachment.url??`(unknown)`}`);return}if(e.statSize!==void 0)return e.statSize;try{let t=e.resolvedPath,n=await T.stat(t);if(!n.isFile()){e.resolvedPath=void 0;return}let r=await T.realpath(t).catch(()=>t);if(!y({filePath:r,roots:await this.getCanonicalLocalPathRoots()})){e.resolvedPath=void 0,c()&&s(`Blocked canonicalized attachment path outside allowed roots: ${r}`);return}return e.resolvedPath=r,e.statSize=n.size,n.size}catch(t){e.resolvedPath=void 0,c()&&s(`Failed to read attachment ${e.attachment.index+1}: ${String(t)}`);return}}}async getCanonicalLocalPathRoots(){return this.canonicalLocalPathRoots||=(async()=>b(this.localPathRoots,await Promise.all(this.localPathRoots.map(async e=>e.includes(`*`)?e:await T.realpath(e).catch(()=>e)))))(),await this.canonicalLocalPathRoots}};const I=1024*1024,Ke={image:500,audio:void 0,video:500},qe={image:10*I,audio:20*I,video:50*I},Je={image:60,audio:60,video:120},Ye={image:`Describe the image.`,audio:`Transcribe the audio.`,video:`Describe the video.`};70*I;const Xe={groq:`whisper-large-v3-turbo`,openai:`gpt-4o-mini-transcribe`,deepgram:`nova-3`,mistral:`voxtral-mini-latest`},Ze=[`openai`,`groq`,`deepgram`,`google`,`mistral`],L=[`openai`,`anthropic`,`google`,`minimax`,`minimax-portal`,`zai`],Qe=[`google`,`moonshot`],R={openai:`gpt-5-mini`,anthropic:`claude-opus-4-6`,google:`gemini-3-flash-preview`,minimax:`MiniMax-VL-01`,"minimax-portal":`MiniMax-VL-01`,zai:`glm-4.6v`},z=5*I;async function B(e){if(!e)return!1;try{return await T.stat(e),!0}catch{return!1}}function $e(e){let t=e.trim(),n=t.lastIndexOf(`{`);if(n===-1)return null;let r=t.slice(n);try{return JSON.parse(r)}catch{return null}}function V(e){let t=$e(e);if(!t||typeof t!=`object`)return null;let n=t.response;return typeof n==`string`&&n.trim()||null}const et={id:`anthropic`,capabilities:[`image`],describeImage:S};function tt(e){return e?.trim()||`nova-3`}async function nt(e){let t=e.fetchFn??fetch,n=M(e.baseUrl,`https://api.deepgram.com/v1`),r=!!e.baseUrl?.trim(),i=tt(e.model),a=new URL(`${n}/listen`);if(a.searchParams.set(`model`,i),e.language?.trim()&&a.searchParams.set(`language`,e.language.trim()),e.query)for(let[t,n]of Object.entries(e.query))n!==void 0&&a.searchParams.set(t,String(n));let o=new Headers(e.headers);o.has(`authorization`)||o.set(`authorization`,`Token ${e.apiKey}`),o.has(`content-type`)||o.set(`content-type`,e.mime??`application/octet-stream`);let s=new Uint8Array(e.buffer),{response:c,release:l}=await Be({url:a.toString(),headers:o,body:s,timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{return await P(c,`Audio transcription failed`),{text:F((await c.json()).results?.channels?.[0]?.alternatives?.[0]?.transcript,`Audio transcription response missing transcript`),model:i}}finally{await l()}}const rt={id:`deepgram`,capabilities:[`audio`],transcribeAudio:nt};async function H(e){let t=e.fetchFn??fetch,n=M(e.baseUrl,e.defaultBaseUrl),r=!!e.baseUrl?.trim(),i=(()=>{let t=e.model?.trim();return t?v(t):e.defaultModel})(),a=`${n}/models/${i}:generateContent`,o=ae(e.apiKey),s=new Headers(e.headers);for(let[e,t]of Object.entries(o.headers))s.has(e)||s.set(e,t);let{response:c,release:l}=await Ve({url:a,headers:s,body:{contents:[{role:`user`,parts:[{text:e.prompt?.trim()||e.defaultPrompt},{inline_data:{mime_type:e.mime??e.defaultMime,data:e.buffer.toString(`base64`)}}]}]},timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{await P(c,e.httpErrorLabel);let t=((await c.json()).candidates?.[0]?.content?.parts??[]).map(e=>e?.text?.trim()).filter(Boolean).join(`
 `);if(!t)throw Error(e.missingTextError);return{text:t,model:i}}finally{await l()}}async function it(e){let{text:t,model:n}=await H({...e,defaultBaseUrl:`https://generativelanguage.googleapis.com/v1beta`,defaultModel:`gemini-3-flash-preview`,defaultPrompt:`Transcribe the audio.`,defaultMime:`audio/wav`,httpErrorLabel:`Audio transcription failed`,missingTextError:`Audio transcription response missing text`});return{text:t,model:n}}async function at(e){let{text:t,model:n}=await H({...e,defaultBaseUrl:`https://generativelanguage.googleapis.com/v1beta`,defaultModel:`gemini-3-flash-preview`,defaultPrompt:`Describe the video.`,defaultMime:`video/mp4`,httpErrorLabel:`Video description failed`,missingTextError:`Video description response missing text`});return{text:t,model:n}}const ot={id:`google`,capabilities:[`image`,`audio`,`video`],describeImage:S,transcribeAudio:it,describeVideo:at};function st(e){return e?.trim()||`gpt-4o-mini-transcribe`}async function U(e){let t=e.fetchFn??fetch,n=M(e.baseUrl,`https://api.openai.com/v1`),r=!!e.baseUrl?.trim(),i=`${n}/audio/transcriptions`,a=st(e.model),o=new FormData,s=e.fileName?.trim()||E.basename(e.fileName)||`audio`,c=new Uint8Array(e.buffer),l=new Blob([c],{type:e.mime??`application/octet-stream`});o.append(`file`,l,s),o.append(`model`,a),e.language?.trim()&&o.append(`language`,e.language.trim()),e.prompt?.trim()&&o.append(`prompt`,e.prompt.trim());let u=new Headers(e.headers);u.has(`authorization`)||u.set(`authorization`,`Bearer ${e.apiKey}`);let{response:d,release:f}=await Be({url:i,headers:u,body:o,timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{return await P(d,`Audio transcription failed`),{text:F((await d.json()).text,`Audio transcription response missing text`),model:a}}finally{await f()}}const ct={id:`groq`,capabilities:[`audio`],transcribeAudio:e=>U({...e,baseUrl:e.baseUrl??`https://api.groq.com/openai/v1`})},lt={id:`minimax`,capabilities:[`image`],describeImage:S},ut={id:`minimax-portal`,capabilities:[`image`],describeImage:S},dt={id:`mistral`,capabilities:[`audio`],transcribeAudio:e=>U({...e,baseUrl:e.baseUrl??`https://api.mistral.ai/v1`})};function ft(e){return e?.trim()||`kimi-k2.5`}function pt(e){return e?.trim()||`Describe the video.`}function mt(e){let t=e.choices?.[0]?.message;if(!t)return null;if(typeof t.content==`string`&&t.content.trim())return t.content.trim();if(Array.isArray(t.content)){let e=t.content.map(e=>typeof e.text==`string`?e.text.trim():``).filter(Boolean).join(`
 `).trim();if(e)return e}return typeof t.reasoning_content==`string`&&t.reasoning_content.trim()?t.reasoning_content.trim():null}async function ht(e){let t=e.fetchFn??fetch,n=M(e.baseUrl,`https://api.moonshot.ai/v1`),r=ft(e.model),i=e.mime??`video/mp4`,a=pt(e.prompt),o=`${n}/chat/completions`,s=new Headers(e.headers);s.has(`content-type`)||s.set(`content-type`,`application/json`),s.has(`authorization`)||s.set(`authorization`,`Bearer ${e.apiKey}`);let{response:c,release:l}=await Ve({url:o,headers:s,body:{model:r,messages:[{role:`user`,content:[{type:`text`,text:a},{type:`video_url`,video_url:{url:`data:${i};base64,${e.buffer.toString(`base64`)}`}}]}]},timeoutMs:e.timeoutMs,fetchFn:t});try{await P(c,`Moonshot video description failed`);let e=mt(await c.json());if(!e)throw Error(`Moonshot video description response missing content`);return{text:e,model:r}}finally{await l()}}const gt=[ct,{id:`openai`,capabilities:[`image`,`audio`],describeImage:S,transcribeAudio:U},ot,et,lt,ut,{id:`moonshot`,capabilities:[`image`,`video`],describeImage:S,describeVideo:ht},dt,{id:`zai`,capabilities:[`image`],describeImage:S},rt];function W(e){let t=h(e);return t===`gemini`?`google`:t}function _t(e){let t=new Map;for(let e of gt)t.set(W(e.id),e);if(e)for(let[n,r]of Object.entries(e)){let e=W(n),i=t.get(e),a=i?{...i,...r,capabilities:r.capabilities??i.capabilities}:r;t.set(e,a)}return t}function G(e,t){return t.get(W(e))}function vt(e){let t=e?.trim().toLowerCase();if(t===`allow`)return`allow`;if(t===`deny`)return`deny`}function K(e){return e?.trim().toLowerCase()||void 0}function q(e){return f(e??void 0)}function yt(e){let t=e.scope;if(!t)return`allow`;let n=K(e.channel),r=q(e.chatType),i=K(e.sessionKey)??``;for(let e of t.rules??[]){if(!e)continue;let t=vt(e.action)??`allow`,a=e.match??{},o=K(a.channel),s=q(a.chatType),c=K(a.keyPrefix);if(!(o&&o!==n)&&!(s&&s!==r)&&!(c&&!i.startsWith(c)))return t}return vt(t.default)??`allow`}function bt(e,t){let n=typeof e==`number`&&Number.isFinite(e)?e:t;return Math.max(1e3,Math.floor(n*1e3))}function xt(e,t,n){let r=t?.trim()||Ye[e];return!n||e===`audio`?r:`${r} Respond in at most ${n} characters.`}function St(e){let{capability:t,entry:n,cfg:r}=e,i=n.maxChars??e.config?.maxChars??r.tools?.media?.[t]?.maxChars;return typeof i==`number`?i:Ke[t]}function Ct(e){let t=e.entry.maxBytes??e.config?.maxBytes??e.cfg.tools?.media?.[e.capability]?.maxBytes;return typeof t==`number`?t:qe[e.capability]}function wt(e){return yt({scope:e.scope,sessionKey:e.ctx.SessionKey,channel:e.ctx.Surface??e.ctx.Provider,chatType:q(e.ctx.ChatType)})}function Tt(e){if((e.entry.type??(e.entry.command?`cli`:`provider`))===`cli`)return;let t=W(e.entry.provider??``);if(t)return e.providerRegistry.get(t)?.capabilities}function Et(e){let{cfg:t,capability:n,config:r}=e,i=t.tools?.media?.models??[],a=[...(r?.models??[]).map(e=>({entry:e,source:`capability`})),...i.map(e=>({entry:e,source:`shared`}))];return a.length===0?[]:a.filter(({entry:t,source:r})=>{let i=t.capabilities&&t.capabilities.length>0?t.capabilities:r===`shared`?Tt({entry:t,providerRegistry:e.providerRegistry}):void 0;return!i||i.length===0?r===`shared`?(c()&&s(`Skipping shared media model without capabilities: ${t.provider??t.command??`unknown`}`),!1):!0:i.includes(n)}).map(({entry:e})=>e)}function Dt(e){let t=e.tools?.media?.concurrency;return typeof t==`number`&&Number.isFinite(t)&&t>0?Math.floor(t):2}function Ot(e){return e==null?``:typeof e==`string`?e:typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`?String(e):typeof e==`symbol`||typeof e==`function`?e.toString():Array.isArray(e)?e.flatMap(e=>e==null?[]:typeof e==`string`?[e]:typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`?[String(e)]:[]).join(`,`):``}function kt(e,t){return e?e.replace(/{{\s*(\w+)\s*}}/g,(e,n)=>{let r=t[n];return Ot(r)}):``}function At(e){return Math.ceil(e/3)*4}function jt(e){let t=Math.floor(4/3*e);return Math.min(t,73400320)}function J(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Y(e,t){let n=e.trim();return!t||n.length<=t?n:n.slice(0,t).trim()}function Mt(e){let t=e=>{let n=e.trim();if(!n)return null;let r=n[0];if(r!==`{`&&r!==`"`)return null;try{let e=JSON.parse(n);if(typeof e==`string`)return t(e);if(e&&typeof e==`object`){let t=e.text;if(typeof t==`string`&&t.trim())return t.trim()}}catch{}return null},n=t(e);if(n)return n;let r=e.split(`
-`).map(e=>e.trim()).filter(Boolean);for(let e=r.length-1;e>=0;--e){let n=t(r[e]??``);if(n)return n}return null}function Nt(e){return E.parse(e).name}function X(e,t){for(let n=0;n<e.length;n+=1)if(t.includes(e[n]??``)){let t=e[n+1];if(t)return t}}function Pt(e,t){return e.some(e=>t.includes(e))}function Ft(e,t){let n=X(e,[`--output_dir`,`-o`]),r=X(e,[`--output_format`]);if(!n||!r||!r.split(`,`).map(e=>e.trim()).includes(`txt`))return null;let i=E.parse(t).name;return E.join(n,`${i}.txt`)}function It(e){if(!Pt(e,[`-otxt`,`--output-txt`]))return null;let t=X(e,[`-of`,`--output-file`]);return t?`${t}.txt`:null}function Lt(e,t){let n=X(e,[`--output-dir`]),r=X(e,[`--output-format`]);if(!n||r&&r!==`txt`)return null;let i=E.parse(t).name;return E.join(n,`${i}.txt`)}async function Rt(e){let t=Nt(e.command),n=t===`whisper-cli`?It(e.args):t===`whisper`?Ft(e.args,e.mediaPath):t===`parakeet-mlx`?Lt(e.args,e.mediaPath):null;if(n&&await B(n))try{let e=await T.readFile(n,`utf8`);if(e.trim())return e.trim()}catch{}if(t===`gemini`){let t=V(e.stdout);if(t)return t}if(t===`sherpa-onnx-offline`){let t=Mt(e.stdout);if(t)return t}return e.stdout.trim()}function zt(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Bt(e){if(!e)return;let t={};return typeof e.detectLanguage==`boolean`&&(t.detect_language=e.detectLanguage),typeof e.punctuate==`boolean`&&(t.punctuate=e.punctuate),typeof e.smartFormat==`boolean`&&(t.smart_format=e.smartFormat),Object.keys(t).length>0?t:void 0}function Vt(e){let t={...e};return`detectLanguage`in t&&(t.detect_language=t.detectLanguage,delete t.detectLanguage),`smartFormat`in t&&(t.smart_format=t.smartFormat,delete t.smartFormat),t}function Ht(e){let{providerId:t,config:n,entry:r}=e,i=zt({...n?.providerOptions?.[t],...r.providerOptions?.[t]});if(t!==`deepgram`)return i;let a=Vt(i??{}),o=Bt({...n?.deepgram,...r.deepgram});for(let[e,t]of Object.entries(o??{}))a[e]===void 0&&(a[e]=t);return Object.keys(a).length>0?a:void 0}function Z(e){if(e.entryType===`cli`){let t=e.entry.command?.trim();return{type:`cli`,provider:t??`cli`,model:e.entry.model??t,outcome:e.outcome,reason:e.reason}}let t=e.entry.provider?.trim();return{type:`provider`,provider:(t?W(t):void 0)??t,model:e.entry.model,outcome:e.outcome,reason:e.reason}}function Ut(e){let{capability:t,entry:n,cfg:r}=e,i=Ct({capability:t,entry:n,cfg:r,config:e.config}),a=St({capability:t,entry:n,cfg:r,config:e.config});return{maxBytes:i,maxChars:a,timeoutMs:bt(n.timeoutSeconds??e.config?.timeoutSeconds??r.tools?.media?.[t]?.timeoutSeconds,Je[t]),prompt:xt(t,n.prompt??e.config?.prompt??r.tools?.media?.[t]?.prompt,a)}}async function Wt(e){let t=await x({provider:e.providerId,cfg:e.cfg,profileId:e.entry.profile,preferredProfile:e.entry.preferredProfile,agentDir:e.agentDir});return{apiKeys:oe({provider:e.providerId,primaryApiKey:m(t,e.providerId)}),providerConfig:e.cfg.models?.providers?.[e.providerId]}}async function Gt(e){let{apiKeys:t,providerConfig:n}=await Wt({providerId:e.providerId,cfg:e.cfg,entry:e.entry,agentDir:e.agentDir}),r=e.entry.baseUrl??e.config?.baseUrl??n?.baseUrl,i={...J(n?.headers),...J(e.config?.headers),...J(e.entry.headers)};return{apiKeys:t,baseUrl:r,headers:Object.keys(i).length>0?i:void 0}}function Kt(e){let t=Array.isArray(e.attachments)?e.attachments:[],n=t.length,r=t.filter(e=>e?.chosen?.outcome===`success`).length,i=t.find(e=>e?.chosen)?.chosen,a=typeof i?.provider==`string`?i.provider.trim():void 0,o=typeof i?.model==`string`?i.model.trim():void 0,s=a?o?`${a}/${o}`:a:void 0,c=t.flatMap(e=>(Array.isArray(e?.attempts)?e.attempts:[]).map(e=>typeof e?.reason==`string`?e.reason:void 0).filter(e=>!!e)).find(e=>e.trim().length>0),l=c?c.split(`:`)[0]?.trim():void 0,u=n>0?` (${r}/${n})`:``,d=s?` via ${s}`:``,f=l?` reason=${l}`:``;return`${e.capability}: ${e.outcome}${u}${d}${f}`}function qt(e){if(!(e.size>=1024))throw new j(`tooSmall`,`Audio attachment ${e.attachmentIndex+1} is too small (${e.size} bytes, minimum 1024)`)}async function Jt(e){let{entry:t,capability:n,cfg:r}=e,i=t.provider?.trim();if(!i)throw Error(`Provider entry missing provider for ${n}`);let a=W(i),{maxBytes:o,maxChars:s,timeoutMs:c,prompt:l}=Ut({capability:n,entry:t,cfg:r,config:e.config});if(n===`image`){if(!e.agentDir)throw Error(`Image understanding requires agentDir`);let n=t.model?.trim();if(!n)throw Error(`Image understanding requires model id`);let r=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),i=G(a,e.providerRegistry),u={buffer:r.buffer,fileName:r.fileName,mime:r.mime,model:n,provider:a,prompt:l,timeoutMs:c,profile:t.profile,preferredProfile:t.preferredProfile,agentDir:e.agentDir,cfg:e.cfg},d=await(i?.describeImage??S)(u);return{kind:`image.description`,attachmentIndex:e.attachmentIndex,text:Y(d.text,s),provider:a,model:d.model??n}}let u=G(a,e.providerRegistry);if(!u)throw Error(`Media provider not available: ${a}`);let d=se();if(n===`audio`){if(!u.transcribeAudio)throw Error(`Audio transcription provider "${a}" not available.`);let n=u.transcribeAudio,i=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c});qt({size:i.size,attachmentIndex:e.attachmentIndex});let{apiKeys:f,baseUrl:p,headers:m}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),h=Ht({providerId:a,config:e.config,entry:t}),g=t.model?.trim()||Xe[a]||t.model,_=await w({provider:a,apiKeys:f,execute:async a=>n({buffer:i.buffer,fileName:i.fileName,mime:i.mime,apiKey:a,baseUrl:p,headers:m,model:g,language:t.language??e.config?.language??r.tools?.media?.audio?.language,prompt:l,query:h,timeoutMs:c,fetchFn:d})});return{kind:`audio.transcription`,attachmentIndex:e.attachmentIndex,text:Y(_.text,s),provider:a,model:_.model??g}}if(!u.describeVideo)throw Error(`Video understanding provider "${a}" not available.`);let f=u.describeVideo,p=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),m=At(p.size),h=jt(o);if(m>h)throw new j(`maxBytes`,`Video attachment ${e.attachmentIndex+1} base64 payload ${m} exceeds ${h}`);let{apiKeys:g,baseUrl:_,headers:v}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),y=await w({provider:a,apiKeys:g,execute:e=>f({buffer:p.buffer,fileName:p.fileName,mime:p.mime,apiKey:e,baseUrl:_,headers:v,model:t.model,prompt:l,timeoutMs:c,fetchFn:d})});return{kind:`video.description`,attachmentIndex:e.attachmentIndex,text:Y(y.text,s),provider:a,model:y.model??t.model}}async function Yt(e){let{entry:t,capability:n,cfg:r,ctx:i}=e,a=t.command?.trim(),l=t.args??[];if(!a)throw Error(`CLI entry missing command for ${n}`);let{maxBytes:u,maxChars:f,timeoutMs:p,prompt:m}=Ut({capability:n,entry:t,cfg:r,config:e.config}),h=await e.cache.getPath({attachmentIndex:e.attachmentIndex,maxBytes:u,timeoutMs:p});n===`audio`&&qt({size:(await T.stat(h.path)).size,attachmentIndex:e.attachmentIndex});let g=await T.mkdtemp(E.join(o(),`openclaw-media-cli-`)),_=h.path,v=E.join(g,E.parse(_).name),y={...i,MediaPath:_,MediaDir:E.dirname(_),OutputDir:g,OutputBase:v,Prompt:m,MaxChars:f},b=[a,...l].map((e,t)=>t===0?e:kt(e,y));try{c()&&s(`Media understanding via CLI: ${b.join(` `)}`);let{stdout:t}=await d(b[0],b.slice(1),{timeoutMs:p,maxBuffer:z}),r=Y(await Rt({command:a,args:b.slice(1),stdout:t,mediaPath:_}),f);return r?{kind:n===`audio`?`audio.transcription`:`${n}.description`,attachmentIndex:e.attachmentIndex,text:r,provider:`cli`,model:a}:null}finally{await T.rm(g,{recursive:!0,force:!0}).catch(()=>{})}}function Q(e){return _t(e)}function Xt(e){return k(e)}function Zt(e){return b(C(),_({cfg:e.cfg,accountId:e.ctx.AccountId}))}function Qt(e,t){return new Ge(e,t)}const $t=new Map,en=new Map;function tn(e){if(!e.startsWith(`~`))return e;let t=ce.homedir();return e===`~`?t:e.startsWith(`~/`)?E.join(t,e.slice(2)):e}function nn(e){return e.includes(`/`)||e.includes(`\\`)}function rn(e){if(process.platform!==`win32`||E.extname(e))return[e];let t=(process.env.PATHEXT??`.EXE;.CMD;.BAT;.COM`).split(`;`).map(e=>e.trim()).filter(Boolean).map(e=>e.startsWith(`.`)?e:`.${e}`);return[e,...Array.from(new Set(t)).map(t=>`${e}${t}`)]}async function an(e){try{return(await T.stat(e)).isFile()?(process.platform===`win32`||await T.access(e,le.X_OK),!0):!1}catch{return!1}}async function on(e){let t=$t.get(e);if(t)return t;let n=(async()=>{let t=tn(e.trim());if(t&&nn(t)){for(let e of rn(t))if(await an(e))return e}let n=e.trim();if(!n)return null;let r=(process.env.PATH??``).split(E.delimiter),i=rn(n);for(let e of r){let t=tn(e.trim().replace(/^"(.*)"$/,`$1`));if(t)for(let e of i){let n=E.join(t,e);if(await an(n))return n}}return null})();return $t.set(e,n),n}async function $(e){return!!await on(e)}async function sn(){let e=en.get(`gemini`);if(e)return e;let t=(async()=>{if(!await $(`gemini`))return!1;try{let{stdout:e}=await d(`gemini`,[`--output-format`,`json`,`ok`],{timeoutMs:8e3});return!!(V(e)??e.toLowerCase().includes(`ok`))}catch{return!1}})();return en.set(`gemini`,t),t}async function cn(){if(!await $(`whisper-cli`))return null;let e=process.env.WHISPER_CPP_MODEL?.trim(),t=e&&await B(e)?e:`/opt/homebrew/share/whisper-cpp/for-tests-ggml-tiny.bin`;return await B(t)?{type:`cli`,command:`whisper-cli`,args:[`-m`,t,`-otxt`,`-of`,`{{OutputBase}}`,`-np`,`-nt`,`{{MediaPath}}`]}:null}async function ln(){return await $(`whisper`)?{type:`cli`,command:`whisper`,args:[`--model`,`turbo`,`--output_format`,`txt`,`--output_dir`,`{{OutputDir}}`,`--verbose`,`False`,`{{MediaPath}}`]}:null}async function un(){if(!await $(`sherpa-onnx-offline`))return null;let e=process.env.SHERPA_ONNX_MODEL_DIR?.trim();if(!e)return null;let t=E.join(e,`tokens.txt`),n=E.join(e,`encoder.onnx`),r=E.join(e,`decoder.onnx`),i=E.join(e,`joiner.onnx`);return!await B(t)||!await B(n)||!await B(r)||!await B(i)?null:{type:`cli`,command:`sherpa-onnx-offline`,args:[`--tokens=${t}`,`--encoder=${n}`,`--decoder=${r}`,`--joiner=${i}`,`{{MediaPath}}`]}}async function dn(){return await un()||await cn()||await ln()}async function fn(e){return await sn()?{type:`cli`,command:`gemini`,args:[`--output-format`,`json`,`--allowed-tools`,`read_many_files`,`--include-directories`,`{{MediaDir}}`,`{{Prompt}}`,`Use read_many_files to read {{MediaPath}} and respond with only the text output.`]}:null}async function pn(e){let{cfg:t,agentDir:n,providerRegistry:r,capability:i}=e,a=async(e,a)=>{let o=G(e,r);if(!o||i===`audio`&&!o.transcribeAudio||i===`image`&&!o.describeImage||i===`video`&&!o.describeVideo)return null;try{return await x({provider:e,cfg:t,agentDir:n}),{type:`provider`,provider:e,model:a}}catch{return null}};if(i===`image`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of L){let t=R[e],n=await a(e,t);if(n)return n}return null}if(i===`video`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of Qe){let t=await a(e,void 0);if(t)return t}return null}let o=e.activeModel?.provider?.trim();if(o){let t=await a(o,e.activeModel?.model);if(t)return t}for(let e of Ze){let t=await a(e,void 0);if(t)return t}return null}function mn(e){let t=[],n=i(e.agents?.defaults?.imageModel);n?.trim()&&t.push(n.trim());for(let n of r(e.agents?.defaults?.imageModel))n?.trim()&&t.push(n.trim());if(t.length===0)return[];let a=[];for(let e of t){let t=e.indexOf(`/`);t<=0||t>=e.length-1||a.push({type:`provider`,provider:e.slice(0,t),model:e.slice(t+1)})}return a}async function hn(e){let t=await _n(e);if(t)return[t];if(e.capability===`audio`){let e=await dn();if(e)return[e]}if(e.capability===`image`){let t=mn(e.cfg);if(t.length>0)return t}let n=await fn(e.capability);if(n)return[n];let r=await pn(e);return r?[r]:[]}async function gn(e){let t=Q(),n=e=>{if(!e||e.type===`cli`)return null;let t=e.provider;if(!t)return null;let n=e.model??R[t];return n?{provider:t,model:n}:null};return n(await _n({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))||n(await pn({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))}async function _n(e){let t=e.activeModel?.provider?.trim();if(!t)return null;let n=W(t);if(!n)return null;let r=G(n,e.providerRegistry);if(!r||e.capability===`audio`&&!r.transcribeAudio||e.capability===`image`&&!r.describeImage||e.capability===`video`&&!r.describeVideo)return null;try{await x({provider:n,cfg:e.cfg,agentDir:e.agentDir})}catch{return null}return{type:`provider`,provider:n,model:e.activeModel?.model}}async function vn(e){let{entries:t,capability:n}=e,r=[];for(let i of t){let t=i.type??(i.command?`cli`:`provider`);try{let a=t===`cli`?await Yt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,config:e.config}):await Jt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,agentDir:e.agentDir,providerRegistry:e.providerRegistry,config:e.config});if(a){let e=Z({entry:i,entryType:t,outcome:`success`});return a.provider&&(e.provider=a.provider),a.model&&(e.model=a.model),r.push(e),{output:a,attempts:r}}r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`empty output`}))}catch(e){if(ze(e)){r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`${e.reason}: ${e.message}`})),c()&&s(`Skipping ${n} model due to ${e.reason}: ${e.message}`);continue}r.push(Z({entry:i,entryType:t,outcome:`failed`,reason:String(e)})),c()&&s(`${n} understanding failed: ${String(e)}`)}}return{output:null,attempts:r}}async function yn(e){let{capability:t,cfg:n,ctx:r}=e,i=e.config??n.tools?.media?.[t];if(i?.enabled===!1)return{outputs:[],decision:{capability:t,outcome:`disabled`,attachments:[]}};let a=i?.attachments,o=je({capability:t,attachments:e.media,policy:a});if(o.length===0)return{outputs:[],decision:{capability:t,outcome:`no-attachment`,attachments:[]}};if(wt({scope:i?.scope,ctx:r})===`deny`)return c()&&s(`${t} understanding disabled by scope policy.`),{outputs:[],decision:{capability:t,outcome:`scope-deny`,attachments:o.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let l=e.activeModel?.provider?.trim();if(t===`image`&&l&&Ce(we(await Se({config:n}),l,e.activeModel?.model??``))){c()&&s(`Skipping image understanding: primary model supports vision natively`);let n=e.activeModel?.model?.trim();return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:o.map(e=>{let t={type:`provider`,provider:l,model:n||void 0,outcome:`skipped`,reason:`primary model supports vision natively`};return{attachmentIndex:e.index,attempts:[t],chosen:t}})}}}let u=Et({cfg:n,capability:t,config:i,providerRegistry:e.providerRegistry});if(u.length===0&&(u=await hn({cfg:n,agentDir:e.agentDir,providerRegistry:e.providerRegistry,capability:t,activeModel:e.activeModel})),u.length===0)return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:o.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let d=[],f=[];for(let a of o){let{output:o,attempts:s}=await vn({capability:t,cfg:n,ctx:r,attachmentIndex:a.index,agentDir:e.agentDir,providerRegistry:e.providerRegistry,cache:e.attachments,entries:u,config:i});o&&d.push(o),f.push({attachmentIndex:a.index,attempts:s,chosen:s.find(e=>e.outcome===`success`)})}let p={capability:t,outcome:d.length>0?`success`:`skipped`,attachments:f};return c()&&s(`Media understanding ${Kt(p)}`),{outputs:d,decision:p}}async function bn(e){let t=e.attachments??Xt(e.ctx);if(t.length===0)return{transcript:void 0,attachments:t};let n=Q(e.providers),r=Qt(t,e.localPathRoots?{localPathRoots:e.localPathRoots}:void 0);try{return{transcript:(await yn({capability:`audio`,cfg:e.cfg,ctx:e.ctx,attachments:r,media:t,agentDir:e.agentDir,providerRegistry:n,config:e.cfg.tools?.media?.audio,activeModel:e.activeModel})).outputs.find(e=>e.kind===`audio.transcription`)?.text?.trim()||void 0,attachments:t}}finally{await r.cleanup()}}export{Se as C,we as S,Pe as _,gn as a,k as b,kt as c,q as d,yt as f,Re as g,R as h,Xt as i,Dt as l,z as m,Q as n,Zt as o,L as p,Qt as r,yn as s,bn as t,bt as u,De as v,Ce as w,A as x,Te as y};
+`).map(e=>e.trim()).filter(Boolean);for(let e=r.length-1;e>=0;--e){let n=t(r[e]??``);if(n)return n}return null}function Nt(e){return E.parse(e).name}function X(e,t){for(let n=0;n<e.length;n+=1)if(t.includes(e[n]??``)){let t=e[n+1];if(t)return t}}function Pt(e,t){return e.some(e=>t.includes(e))}function Ft(e,t){let n=X(e,[`--output_dir`,`-o`]),r=X(e,[`--output_format`]);if(!n||!r||!r.split(`,`).map(e=>e.trim()).includes(`txt`))return null;let i=E.parse(t).name;return E.join(n,`${i}.txt`)}function It(e){if(!Pt(e,[`-otxt`,`--output-txt`]))return null;let t=X(e,[`-of`,`--output-file`]);return t?`${t}.txt`:null}function Lt(e,t){let n=X(e,[`--output-dir`]),r=X(e,[`--output-format`]);if(!n||r&&r!==`txt`)return null;let i=E.parse(t).name;return E.join(n,`${i}.txt`)}async function Rt(e){let t=Nt(e.command),n=t===`whisper-cli`?It(e.args):t===`whisper`?Ft(e.args,e.mediaPath):t===`parakeet-mlx`?Lt(e.args,e.mediaPath):null;if(n&&await B(n))try{let e=await T.readFile(n,`utf8`);if(e.trim())return e.trim()}catch{}if(t===`gemini`){let t=V(e.stdout);if(t)return t}if(t===`sherpa-onnx-offline`){let t=Mt(e.stdout);if(t)return t}return e.stdout.trim()}function zt(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Bt(e){if(!e)return;let t={};return typeof e.detectLanguage==`boolean`&&(t.detect_language=e.detectLanguage),typeof e.punctuate==`boolean`&&(t.punctuate=e.punctuate),typeof e.smartFormat==`boolean`&&(t.smart_format=e.smartFormat),Object.keys(t).length>0?t:void 0}function Vt(e){let t={...e};return`detectLanguage`in t&&(t.detect_language=t.detectLanguage,delete t.detectLanguage),`smartFormat`in t&&(t.smart_format=t.smartFormat,delete t.smartFormat),t}function Ht(e){let{providerId:t,config:n,entry:r}=e,i=zt({...n?.providerOptions?.[t],...r.providerOptions?.[t]});if(t!==`deepgram`)return i;let a=Vt(i??{}),o=Bt({...n?.deepgram,...r.deepgram});for(let[e,t]of Object.entries(o??{}))a[e]===void 0&&(a[e]=t);return Object.keys(a).length>0?a:void 0}function Z(e){if(e.entryType===`cli`){let t=e.entry.command?.trim();return{type:`cli`,provider:t??`cli`,model:e.entry.model??t,outcome:e.outcome,reason:e.reason}}let t=e.entry.provider?.trim();return{type:`provider`,provider:(t?W(t):void 0)??t,model:e.entry.model,outcome:e.outcome,reason:e.reason}}function Ut(e){let{capability:t,entry:n,cfg:r}=e,i=Ct({capability:t,entry:n,cfg:r,config:e.config}),a=St({capability:t,entry:n,cfg:r,config:e.config});return{maxBytes:i,maxChars:a,timeoutMs:bt(n.timeoutSeconds??e.config?.timeoutSeconds??r.tools?.media?.[t]?.timeoutSeconds,Je[t]),prompt:xt(t,n.prompt??e.config?.prompt??r.tools?.media?.[t]?.prompt,a)}}async function Wt(e){let t=await x({provider:e.providerId,cfg:e.cfg,profileId:e.entry.profile,preferredProfile:e.entry.preferredProfile,agentDir:e.agentDir});return{apiKeys:oe({provider:e.providerId,primaryApiKey:m(t,e.providerId)}),providerConfig:e.cfg.models?.providers?.[e.providerId]}}async function Gt(e){let{apiKeys:t,providerConfig:n}=await Wt({providerId:e.providerId,cfg:e.cfg,entry:e.entry,agentDir:e.agentDir}),r=e.entry.baseUrl??e.config?.baseUrl??n?.baseUrl,i={...J(n?.headers),...J(e.config?.headers),...J(e.entry.headers)};return{apiKeys:t,baseUrl:r,headers:Object.keys(i).length>0?i:void 0}}function Kt(e){let t=Array.isArray(e.attachments)?e.attachments:[],n=t.length,r=t.filter(e=>e?.chosen?.outcome===`success`).length,i=t.find(e=>e?.chosen)?.chosen,a=typeof i?.provider==`string`?i.provider.trim():void 0,o=typeof i?.model==`string`?i.model.trim():void 0,s=a?o?`${a}/${o}`:a:void 0,c=t.flatMap(e=>(Array.isArray(e?.attempts)?e.attempts:[]).map(e=>typeof e?.reason==`string`?e.reason:void 0).filter(e=>!!e)).find(e=>e.trim().length>0),l=c?c.split(`:`)[0]?.trim():void 0,u=n>0?` (${r}/${n})`:``,d=s?` via ${s}`:``,f=l?` reason=${l}`:``;return`${e.capability}: ${e.outcome}${u}${d}${f}`}function qt(e){if(!(e.size>=1024))throw new j(`tooSmall`,`Audio attachment ${e.attachmentIndex+1} is too small (${e.size} bytes, minimum 1024)`)}async function Jt(e){let{entry:t,capability:n,cfg:r}=e,i=t.provider?.trim();if(!i)throw Error(`Provider entry missing provider for ${n}`);let a=W(i),{maxBytes:o,maxChars:s,timeoutMs:c,prompt:l}=Ut({capability:n,entry:t,cfg:r,config:e.config});if(n===`image`){if(!e.agentDir)throw Error(`Image understanding requires agentDir`);let n=t.model?.trim();if(!n)throw Error(`Image understanding requires model id`);let r=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),i=G(a,e.providerRegistry),u={buffer:r.buffer,fileName:r.fileName,mime:r.mime,model:n,provider:a,prompt:l,timeoutMs:c,profile:t.profile,preferredProfile:t.preferredProfile,agentDir:e.agentDir,cfg:e.cfg},d=await(i?.describeImage??S)(u);return{kind:`image.description`,attachmentIndex:e.attachmentIndex,text:Y(d.text,s),provider:a,model:d.model??n}}let u=G(a,e.providerRegistry);if(!u)throw Error(`Media provider not available: ${a}`);let d=se();if(n===`audio`){if(!u.transcribeAudio)throw Error(`Audio transcription provider "${a}" not available.`);let n=u.transcribeAudio,i=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c});qt({size:i.size,attachmentIndex:e.attachmentIndex});let{apiKeys:f,baseUrl:p,headers:m}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),h=Ht({providerId:a,config:e.config,entry:t}),g=t.model?.trim()||Xe[a]||t.model,_=await w({provider:a,apiKeys:f,execute:async a=>n({buffer:i.buffer,fileName:i.fileName,mime:i.mime,apiKey:a,baseUrl:p,headers:m,model:g,language:t.language??e.config?.language??r.tools?.media?.audio?.language,prompt:l,query:h,timeoutMs:c,fetchFn:d})});return{kind:`audio.transcription`,attachmentIndex:e.attachmentIndex,text:Y(_.text,s),provider:a,model:_.model??g}}if(!u.describeVideo)throw Error(`Video understanding provider "${a}" not available.`);let f=u.describeVideo,p=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),m=At(p.size),h=jt(o);if(m>h)throw new j(`maxBytes`,`Video attachment ${e.attachmentIndex+1} base64 payload ${m} exceeds ${h}`);let{apiKeys:g,baseUrl:_,headers:v}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),y=await w({provider:a,apiKeys:g,execute:e=>f({buffer:p.buffer,fileName:p.fileName,mime:p.mime,apiKey:e,baseUrl:_,headers:v,model:t.model,prompt:l,timeoutMs:c,fetchFn:d})});return{kind:`video.description`,attachmentIndex:e.attachmentIndex,text:Y(y.text,s),provider:a,model:y.model??t.model}}async function Yt(e){let{entry:t,capability:n,cfg:r,ctx:i}=e,a=t.command?.trim(),l=t.args??[];if(!a)throw Error(`CLI entry missing command for ${n}`);let{maxBytes:u,maxChars:f,timeoutMs:p,prompt:m}=Ut({capability:n,entry:t,cfg:r,config:e.config}),h=await e.cache.getPath({attachmentIndex:e.attachmentIndex,maxBytes:u,timeoutMs:p});n===`audio`&&qt({size:(await T.stat(h.path)).size,attachmentIndex:e.attachmentIndex});let g=await T.mkdtemp(E.join(o(),`openclaw-media-cli-`)),_=h.path,v=E.join(g,E.parse(_).name),y={...i,MediaPath:_,MediaDir:E.dirname(_),OutputDir:g,OutputBase:v,Prompt:m,MaxChars:f},b=[a,...l].map((e,t)=>t===0?e:kt(e,y));try{c()&&s(`Media understanding via CLI: ${b.join(` `)}`);let{stdout:t}=await d(b[0],b.slice(1),{timeoutMs:p,maxBuffer:z}),r=Y(await Rt({command:a,args:b.slice(1),stdout:t,mediaPath:_}),f);return r?{kind:n===`audio`?`audio.transcription`:`${n}.description`,attachmentIndex:e.attachmentIndex,text:r,provider:`cli`,model:a}:null}finally{await T.rm(g,{recursive:!0,force:!0}).catch(()=>{})}}function Q(e){return _t(e)}function Xt(e){return k(e)}function Zt(e){return b(C(),_({cfg:e.cfg,accountId:e.ctx.AccountId}))}function Qt(e,t){return new Ge(e,t)}const $t=new Map,en=new Map;function tn(e){if(!e.startsWith(`~`))return e;let t=ce.homedir();return e===`~`?t:e.startsWith(`~/`)?E.join(t,e.slice(2)):e}function nn(e){return e.includes(`/`)||e.includes(`\\`)}function rn(e){if(process.platform!==`win32`||E.extname(e))return[e];let t=(process.env.PATHEXT??`.EXE;.CMD;.BAT;.COM`).split(`;`).map(e=>e.trim()).filter(Boolean).map(e=>e.startsWith(`.`)?e:`.${e}`);return[e,...Array.from(new Set(t)).map(t=>`${e}${t}`)]}async function an(e){try{return(await T.stat(e)).isFile()?(process.platform===`win32`||await T.access(e,le.X_OK),!0):!1}catch{return!1}}async function on(e){let t=$t.get(e);if(t)return t;let n=(async()=>{let t=tn(e.trim());if(t&&nn(t)){for(let e of rn(t))if(await an(e))return e}let n=e.trim();if(!n)return null;let r=(process.env.PATH??``).split(E.delimiter),i=rn(n);for(let e of r){let t=tn(e.trim().replace(/^"(.*)"$/,`$1`));if(t)for(let e of i){let n=E.join(t,e);if(await an(n))return n}}return null})();return $t.set(e,n),n}async function $(e){return!!await on(e)}async function sn(){let e=en.get(`gemini`);if(e)return e;let t=(async()=>{if(!await $(`gemini`))return!1;try{let{stdout:e}=await d(`gemini`,[`--output-format`,`json`,`ok`],{timeoutMs:8e3});return!!(V(e)??e.toLowerCase().includes(`ok`))}catch{return!1}})();return en.set(`gemini`,t),t}async function cn(){if(!await $(`whisper-cli`))return null;let e=process.env.WHISPER_CPP_MODEL?.trim(),t=e&&await B(e)?e:`/opt/homebrew/share/whisper-cpp/for-tests-ggml-tiny.bin`;return await B(t)?{type:`cli`,command:`whisper-cli`,args:[`-m`,t,`-otxt`,`-of`,`{{OutputBase}}`,`-np`,`-nt`,`{{MediaPath}}`]}:null}async function ln(){return await $(`whisper`)?{type:`cli`,command:`whisper`,args:[`--model`,`turbo`,`--output_format`,`txt`,`--output_dir`,`{{OutputDir}}`,`--verbose`,`False`,`{{MediaPath}}`]}:null}async function un(){if(!await $(`sherpa-onnx-offline`))return null;let e=process.env.SHERPA_ONNX_MODEL_DIR?.trim();if(!e)return null;let t=E.join(e,`tokens.txt`),n=E.join(e,`encoder.onnx`),r=E.join(e,`decoder.onnx`),i=E.join(e,`joiner.onnx`);return!await B(t)||!await B(n)||!await B(r)||!await B(i)?null:{type:`cli`,command:`sherpa-onnx-offline`,args:[`--tokens=${t}`,`--encoder=${n}`,`--decoder=${r}`,`--joiner=${i}`,`{{MediaPath}}`]}}async function dn(){return await un()||await cn()||await ln()}async function fn(e){return await sn()?{type:`cli`,command:`gemini`,args:[`--output-format`,`json`,`--allowed-tools`,`read_many_files`,`--include-directories`,`{{MediaDir}}`,`{{Prompt}}`,`Use read_many_files to read {{MediaPath}} and respond with only the text output.`]}:null}async function pn(e){let{cfg:t,agentDir:n,providerRegistry:r,capability:i}=e,a=async(e,a)=>{let o=G(e,r);if(!o||i===`audio`&&!o.transcribeAudio||i===`image`&&!o.describeImage||i===`video`&&!o.describeVideo)return null;try{return await x({provider:e,cfg:t,agentDir:n}),{type:`provider`,provider:e,model:a}}catch{return null}};if(i===`image`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of L){let t=R[e],n=await a(e,t);if(n)return n}return null}if(i===`video`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of Qe){let t=await a(e,void 0);if(t)return t}return null}let o=e.activeModel?.provider?.trim();if(o){let t=await a(o,e.activeModel?.model);if(t)return t}for(let e of Ze){let t=await a(e,void 0);if(t)return t}return null}function mn(e){let t=[],n=i(e.agents?.defaults?.imageModel);n?.trim()&&t.push(n.trim());for(let n of r(e.agents?.defaults?.imageModel))n?.trim()&&t.push(n.trim());if(t.length===0)return[];let a=[];for(let e of t){let t=e.indexOf(`/`);t<=0||t>=e.length-1||a.push({type:`provider`,provider:e.slice(0,t),model:e.slice(t+1)})}return a}async function hn(e){let t=await _n(e);if(t)return[t];if(e.capability===`audio`){let e=await dn();if(e)return[e]}if(e.capability===`image`){let t=mn(e.cfg);if(t.length>0)return t}let n=await fn(e.capability);if(n)return[n];let r=await pn(e);return r?[r]:[]}async function gn(e){let t=Q(),n=e=>{if(!e||e.type===`cli`)return null;let t=e.provider;if(!t)return null;let n=e.model??R[t];return n?{provider:t,model:n}:null};return n(await _n({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))||n(await pn({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))}async function _n(e){let t=e.activeModel?.provider?.trim();if(!t)return null;let n=W(t);if(!n)return null;let r=G(n,e.providerRegistry);if(!r||e.capability===`audio`&&!r.transcribeAudio||e.capability===`image`&&!r.describeImage||e.capability===`video`&&!r.describeVideo)return null;try{await x({provider:n,cfg:e.cfg,agentDir:e.agentDir})}catch{return null}return{type:`provider`,provider:n,model:e.activeModel?.model}}async function vn(e){let{entries:t,capability:n}=e,r=[];for(let i of t){let t=i.type??(i.command?`cli`:`provider`);try{let a=t===`cli`?await Yt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,config:e.config}):await Jt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,agentDir:e.agentDir,providerRegistry:e.providerRegistry,config:e.config});if(a){let e=Z({entry:i,entryType:t,outcome:`success`});return a.provider&&(e.provider=a.provider),a.model&&(e.model=a.model),r.push(e),{output:a,attempts:r}}r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`empty output`}))}catch(e){if(ze(e)){r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`${e.reason}: ${e.message}`})),c()&&s(`Skipping ${n} model due to ${e.reason}: ${e.message}`);continue}r.push(Z({entry:i,entryType:t,outcome:`failed`,reason:String(e)})),c()&&s(`${n} understanding failed: ${String(e)}`)}}return{output:null,attempts:r}}async function yn(e){let{capability:t,cfg:n,ctx:r}=e,i=e.config??n.tools?.media?.[t];if(i?.enabled===!1)return{outputs:[],decision:{capability:t,outcome:`disabled`,attachments:[]}};let a=i?.attachments,o=je({capability:t,attachments:e.media,policy:a});if(o.length===0)return{outputs:[],decision:{capability:t,outcome:`no-attachment`,attachments:[]}};if(wt({scope:i?.scope,ctx:r})===`deny`)return c()&&s(`${t} understanding disabled by scope policy.`),{outputs:[],decision:{capability:t,outcome:`scope-deny`,attachments:o.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let l=e.activeModel?.provider?.trim();if(t===`image`&&l&&Ce(we(await Se({config:n}),l,e.activeModel?.model??``))){c()&&s(`Skipping image understanding: primary model supports vision natively`);let n=e.activeModel?.model?.trim();return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:o.map(e=>{let t={type:`provider`,provider:l,model:n||void 0,outcome:`skipped`,reason:`primary model supports vision natively`};return{attachmentIndex:e.index,attempts:[t],chosen:t}})}}}let u=Et({cfg:n,capability:t,config:i,providerRegistry:e.providerRegistry});if(u.length===0&&(u=await hn({cfg:n,agentDir:e.agentDir,providerRegistry:e.providerRegistry,capability:t,activeModel:e.activeModel})),u.length===0)return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:o.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let d=[],f=[];for(let a of o){let{output:o,attempts:s}=await vn({capability:t,cfg:n,ctx:r,attachmentIndex:a.index,agentDir:e.agentDir,providerRegistry:e.providerRegistry,cache:e.attachments,entries:u,config:i});o&&d.push(o),f.push({attachmentIndex:a.index,attempts:s,chosen:s.find(e=>e.outcome===`success`)})}let p={capability:t,outcome:d.length>0?`success`:`skipped`,attachments:f};return c()&&s(`Media understanding ${Kt(p)}`),{outputs:d,decision:p}}async function bn(e){let t=e.attachments??Xt(e.ctx);if(t.length===0)return{transcript:void 0,attachments:t};let n=Q(e.providers),r=Qt(t,e.localPathRoots?{localPathRoots:e.localPathRoots}:void 0);try{return{transcript:(await yn({capability:`audio`,cfg:e.cfg,ctx:e.ctx,attachments:r,media:t,agentDir:e.agentDir,providerRegistry:n,config:e.cfg.tools?.media?.audio,activeModel:e.activeModel})).outputs.find(e=>e.kind===`audio.transcription`)?.text?.trim()||void 0,attachments:t}}finally{await r.cleanup()}}export{Se as C,we as S,Pe as _,gn as a,k as b,kt as c,q as d,yt as f,Re as g,R as h,Xt as i,Dt as l,z as m,Q as n,Zt as o,L as p,Qt as r,yn as s,bn as t,bt as u,De as v,Ce as w,A as x,Te as y};

package/dist/audio-transcription-runner-CjKLRVPo.js

@@ -1,4 +1,4 @@
 import{Kt as e,f as t,g as n,m as r,qt as i,u as a}from"./paths-piJASC5k.js";import{B as o,O as s,R as c,Z as l}from"./logger-DwWqfo66.js";import{Gs as u,Ka as d,Kr as f,Za as p,b as m,c as h,co as g,do as _,h as v,lo as y,uo as b,y as ee}from"./model-selection-C2QwHmXT.js";import{D as te,t as x}from"./image-Ba-mOMMV.js";import{a as ne,n as re,t as ie}from"./fetch-BI3CnKE3.js";import{n as ae}from"./fetch-timeout-Cj8_oAls.js";import{t as oe}from"./fetch-guard-BmNIhXP-.js";import{n as S,r as se,t as ce}from"./api-key-rotation-C_MG2y1D.js";import{r as le}from"./proxy-fetch-DnjU1fEB.js";import{constants as ue}from"node:fs";import C from"node:path";import de from"node:os";import w from"node:fs/promises";import{fileURLToPath as fe}from"node:url";import pe from"node:crypto";import"node:process";const me=s(`model-catalog`);let T=null,E=!1,he=()=>import(`./pi-model-discovery-C8YBu6D4.js`).then(e=>e.r);const D=`openai-codex`,ge=`openai`,_e=new Set([`kilocode`]),ve=[{provider:ge,id:`gpt-5.4`,templateIds:[`gpt-5.2`]},{provider:ge,id:`gpt-5.4-pro`,templateIds:[`gpt-5.2-pro`,`gpt-5.2`]},{provider:D,id:`gpt-5.4`,templateIds:[`gpt-5.3-codex`,`gpt-5.2-codex`]},{provider:D,id:`gpt-5.3-codex-spark`,templateIds:[`gpt-5.3-codex`]}];function ye(e){let t=(t,n)=>e.find(e=>e.provider.toLowerCase()===t.toLowerCase()&&e.id.toLowerCase()===n.toLowerCase());for(let n of ve){if(t(n.provider,n.id))continue;let r=n.templateIds.map(e=>t(n.provider,e)).find(e=>e!==void 0);r&&e.push({...r,id:n.id,name:n.id})}}function be(e){if(!Array.isArray(e))return;let t=e.filter(e=>e===`text`||e===`image`||e===`document`);return t.length>0?t:void 0}function xe(e){let t=e.models?.providers;if(!t||typeof t!=`object`)return[];let n=[];for(let[e,r]of Object.entries(t)){let t=e.toLowerCase().trim();if(!_e.has(t)||!r||typeof r!=`object`)continue;let i=r.models;if(Array.isArray(i))for(let e of i){if(!e||typeof e!=`object`)continue;let r=e.id;if(typeof r!=`string`)continue;let i=r.trim();if(!i)continue;let a=e.name,o=(typeof a==`string`?a:i).trim()||i,s=e.contextWindow,c=typeof s==`number`&&s>0?s:void 0,l=e.reasoning,u=typeof l==`boolean`?l:void 0,d=be(e.input);n.push({id:i,name:o,provider:t,contextWindow:c,reasoning:u,input:d})}}return n}function Se(e){let t=xe(e.config);if(t.length===0)return;let n=new Set(e.models.map(e=>`${e.provider.toLowerCase().trim()}::${e.id.toLowerCase().trim()}`));for(let r of t){let t=`${r.provider.toLowerCase().trim()}::${r.id.toLowerCase().trim()}`;n.has(t)||(e.models.push(r),n.add(t))}}async function Ce(e){return e?.useCache===!1&&(T=null),T||(T=(async()=>{let t=[],n=e=>e.sort((e,t)=>{let n=e.provider.localeCompare(t.provider);return n===0?e.name.localeCompare(t.name):n});try{let r=e?.config??p();await te(r);let i=await he(),a=u(),{join:o}=await import(`node:path`),s=i.discoverAuthStorage(a),c=new i.ModelRegistry(s,o(a,`models.json`)),l=Array.isArray(c)?c:c.getAll();for(let e of l){let n=String(e?.id??``).trim();if(!n)continue;let r=String(e?.provider??``).trim();if(!r)continue;let i=String(e?.name??n).trim()||n,a=typeof e?.contextWindow==`number`&&e.contextWindow>0?e.contextWindow:void 0,o=typeof e?.reasoning==`boolean`?e.reasoning:void 0,s=Array.isArray(e?.input)?e.input:void 0;t.push({id:n,name:i,provider:r,contextWindow:a,reasoning:o,input:s})}return Se({config:r,models:t}),ye(t),t.length===0&&(T=null),n(t)}catch(e){return E||(E=!0,me.warn(`Failed to load model catalog: ${String(e)}`)),T=null,t.length>0?n(t):[]}})(),T)}function O(e){return e?.input?.includes(`image`)??!1}function we(e,t,n){let r=t.toLowerCase().trim(),i=n.toLowerCase().trim();return e.find(e=>e.provider.toLowerCase()===r&&e.id.toLowerCase()===i)}function Te(e){let t=e?.trim();if(t){if(t.startsWith(`file://`))try{return fe(t)}catch{return}return t}}function Ee(e){let t=Array.isArray(e.MediaPaths)?e.MediaPaths:void 0,n=Array.isArray(e.MediaUrls)?e.MediaUrls:void 0,r=Array.isArray(e.MediaTypes)?e.MediaTypes:void 0,i=(t,n)=>{let i=r?.[n];return(typeof i==`string`?i.trim():``)||(t===1?e.MediaType:void 0)};if(t&&t.length>0){let r=t.length,a=n&&n.length>0?n:void 0;return t.map((t,n)=>({path:t?.trim()||void 0,url:a?.[n]??e.MediaUrl,mime:i(r,n),index:n})).filter(e=>!!(e.path?.trim()||e.url?.trim()))}if(n&&n.length>0){let e=n.length;return n.map((t,n)=>({path:void 0,url:t?.trim()||void 0,mime:i(e,n),index:n})).filter(e=>!!e.url?.trim())}let a=e.MediaPath?.trim(),o=e.MediaUrl?.trim();return!a&&!o?[]:[{path:a||void 0,url:o||void 0,mime:e.MediaType,index:0}]}function k(e){let i=n(e.mime);if(i===`image`||i===`audio`||i===`video`)return i;let a=t(e.path??e.url);return a?[`.mp4`,`.mov`,`.mkv`,`.webm`,`.avi`,`.m4v`].includes(a)?`video`:r(e.path??e.url)?`audio`:[`.png`,`.jpg`,`.jpeg`,`.webp`,`.gif`,`.bmp`,`.tiff`,`.tif`].includes(a)?`image`:`unknown`:`unknown`}function De(e){return k(e)===`video`}function A(e){return k(e)===`audio`}function Oe(e){return k(e)===`image`}function ke(e,t){let n=Array.isArray(e)?e.filter(j):[];if(!t||t===`first`)return n;if(t===`last`)return[...n].toReversed();if(t===`path`){let e=n.filter(e=>e.path),t=n.filter(e=>!e.path);return[...e,...t]}if(t===`url`){let e=n.filter(e=>e.url),t=n.filter(e=>!e.url);return[...e,...t]}return n}function j(e){if(!e||typeof e!=`object`)return!1;let t=e;return!(typeof t.index!=`number`||t.path!==void 0&&typeof t.path!=`string`||t.url!==void 0&&typeof t.url!=`string`||t.mime!==void 0&&typeof t.mime!=`string`||t.alreadyTranscribed!==void 0&&typeof t.alreadyTranscribed!=`boolean`)}function Ae(e){let{capability:t,attachments:n,policy:r}=e,i=(Array.isArray(n)?n.filter(j):[]).filter(e=>t===`audio`&&e.alreadyTranscribed?!1:t===`image`?Oe(e):t===`audio`?A(e):De(e));if(i.length===0)return[];let a=ke(i,r?.prefer),o=r?.mode??`first`,s=r?.maxAttachments??1;return o===`all`?a.slice(0,Math.max(1,s)):a.slice(0,1)}const je=new Set;function Me(e){return!e||typeof e!=`object`?!1:(`name`in e?String(e.name):``)===`AbortError`||(`message`in e&&typeof e.message==`string`?e.message:``)===`This operation was aborted`}function Ne(e){return je.add(e),()=>{je.delete(e)}}function Pe(e){return e.replace(/[^a-zA-Z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``)||`tmp`}function Fe(e){if(!e)return``;let t=((e.startsWith(`.`)?e:`.${e}`).match(/[a-zA-Z0-9._-]+$/)?.[0]??``).replace(/^[._-]+/,``);return t?`.${t}`:``}function Ie(e){return e??l()}function Le(e){let t=Pe(e.prefix),n=Fe(e.extension),r=e.now,i=typeof r==`number`&&Number.isFinite(r)?Math.trunc(r):Date.now(),a=e.uuid?.trim()||pe.randomUUID();return C.join(Ie(e.tmpDir),`${t}-${i}-${a}${n}`)}var M=class extends Error{constructor(e,t){super(t),this.reason=e,this.name=`MediaUnderstandingSkipError`}};function Re(e){return e instanceof M}function N(e,t){return(e?.trim()||t).replace(/\/+$/,``)}async function ze(e,t,n,r,i){return await oe({url:e,fetchImpl:r,init:t,timeoutMs:n,policy:i?.ssrfPolicy,lookupFn:i?.lookupFn,pinDns:i?.pinDns})}async function Be(e){return ze(e.url,{method:`POST`,headers:e.headers,body:e.body},e.timeoutMs,e.fetchFn,e.allowPrivateNetwork?{ssrfPolicy:{allowPrivateNetwork:!0}}:void 0)}async function Ve(e){return ze(e.url,{method:`POST`,headers:e.headers,body:JSON.stringify(e.body)},e.timeoutMs,e.fetchFn,e.allowPrivateNetwork?{ssrfPolicy:{allowPrivateNetwork:!0}}:void 0)}async function He(e){try{let t=(await e.text()).replace(/\s+/g,` `).trim();return t?t.length<=300?t:`${t.slice(0,300)}…`:void 0}catch{return}}async function P(e,t){if(e.ok)return;let n=await He(e),r=n?`: ${n}`:``;throw Error(`${t} (HTTP ${e.status})${r}`)}function F(e,t){let n=e?.trim();if(!n)throw Error(t);return n}const Ue=b(ne(),g);function We(e){return typeof e==`string`?e:e instanceof URL?e.toString():e.url}var Ge=class{constructor(e,t){this.entries=new Map,this.attachments=e,this.localPathRoots=b(t?.localPathRoots,Ue);for(let t of e)this.entries.set(t.index,{attachment:t})}async getBuffer(e){let t=await this.ensureEntry(e.attachmentIndex);if(t.buffer){if(t.buffer.length>e.maxBytes)throw new M(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);return{buffer:t.buffer,mime:t.bufferMime,fileName:t.bufferFileName??`media-${e.attachmentIndex+1}`,size:t.buffer.length}}if(t.resolvedPath){let n=await this.ensureLocalStat(t);if(t.resolvedPath){if(n!==void 0&&n>e.maxBytes)throw new M(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);let r=await w.readFile(t.resolvedPath);return t.buffer=r,t.bufferMime=t.bufferMime??t.attachment.mime??await a({buffer:r,filePath:t.resolvedPath}),t.bufferFileName=C.basename(t.resolvedPath)||`media-${e.attachmentIndex+1}`,{buffer:r,mime:t.bufferMime,fileName:t.bufferFileName,size:r.length}}}let n=t.attachment.url?.trim();if(!n)throw new M(`empty`,`Attachment ${e.attachmentIndex+1} has no path or URL.`);try{let r=await re({url:n,fetchImpl:(t,n)=>ae(We(t),n??{},e.timeoutMs,fetch),maxBytes:e.maxBytes});return t.buffer=r.buffer,t.bufferMime=t.attachment.mime??r.contentType??await a({buffer:r.buffer,filePath:r.fileName??n}),t.bufferFileName=r.fileName??`media-${e.attachmentIndex+1}`,{buffer:r.buffer,mime:t.bufferMime,fileName:t.bufferFileName,size:r.buffer.length}}catch(t){throw t instanceof ie&&t.code===`max_bytes`?new M(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`):Me(t)?new M(`timeout`,`Attachment ${e.attachmentIndex+1} timed out while fetching.`):t}}async getPath(e){let t=await this.ensureEntry(e.attachmentIndex);if(t.resolvedPath){if(e.maxBytes){let n=await this.ensureLocalStat(t);if(t.resolvedPath&&n!==void 0&&n>e.maxBytes)throw new M(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`)}if(t.resolvedPath)return{path:t.resolvedPath}}if(t.tempPath){if(e.maxBytes&&t.buffer&&t.buffer.length>e.maxBytes)throw new M(`maxBytes`,`Attachment ${e.attachmentIndex+1} exceeds maxBytes ${e.maxBytes}`);return{path:t.tempPath,cleanup:t.tempCleanup}}let n=e.maxBytes??1/0,r=await this.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:n,timeoutMs:e.timeoutMs}),i=Le({prefix:`openclaw-media`,extension:C.extname(r.fileName||``)||``});return await w.writeFile(i,r.buffer),t.tempPath=i,t.tempCleanup=async()=>{await w.unlink(i).catch(()=>{})},{path:i,cleanup:t.tempCleanup}}async cleanup(){let e=[];for(let t of this.entries.values())t.tempCleanup&&=(e.push(Promise.resolve(t.tempCleanup())),void 0);await Promise.all(e)}async ensureEntry(e){let t=this.entries.get(e);if(t)return t.resolvedPath||=this.resolveLocalPath(t.attachment),t;let n=this.attachments.find(t=>t.index===e)??{index:e},r={attachment:n,resolvedPath:this.resolveLocalPath(n)};return this.entries.set(e,r),r}resolveLocalPath(e){let t=Te(e.path);if(t)return C.isAbsolute(t)?t:C.resolve(t)}async ensureLocalStat(e){if(e.resolvedPath){if(!y({filePath:e.resolvedPath,roots:this.localPathRoots})){e.resolvedPath=void 0,o()&&c(`Blocked attachment path outside allowed roots: ${e.attachment.path??e.attachment.url??`(unknown)`}`);return}if(e.statSize!==void 0)return e.statSize;try{let t=e.resolvedPath,n=await w.stat(t);if(!n.isFile()){e.resolvedPath=void 0;return}let r=await w.realpath(t).catch(()=>t);if(!y({filePath:r,roots:await this.getCanonicalLocalPathRoots()})){e.resolvedPath=void 0,o()&&c(`Blocked canonicalized attachment path outside allowed roots: ${r}`);return}return e.resolvedPath=r,e.statSize=n.size,n.size}catch(t){e.resolvedPath=void 0,o()&&c(`Failed to read attachment ${e.attachment.index+1}: ${String(t)}`);return}}}async getCanonicalLocalPathRoots(){return this.canonicalLocalPathRoots||=(async()=>b(this.localPathRoots,await Promise.all(this.localPathRoots.map(async e=>e.includes(`*`)?e:await w.realpath(e).catch(()=>e)))))(),await this.canonicalLocalPathRoots}};const I=1024*1024,Ke={image:500,audio:void 0,video:500},qe={image:10*I,audio:20*I,video:50*I},Je={image:60,audio:60,video:120},Ye={image:`Describe the image.`,audio:`Transcribe the audio.`,video:`Describe the video.`};70*I;const Xe={groq:`whisper-large-v3-turbo`,openai:`gpt-4o-mini-transcribe`,deepgram:`nova-3`,mistral:`voxtral-mini-latest`},Ze=[`openai`,`groq`,`deepgram`,`google`,`mistral`],L=[`openai`,`anthropic`,`google`,`minimax`,`minimax-portal`,`zai`],Qe=[`google`,`moonshot`],R={openai:`gpt-5-mini`,anthropic:`claude-opus-4-6`,google:`gemini-3-flash-preview`,minimax:`MiniMax-VL-01`,"minimax-portal":`MiniMax-VL-01`,zai:`glm-4.6v`},z=5*I;async function B(e){if(!e)return!1;try{return await w.stat(e),!0}catch{return!1}}function $e(e){let t=e.trim(),n=t.lastIndexOf(`{`);if(n===-1)return null;let r=t.slice(n);try{return JSON.parse(r)}catch{return null}}function V(e){let t=$e(e);if(!t||typeof t!=`object`)return null;let n=t.response;return typeof n==`string`&&n.trim()||null}const et={id:`anthropic`,capabilities:[`image`],describeImage:x};function tt(e){return e?.trim()||`nova-3`}async function nt(e){let t=e.fetchFn??fetch,n=N(e.baseUrl,`https://api.deepgram.com/v1`),r=!!e.baseUrl?.trim(),i=tt(e.model),a=new URL(`${n}/listen`);if(a.searchParams.set(`model`,i),e.language?.trim()&&a.searchParams.set(`language`,e.language.trim()),e.query)for(let[t,n]of Object.entries(e.query))n!==void 0&&a.searchParams.set(t,String(n));let o=new Headers(e.headers);o.has(`authorization`)||o.set(`authorization`,`Token ${e.apiKey}`),o.has(`content-type`)||o.set(`content-type`,e.mime??`application/octet-stream`);let s=new Uint8Array(e.buffer),{response:c,release:l}=await Be({url:a.toString(),headers:o,body:s,timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{return await P(c,`Audio transcription failed`),{text:F((await c.json()).results?.channels?.[0]?.alternatives?.[0]?.transcript,`Audio transcription response missing transcript`),model:i}}finally{await l()}}const rt={id:`deepgram`,capabilities:[`audio`],transcribeAudio:nt};async function H(e){let t=e.fetchFn??fetch,n=N(e.baseUrl,e.defaultBaseUrl),r=!!e.baseUrl?.trim(),i=(()=>{let t=e.model?.trim();return t?v(t):e.defaultModel})(),a=`${n}/models/${i}:generateContent`,o=se(e.apiKey),s=new Headers(e.headers);for(let[e,t]of Object.entries(o.headers))s.has(e)||s.set(e,t);let{response:c,release:l}=await Ve({url:a,headers:s,body:{contents:[{role:`user`,parts:[{text:e.prompt?.trim()||e.defaultPrompt},{inline_data:{mime_type:e.mime??e.defaultMime,data:e.buffer.toString(`base64`)}}]}]},timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{await P(c,e.httpErrorLabel);let t=((await c.json()).candidates?.[0]?.content?.parts??[]).map(e=>e?.text?.trim()).filter(Boolean).join(`
 `);if(!t)throw Error(e.missingTextError);return{text:t,model:i}}finally{await l()}}async function it(e){let{text:t,model:n}=await H({...e,defaultBaseUrl:`https://generativelanguage.googleapis.com/v1beta`,defaultModel:`gemini-3-flash-preview`,defaultPrompt:`Transcribe the audio.`,defaultMime:`audio/wav`,httpErrorLabel:`Audio transcription failed`,missingTextError:`Audio transcription response missing text`});return{text:t,model:n}}async function at(e){let{text:t,model:n}=await H({...e,defaultBaseUrl:`https://generativelanguage.googleapis.com/v1beta`,defaultModel:`gemini-3-flash-preview`,defaultPrompt:`Describe the video.`,defaultMime:`video/mp4`,httpErrorLabel:`Video description failed`,missingTextError:`Video description response missing text`});return{text:t,model:n}}const ot={id:`google`,capabilities:[`image`,`audio`,`video`],describeImage:x,transcribeAudio:it,describeVideo:at};function st(e){return e?.trim()||`gpt-4o-mini-transcribe`}async function U(e){let t=e.fetchFn??fetch,n=N(e.baseUrl,`https://api.openai.com/v1`),r=!!e.baseUrl?.trim(),i=`${n}/audio/transcriptions`,a=st(e.model),o=new FormData,s=e.fileName?.trim()||C.basename(e.fileName)||`audio`,c=new Uint8Array(e.buffer),l=new Blob([c],{type:e.mime??`application/octet-stream`});o.append(`file`,l,s),o.append(`model`,a),e.language?.trim()&&o.append(`language`,e.language.trim()),e.prompt?.trim()&&o.append(`prompt`,e.prompt.trim());let u=new Headers(e.headers);u.has(`authorization`)||u.set(`authorization`,`Bearer ${e.apiKey}`);let{response:d,release:f}=await Be({url:i,headers:u,body:o,timeoutMs:e.timeoutMs,fetchFn:t,allowPrivateNetwork:r});try{return await P(d,`Audio transcription failed`),{text:F((await d.json()).text,`Audio transcription response missing text`),model:a}}finally{await f()}}const ct={id:`groq`,capabilities:[`audio`],transcribeAudio:e=>U({...e,baseUrl:e.baseUrl??`https://api.groq.com/openai/v1`})},lt={id:`minimax`,capabilities:[`image`],describeImage:x},ut={id:`minimax-portal`,capabilities:[`image`],describeImage:x},dt={id:`mistral`,capabilities:[`audio`],transcribeAudio:e=>U({...e,baseUrl:e.baseUrl??`https://api.mistral.ai/v1`})};function ft(e){return e?.trim()||`kimi-k2.5`}function pt(e){return e?.trim()||`Describe the video.`}function mt(e){let t=e.choices?.[0]?.message;if(!t)return null;if(typeof t.content==`string`&&t.content.trim())return t.content.trim();if(Array.isArray(t.content)){let e=t.content.map(e=>typeof e.text==`string`?e.text.trim():``).filter(Boolean).join(`
 `).trim();if(e)return e}return typeof t.reasoning_content==`string`&&t.reasoning_content.trim()?t.reasoning_content.trim():null}async function ht(e){let t=e.fetchFn??fetch,n=N(e.baseUrl,`https://api.moonshot.ai/v1`),r=ft(e.model),i=e.mime??`video/mp4`,a=pt(e.prompt),o=`${n}/chat/completions`,s=new Headers(e.headers);s.has(`content-type`)||s.set(`content-type`,`application/json`),s.has(`authorization`)||s.set(`authorization`,`Bearer ${e.apiKey}`);let{response:c,release:l}=await Ve({url:o,headers:s,body:{model:r,messages:[{role:`user`,content:[{type:`text`,text:a},{type:`video_url`,video_url:{url:`data:${i};base64,${e.buffer.toString(`base64`)}`}}]}]},timeoutMs:e.timeoutMs,fetchFn:t});try{await P(c,`Moonshot video description failed`);let e=mt(await c.json());if(!e)throw Error(`Moonshot video description response missing content`);return{text:e,model:r}}finally{await l()}}const gt=[ct,{id:`openai`,capabilities:[`image`,`audio`],describeImage:x,transcribeAudio:U},ot,et,lt,ut,{id:`moonshot`,capabilities:[`image`,`video`],describeImage:x,describeVideo:ht},dt,{id:`zai`,capabilities:[`image`],describeImage:x},rt];function W(e){let t=h(e);return t===`gemini`?`google`:t}function _t(e){let t=new Map;for(let e of gt)t.set(W(e.id),e);if(e)for(let[n,r]of Object.entries(e)){let e=W(n),i=t.get(e),a=i?{...i,...r,capabilities:r.capabilities??i.capabilities}:r;t.set(e,a)}return t}function G(e,t){return t.get(W(e))}function vt(e){let t=e?.trim().toLowerCase();if(t===`allow`)return`allow`;if(t===`deny`)return`deny`}function K(e){return e?.trim().toLowerCase()||void 0}function q(e){return f(e??void 0)}function yt(e){let t=e.scope;if(!t)return`allow`;let n=K(e.channel),r=q(e.chatType),i=K(e.sessionKey)??``;for(let e of t.rules??[]){if(!e)continue;let t=vt(e.action)??`allow`,a=e.match??{},o=K(a.channel),s=q(a.chatType),c=K(a.keyPrefix);if(!(o&&o!==n)&&!(s&&s!==r)&&!(c&&!i.startsWith(c)))return t}return vt(t.default)??`allow`}function bt(e,t){let n=typeof e==`number`&&Number.isFinite(e)?e:t;return Math.max(1e3,Math.floor(n*1e3))}function xt(e,t,n){let r=t?.trim()||Ye[e];return!n||e===`audio`?r:`${r} Respond in at most ${n} characters.`}function St(e){let{capability:t,entry:n,cfg:r}=e,i=n.maxChars??e.config?.maxChars??r.tools?.media?.[t]?.maxChars;return typeof i==`number`?i:Ke[t]}function Ct(e){let t=e.entry.maxBytes??e.config?.maxBytes??e.cfg.tools?.media?.[e.capability]?.maxBytes;return typeof t==`number`?t:qe[e.capability]}function wt(e){return yt({scope:e.scope,sessionKey:e.ctx.SessionKey,channel:e.ctx.Surface??e.ctx.Provider,chatType:q(e.ctx.ChatType)})}function Tt(e){if((e.entry.type??(e.entry.command?`cli`:`provider`))===`cli`)return;let t=W(e.entry.provider??``);if(t)return e.providerRegistry.get(t)?.capabilities}function Et(e){let{cfg:t,capability:n,config:r}=e,i=t.tools?.media?.models??[],a=[...(r?.models??[]).map(e=>({entry:e,source:`capability`})),...i.map(e=>({entry:e,source:`shared`}))];return a.length===0?[]:a.filter(({entry:t,source:r})=>{let i=t.capabilities&&t.capabilities.length>0?t.capabilities:r===`shared`?Tt({entry:t,providerRegistry:e.providerRegistry}):void 0;return!i||i.length===0?r===`shared`?(o()&&c(`Skipping shared media model without capabilities: ${t.provider??t.command??`unknown`}`),!1):!0:i.includes(n)}).map(({entry:e})=>e)}function Dt(e){let t=e.tools?.media?.concurrency;return typeof t==`number`&&Number.isFinite(t)&&t>0?Math.floor(t):2}function Ot(e){return e==null?``:typeof e==`string`?e:typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`?String(e):typeof e==`symbol`||typeof e==`function`?e.toString():Array.isArray(e)?e.flatMap(e=>e==null?[]:typeof e==`string`?[e]:typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`?[String(e)]:[]).join(`,`):``}function kt(e,t){return e?e.replace(/{{\s*(\w+)\s*}}/g,(e,n)=>{let r=t[n];return Ot(r)}):``}function At(e){return Math.ceil(e/3)*4}function jt(e){let t=Math.floor(4/3*e);return Math.min(t,73400320)}function J(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Y(e,t){let n=e.trim();return!t||n.length<=t?n:n.slice(0,t).trim()}function Mt(e){let t=e=>{let n=e.trim();if(!n)return null;let r=n[0];if(r!==`{`&&r!==`"`)return null;try{let e=JSON.parse(n);if(typeof e==`string`)return t(e);if(e&&typeof e==`object`){let t=e.text;if(typeof t==`string`&&t.trim())return t.trim()}}catch{}return null},n=t(e);if(n)return n;let r=e.split(`
-`).map(e=>e.trim()).filter(Boolean);for(let e=r.length-1;e>=0;--e){let n=t(r[e]??``);if(n)return n}return null}function Nt(e){return C.parse(e).name}function X(e,t){for(let n=0;n<e.length;n+=1)if(t.includes(e[n]??``)){let t=e[n+1];if(t)return t}}function Pt(e,t){return e.some(e=>t.includes(e))}function Ft(e,t){let n=X(e,[`--output_dir`,`-o`]),r=X(e,[`--output_format`]);if(!n||!r||!r.split(`,`).map(e=>e.trim()).includes(`txt`))return null;let i=C.parse(t).name;return C.join(n,`${i}.txt`)}function It(e){if(!Pt(e,[`-otxt`,`--output-txt`]))return null;let t=X(e,[`-of`,`--output-file`]);return t?`${t}.txt`:null}function Lt(e,t){let n=X(e,[`--output-dir`]),r=X(e,[`--output-format`]);if(!n||r&&r!==`txt`)return null;let i=C.parse(t).name;return C.join(n,`${i}.txt`)}async function Rt(e){let t=Nt(e.command),n=t===`whisper-cli`?It(e.args):t===`whisper`?Ft(e.args,e.mediaPath):t===`parakeet-mlx`?Lt(e.args,e.mediaPath):null;if(n&&await B(n))try{let e=await w.readFile(n,`utf8`);if(e.trim())return e.trim()}catch{}if(t===`gemini`){let t=V(e.stdout);if(t)return t}if(t===`sherpa-onnx-offline`){let t=Mt(e.stdout);if(t)return t}return e.stdout.trim()}function zt(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Bt(e){if(!e)return;let t={};return typeof e.detectLanguage==`boolean`&&(t.detect_language=e.detectLanguage),typeof e.punctuate==`boolean`&&(t.punctuate=e.punctuate),typeof e.smartFormat==`boolean`&&(t.smart_format=e.smartFormat),Object.keys(t).length>0?t:void 0}function Vt(e){let t={...e};return`detectLanguage`in t&&(t.detect_language=t.detectLanguage,delete t.detectLanguage),`smartFormat`in t&&(t.smart_format=t.smartFormat,delete t.smartFormat),t}function Ht(e){let{providerId:t,config:n,entry:r}=e,i=zt({...n?.providerOptions?.[t],...r.providerOptions?.[t]});if(t!==`deepgram`)return i;let a=Vt(i??{}),o=Bt({...n?.deepgram,...r.deepgram});for(let[e,t]of Object.entries(o??{}))a[e]===void 0&&(a[e]=t);return Object.keys(a).length>0?a:void 0}function Z(e){if(e.entryType===`cli`){let t=e.entry.command?.trim();return{type:`cli`,provider:t??`cli`,model:e.entry.model??t,outcome:e.outcome,reason:e.reason}}let t=e.entry.provider?.trim();return{type:`provider`,provider:(t?W(t):void 0)??t,model:e.entry.model,outcome:e.outcome,reason:e.reason}}function Ut(e){let{capability:t,entry:n,cfg:r}=e,i=Ct({capability:t,entry:n,cfg:r,config:e.config}),a=St({capability:t,entry:n,cfg:r,config:e.config});return{maxBytes:i,maxChars:a,timeoutMs:bt(n.timeoutSeconds??e.config?.timeoutSeconds??r.tools?.media?.[t]?.timeoutSeconds,Je[t]),prompt:xt(t,n.prompt??e.config?.prompt??r.tools?.media?.[t]?.prompt,a)}}async function Wt(e){let t=await m({provider:e.providerId,cfg:e.cfg,profileId:e.entry.profile,preferredProfile:e.entry.preferredProfile,agentDir:e.agentDir});return{apiKeys:ce({provider:e.providerId,primaryApiKey:ee(t,e.providerId)}),providerConfig:e.cfg.models?.providers?.[e.providerId]}}async function Gt(e){let{apiKeys:t,providerConfig:n}=await Wt({providerId:e.providerId,cfg:e.cfg,entry:e.entry,agentDir:e.agentDir}),r=e.entry.baseUrl??e.config?.baseUrl??n?.baseUrl,i={...J(n?.headers),...J(e.config?.headers),...J(e.entry.headers)};return{apiKeys:t,baseUrl:r,headers:Object.keys(i).length>0?i:void 0}}function Kt(e){let t=Array.isArray(e.attachments)?e.attachments:[],n=t.length,r=t.filter(e=>e?.chosen?.outcome===`success`).length,i=t.find(e=>e?.chosen)?.chosen,a=typeof i?.provider==`string`?i.provider.trim():void 0,o=typeof i?.model==`string`?i.model.trim():void 0,s=a?o?`${a}/${o}`:a:void 0,c=t.flatMap(e=>(Array.isArray(e?.attempts)?e.attempts:[]).map(e=>typeof e?.reason==`string`?e.reason:void 0).filter(e=>!!e)).find(e=>e.trim().length>0),l=c?c.split(`:`)[0]?.trim():void 0,u=n>0?` (${r}/${n})`:``,d=s?` via ${s}`:``,f=l?` reason=${l}`:``;return`${e.capability}: ${e.outcome}${u}${d}${f}`}function qt(e){if(!(e.size>=1024))throw new M(`tooSmall`,`Audio attachment ${e.attachmentIndex+1} is too small (${e.size} bytes, minimum 1024)`)}async function Jt(e){let{entry:t,capability:n,cfg:r}=e,i=t.provider?.trim();if(!i)throw Error(`Provider entry missing provider for ${n}`);let a=W(i),{maxBytes:o,maxChars:s,timeoutMs:c,prompt:l}=Ut({capability:n,entry:t,cfg:r,config:e.config});if(n===`image`){if(!e.agentDir)throw Error(`Image understanding requires agentDir`);let n=t.model?.trim();if(!n)throw Error(`Image understanding requires model id`);let r=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),i=G(a,e.providerRegistry),u={buffer:r.buffer,fileName:r.fileName,mime:r.mime,model:n,provider:a,prompt:l,timeoutMs:c,profile:t.profile,preferredProfile:t.preferredProfile,agentDir:e.agentDir,cfg:e.cfg},d=await(i?.describeImage??x)(u);return{kind:`image.description`,attachmentIndex:e.attachmentIndex,text:Y(d.text,s),provider:a,model:d.model??n}}let u=G(a,e.providerRegistry);if(!u)throw Error(`Media provider not available: ${a}`);let d=le();if(n===`audio`){if(!u.transcribeAudio)throw Error(`Audio transcription provider "${a}" not available.`);let n=u.transcribeAudio,i=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c});qt({size:i.size,attachmentIndex:e.attachmentIndex});let{apiKeys:f,baseUrl:p,headers:m}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),h=Ht({providerId:a,config:e.config,entry:t}),g=t.model?.trim()||Xe[a]||t.model,_=await S({provider:a,apiKeys:f,execute:async a=>n({buffer:i.buffer,fileName:i.fileName,mime:i.mime,apiKey:a,baseUrl:p,headers:m,model:g,language:t.language??e.config?.language??r.tools?.media?.audio?.language,prompt:l,query:h,timeoutMs:c,fetchFn:d})});return{kind:`audio.transcription`,attachmentIndex:e.attachmentIndex,text:Y(_.text,s),provider:a,model:_.model??g}}if(!u.describeVideo)throw Error(`Video understanding provider "${a}" not available.`);let f=u.describeVideo,p=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),m=At(p.size),h=jt(o);if(m>h)throw new M(`maxBytes`,`Video attachment ${e.attachmentIndex+1} base64 payload ${m} exceeds ${h}`);let{apiKeys:g,baseUrl:_,headers:v}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),y=await S({provider:a,apiKeys:g,execute:e=>f({buffer:p.buffer,fileName:p.fileName,mime:p.mime,apiKey:e,baseUrl:_,headers:v,model:t.model,prompt:l,timeoutMs:c,fetchFn:d})});return{kind:`video.description`,attachmentIndex:e.attachmentIndex,text:Y(y.text,s),provider:a,model:y.model??t.model}}async function Yt(e){let{entry:t,capability:n,cfg:r,ctx:i}=e,a=t.command?.trim(),s=t.args??[];if(!a)throw Error(`CLI entry missing command for ${n}`);let{maxBytes:u,maxChars:f,timeoutMs:p,prompt:m}=Ut({capability:n,entry:t,cfg:r,config:e.config}),h=await e.cache.getPath({attachmentIndex:e.attachmentIndex,maxBytes:u,timeoutMs:p});n===`audio`&&qt({size:(await w.stat(h.path)).size,attachmentIndex:e.attachmentIndex});let g=await w.mkdtemp(C.join(l(),`openclaw-media-cli-`)),_=h.path,v=C.join(g,C.parse(_).name),y={...i,MediaPath:_,MediaDir:C.dirname(_),OutputDir:g,OutputBase:v,Prompt:m,MaxChars:f},b=[a,...s].map((e,t)=>t===0?e:kt(e,y));try{o()&&c(`Media understanding via CLI: ${b.join(` `)}`);let{stdout:t}=await d(b[0],b.slice(1),{timeoutMs:p,maxBuffer:z}),r=Y(await Rt({command:a,args:b.slice(1),stdout:t,mediaPath:_}),f);return r?{kind:n===`audio`?`audio.transcription`:`${n}.description`,attachmentIndex:e.attachmentIndex,text:r,provider:`cli`,model:a}:null}finally{await w.rm(g,{recursive:!0,force:!0}).catch(()=>{})}}function Q(e){return _t(e)}function Xt(e){return Ee(e)}function Zt(e){return b(ne(),_({cfg:e.cfg,accountId:e.ctx.AccountId}))}function Qt(e,t){return new Ge(e,t)}const $t=new Map,en=new Map;function tn(e){if(!e.startsWith(`~`))return e;let t=de.homedir();return e===`~`?t:e.startsWith(`~/`)?C.join(t,e.slice(2)):e}function nn(e){return e.includes(`/`)||e.includes(`\\`)}function rn(e){if(process.platform!==`win32`||C.extname(e))return[e];let t=(process.env.PATHEXT??`.EXE;.CMD;.BAT;.COM`).split(`;`).map(e=>e.trim()).filter(Boolean).map(e=>e.startsWith(`.`)?e:`.${e}`);return[e,...Array.from(new Set(t)).map(t=>`${e}${t}`)]}async function an(e){try{return(await w.stat(e)).isFile()?(process.platform===`win32`||await w.access(e,ue.X_OK),!0):!1}catch{return!1}}async function on(e){let t=$t.get(e);if(t)return t;let n=(async()=>{let t=tn(e.trim());if(t&&nn(t)){for(let e of rn(t))if(await an(e))return e}let n=e.trim();if(!n)return null;let r=(process.env.PATH??``).split(C.delimiter),i=rn(n);for(let e of r){let t=tn(e.trim().replace(/^"(.*)"$/,`$1`));if(t)for(let e of i){let n=C.join(t,e);if(await an(n))return n}}return null})();return $t.set(e,n),n}async function $(e){return!!await on(e)}async function sn(){let e=en.get(`gemini`);if(e)return e;let t=(async()=>{if(!await $(`gemini`))return!1;try{let{stdout:e}=await d(`gemini`,[`--output-format`,`json`,`ok`],{timeoutMs:8e3});return!!(V(e)??e.toLowerCase().includes(`ok`))}catch{return!1}})();return en.set(`gemini`,t),t}async function cn(){if(!await $(`whisper-cli`))return null;let e=process.env.WHISPER_CPP_MODEL?.trim(),t=e&&await B(e)?e:`/opt/homebrew/share/whisper-cpp/for-tests-ggml-tiny.bin`;return await B(t)?{type:`cli`,command:`whisper-cli`,args:[`-m`,t,`-otxt`,`-of`,`{{OutputBase}}`,`-np`,`-nt`,`{{MediaPath}}`]}:null}async function ln(){return await $(`whisper`)?{type:`cli`,command:`whisper`,args:[`--model`,`turbo`,`--output_format`,`txt`,`--output_dir`,`{{OutputDir}}`,`--verbose`,`False`,`{{MediaPath}}`]}:null}async function un(){if(!await $(`sherpa-onnx-offline`))return null;let e=process.env.SHERPA_ONNX_MODEL_DIR?.trim();if(!e)return null;let t=C.join(e,`tokens.txt`),n=C.join(e,`encoder.onnx`),r=C.join(e,`decoder.onnx`),i=C.join(e,`joiner.onnx`);return!await B(t)||!await B(n)||!await B(r)||!await B(i)?null:{type:`cli`,command:`sherpa-onnx-offline`,args:[`--tokens=${t}`,`--encoder=${n}`,`--decoder=${r}`,`--joiner=${i}`,`{{MediaPath}}`]}}async function dn(){return await un()||await cn()||await ln()}async function fn(e){return await sn()?{type:`cli`,command:`gemini`,args:[`--output-format`,`json`,`--allowed-tools`,`read_many_files`,`--include-directories`,`{{MediaDir}}`,`{{Prompt}}`,`Use read_many_files to read {{MediaPath}} and respond with only the text output.`]}:null}async function pn(e){let{cfg:t,agentDir:n,providerRegistry:r,capability:i}=e,a=async(e,a)=>{let o=G(e,r);if(!o||i===`audio`&&!o.transcribeAudio||i===`image`&&!o.describeImage||i===`video`&&!o.describeVideo)return null;try{return await m({provider:e,cfg:t,agentDir:n}),{type:`provider`,provider:e,model:a}}catch{return null}};if(i===`image`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of L){let t=R[e],n=await a(e,t);if(n)return n}return null}if(i===`video`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of Qe){let t=await a(e,void 0);if(t)return t}return null}let o=e.activeModel?.provider?.trim();if(o){let t=await a(o,e.activeModel?.model);if(t)return t}for(let e of Ze){let t=await a(e,void 0);if(t)return t}return null}function mn(t){let n=[],r=i(t.agents?.defaults?.imageModel);r?.trim()&&n.push(r.trim());for(let r of e(t.agents?.defaults?.imageModel))r?.trim()&&n.push(r.trim());if(n.length===0)return[];let a=[];for(let e of n){let t=e.indexOf(`/`);t<=0||t>=e.length-1||a.push({type:`provider`,provider:e.slice(0,t),model:e.slice(t+1)})}return a}async function hn(e){let t=await _n(e);if(t)return[t];if(e.capability===`audio`){let e=await dn();if(e)return[e]}if(e.capability===`image`){let t=mn(e.cfg);if(t.length>0)return t}let n=await fn(e.capability);if(n)return[n];let r=await pn(e);return r?[r]:[]}async function gn(e){let t=Q(),n=e=>{if(!e||e.type===`cli`)return null;let t=e.provider;if(!t)return null;let n=e.model??R[t];return n?{provider:t,model:n}:null};return n(await _n({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))||n(await pn({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))}async function _n(e){let t=e.activeModel?.provider?.trim();if(!t)return null;let n=W(t);if(!n)return null;let r=G(n,e.providerRegistry);if(!r||e.capability===`audio`&&!r.transcribeAudio||e.capability===`image`&&!r.describeImage||e.capability===`video`&&!r.describeVideo)return null;try{await m({provider:n,cfg:e.cfg,agentDir:e.agentDir})}catch{return null}return{type:`provider`,provider:n,model:e.activeModel?.model}}async function vn(e){let{entries:t,capability:n}=e,r=[];for(let i of t){let t=i.type??(i.command?`cli`:`provider`);try{let a=t===`cli`?await Yt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,config:e.config}):await Jt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,agentDir:e.agentDir,providerRegistry:e.providerRegistry,config:e.config});if(a){let e=Z({entry:i,entryType:t,outcome:`success`});return a.provider&&(e.provider=a.provider),a.model&&(e.model=a.model),r.push(e),{output:a,attempts:r}}r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`empty output`}))}catch(e){if(Re(e)){r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`${e.reason}: ${e.message}`})),o()&&c(`Skipping ${n} model due to ${e.reason}: ${e.message}`);continue}r.push(Z({entry:i,entryType:t,outcome:`failed`,reason:String(e)})),o()&&c(`${n} understanding failed: ${String(e)}`)}}return{output:null,attempts:r}}async function yn(e){let{capability:t,cfg:n,ctx:r}=e,i=e.config??n.tools?.media?.[t];if(i?.enabled===!1)return{outputs:[],decision:{capability:t,outcome:`disabled`,attachments:[]}};let a=i?.attachments,s=Ae({capability:t,attachments:e.media,policy:a});if(s.length===0)return{outputs:[],decision:{capability:t,outcome:`no-attachment`,attachments:[]}};if(wt({scope:i?.scope,ctx:r})===`deny`)return o()&&c(`${t} understanding disabled by scope policy.`),{outputs:[],decision:{capability:t,outcome:`scope-deny`,attachments:s.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let l=e.activeModel?.provider?.trim();if(t===`image`&&l&&O(we(await Ce({config:n}),l,e.activeModel?.model??``))){o()&&c(`Skipping image understanding: primary model supports vision natively`);let n=e.activeModel?.model?.trim();return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:s.map(e=>{let t={type:`provider`,provider:l,model:n||void 0,outcome:`skipped`,reason:`primary model supports vision natively`};return{attachmentIndex:e.index,attempts:[t],chosen:t}})}}}let u=Et({cfg:n,capability:t,config:i,providerRegistry:e.providerRegistry});if(u.length===0&&(u=await hn({cfg:n,agentDir:e.agentDir,providerRegistry:e.providerRegistry,capability:t,activeModel:e.activeModel})),u.length===0)return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:s.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let d=[],f=[];for(let a of s){let{output:o,attempts:s}=await vn({capability:t,cfg:n,ctx:r,attachmentIndex:a.index,agentDir:e.agentDir,providerRegistry:e.providerRegistry,cache:e.attachments,entries:u,config:i});o&&d.push(o),f.push({attachmentIndex:a.index,attempts:s,chosen:s.find(e=>e.outcome===`success`)})}let p={capability:t,outcome:d.length>0?`success`:`skipped`,attachments:f};return o()&&c(`Media understanding ${Kt(p)}`),{outputs:d,decision:p}}async function bn(e){let t=e.attachments??Xt(e.ctx);if(t.length===0)return{transcript:void 0,attachments:t};let n=Q(e.providers),r=Qt(t,e.localPathRoots?{localPathRoots:e.localPathRoots}:void 0);try{return{transcript:(await yn({capability:`audio`,cfg:e.cfg,ctx:e.ctx,attachments:r,media:t,agentDir:e.agentDir,providerRegistry:n,config:e.cfg.tools?.media?.audio,activeModel:e.activeModel})).outputs.find(e=>e.kind===`audio.transcription`)?.text?.trim()||void 0,attachments:t}}finally{await r.cleanup()}}export{Ce as C,we as S,Ne as _,gn as a,Ee as b,kt as c,q as d,yt as f,Le as g,R as h,Xt as i,Dt as l,z as m,Q as n,Zt as o,L as p,Qt as r,yn as s,bn as t,bt as u,A as v,O as w,k as x,Te as y};
+`).map(e=>e.trim()).filter(Boolean);for(let e=r.length-1;e>=0;--e){let n=t(r[e]??``);if(n)return n}return null}function Nt(e){return C.parse(e).name}function X(e,t){for(let n=0;n<e.length;n+=1)if(t.includes(e[n]??``)){let t=e[n+1];if(t)return t}}function Pt(e,t){return e.some(e=>t.includes(e))}function Ft(e,t){let n=X(e,[`--output_dir`,`-o`]),r=X(e,[`--output_format`]);if(!n||!r||!r.split(`,`).map(e=>e.trim()).includes(`txt`))return null;let i=C.parse(t).name;return C.join(n,`${i}.txt`)}function It(e){if(!Pt(e,[`-otxt`,`--output-txt`]))return null;let t=X(e,[`-of`,`--output-file`]);return t?`${t}.txt`:null}function Lt(e,t){let n=X(e,[`--output-dir`]),r=X(e,[`--output-format`]);if(!n||r&&r!==`txt`)return null;let i=C.parse(t).name;return C.join(n,`${i}.txt`)}async function Rt(e){let t=Nt(e.command),n=t===`whisper-cli`?It(e.args):t===`whisper`?Ft(e.args,e.mediaPath):t===`parakeet-mlx`?Lt(e.args,e.mediaPath):null;if(n&&await B(n))try{let e=await w.readFile(n,`utf8`);if(e.trim())return e.trim()}catch{}if(t===`gemini`){let t=V(e.stdout);if(t)return t}if(t===`sherpa-onnx-offline`){let t=Mt(e.stdout);if(t)return t}return e.stdout.trim()}function zt(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))r!==void 0&&(t[n]=r);return Object.keys(t).length>0?t:void 0}function Bt(e){if(!e)return;let t={};return typeof e.detectLanguage==`boolean`&&(t.detect_language=e.detectLanguage),typeof e.punctuate==`boolean`&&(t.punctuate=e.punctuate),typeof e.smartFormat==`boolean`&&(t.smart_format=e.smartFormat),Object.keys(t).length>0?t:void 0}function Vt(e){let t={...e};return`detectLanguage`in t&&(t.detect_language=t.detectLanguage,delete t.detectLanguage),`smartFormat`in t&&(t.smart_format=t.smartFormat,delete t.smartFormat),t}function Ht(e){let{providerId:t,config:n,entry:r}=e,i=zt({...n?.providerOptions?.[t],...r.providerOptions?.[t]});if(t!==`deepgram`)return i;let a=Vt(i??{}),o=Bt({...n?.deepgram,...r.deepgram});for(let[e,t]of Object.entries(o??{}))a[e]===void 0&&(a[e]=t);return Object.keys(a).length>0?a:void 0}function Z(e){if(e.entryType===`cli`){let t=e.entry.command?.trim();return{type:`cli`,provider:t??`cli`,model:e.entry.model??t,outcome:e.outcome,reason:e.reason}}let t=e.entry.provider?.trim();return{type:`provider`,provider:(t?W(t):void 0)??t,model:e.entry.model,outcome:e.outcome,reason:e.reason}}function Ut(e){let{capability:t,entry:n,cfg:r}=e,i=Ct({capability:t,entry:n,cfg:r,config:e.config}),a=St({capability:t,entry:n,cfg:r,config:e.config});return{maxBytes:i,maxChars:a,timeoutMs:bt(n.timeoutSeconds??e.config?.timeoutSeconds??r.tools?.media?.[t]?.timeoutSeconds,Je[t]),prompt:xt(t,n.prompt??e.config?.prompt??r.tools?.media?.[t]?.prompt,a)}}async function Wt(e){let t=await m({provider:e.providerId,cfg:e.cfg,profileId:e.entry.profile,preferredProfile:e.entry.preferredProfile,agentDir:e.agentDir});return{apiKeys:ce({provider:e.providerId,primaryApiKey:ee(t,e.providerId)}),providerConfig:e.cfg.models?.providers?.[e.providerId]}}async function Gt(e){let{apiKeys:t,providerConfig:n}=await Wt({providerId:e.providerId,cfg:e.cfg,entry:e.entry,agentDir:e.agentDir}),r=e.entry.baseUrl??e.config?.baseUrl??n?.baseUrl,i={...J(n?.headers),...J(e.config?.headers),...J(e.entry.headers)};return{apiKeys:t,baseUrl:r,headers:Object.keys(i).length>0?i:void 0}}function Kt(e){let t=Array.isArray(e.attachments)?e.attachments:[],n=t.length,r=t.filter(e=>e?.chosen?.outcome===`success`).length,i=t.find(e=>e?.chosen)?.chosen,a=typeof i?.provider==`string`?i.provider.trim():void 0,o=typeof i?.model==`string`?i.model.trim():void 0,s=a?o?`${a}/${o}`:a:void 0,c=t.flatMap(e=>(Array.isArray(e?.attempts)?e.attempts:[]).map(e=>typeof e?.reason==`string`?e.reason:void 0).filter(e=>!!e)).find(e=>e.trim().length>0),l=c?c.split(`:`)[0]?.trim():void 0,u=n>0?` (${r}/${n})`:``,d=s?` via ${s}`:``,f=l?` reason=${l}`:``;return`${e.capability}: ${e.outcome}${u}${d}${f}`}function qt(e){if(!(e.size>=1024))throw new M(`tooSmall`,`Audio attachment ${e.attachmentIndex+1} is too small (${e.size} bytes, minimum 1024)`)}async function Jt(e){let{entry:t,capability:n,cfg:r}=e,i=t.provider?.trim();if(!i)throw Error(`Provider entry missing provider for ${n}`);let a=W(i),{maxBytes:o,maxChars:s,timeoutMs:c,prompt:l}=Ut({capability:n,entry:t,cfg:r,config:e.config});if(n===`image`){if(!e.agentDir)throw Error(`Image understanding requires agentDir`);let n=t.model?.trim();if(!n)throw Error(`Image understanding requires model id`);let r=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),i=G(a,e.providerRegistry),u={buffer:r.buffer,fileName:r.fileName,mime:r.mime,model:n,provider:a,prompt:l,timeoutMs:c,profile:t.profile,preferredProfile:t.preferredProfile,agentDir:e.agentDir,cfg:e.cfg},d=await(i?.describeImage??x)(u);return{kind:`image.description`,attachmentIndex:e.attachmentIndex,text:Y(d.text,s),provider:a,model:d.model??n}}let u=G(a,e.providerRegistry);if(!u)throw Error(`Media provider not available: ${a}`);let d=le();if(n===`audio`){if(!u.transcribeAudio)throw Error(`Audio transcription provider "${a}" not available.`);let n=u.transcribeAudio,i=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c});qt({size:i.size,attachmentIndex:e.attachmentIndex});let{apiKeys:f,baseUrl:p,headers:m}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),h=Ht({providerId:a,config:e.config,entry:t}),g=t.model?.trim()||Xe[a]||t.model,_=await S({provider:a,apiKeys:f,execute:async a=>n({buffer:i.buffer,fileName:i.fileName,mime:i.mime,apiKey:a,baseUrl:p,headers:m,model:g,language:t.language??e.config?.language??r.tools?.media?.audio?.language,prompt:l,query:h,timeoutMs:c,fetchFn:d})});return{kind:`audio.transcription`,attachmentIndex:e.attachmentIndex,text:Y(_.text,s),provider:a,model:_.model??g}}if(!u.describeVideo)throw Error(`Video understanding provider "${a}" not available.`);let f=u.describeVideo,p=await e.cache.getBuffer({attachmentIndex:e.attachmentIndex,maxBytes:o,timeoutMs:c}),m=At(p.size),h=jt(o);if(m>h)throw new M(`maxBytes`,`Video attachment ${e.attachmentIndex+1} base64 payload ${m} exceeds ${h}`);let{apiKeys:g,baseUrl:_,headers:v}=await Gt({providerId:a,cfg:r,entry:t,config:e.config,agentDir:e.agentDir}),y=await S({provider:a,apiKeys:g,execute:e=>f({buffer:p.buffer,fileName:p.fileName,mime:p.mime,apiKey:e,baseUrl:_,headers:v,model:t.model,prompt:l,timeoutMs:c,fetchFn:d})});return{kind:`video.description`,attachmentIndex:e.attachmentIndex,text:Y(y.text,s),provider:a,model:y.model??t.model}}async function Yt(e){let{entry:t,capability:n,cfg:r,ctx:i}=e,a=t.command?.trim(),s=t.args??[];if(!a)throw Error(`CLI entry missing command for ${n}`);let{maxBytes:u,maxChars:f,timeoutMs:p,prompt:m}=Ut({capability:n,entry:t,cfg:r,config:e.config}),h=await e.cache.getPath({attachmentIndex:e.attachmentIndex,maxBytes:u,timeoutMs:p});n===`audio`&&qt({size:(await w.stat(h.path)).size,attachmentIndex:e.attachmentIndex});let g=await w.mkdtemp(C.join(l(),`openclaw-media-cli-`)),_=h.path,v=C.join(g,C.parse(_).name),y={...i,MediaPath:_,MediaDir:C.dirname(_),OutputDir:g,OutputBase:v,Prompt:m,MaxChars:f},b=[a,...s].map((e,t)=>t===0?e:kt(e,y));try{o()&&c(`Media understanding via CLI: ${b.join(` `)}`);let{stdout:t}=await d(b[0],b.slice(1),{timeoutMs:p,maxBuffer:z}),r=Y(await Rt({command:a,args:b.slice(1),stdout:t,mediaPath:_}),f);return r?{kind:n===`audio`?`audio.transcription`:`${n}.description`,attachmentIndex:e.attachmentIndex,text:r,provider:`cli`,model:a}:null}finally{await w.rm(g,{recursive:!0,force:!0}).catch(()=>{})}}function Q(e){return _t(e)}function Xt(e){return Ee(e)}function Zt(e){return b(ne(),_({cfg:e.cfg,accountId:e.ctx.AccountId}))}function Qt(e,t){return new Ge(e,t)}const $t=new Map,en=new Map;function tn(e){if(!e.startsWith(`~`))return e;let t=de.homedir();return e===`~`?t:e.startsWith(`~/`)?C.join(t,e.slice(2)):e}function nn(e){return e.includes(`/`)||e.includes(`\\`)}function rn(e){if(process.platform!==`win32`||C.extname(e))return[e];let t=(process.env.PATHEXT??`.EXE;.CMD;.BAT;.COM`).split(`;`).map(e=>e.trim()).filter(Boolean).map(e=>e.startsWith(`.`)?e:`.${e}`);return[e,...Array.from(new Set(t)).map(t=>`${e}${t}`)]}async function an(e){try{return(await w.stat(e)).isFile()?(process.platform===`win32`||await w.access(e,ue.X_OK),!0):!1}catch{return!1}}async function on(e){let t=$t.get(e);if(t)return t;let n=(async()=>{let t=tn(e.trim());if(t&&nn(t)){for(let e of rn(t))if(await an(e))return e}let n=e.trim();if(!n)return null;let r=(process.env.PATH??``).split(C.delimiter),i=rn(n);for(let e of r){let t=tn(e.trim().replace(/^"(.*)"$/,`$1`));if(t)for(let e of i){let n=C.join(t,e);if(await an(n))return n}}return null})();return $t.set(e,n),n}async function $(e){return!!await on(e)}async function sn(){let e=en.get(`gemini`);if(e)return e;let t=(async()=>{if(!await $(`gemini`))return!1;try{let{stdout:e}=await d(`gemini`,[`--output-format`,`json`,`ok`],{timeoutMs:8e3});return!!(V(e)??e.toLowerCase().includes(`ok`))}catch{return!1}})();return en.set(`gemini`,t),t}async function cn(){if(!await $(`whisper-cli`))return null;let e=process.env.WHISPER_CPP_MODEL?.trim(),t=e&&await B(e)?e:`/opt/homebrew/share/whisper-cpp/for-tests-ggml-tiny.bin`;return await B(t)?{type:`cli`,command:`whisper-cli`,args:[`-m`,t,`-otxt`,`-of`,`{{OutputBase}}`,`-np`,`-nt`,`{{MediaPath}}`]}:null}async function ln(){return await $(`whisper`)?{type:`cli`,command:`whisper`,args:[`--model`,`turbo`,`--output_format`,`txt`,`--output_dir`,`{{OutputDir}}`,`--verbose`,`False`,`{{MediaPath}}`]}:null}async function un(){if(!await $(`sherpa-onnx-offline`))return null;let e=process.env.SHERPA_ONNX_MODEL_DIR?.trim();if(!e)return null;let t=C.join(e,`tokens.txt`),n=C.join(e,`encoder.onnx`),r=C.join(e,`decoder.onnx`),i=C.join(e,`joiner.onnx`);return!await B(t)||!await B(n)||!await B(r)||!await B(i)?null:{type:`cli`,command:`sherpa-onnx-offline`,args:[`--tokens=${t}`,`--encoder=${n}`,`--decoder=${r}`,`--joiner=${i}`,`{{MediaPath}}`]}}async function dn(){return await un()||await cn()||await ln()}async function fn(e){return await sn()?{type:`cli`,command:`gemini`,args:[`--output-format`,`json`,`--allowed-tools`,`read_many_files`,`--include-directories`,`{{MediaDir}}`,`{{Prompt}}`,`Use read_many_files to read {{MediaPath}} and respond with only the text output.`]}:null}async function pn(e){let{cfg:t,agentDir:n,providerRegistry:r,capability:i}=e,a=async(e,a)=>{let o=G(e,r);if(!o||i===`audio`&&!o.transcribeAudio||i===`image`&&!o.describeImage||i===`video`&&!o.describeVideo)return null;try{return await m({provider:e,cfg:t,agentDir:n}),{type:`provider`,provider:e,model:a}}catch{return null}};if(i===`image`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of L){let t=R[e],n=await a(e,t);if(n)return n}return null}if(i===`video`){let t=e.activeModel?.provider?.trim();if(t){let n=await a(t,e.activeModel?.model);if(n)return n}for(let e of Qe){let t=await a(e,void 0);if(t)return t}return null}let o=e.activeModel?.provider?.trim();if(o){let t=await a(o,e.activeModel?.model);if(t)return t}for(let e of Ze){let t=await a(e,void 0);if(t)return t}return null}function mn(t){let n=[],r=i(t.agents?.defaults?.imageModel);r?.trim()&&n.push(r.trim());for(let r of e(t.agents?.defaults?.imageModel))r?.trim()&&n.push(r.trim());if(n.length===0)return[];let a=[];for(let e of n){let t=e.indexOf(`/`);t<=0||t>=e.length-1||a.push({type:`provider`,provider:e.slice(0,t),model:e.slice(t+1)})}return a}async function hn(e){let t=await _n(e);if(t)return[t];if(e.capability===`audio`){let e=await dn();if(e)return[e]}if(e.capability===`image`){let t=mn(e.cfg);if(t.length>0)return t}let n=await fn(e.capability);if(n)return[n];let r=await pn(e);return r?[r]:[]}async function gn(e){let t=Q(),n=e=>{if(!e||e.type===`cli`)return null;let t=e.provider;if(!t)return null;let n=e.model??R[t];return n?{provider:t,model:n}:null};return n(await _n({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))||n(await pn({cfg:e.cfg,agentDir:e.agentDir,providerRegistry:t,capability:`image`,activeModel:e.activeModel}))}async function _n(e){let t=e.activeModel?.provider?.trim();if(!t)return null;let n=W(t);if(!n)return null;let r=G(n,e.providerRegistry);if(!r||e.capability===`audio`&&!r.transcribeAudio||e.capability===`image`&&!r.describeImage||e.capability===`video`&&!r.describeVideo)return null;try{await m({provider:n,cfg:e.cfg,agentDir:e.agentDir})}catch{return null}return{type:`provider`,provider:n,model:e.activeModel?.model}}async function vn(e){let{entries:t,capability:n}=e,r=[];for(let i of t){let t=i.type??(i.command?`cli`:`provider`);try{let a=t===`cli`?await Yt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,config:e.config}):await Jt({capability:n,entry:i,cfg:e.cfg,ctx:e.ctx,attachmentIndex:e.attachmentIndex,cache:e.cache,agentDir:e.agentDir,providerRegistry:e.providerRegistry,config:e.config});if(a){let e=Z({entry:i,entryType:t,outcome:`success`});return a.provider&&(e.provider=a.provider),a.model&&(e.model=a.model),r.push(e),{output:a,attempts:r}}r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`empty output`}))}catch(e){if(Re(e)){r.push(Z({entry:i,entryType:t,outcome:`skipped`,reason:`${e.reason}: ${e.message}`})),o()&&c(`Skipping ${n} model due to ${e.reason}: ${e.message}`);continue}r.push(Z({entry:i,entryType:t,outcome:`failed`,reason:String(e)})),o()&&c(`${n} understanding failed: ${String(e)}`)}}return{output:null,attempts:r}}async function yn(e){let{capability:t,cfg:n,ctx:r}=e,i=e.config??n.tools?.media?.[t];if(i?.enabled===!1)return{outputs:[],decision:{capability:t,outcome:`disabled`,attachments:[]}};let a=i?.attachments,s=Ae({capability:t,attachments:e.media,policy:a});if(s.length===0)return{outputs:[],decision:{capability:t,outcome:`no-attachment`,attachments:[]}};if(wt({scope:i?.scope,ctx:r})===`deny`)return o()&&c(`${t} understanding disabled by scope policy.`),{outputs:[],decision:{capability:t,outcome:`scope-deny`,attachments:s.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let l=e.activeModel?.provider?.trim();if(t===`image`&&l&&O(we(await Ce({config:n}),l,e.activeModel?.model??``))){o()&&c(`Skipping image understanding: primary model supports vision natively`);let n=e.activeModel?.model?.trim();return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:s.map(e=>{let t={type:`provider`,provider:l,model:n||void 0,outcome:`skipped`,reason:`primary model supports vision natively`};return{attachmentIndex:e.index,attempts:[t],chosen:t}})}}}let u=Et({cfg:n,capability:t,config:i,providerRegistry:e.providerRegistry});if(u.length===0&&(u=await hn({cfg:n,agentDir:e.agentDir,providerRegistry:e.providerRegistry,capability:t,activeModel:e.activeModel})),u.length===0)return{outputs:[],decision:{capability:t,outcome:`skipped`,attachments:s.map(e=>({attachmentIndex:e.index,attempts:[]}))}};let d=[],f=[];for(let a of s){let{output:o,attempts:s}=await vn({capability:t,cfg:n,ctx:r,attachmentIndex:a.index,agentDir:e.agentDir,providerRegistry:e.providerRegistry,cache:e.attachments,entries:u,config:i});o&&d.push(o),f.push({attachmentIndex:a.index,attempts:s,chosen:s.find(e=>e.outcome===`success`)})}let p={capability:t,outcome:d.length>0?`success`:`skipped`,attachments:f};return o()&&c(`Media understanding ${Kt(p)}`),{outputs:d,decision:p}}async function bn(e){let t=e.attachments??Xt(e.ctx);if(t.length===0)return{transcript:void 0,attachments:t};let n=Q(e.providers),r=Qt(t,e.localPathRoots?{localPathRoots:e.localPathRoots}:void 0);try{return{transcript:(await yn({capability:`audio`,cfg:e.cfg,ctx:e.ctx,attachments:r,media:t,agentDir:e.agentDir,providerRegistry:n,config:e.cfg.tools?.media?.audio,activeModel:e.activeModel})).outputs.find(e=>e.kind===`audio.transcription`)?.text?.trim()||void 0,attachments:t}}finally{await r.cleanup()}}export{Ce as C,we as S,Ne as _,gn as a,Ee as b,kt as c,q as d,yt as f,Le as g,R as h,Xt as i,Dt as l,z as m,Q as n,Zt as o,L as p,Qt as r,yn as s,bn as t,bt as u,A as v,O as w,k as x,Te as y};

package/dist/audit-7DFnKINd.js

@@ -33,4 +33,4 @@ Native skill commands are enabled on at least one configured chat surface; treat
 `)+(r.length>12?`\n- +${r.length-12} more`:``),remediation:`Keep workspace skills inside the workspace root (replace symlinked escapes with real in-workspace files), or move trusted shared skills to managed/bundled skill locations.`}),t}async function It(e){let t=[];if(!e.configSnapshot.exists)return t;let n=e.configSnapshot.path,r=await mt({configPath:n,parsed:e.configSnapshot.parsed});if(r.length===0)return t;for(let n of r){let r=await c(n,{env:e.env,platform:e.platform,exec:e.execIcacls});r.ok&&(r.worldWritable||r.groupWritable?t.push({checkId:`fs.config_include.perms_writable`,severity:`critical`,title:`Config include file is writable by others`,detail:`${u(n,r)}; another user could influence your effective config.`,remediation:s({targetPath:n,perms:r,isDir:!1,posixMode:384,env:e.env})}):r.worldReadable?t.push({checkId:`fs.config_include.perms_world_readable`,severity:`critical`,title:`Config include file is world-readable`,detail:`${u(n,r)}; include files can contain tokens and private settings.`,remediation:s({targetPath:n,perms:r,isDir:!1,posixMode:384,env:e.env})}):r.groupReadable&&t.push({checkId:`fs.config_include.perms_group_readable`,severity:`warn`,title:`Config include file is group-readable`,detail:`${u(n,r)}; include files can contain tokens and private settings.`,remediation:s({targetPath:n,perms:r,isDir:!1,posixMode:384,env:e.env})}))}return t}async function Lt(e){let n=[],r=t(e.env,e.stateDir),i=await c(r,{env:e.env,platform:e.platform,exec:e.execIcacls});i.ok&&i.isDir&&(i.worldWritable||i.groupWritable?n.push({checkId:`fs.credentials_dir.perms_writable`,severity:`critical`,title:`Credentials dir is writable by others`,detail:`${u(r,i)}; another user could drop/modify credential files.`,remediation:s({targetPath:r,perms:i,isDir:!0,posixMode:448,env:e.env})}):(i.groupReadable||i.worldReadable)&&n.push({checkId:`fs.credentials_dir.perms_readable`,severity:`warn`,title:`Credentials dir is readable by others`,detail:`${u(r,i)}; credentials and allowlists can be sensitive.`,remediation:s({targetPath:r,perms:i,isDir:!0,posixMode:448,env:e.env})}));let a=Array.isArray(e.cfg.agents?.list)?e.cfg.agents?.list.map(e=>e&&typeof e==`object`&&typeof e.id==`string`?e.id.trim():``).filter(Boolean):[],o=w(e.cfg),l=Array.from(new Set([o,...a])).map(e=>T(e));for(let t of l){let r=z.join(e.stateDir,`agents`,t,`agent`),i=z.join(r,`auth-profiles.json`),a=await c(i,{env:e.env,platform:e.platform,exec:e.execIcacls});a.ok&&(a.worldWritable||a.groupWritable?n.push({checkId:`fs.auth_profiles.perms_writable`,severity:`critical`,title:`auth-profiles.json is writable by others`,detail:`${u(i,a)}; another user could inject credentials.`,remediation:s({targetPath:i,perms:a,isDir:!1,posixMode:384,env:e.env})}):(a.worldReadable||a.groupReadable)&&n.push({checkId:`fs.auth_profiles.perms_readable`,severity:`warn`,title:`auth-profiles.json is readable by others`,detail:`${u(i,a)}; auth-profiles.json contains API keys and OAuth tokens.`,remediation:s({targetPath:i,perms:a,isDir:!1,posixMode:384,env:e.env})}));let o=z.join(e.stateDir,`agents`,t,`sessions`,`sessions.json`),l=await c(o,{env:e.env,platform:e.platform,exec:e.execIcacls});l.ok&&(l.worldReadable||l.groupReadable)&&n.push({checkId:`fs.sessions_store.perms_readable`,severity:`warn`,title:`sessions.json is readable by others`,detail:`${u(o,l)}; routing and transcript metadata can be sensitive.`,remediation:s({targetPath:o,perms:l,isDir:!1,posixMode:384,env:e.env})})}let d=typeof e.cfg.logging?.file==`string`?e.cfg.logging.file.trim():``;if(d){let t=d.startsWith(`~`)?ht(d,e.env):d;if(t){let r=z.resolve(t),i=await c(r,{env:e.env,platform:e.platform,exec:e.execIcacls});i.ok&&(i.worldReadable||i.groupReadable)&&n.push({checkId:`fs.log_file.perms_readable`,severity:`warn`,title:`Log file is readable by others`,detail:`${u(r,i)}; logs can contain private messages and tool output.`,remediation:s({targetPath:r,perms:i,isDir:!1,posixMode:384,env:e.env})})}}return n}async function Rt(e){return await p({env:e.env,configPath:e.configPath}).readConfigFileSnapshot()}async function zt(e){let t=[],{extensionsDir:n,pluginDirs:r}=await _t({stateDir:e.stateDir,onReadError:e=>{t.push({checkId:`plugins.code_safety.scan_failed`,severity:`warn`,title:`Plugin extensions directory scan failed`,detail:`Static code scan could not list extensions directory: ${String(e)}`,remediation:"Check file permissions and plugin layout, then rerun `openclaw security audit --deep`."})}});for(let i of r){let r=z.join(n,i),a=await gt(r).catch(()=>[]),o=[],s=[];for(let e of a){let n=z.resolve(r,e);if(!k(r,n)){s.push(e);continue}ee(e)&&t.push({checkId:`plugins.code_safety.entry_path`,severity:`warn`,title:`Plugin "${i}" entry path is hidden or node_modules`,detail:`Extension entry "${e}" points to a hidden or node_modules path. Deep code scan will cover this entry explicitly, but review this path choice carefully.`,remediation:`Prefer extension entrypoints under normal source paths like dist/ or src/.`}),o.push(n)}s.length>0&&t.push({checkId:`plugins.code_safety.entry_escape`,severity:`critical`,title:`Plugin "${i}" has extension entry path traversal`,detail:`Found extension entries that escape the plugin directory:\n${s.map(e=>`  - ${e}`).join(`
 `)}`,remediation:`Update the plugin manifest so all openclaw.extensions entries stay inside the plugin directory.`});let c=await Tt({dirPath:r,includeFiles:o,summaryCache:e.summaryCache}).catch(e=>(t.push({checkId:`plugins.code_safety.scan_failed`,severity:`warn`,title:`Plugin "${i}" code scan failed`,detail:`Static code scan could not complete: ${String(e)}`,remediation:"Check file permissions and plugin layout, then rerun `openclaw security audit --deep`."}),null));if(c){if(c.critical>0){let e=Y(c.findings.filter(e=>e.severity===`critical`),r);t.push({checkId:`plugins.code_safety`,severity:`critical`,title:`Plugin "${i}" contains dangerous code patterns`,detail:`Found ${c.critical} critical issue(s) in ${c.scannedFiles} scanned file(s):\n${e}`,remediation:`Review the plugin source code carefully before use. If untrusted, remove the plugin from your OpenClaw extensions state directory.`})}else if(c.warn>0){let e=Y(c.findings.filter(e=>e.severity===`warn`),r);t.push({checkId:`plugins.code_safety`,severity:`warn`,title:`Plugin "${i}" contains suspicious code patterns`,detail:`Found ${c.warn} warning(s) in ${c.scannedFiles} scanned file(s):\n${e}`,remediation:`Review the flagged code to ensure it is intentional and safe.`})}}}return t}async function Bt(e){let t=[],n=z.join(e.stateDir,`extensions`),r=new Set,i=L(e.cfg);for(let a of i){let i=j(a,{config:e.cfg});for(let a of i){if(a.skill.source===`openclaw-bundled`)continue;let i=z.resolve(a.skill.baseDir);if(k(n,i)||r.has(i))continue;r.add(i);let o=a.skill.name,s=await Tt({dirPath:i,summaryCache:e.summaryCache}).catch(e=>(t.push({checkId:`skills.code_safety.scan_failed`,severity:`warn`,title:`Skill "${o}" code scan failed`,detail:`Static code scan could not complete for ${i}: ${String(e)}`,remediation:"Check file permissions and skill layout, then rerun `openclaw security audit --deep`."}),null));if(s){if(s.critical>0){let e=Y(s.findings.filter(e=>e.severity===`critical`),i);t.push({checkId:`skills.code_safety`,severity:`critical`,title:`Skill "${o}" contains dangerous code patterns`,detail:`Found ${s.critical} critical issue(s) in ${s.scannedFiles} scanned file(s) under ${i}:\n${e}`,remediation:`Review the skill source code before use. If untrusted, remove "${i}".`})}else if(s.warn>0){let e=Y(s.findings.filter(e=>e.severity===`warn`),i);t.push({checkId:`skills.code_safety`,severity:`warn`,title:`Skill "${o}" contains suspicious code patterns`,detail:`Found ${s.warn} warning(s) in ${s.scannedFiles} scanned file(s) under ${i}:\n${e}`,remediation:`Review flagged lines to ensure the behavior is intentional and safe.`})}}}}return t}function Vt(e){let t=[];if(e.gateway?.controlUi?.allowInsecureAuth===!0&&t.push(`gateway.controlUi.allowInsecureAuth=true`),e.gateway?.controlUi?.dangerouslyAllowHostHeaderOriginFallback===!0&&t.push(`gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true`),e.gateway?.controlUi?.dangerouslyDisableDeviceAuth===!0&&t.push(`gateway.controlUi.dangerouslyDisableDeviceAuth=true`),e.hooks?.gmail?.allowUnsafeExternalContent===!0&&t.push(`hooks.gmail.allowUnsafeExternalContent=true`),Array.isArray(e.hooks?.mappings))for(let[n,r]of e.hooks.mappings.entries())r?.allowUnsafeExternalContent===!0&&t.push(`hooks.mappings[${n}].allowUnsafeExternalContent=true`);return e.tools?.exec?.applyPatch?.workspaceOnly===!1&&t.push(`tools.exec.applyPatch.workspaceOnly=false`),t}function Ht(e){let t=0,n=0,r=0;for(let i of e)i.severity===`critical`?t+=1:i.severity===`warn`?n+=1:r+=1;return{critical:t,warn:n,info:r}}function Ut(e){return Array.isArray(e)?e.map(e=>String(e).trim()).filter(Boolean):[]}function Q(e){if(!(!e||typeof e!=`object`||Array.isArray(e)))return e}function $(e){return typeof e==`string`&&e.trim().length>0}function Wt(e){let t=Q(Q(e.channels)?.feishu);if(!t||t.enabled===!1)return!1;let n=Q(t.tools),r=n?.doc!==!1,i=$(t.appId),a=D(t.appSecret,e.secrets?.defaults),o=i&&a,s=Q(t.accounts);if(!s||Object.keys(s).length===0)return r&&o;for(let t of Object.values(s)){let r=Q(t)??{};if(r.enabled!==!1&&(Q(r.tools)??n)?.doc!==!1&&($(r.appId)||i)&&(D(r.appSecret,e.secrets?.defaults)||a))return!0}return!1}async function Gt(e){let t=[],n=await c(e.stateDir,{env:e.env,platform:e.platform,exec:e.execIcacls});n.ok&&(n.isSymlink&&t.push({checkId:`fs.state_dir.symlink`,severity:`warn`,title:`State dir is a symlink`,detail:`${e.stateDir} is a symlink; treat this as an extra trust boundary.`}),n.worldWritable?t.push({checkId:`fs.state_dir.perms_world_writable`,severity:`critical`,title:`State dir is world-writable`,detail:`${u(e.stateDir,n)}; other users can write into your OpenClaw state.`,remediation:s({targetPath:e.stateDir,perms:n,isDir:!0,posixMode:448,env:e.env})}):n.groupWritable?t.push({checkId:`fs.state_dir.perms_group_writable`,severity:`warn`,title:`State dir is group-writable`,detail:`${u(e.stateDir,n)}; group users can write into your OpenClaw state.`,remediation:s({targetPath:e.stateDir,perms:n,isDir:!0,posixMode:448,env:e.env})}):(n.groupReadable||n.worldReadable)&&t.push({checkId:`fs.state_dir.perms_readable`,severity:`warn`,title:`State dir is readable by others`,detail:`${u(e.stateDir,n)}; consider restricting to 700.`,remediation:s({targetPath:e.stateDir,perms:n,isDir:!0,posixMode:448,env:e.env})}));let r=await c(e.configPath,{env:e.env,platform:e.platform,exec:e.execIcacls});if(r.ok){let n=r.isSymlink;r.isSymlink&&t.push({checkId:`fs.config.symlink`,severity:`warn`,title:`Config file is a symlink`,detail:`${e.configPath} is a symlink; make sure you trust its target.`}),r.worldWritable||r.groupWritable?t.push({checkId:`fs.config.perms_writable`,severity:`critical`,title:`Config file is writable by others`,detail:`${u(e.configPath,r)}; another user could change gateway/auth/tool policies.`,remediation:s({targetPath:e.configPath,perms:r,isDir:!1,posixMode:384,env:e.env})}):!n&&r.worldReadable?t.push({checkId:`fs.config.perms_world_readable`,severity:`critical`,title:`Config file is world-readable`,detail:`${u(e.configPath,r)}; config can contain tokens and private settings.`,remediation:s({targetPath:e.configPath,perms:r,isDir:!1,posixMode:384,env:e.env})}):!n&&r.groupReadable&&t.push({checkId:`fs.config.perms_group_readable`,severity:`warn`,title:`Config file is group-readable`,detail:`${u(e.configPath,r)}; config can contain tokens and private settings.`,remediation:s({targetPath:e.configPath,perms:r,isDir:!1,posixMode:384,env:e.env})})}return t}function Kt(e,t){let n=[],i=typeof e.gateway?.bind==`string`?e.gateway.bind:`loopback`,a=e.gateway?.tailscale?.mode??`off`,o=r({authConfig:e.gateway?.auth,tailscaleMode:a,env:t}),s=e.gateway?.controlUi?.enabled!==!1,c=(e.gateway?.controlUi?.allowedOrigins??[]).map(e=>e.trim()).filter(Boolean),l=e.gateway?.controlUi?.dangerouslyAllowHostHeaderOriginFallback===!0,u=Array.isArray(e.gateway?.trustedProxies)?e.gateway.trustedProxies:[],d=typeof o.token==`string`&&o.token.trim().length>0,f=typeof o.password==`string`&&o.password.trim().length>0,p=$(t.OPENCLAW_GATEWAY_TOKEN)||$(t.CLAWDBOT_GATEWAY_TOKEN),m=$(t.OPENCLAW_GATEWAY_PASSWORD)||$(t.CLAWDBOT_GATEWAY_PASSWORD),h=D(e.gateway?.auth?.token,e.secrets?.defaults),g=D(e.gateway?.auth?.password,e.secrets?.defaults),_=D(e.gateway?.remote?.token,e.secrets?.defaults),v=e.gateway?.auth?.mode,y=d||p||h||_,b=v===`password`||v!==`token`&&v!==`none`&&v!==`trusted-proxy`&&!y,x=y,S=f||b&&(m||g),C=v===`token`?x:v===`password`?S:v===`none`||v===`trusted-proxy`?!1:x||S,w=o.allowTailscale&&a===`serve`,T=C||w,E=e.gateway?.allowRealIpFallback===!0,O=e.discovery?.mdns?.mode??`minimal`,k=Array.isArray(e.gateway?.tools?.allow)?e.gateway?.tools?.allow:[],ee=new Set(k.map(e=>typeof e==`string`?e.trim().toLowerCase():``).filter(Boolean)),A=fe.filter(e=>ee.has(e));if(A.length>0){let e=i!==`loopback`||a===`funnel`;n.push({checkId:`gateway.tools_invoke_http.dangerous_allow`,severity:e?`critical`:`warn`,title:`Gateway HTTP /tools/invoke re-enables dangerous tools`,detail:`gateway.tools.allow includes ${A.join(`, `)} which removes them from the default HTTP deny list. This can allow remote session spawning / control-plane actions via HTTP and increases RCE blast radius if the gateway is reachable.`,remediation:`Remove these entries from gateway.tools.allow (recommended). If you keep them enabled, keep gateway.bind loopback-only (or tailnet-only), restrict network exposure, and treat the gateway token/password as full-admin.`})}if(i!==`loopback`&&!C&&o.mode!==`trusted-proxy`&&n.push({checkId:`gateway.bind_no_auth`,severity:`critical`,title:`Gateway binds beyond loopback without auth`,detail:`gateway.bind="${i}" but no gateway.auth token/password is configured.`,remediation:`Set gateway.auth (token recommended) or bind to loopback.`}),i===`loopback`&&s&&u.length===0&&n.push({checkId:`gateway.trusted_proxies_missing`,severity:`warn`,title:`Reverse proxy headers are not trusted`,detail:`gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.`,remediation:`Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.`}),i===`loopback`&&s&&!T&&n.push({checkId:`gateway.loopback_no_auth`,severity:`critical`,title:`Gateway auth missing on loopback`,detail:`gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.`,remediation:`Set gateway.auth (token recommended) or keep the Control UI local-only.`}),i!==`loopback`&&s&&c.length===0&&!l&&n.push({checkId:`gateway.control_ui.allowed_origins_required`,severity:`critical`,title:`Non-loopback Control UI missing explicit allowed origins`,detail:`Control UI is enabled on a non-loopback bind but gateway.controlUi.allowedOrigins is empty. Strict origin policy requires explicit allowed origins for non-loopback deployments.`,remediation:`Set gateway.controlUi.allowedOrigins to full trusted origins (for example https://control.example.com). If your deployment intentionally relies on Host-header origin fallback, set gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true.`}),c.includes(`*`)){let e=i!==`loopback`;n.push({checkId:`gateway.control_ui.allowed_origins_wildcard`,severity:e?`critical`:`warn`,title:`Control UI allowed origins contains wildcard`,detail:`gateway.controlUi.allowedOrigins includes "*" which effectively disables origin allowlisting for Control UI/WebChat requests.`,remediation:`Replace wildcard origins with explicit trusted origins (for example https://control.example.com).`})}if(l){let e=i!==`loopback`;n.push({checkId:`gateway.control_ui.host_header_origin_fallback`,severity:e?`critical`:`warn`,title:`DANGEROUS: Host-header origin fallback enabled`,detail:`gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true enables Host-header origin fallback for Control UI/WebChat websocket checks and weakens DNS rebinding protections.`,remediation:`Disable gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback and configure explicit gateway.controlUi.allowedOrigins.`})}if(E){let e=u.some(e=>!qt(e)),t=i!==`loopback`||o.mode===`trusted-proxy`&&e;n.push({checkId:`gateway.real_ip_fallback_enabled`,severity:t?`critical`:`warn`,title:`X-Real-IP fallback is enabled`,detail:`gateway.allowRealIpFallback=true trusts X-Real-IP when trusted proxies omit X-Forwarded-For. Misconfigured proxies that forward client-supplied X-Real-IP can spoof source IP and local-client checks.`,remediation:`Keep gateway.allowRealIpFallback=false (default). Only enable this when your trusted proxy always overwrites X-Real-IP and cannot provide X-Forwarded-For.`})}if(O===`full`){let e=i!==`loopback`;n.push({checkId:`discovery.mdns_full_mode`,severity:e?`critical`:`warn`,title:`mDNS full mode can leak host metadata`,detail:`discovery.mdns.mode="full" publishes cliPath/sshPort in local-network TXT records. This can reveal usernames, filesystem layout, and management ports.`,remediation:`Prefer discovery.mdns.mode="minimal" (recommended) or "off", especially when gateway.bind is not loopback.`})}a===`funnel`?n.push({checkId:`gateway.tailscale_funnel`,severity:`critical`,title:`Tailscale Funnel exposure enabled`,detail:`gateway.tailscale.mode="funnel" exposes the Gateway publicly; keep auth strict and treat it as internet-facing.`,remediation:`Prefer tailscale.mode="serve" (tailnet-only) or set tailscale.mode="off".`}):a===`serve`&&n.push({checkId:`gateway.tailscale_serve`,severity:`info`,title:`Tailscale Serve exposure enabled`,detail:`gateway.tailscale.mode="serve" exposes the Gateway to your tailnet (loopback behind Tailscale).`}),e.gateway?.controlUi?.allowInsecureAuth===!0&&n.push({checkId:`gateway.control_ui.insecure_auth`,severity:`warn`,title:`Control UI insecure auth toggle enabled`,detail:`gateway.controlUi.allowInsecureAuth=true does not bypass secure context or device identity checks; only dangerouslyDisableDeviceAuth disables Control UI device identity checks.`,remediation:`Disable it or switch to HTTPS (Tailscale Serve) or localhost.`}),e.gateway?.controlUi?.dangerouslyDisableDeviceAuth===!0&&n.push({checkId:`gateway.control_ui.device_auth_disabled`,severity:`critical`,title:`DANGEROUS: Control UI device auth disabled`,detail:`gateway.controlUi.dangerouslyDisableDeviceAuth=true disables device identity checks for the Control UI.`,remediation:`Disable it unless you are in a short-lived break-glass scenario.`}),Wt(e)&&n.push({checkId:`channels.feishu.doc_owner_open_id`,severity:`warn`,title:`Feishu doc create can grant requester permissions`,detail:`channels.feishu tools include "doc"; feishu_doc action "create" can grant document access to the trusted requesting Feishu user.`,remediation:`Disable channels.feishu.tools.doc when not needed, and restrict tool access for untrusted prompts.`});let j=Vt(e);j.length>0&&n.push({checkId:`config.insecure_or_dangerous_flags`,severity:`warn`,title:`Insecure or dangerous config flags enabled`,detail:`Detected ${j.length} enabled flag(s): ${j.join(`, `)}.`,remediation:`Disable these flags when not actively debugging, or keep deployment scoped to trusted/local-only networks.`});let M=typeof o.token==`string`&&o.token.trim().length>0?o.token.trim():null;if(o.mode===`token`&&M&&M.length<24&&n.push({checkId:`gateway.token_too_short`,severity:`warn`,title:`Gateway token looks short`,detail:`gateway auth token is ${M.length} chars; prefer a long random token.`}),o.mode===`trusted-proxy`){let t=e.gateway?.trustedProxies??[],r=e.gateway?.auth?.trustedProxy;n.push({checkId:`gateway.trusted_proxy_auth`,severity:`critical`,title:`Trusted-proxy auth mode enabled`,detail:`gateway.auth.mode="trusted-proxy" delegates authentication to a reverse proxy. Ensure your proxy (Pomerium, Caddy, nginx) handles auth correctly and that gateway.trustedProxies only contains IPs of your actual proxy servers.`,remediation:`Verify: (1) Your proxy terminates TLS and authenticates users. (2) gateway.trustedProxies is restricted to proxy IPs only. (3) Direct access to the Gateway port is blocked by firewall. See /gateway/trusted-proxy-auth for setup guidance.`}),t.length===0&&n.push({checkId:`gateway.trusted_proxy_no_proxies`,severity:`critical`,title:`Trusted-proxy auth enabled but no trusted proxies configured`,detail:`gateway.auth.mode="trusted-proxy" but gateway.trustedProxies is empty. All requests will be rejected.`,remediation:`Set gateway.trustedProxies to the IP(s) of your reverse proxy.`}),r?.userHeader||n.push({checkId:`gateway.trusted_proxy_no_user_header`,severity:`critical`,title:`Trusted-proxy auth missing userHeader config`,detail:`gateway.auth.mode="trusted-proxy" but gateway.auth.trustedProxy.userHeader is not configured.`,remediation:`Set gateway.auth.trustedProxy.userHeader to the header name your proxy uses (e.g., "x-forwarded-user", "x-pomerium-claim-email").`}),(r?.allowUsers??[]).length===0&&n.push({checkId:`gateway.trusted_proxy_no_allowlist`,severity:`warn`,title:`Trusted-proxy auth allows all authenticated users`,detail:`gateway.auth.trustedProxy.allowUsers is empty, so any user authenticated by your proxy can access the Gateway.`,remediation:`Consider setting gateway.auth.trustedProxy.allowUsers to restrict access to specific users (e.g., ["nick@example.com"]).`})}return i!==`loopback`&&o.mode!==`trusted-proxy`&&!e.gateway?.auth?.rateLimit&&n.push({checkId:`gateway.auth_no_rate_limit`,severity:`warn`,title:`No auth rate limiting configured`,detail:`gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.`,remediation:`Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).`}),n}function qt(e){let t=e.trim();if(!t)return!1;if(!t.includes(`/`))return t===`127.0.0.1`||t.toLowerCase()===`::1`;let[n,r]=t.split(`/`,2);if(!n||!r)return!1;let i=Ce(n.trim()),a=Number.parseInt(r.trim(),10);return Number.isInteger(a)?i===4?n.trim()===`127.0.0.1`&&a===32:i===6?a===128&&n.trim().toLowerCase()===`::1`:!1:!1}function Jt(e,t){let r=[],a;try{a=v(e.browser,e)}catch(e){return r.push({checkId:`browser.control_invalid_config`,severity:`warn`,title:`Browser control config looks invalid`,detail:String(e),remediation:`Fix browser.cdpUrl in ${n()} and re-run "${O(`openclaw security audit --deep`)}".`}),r}if(!a.enabled)return r;let o=i(e,t),s=e.gateway?.auth?.mode,c=!!o.token||$(t.OPENCLAW_GATEWAY_TOKEN)||$(t.CLAWDBOT_GATEWAY_TOKEN)||D(e.gateway?.auth?.token,e.secrets?.defaults),l=s===`password`||s!==`token`&&s!==`none`&&s!==`trusted-proxy`&&!c,u=!!o.password||l&&($(t.OPENCLAW_GATEWAY_PASSWORD)||$(t.CLAWDBOT_GATEWAY_PASSWORD)||D(e.gateway?.auth?.password,e.secrets?.defaults));!c&&!u&&r.push({checkId:`browser.control_no_auth`,severity:`critical`,title:`Browser control has no auth`,detail:`Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.`,remediation:`Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled.`});for(let e of Object.keys(a.profiles)){let t=g(a,e);if(!t||t.cdpIsLoopback)continue;let n;try{n=new URL(t.cdpUrl)}catch{continue}n.protocol===`http:`&&r.push({checkId:`browser.remote_cdp_http`,severity:`warn`,title:`Remote CDP uses HTTP`,detail:`browser profile "${e}" uses http CDP (${t.cdpUrl}); this is OK only if it's tailnet-only or behind an encrypted tunnel.`,remediation:`Prefer HTTPS/TLS or a tailnet-only endpoint for remote CDP.`})}return r}function Yt(e){return e.logging?.redactSensitive===`off`?[{checkId:`logging.redact_off`,severity:`warn`,title:`Tool summary redaction is disabled`,detail:`logging.redactSensitive="off" can leak secrets into logs and status output.`,remediation:`Set logging.redactSensitive="tools".`}]:[]}function Xt(e){let t=[],n=e.tools?.elevated?.enabled,r=e.tools?.elevated?.allowFrom??{},i=Object.keys(r).length>0;if(n===!1||!i)return t;for(let[e,n]of Object.entries(r)){let r=Ut(n);r.includes(`*`)?t.push({checkId:`tools.elevated.allowFrom.${e}.wildcard`,severity:`critical`,title:`Elevated exec allowlist contains wildcard`,detail:`tools.elevated.allowFrom.${e} includes "*" which effectively approves everyone on that channel for elevated mode.`}):r.length>25&&t.push({checkId:`tools.elevated.allowFrom.${e}.large`,severity:`warn`,title:`Elevated exec allowlist is large`,detail:`tools.elevated.allowFrom.${e} has ${r.length} entries; consider tightening elevated access.`})}return t}function Zt(e){let t=[],n=e.tools?.exec?.host,r=x(e).mode;n===`sandbox`&&r===`off`&&t.push({checkId:`tools.exec.host_sandbox_no_sandbox_defaults`,severity:`warn`,title:`Exec host is sandbox but sandbox mode is off`,detail:`tools.exec.host is explicitly set to sandbox while agents.defaults.sandbox.mode=off. In this mode, exec runs directly on the gateway host.`,remediation:'Enable sandbox mode (`agents.defaults.sandbox.mode="non-main"` or `"all"`) or set tools.exec.host to "gateway" with approvals.'});let i=Array.isArray(e.agents?.list)?e.agents.list:[],a=i.filter(t=>t&&typeof t==`object`&&typeof t.id==`string`&&t.tools?.exec?.host===`sandbox`&&x(e,t.id).mode===`off`).map(e=>e.id).slice(0,5);a.length>0&&t.push({checkId:`tools.exec.host_sandbox_no_sandbox_agents`,severity:`warn`,title:`Agent exec host uses sandbox while sandbox mode is off`,detail:`agents.list.*.tools.exec.host is set to sandbox for: ${a.join(`, `)}. With sandbox mode off, exec runs directly on the gateway host.`,remediation:'Enable sandbox mode for these agents (`agents.list[].sandbox.mode`) or set their tools.exec.host to "gateway".'});let o=e=>Array.isArray(e)?Array.from(new Set(e.map(e=>typeof e==`string`?e.trim().toLowerCase():``).filter(e=>e.length>0))).toSorted():[],s=e=>Array.isArray(e)?b(e.filter(e=>typeof e==`string`)):[],c=e=>{let t=e.trim();if(!t)return null;if(!z.isAbsolute(t))return`relative path (trust boundary depends on process cwd)`;let n=z.resolve(t).replace(/\\/g,`/`).toLowerCase();return n===`/tmp`||n.startsWith(`/tmp/`)||n===`/var/tmp`||n.startsWith(`/var/tmp/`)||n===`/private/tmp`||n.startsWith(`/private/tmp/`)?`temporary directory is mutable and easy to poison`:n===`/usr/local/bin`||n===`/opt/homebrew/bin`||n===`/opt/local/bin`||n===`/home/linuxbrew/.linuxbrew/bin`?`package-manager bin directory (often user-writable)`:n.startsWith(`/users/`)||n.startsWith(`/home/`)||n.includes(`/.local/bin`)||/^[a-z]:\/users\//.test(n)?`home-scoped bin directory (typically user-writable)`:null},l=e.tools?.exec,u=[],d=(e,t)=>{for(let n of s(t)){let t=c(n);t&&u.push(`- ${e}.safeBinTrustedDirs: ${n} (${t})`)}};d(`tools.exec`,l?.safeBinTrustedDirs);for(let e of i)!e||typeof e!=`object`||typeof e.id!=`string`||d(`agents.list.${e.id}.tools.exec`,e.tools?.exec?.safeBinTrustedDirs);let f=[],p=o(l?.safeBins);if(p.length>0){let e=ae({global:l})??{},t=oe(p).filter(t=>!e[t]);t.length>0&&f.push(`- tools.exec.safeBins: ${t.join(`, `)}`)}for(let e of i){if(!e||typeof e!=`object`||typeof e.id!=`string`)continue;let t=e.tools?.exec,n=o(t?.safeBins);if(n.length===0)continue;let r=ae({global:l,local:t})??{},i=oe(n).filter(e=>!r[e]);i.length!==0&&f.push(`- agents.list.${e.id}.tools.exec.safeBins: ${i.join(`, `)}`)}return f.length>0&&t.push({checkId:`tools.exec.safe_bins_interpreter_unprofiled`,severity:`warn`,title:`safeBins includes interpreter/runtime binaries without explicit profiles`,detail:`Detected interpreter-like safeBins entries missing explicit profiles:\n${f.join(`
 `)}\nThese entries can turn safeBins into a broad execution surface when used with permissive argv profiles.`,remediation:`Remove interpreter/runtime bins from safeBins (prefer allowlist entries) or define hardened tools.exec.safeBinProfiles.<bin> rules.`}),u.length>0&&t.push({checkId:`tools.exec.safe_bin_trusted_dirs_risky`,severity:`warn`,title:`safeBinTrustedDirs includes risky mutable directories`,detail:`Detected risky safeBinTrustedDirs entries:\n${u.slice(0,10).join(`
-`)}`+(u.length>10?`\n- +${u.length-10} more entries.`:``),remediation:`Prefer root-owned immutable bins, keep default trust dirs (/bin, /usr/bin), and avoid trusting temporary/home/package-manager paths unless tightly controlled.`}),t}async function Qt(e){let t=ie({config:e.cfg}).url,n=e.cfg.gateway?.mode===`remote`,r=typeof e.cfg.gateway?.remote?.url==`string`?e.cfg.gateway.remote.url.trim():``,i=me(!n||n&&!r?{cfg:e.cfg,env:e.env,mode:`local`}:{cfg:e.cfg,env:e.env,mode:`remote`}),a=await e.probe({url:t,auth:i.auth,timeoutMs:e.timeoutMs}).catch(e=>({ok:!1,url:t,connectLatencyMs:null,error:String(e),close:null,health:null,status:null,presence:null,configSnapshot:null}));return i.warning&&!a.ok&&(a.error=a.error?`${a.error}; ${i.warning}`:i.warning),{deep:{gateway:{attempted:!0,url:t,ok:a.ok,error:a.ok?null:a.error,close:a.close?{code:a.close.code,reason:a.close.reason}:null}},authWarning:i.warning}}async function $t(t){let r=t.config,i=t.sourceConfig??t.config,a=t.env??process.env,o=t.platform??process.platform,s=t.includeFilesystem!==!1,c=t.includeChannelSecurity!==!1,l=t.deep===!0,u=Math.max(250,t.deepTimeoutMs??5e3),d=t.stateDir??e(a),f=t.configPath??n(a,d),p=s?t.configSnapshot===void 0?await Rt({env:a,configPath:f}).catch(()=>null):t.configSnapshot:null;return{cfg:r,sourceConfig:i,env:a,platform:o,includeFilesystem:s,includeChannelSecurity:c,deep:l,deepTimeoutMs:u,stateDir:d,configPath:f,execIcacls:t.execIcacls,execDockerRawFn:t.execDockerRawFn,probeGatewayFn:t.probeGatewayFn,plugins:t.plugins,configSnapshot:p,codeSafetySummaryCache:t.codeSafetySummaryCache??new Map}}async function en(e){let t=[],n=await $t(e),{cfg:r,env:i,platform:a,stateDir:o,configPath:s}=n;if(t.push(...Ze(r)),t.push(...Qe({stateDir:o,configPath:s})),t.push(...Kt(r,i)),t.push(...Jt(r,i)),t.push(...Yt(r)),t.push(...Xt(r)),t.push(...Zt(r)),t.push(...et(r,i)),t.push(...nt(r,i)),t.push(...tt(r)),t.push(...rt(r)),t.push(...it(r)),t.push(...at(r)),t.push(...ot(r)),t.push(...st(r)),t.push(...$e(r)),t.push(...ct(r)),t.push(...lt({cfg:r,env:i})),t.push(...ut(r)),t.push(...dt(r)),n.includeFilesystem&&(t.push(...await Gt({stateDir:o,configPath:s,env:i,platform:a,execIcacls:n.execIcacls})),n.configSnapshot&&t.push(...await It({configSnapshot:n.configSnapshot,env:i,platform:a,execIcacls:n.execIcacls})),t.push(...await Lt({cfg:r,env:i,stateDir:o,platform:a,execIcacls:n.execIcacls})),t.push(...await Ft({cfg:r})),t.push(...await Nt({execDockerRawFn:n.execDockerRawFn})),t.push(...await Pt({cfg:r,stateDir:o})),n.deep&&(t.push(...await zt({stateDir:o,summaryCache:n.codeSafetySummaryCache})),t.push(...await Bt({cfg:r,stateDir:o,summaryCache:n.codeSafetySummaryCache})))),n.includeChannelSecurity){let e=n.plugins??ne();t.push(...await De({cfg:r,sourceConfig:n.sourceConfig,plugins:e}))}let c=n.deep?await Qt({cfg:r,env:i,timeoutMs:n.deepTimeoutMs,probe:n.probeGatewayFn??pe}):void 0,l=c?.deep;l?.gateway?.attempted&&!l.gateway.ok&&t.push({checkId:`gateway.probe_failed`,severity:`warn`,title:`Gateway probe failed (deep)`,detail:l.gateway.error??`gateway unreachable`,remediation:`Run "${O(`openclaw status --all`)}" to debug connectivity/auth, then re-run "${O(`openclaw security audit --deep`)}".`}),c?.authWarning&&t.push({checkId:`gateway.probe_auth_secretref_unavailable`,severity:`warn`,title:`Gateway probe auth SecretRef is unavailable`,detail:c.authWarning,remediation:`Set OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD in this shell or resolve the external secret provider, then re-run "${O(`openclaw security audit --deep`)}".`});let u=Ht(t);return{ts:Date.now(),summary:u,findings:t,deep:l}}export{Vt as n,mt as r,en as t};
+`)}`+(u.length>10?`\n- +${u.length-10} more entries.`:``),remediation:`Prefer root-owned immutable bins, keep default trust dirs (/bin, /usr/bin), and avoid trusting temporary/home/package-manager paths unless tightly controlled.`}),t}async function Qt(e){let t=ie({config:e.cfg}).url,n=e.cfg.gateway?.mode===`remote`,r=typeof e.cfg.gateway?.remote?.url==`string`?e.cfg.gateway.remote.url.trim():``,i=me(!n||n&&!r?{cfg:e.cfg,env:e.env,mode:`local`}:{cfg:e.cfg,env:e.env,mode:`remote`}),a=await e.probe({url:t,auth:i.auth,timeoutMs:e.timeoutMs}).catch(e=>({ok:!1,url:t,connectLatencyMs:null,error:String(e),close:null,health:null,status:null,presence:null,configSnapshot:null}));return i.warning&&!a.ok&&(a.error=a.error?`${a.error}; ${i.warning}`:i.warning),{deep:{gateway:{attempted:!0,url:t,ok:a.ok,error:a.ok?null:a.error,close:a.close?{code:a.close.code,reason:a.close.reason}:null}},authWarning:i.warning}}async function $t(t){let r=t.config,i=t.sourceConfig??t.config,a=t.env??process.env,o=t.platform??process.platform,s=t.includeFilesystem!==!1,c=t.includeChannelSecurity!==!1,l=t.deep===!0,u=Math.max(250,t.deepTimeoutMs??5e3),d=t.stateDir??e(a),f=t.configPath??n(a,d),p=s?t.configSnapshot===void 0?await Rt({env:a,configPath:f}).catch(()=>null):t.configSnapshot:null;return{cfg:r,sourceConfig:i,env:a,platform:o,includeFilesystem:s,includeChannelSecurity:c,deep:l,deepTimeoutMs:u,stateDir:d,configPath:f,execIcacls:t.execIcacls,execDockerRawFn:t.execDockerRawFn,probeGatewayFn:t.probeGatewayFn,plugins:t.plugins,configSnapshot:p,codeSafetySummaryCache:t.codeSafetySummaryCache??new Map}}async function en(e){let t=[],n=await $t(e),{cfg:r,env:i,platform:a,stateDir:o,configPath:s}=n;if(t.push(...Ze(r)),t.push(...Qe({stateDir:o,configPath:s})),t.push(...Kt(r,i)),t.push(...Jt(r,i)),t.push(...Yt(r)),t.push(...Xt(r)),t.push(...Zt(r)),t.push(...et(r,i)),t.push(...nt(r,i)),t.push(...tt(r)),t.push(...rt(r)),t.push(...it(r)),t.push(...at(r)),t.push(...ot(r)),t.push(...st(r)),t.push(...$e(r)),t.push(...ct(r)),t.push(...lt({cfg:r,env:i})),t.push(...ut(r)),t.push(...dt(r)),n.includeFilesystem&&(t.push(...await Gt({stateDir:o,configPath:s,env:i,platform:a,execIcacls:n.execIcacls})),n.configSnapshot&&t.push(...await It({configSnapshot:n.configSnapshot,env:i,platform:a,execIcacls:n.execIcacls})),t.push(...await Lt({cfg:r,env:i,stateDir:o,platform:a,execIcacls:n.execIcacls})),t.push(...await Ft({cfg:r})),t.push(...await Nt({execDockerRawFn:n.execDockerRawFn})),t.push(...await Pt({cfg:r,stateDir:o})),n.deep&&(t.push(...await zt({stateDir:o,summaryCache:n.codeSafetySummaryCache})),t.push(...await Bt({cfg:r,stateDir:o,summaryCache:n.codeSafetySummaryCache})))),n.includeChannelSecurity){let e=n.plugins??ne();t.push(...await De({cfg:r,sourceConfig:n.sourceConfig,plugins:e}))}let c=n.deep?await Qt({cfg:r,env:i,timeoutMs:n.deepTimeoutMs,probe:n.probeGatewayFn??pe}):void 0,l=c?.deep;l?.gateway?.attempted&&!l.gateway.ok&&t.push({checkId:`gateway.probe_failed`,severity:`warn`,title:`Gateway probe failed (deep)`,detail:l.gateway.error??`gateway unreachable`,remediation:`Run "${O(`openclaw status --all`)}" to debug connectivity/auth, then re-run "${O(`openclaw security audit --deep`)}".`}),c?.authWarning&&t.push({checkId:`gateway.probe_auth_secretref_unavailable`,severity:`warn`,title:`Gateway probe auth SecretRef is unavailable`,detail:c.authWarning,remediation:`Set OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD in this shell or resolve the external secret provider, then re-run "${O(`openclaw security audit --deep`)}".`});let u=Ht(t);return{ts:Date.now(),summary:u,findings:t,deep:l}}export{Vt as n,mt as r,en as t};

package/dist/audit-B6LsW3Ai.js

@@ -33,4 +33,4 @@ Native skill commands are enabled on at least one configured chat surface; treat
 `)+(r.length>12?`\n- +${r.length-12} more`:``),remediation:`Keep workspace skills inside the workspace root (replace symlinked escapes with real in-workspace files), or move trusted shared skills to managed/bundled skill locations.`}),t}async function It(e){let t=[];if(!e.configSnapshot.exists)return t;let n=e.configSnapshot.path,r=await mt({configPath:n,parsed:e.configSnapshot.parsed});if(r.length===0)return t;for(let n of r){let r=await p(n,{env:e.env,platform:e.platform,exec:e.execIcacls});r.ok&&(r.worldWritable||r.groupWritable?t.push({checkId:`fs.config_include.perms_writable`,severity:`critical`,title:`Config include file is writable by others`,detail:`${y(n,r)}; another user could influence your effective config.`,remediation:x({targetPath:n,perms:r,isDir:!1,posixMode:384,env:e.env})}):r.worldReadable?t.push({checkId:`fs.config_include.perms_world_readable`,severity:`critical`,title:`Config include file is world-readable`,detail:`${y(n,r)}; include files can contain tokens and private settings.`,remediation:x({targetPath:n,perms:r,isDir:!1,posixMode:384,env:e.env})}):r.groupReadable&&t.push({checkId:`fs.config_include.perms_group_readable`,severity:`warn`,title:`Config include file is group-readable`,detail:`${y(n,r)}; include files can contain tokens and private settings.`,remediation:x({targetPath:n,perms:r,isDir:!1,posixMode:384,env:e.env})}))}return t}async function Lt(e){let n=[],r=t(e.env,e.stateDir),i=await p(r,{env:e.env,platform:e.platform,exec:e.execIcacls});i.ok&&i.isDir&&(i.worldWritable||i.groupWritable?n.push({checkId:`fs.credentials_dir.perms_writable`,severity:`critical`,title:`Credentials dir is writable by others`,detail:`${y(r,i)}; another user could drop/modify credential files.`,remediation:x({targetPath:r,perms:i,isDir:!0,posixMode:448,env:e.env})}):(i.groupReadable||i.worldReadable)&&n.push({checkId:`fs.credentials_dir.perms_readable`,severity:`warn`,title:`Credentials dir is readable by others`,detail:`${y(r,i)}; credentials and allowlists can be sensitive.`,remediation:x({targetPath:r,perms:i,isDir:!0,posixMode:448,env:e.env})}));let a=Array.isArray(e.cfg.agents?.list)?e.cfg.agents?.list.map(e=>e&&typeof e==`object`&&typeof e.id==`string`?e.id.trim():``).filter(Boolean):[],o=T(e.cfg),s=Array.from(new Set([o,...a])).map(e=>E(e));for(let t of s){let r=B.join(e.stateDir,`agents`,t,`agent`),i=B.join(r,`auth-profiles.json`),a=await p(i,{env:e.env,platform:e.platform,exec:e.execIcacls});a.ok&&(a.worldWritable||a.groupWritable?n.push({checkId:`fs.auth_profiles.perms_writable`,severity:`critical`,title:`auth-profiles.json is writable by others`,detail:`${y(i,a)}; another user could inject credentials.`,remediation:x({targetPath:i,perms:a,isDir:!1,posixMode:384,env:e.env})}):(a.worldReadable||a.groupReadable)&&n.push({checkId:`fs.auth_profiles.perms_readable`,severity:`warn`,title:`auth-profiles.json is readable by others`,detail:`${y(i,a)}; auth-profiles.json contains API keys and OAuth tokens.`,remediation:x({targetPath:i,perms:a,isDir:!1,posixMode:384,env:e.env})}));let o=B.join(e.stateDir,`agents`,t,`sessions`,`sessions.json`),s=await p(o,{env:e.env,platform:e.platform,exec:e.execIcacls});s.ok&&(s.worldReadable||s.groupReadable)&&n.push({checkId:`fs.sessions_store.perms_readable`,severity:`warn`,title:`sessions.json is readable by others`,detail:`${y(o,s)}; routing and transcript metadata can be sensitive.`,remediation:x({targetPath:o,perms:s,isDir:!1,posixMode:384,env:e.env})})}let c=typeof e.cfg.logging?.file==`string`?e.cfg.logging.file.trim():``;if(c){let t=c.startsWith(`~`)?ht(c,e.env):c;if(t){let r=B.resolve(t),i=await p(r,{env:e.env,platform:e.platform,exec:e.execIcacls});i.ok&&(i.worldReadable||i.groupReadable)&&n.push({checkId:`fs.log_file.perms_readable`,severity:`warn`,title:`Log file is readable by others`,detail:`${y(r,i)}; logs can contain private messages and tool output.`,remediation:x({targetPath:r,perms:i,isDir:!1,posixMode:384,env:e.env})})}}return n}async function Rt(e){return await a({env:e.env,configPath:e.configPath}).readConfigFileSnapshot()}async function zt(e){let t=[],{extensionsDir:n,pluginDirs:r}=await _t({stateDir:e.stateDir,onReadError:e=>{t.push({checkId:`plugins.code_safety.scan_failed`,severity:`warn`,title:`Plugin extensions directory scan failed`,detail:`Static code scan could not list extensions directory: ${String(e)}`,remediation:"Check file permissions and plugin layout, then rerun `openclaw security audit --deep`."})}});for(let i of r){let r=B.join(n,i),a=await gt(r).catch(()=>[]),o=[],s=[];for(let e of a){let n=B.resolve(r,e);if(!k(r,n)){s.push(e);continue}ee(e)&&t.push({checkId:`plugins.code_safety.entry_path`,severity:`warn`,title:`Plugin "${i}" entry path is hidden or node_modules`,detail:`Extension entry "${e}" points to a hidden or node_modules path. Deep code scan will cover this entry explicitly, but review this path choice carefully.`,remediation:`Prefer extension entrypoints under normal source paths like dist/ or src/.`}),o.push(n)}s.length>0&&t.push({checkId:`plugins.code_safety.entry_escape`,severity:`critical`,title:`Plugin "${i}" has extension entry path traversal`,detail:`Found extension entries that escape the plugin directory:\n${s.map(e=>`  - ${e}`).join(`
 `)}`,remediation:`Update the plugin manifest so all openclaw.extensions entries stay inside the plugin directory.`});let c=await Tt({dirPath:r,includeFiles:o,summaryCache:e.summaryCache}).catch(e=>(t.push({checkId:`plugins.code_safety.scan_failed`,severity:`warn`,title:`Plugin "${i}" code scan failed`,detail:`Static code scan could not complete: ${String(e)}`,remediation:"Check file permissions and plugin layout, then rerun `openclaw security audit --deep`."}),null));if(c){if(c.critical>0){let e=Y(c.findings.filter(e=>e.severity===`critical`),r);t.push({checkId:`plugins.code_safety`,severity:`critical`,title:`Plugin "${i}" contains dangerous code patterns`,detail:`Found ${c.critical} critical issue(s) in ${c.scannedFiles} scanned file(s):\n${e}`,remediation:`Review the plugin source code carefully before use. If untrusted, remove the plugin from your OpenClaw extensions state directory.`})}else if(c.warn>0){let e=Y(c.findings.filter(e=>e.severity===`warn`),r);t.push({checkId:`plugins.code_safety`,severity:`warn`,title:`Plugin "${i}" contains suspicious code patterns`,detail:`Found ${c.warn} warning(s) in ${c.scannedFiles} scanned file(s):\n${e}`,remediation:`Review the flagged code to ensure it is intentional and safe.`})}}}return t}async function Bt(e){let t=[],n=B.join(e.stateDir,`extensions`),r=new Set,i=ue(e.cfg);for(let a of i){let i=j(a,{config:e.cfg});for(let a of i){if(a.skill.source===`openclaw-bundled`)continue;let i=B.resolve(a.skill.baseDir);if(k(n,i)||r.has(i))continue;r.add(i);let o=a.skill.name,s=await Tt({dirPath:i,summaryCache:e.summaryCache}).catch(e=>(t.push({checkId:`skills.code_safety.scan_failed`,severity:`warn`,title:`Skill "${o}" code scan failed`,detail:`Static code scan could not complete for ${i}: ${String(e)}`,remediation:"Check file permissions and skill layout, then rerun `openclaw security audit --deep`."}),null));if(s){if(s.critical>0){let e=Y(s.findings.filter(e=>e.severity===`critical`),i);t.push({checkId:`skills.code_safety`,severity:`critical`,title:`Skill "${o}" contains dangerous code patterns`,detail:`Found ${s.critical} critical issue(s) in ${s.scannedFiles} scanned file(s) under ${i}:\n${e}`,remediation:`Review the skill source code before use. If untrusted, remove "${i}".`})}else if(s.warn>0){let e=Y(s.findings.filter(e=>e.severity===`warn`),i);t.push({checkId:`skills.code_safety`,severity:`warn`,title:`Skill "${o}" contains suspicious code patterns`,detail:`Found ${s.warn} warning(s) in ${s.scannedFiles} scanned file(s) under ${i}:\n${e}`,remediation:`Review flagged lines to ensure the behavior is intentional and safe.`})}}}}return t}function Vt(e){let t=[];if(e.gateway?.controlUi?.allowInsecureAuth===!0&&t.push(`gateway.controlUi.allowInsecureAuth=true`),e.gateway?.controlUi?.dangerouslyAllowHostHeaderOriginFallback===!0&&t.push(`gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true`),e.gateway?.controlUi?.dangerouslyDisableDeviceAuth===!0&&t.push(`gateway.controlUi.dangerouslyDisableDeviceAuth=true`),e.hooks?.gmail?.allowUnsafeExternalContent===!0&&t.push(`hooks.gmail.allowUnsafeExternalContent=true`),Array.isArray(e.hooks?.mappings))for(let[n,r]of e.hooks.mappings.entries())r?.allowUnsafeExternalContent===!0&&t.push(`hooks.mappings[${n}].allowUnsafeExternalContent=true`);return e.tools?.exec?.applyPatch?.workspaceOnly===!1&&t.push(`tools.exec.applyPatch.workspaceOnly=false`),t}function Ht(e){let t=0,n=0,r=0;for(let i of e)i.severity===`critical`?t+=1:i.severity===`warn`?n+=1:r+=1;return{critical:t,warn:n,info:r}}function Ut(e){return Array.isArray(e)?e.map(e=>String(e).trim()).filter(Boolean):[]}function Q(e){if(!(!e||typeof e!=`object`||Array.isArray(e)))return e}function $(e){return typeof e==`string`&&e.trim().length>0}function Wt(e){let t=Q(Q(e.channels)?.feishu);if(!t||t.enabled===!1)return!1;let n=Q(t.tools),r=n?.doc!==!1,i=$(t.appId),a=O(t.appSecret,e.secrets?.defaults),o=i&&a,s=Q(t.accounts);if(!s||Object.keys(s).length===0)return r&&o;for(let t of Object.values(s)){let r=Q(t)??{};if(r.enabled!==!1&&(Q(r.tools)??n)?.doc!==!1&&($(r.appId)||i)&&(O(r.appSecret,e.secrets?.defaults)||a))return!0}return!1}async function Gt(e){let t=[],n=await p(e.stateDir,{env:e.env,platform:e.platform,exec:e.execIcacls});n.ok&&(n.isSymlink&&t.push({checkId:`fs.state_dir.symlink`,severity:`warn`,title:`State dir is a symlink`,detail:`${e.stateDir} is a symlink; treat this as an extra trust boundary.`}),n.worldWritable?t.push({checkId:`fs.state_dir.perms_world_writable`,severity:`critical`,title:`State dir is world-writable`,detail:`${y(e.stateDir,n)}; other users can write into your OpenClaw state.`,remediation:x({targetPath:e.stateDir,perms:n,isDir:!0,posixMode:448,env:e.env})}):n.groupWritable?t.push({checkId:`fs.state_dir.perms_group_writable`,severity:`warn`,title:`State dir is group-writable`,detail:`${y(e.stateDir,n)}; group users can write into your OpenClaw state.`,remediation:x({targetPath:e.stateDir,perms:n,isDir:!0,posixMode:448,env:e.env})}):(n.groupReadable||n.worldReadable)&&t.push({checkId:`fs.state_dir.perms_readable`,severity:`warn`,title:`State dir is readable by others`,detail:`${y(e.stateDir,n)}; consider restricting to 700.`,remediation:x({targetPath:e.stateDir,perms:n,isDir:!0,posixMode:448,env:e.env})}));let r=await p(e.configPath,{env:e.env,platform:e.platform,exec:e.execIcacls});if(r.ok){let n=r.isSymlink;r.isSymlink&&t.push({checkId:`fs.config.symlink`,severity:`warn`,title:`Config file is a symlink`,detail:`${e.configPath} is a symlink; make sure you trust its target.`}),r.worldWritable||r.groupWritable?t.push({checkId:`fs.config.perms_writable`,severity:`critical`,title:`Config file is writable by others`,detail:`${y(e.configPath,r)}; another user could change gateway/auth/tool policies.`,remediation:x({targetPath:e.configPath,perms:r,isDir:!1,posixMode:384,env:e.env})}):!n&&r.worldReadable?t.push({checkId:`fs.config.perms_world_readable`,severity:`critical`,title:`Config file is world-readable`,detail:`${y(e.configPath,r)}; config can contain tokens and private settings.`,remediation:x({targetPath:e.configPath,perms:r,isDir:!1,posixMode:384,env:e.env})}):!n&&r.groupReadable&&t.push({checkId:`fs.config.perms_group_readable`,severity:`warn`,title:`Config file is group-readable`,detail:`${y(e.configPath,r)}; config can contain tokens and private settings.`,remediation:x({targetPath:e.configPath,perms:r,isDir:!1,posixMode:384,env:e.env})})}return t}function Kt(e,t){let n=[],r=typeof e.gateway?.bind==`string`?e.gateway.bind:`loopback`,i=e.gateway?.tailscale?.mode??`off`,a=c({authConfig:e.gateway?.auth,tailscaleMode:i,env:t}),o=e.gateway?.controlUi?.enabled!==!1,s=(e.gateway?.controlUi?.allowedOrigins??[]).map(e=>e.trim()).filter(Boolean),l=e.gateway?.controlUi?.dangerouslyAllowHostHeaderOriginFallback===!0,u=Array.isArray(e.gateway?.trustedProxies)?e.gateway.trustedProxies:[],d=typeof a.token==`string`&&a.token.trim().length>0,f=typeof a.password==`string`&&a.password.trim().length>0,p=$(t.OPENCLAW_GATEWAY_TOKEN)||$(t.CLAWDBOT_GATEWAY_TOKEN),m=$(t.OPENCLAW_GATEWAY_PASSWORD)||$(t.CLAWDBOT_GATEWAY_PASSWORD),h=O(e.gateway?.auth?.token,e.secrets?.defaults),g=O(e.gateway?.auth?.password,e.secrets?.defaults),_=O(e.gateway?.remote?.token,e.secrets?.defaults),v=e.gateway?.auth?.mode,y=d||p||h||_,b=v===`password`||v!==`token`&&v!==`none`&&v!==`trusted-proxy`&&!y,x=y,S=f||b&&(m||g),C=v===`token`?x:v===`password`?S:v===`none`||v===`trusted-proxy`?!1:x||S,w=a.allowTailscale&&i===`serve`,T=C||w,E=e.gateway?.allowRealIpFallback===!0,D=e.discovery?.mdns?.mode??`minimal`,k=Array.isArray(e.gateway?.tools?.allow)?e.gateway?.tools?.allow:[],ee=new Set(k.map(e=>typeof e==`string`?e.trim().toLowerCase():``).filter(Boolean)),A=de.filter(e=>ee.has(e));if(A.length>0){let e=r!==`loopback`||i===`funnel`;n.push({checkId:`gateway.tools_invoke_http.dangerous_allow`,severity:e?`critical`:`warn`,title:`Gateway HTTP /tools/invoke re-enables dangerous tools`,detail:`gateway.tools.allow includes ${A.join(`, `)} which removes them from the default HTTP deny list. This can allow remote session spawning / control-plane actions via HTTP and increases RCE blast radius if the gateway is reachable.`,remediation:`Remove these entries from gateway.tools.allow (recommended). If you keep them enabled, keep gateway.bind loopback-only (or tailnet-only), restrict network exposure, and treat the gateway token/password as full-admin.`})}if(r!==`loopback`&&!C&&a.mode!==`trusted-proxy`&&n.push({checkId:`gateway.bind_no_auth`,severity:`critical`,title:`Gateway binds beyond loopback without auth`,detail:`gateway.bind="${r}" but no gateway.auth token/password is configured.`,remediation:`Set gateway.auth (token recommended) or bind to loopback.`}),r===`loopback`&&o&&u.length===0&&n.push({checkId:`gateway.trusted_proxies_missing`,severity:`warn`,title:`Reverse proxy headers are not trusted`,detail:`gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.`,remediation:`Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.`}),r===`loopback`&&o&&!T&&n.push({checkId:`gateway.loopback_no_auth`,severity:`critical`,title:`Gateway auth missing on loopback`,detail:`gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.`,remediation:`Set gateway.auth (token recommended) or keep the Control UI local-only.`}),r!==`loopback`&&o&&s.length===0&&!l&&n.push({checkId:`gateway.control_ui.allowed_origins_required`,severity:`critical`,title:`Non-loopback Control UI missing explicit allowed origins`,detail:`Control UI is enabled on a non-loopback bind but gateway.controlUi.allowedOrigins is empty. Strict origin policy requires explicit allowed origins for non-loopback deployments.`,remediation:`Set gateway.controlUi.allowedOrigins to full trusted origins (for example https://control.example.com). If your deployment intentionally relies on Host-header origin fallback, set gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true.`}),s.includes(`*`)){let e=r!==`loopback`;n.push({checkId:`gateway.control_ui.allowed_origins_wildcard`,severity:e?`critical`:`warn`,title:`Control UI allowed origins contains wildcard`,detail:`gateway.controlUi.allowedOrigins includes "*" which effectively disables origin allowlisting for Control UI/WebChat requests.`,remediation:`Replace wildcard origins with explicit trusted origins (for example https://control.example.com).`})}if(l){let e=r!==`loopback`;n.push({checkId:`gateway.control_ui.host_header_origin_fallback`,severity:e?`critical`:`warn`,title:`DANGEROUS: Host-header origin fallback enabled`,detail:`gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true enables Host-header origin fallback for Control UI/WebChat websocket checks and weakens DNS rebinding protections.`,remediation:`Disable gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback and configure explicit gateway.controlUi.allowedOrigins.`})}if(E){let e=u.some(e=>!qt(e)),t=r!==`loopback`||a.mode===`trusted-proxy`&&e;n.push({checkId:`gateway.real_ip_fallback_enabled`,severity:t?`critical`:`warn`,title:`X-Real-IP fallback is enabled`,detail:`gateway.allowRealIpFallback=true trusts X-Real-IP when trusted proxies omit X-Forwarded-For. Misconfigured proxies that forward client-supplied X-Real-IP can spoof source IP and local-client checks.`,remediation:`Keep gateway.allowRealIpFallback=false (default). Only enable this when your trusted proxy always overwrites X-Real-IP and cannot provide X-Forwarded-For.`})}if(D===`full`){let e=r!==`loopback`;n.push({checkId:`discovery.mdns_full_mode`,severity:e?`critical`:`warn`,title:`mDNS full mode can leak host metadata`,detail:`discovery.mdns.mode="full" publishes cliPath/sshPort in local-network TXT records. This can reveal usernames, filesystem layout, and management ports.`,remediation:`Prefer discovery.mdns.mode="minimal" (recommended) or "off", especially when gateway.bind is not loopback.`})}i===`funnel`?n.push({checkId:`gateway.tailscale_funnel`,severity:`critical`,title:`Tailscale Funnel exposure enabled`,detail:`gateway.tailscale.mode="funnel" exposes the Gateway publicly; keep auth strict and treat it as internet-facing.`,remediation:`Prefer tailscale.mode="serve" (tailnet-only) or set tailscale.mode="off".`}):i===`serve`&&n.push({checkId:`gateway.tailscale_serve`,severity:`info`,title:`Tailscale Serve exposure enabled`,detail:`gateway.tailscale.mode="serve" exposes the Gateway to your tailnet (loopback behind Tailscale).`}),e.gateway?.controlUi?.allowInsecureAuth===!0&&n.push({checkId:`gateway.control_ui.insecure_auth`,severity:`warn`,title:`Control UI insecure auth toggle enabled`,detail:`gateway.controlUi.allowInsecureAuth=true does not bypass secure context or device identity checks; only dangerouslyDisableDeviceAuth disables Control UI device identity checks.`,remediation:`Disable it or switch to HTTPS (Tailscale Serve) or localhost.`}),e.gateway?.controlUi?.dangerouslyDisableDeviceAuth===!0&&n.push({checkId:`gateway.control_ui.device_auth_disabled`,severity:`critical`,title:`DANGEROUS: Control UI device auth disabled`,detail:`gateway.controlUi.dangerouslyDisableDeviceAuth=true disables device identity checks for the Control UI.`,remediation:`Disable it unless you are in a short-lived break-glass scenario.`}),Wt(e)&&n.push({checkId:`channels.feishu.doc_owner_open_id`,severity:`warn`,title:`Feishu doc create can grant requester permissions`,detail:`channels.feishu tools include "doc"; feishu_doc action "create" can grant document access to the trusted requesting Feishu user.`,remediation:`Disable channels.feishu.tools.doc when not needed, and restrict tool access for untrusted prompts.`});let j=Vt(e);j.length>0&&n.push({checkId:`config.insecure_or_dangerous_flags`,severity:`warn`,title:`Insecure or dangerous config flags enabled`,detail:`Detected ${j.length} enabled flag(s): ${j.join(`, `)}.`,remediation:`Disable these flags when not actively debugging, or keep deployment scoped to trusted/local-only networks.`});let M=typeof a.token==`string`&&a.token.trim().length>0?a.token.trim():null;if(a.mode===`token`&&M&&M.length<24&&n.push({checkId:`gateway.token_too_short`,severity:`warn`,title:`Gateway token looks short`,detail:`gateway auth token is ${M.length} chars; prefer a long random token.`}),a.mode===`trusted-proxy`){let t=e.gateway?.trustedProxies??[],r=e.gateway?.auth?.trustedProxy;n.push({checkId:`gateway.trusted_proxy_auth`,severity:`critical`,title:`Trusted-proxy auth mode enabled`,detail:`gateway.auth.mode="trusted-proxy" delegates authentication to a reverse proxy. Ensure your proxy (Pomerium, Caddy, nginx) handles auth correctly and that gateway.trustedProxies only contains IPs of your actual proxy servers.`,remediation:`Verify: (1) Your proxy terminates TLS and authenticates users. (2) gateway.trustedProxies is restricted to proxy IPs only. (3) Direct access to the Gateway port is blocked by firewall. See /gateway/trusted-proxy-auth for setup guidance.`}),t.length===0&&n.push({checkId:`gateway.trusted_proxy_no_proxies`,severity:`critical`,title:`Trusted-proxy auth enabled but no trusted proxies configured`,detail:`gateway.auth.mode="trusted-proxy" but gateway.trustedProxies is empty. All requests will be rejected.`,remediation:`Set gateway.trustedProxies to the IP(s) of your reverse proxy.`}),r?.userHeader||n.push({checkId:`gateway.trusted_proxy_no_user_header`,severity:`critical`,title:`Trusted-proxy auth missing userHeader config`,detail:`gateway.auth.mode="trusted-proxy" but gateway.auth.trustedProxy.userHeader is not configured.`,remediation:`Set gateway.auth.trustedProxy.userHeader to the header name your proxy uses (e.g., "x-forwarded-user", "x-pomerium-claim-email").`}),(r?.allowUsers??[]).length===0&&n.push({checkId:`gateway.trusted_proxy_no_allowlist`,severity:`warn`,title:`Trusted-proxy auth allows all authenticated users`,detail:`gateway.auth.trustedProxy.allowUsers is empty, so any user authenticated by your proxy can access the Gateway.`,remediation:`Consider setting gateway.auth.trustedProxy.allowUsers to restrict access to specific users (e.g., ["nick@example.com"]).`})}return r!==`loopback`&&a.mode!==`trusted-proxy`&&!e.gateway?.auth?.rateLimit&&n.push({checkId:`gateway.auth_no_rate_limit`,severity:`warn`,title:`No auth rate limiting configured`,detail:`gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.`,remediation:`Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).`}),n}function qt(e){let t=e.trim();if(!t)return!1;if(!t.includes(`/`))return t===`127.0.0.1`||t.toLowerCase()===`::1`;let[n,r]=t.split(`/`,2);if(!n||!r)return!1;let i=Se(n.trim()),a=Number.parseInt(r.trim(),10);return Number.isInteger(a)?i===4?n.trim()===`127.0.0.1`&&a===32:i===6?a===128&&n.trim().toLowerCase()===`::1`:!1:!1}function Jt(e,t){let i=[],a;try{a=s(e.browser,e)}catch(e){return i.push({checkId:`browser.control_invalid_config`,severity:`warn`,title:`Browser control config looks invalid`,detail:String(e),remediation:`Fix browser.cdpUrl in ${n()} and re-run "${S(`openclaw security audit --deep`)}".`}),i}if(!a.enabled)return i;let o=d(e,t),c=e.gateway?.auth?.mode,l=!!o.token||$(t.OPENCLAW_GATEWAY_TOKEN)||$(t.CLAWDBOT_GATEWAY_TOKEN)||O(e.gateway?.auth?.token,e.secrets?.defaults),u=c===`password`||c!==`token`&&c!==`none`&&c!==`trusted-proxy`&&!l,f=!!o.password||u&&($(t.OPENCLAW_GATEWAY_PASSWORD)||$(t.CLAWDBOT_GATEWAY_PASSWORD)||O(e.gateway?.auth?.password,e.secrets?.defaults));!l&&!f&&i.push({checkId:`browser.control_no_auth`,severity:`critical`,title:`Browser control has no auth`,detail:`Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.`,remediation:`Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled.`});for(let e of Object.keys(a.profiles)){let t=r(a,e);if(!t||t.cdpIsLoopback)continue;let n;try{n=new URL(t.cdpUrl)}catch{continue}n.protocol===`http:`&&i.push({checkId:`browser.remote_cdp_http`,severity:`warn`,title:`Remote CDP uses HTTP`,detail:`browser profile "${e}" uses http CDP (${t.cdpUrl}); this is OK only if it's tailnet-only or behind an encrypted tunnel.`,remediation:`Prefer HTTPS/TLS or a tailnet-only endpoint for remote CDP.`})}return i}function Yt(e){return e.logging?.redactSensitive===`off`?[{checkId:`logging.redact_off`,severity:`warn`,title:`Tool summary redaction is disabled`,detail:`logging.redactSensitive="off" can leak secrets into logs and status output.`,remediation:`Set logging.redactSensitive="tools".`}]:[]}function Xt(e){let t=[],n=e.tools?.elevated?.enabled,r=e.tools?.elevated?.allowFrom??{},i=Object.keys(r).length>0;if(n===!1||!i)return t;for(let[e,n]of Object.entries(r)){let r=Ut(n);r.includes(`*`)?t.push({checkId:`tools.elevated.allowFrom.${e}.wildcard`,severity:`critical`,title:`Elevated exec allowlist contains wildcard`,detail:`tools.elevated.allowFrom.${e} includes "*" which effectively approves everyone on that channel for elevated mode.`}):r.length>25&&t.push({checkId:`tools.elevated.allowFrom.${e}.large`,severity:`warn`,title:`Elevated exec allowlist is large`,detail:`tools.elevated.allowFrom.${e} has ${r.length} entries; consider tightening elevated access.`})}return t}function Zt(e){let t=[],n=e.tools?.exec?.host,r=i(e).mode;n===`sandbox`&&r===`off`&&t.push({checkId:`tools.exec.host_sandbox_no_sandbox_defaults`,severity:`warn`,title:`Exec host is sandbox but sandbox mode is off`,detail:`tools.exec.host is explicitly set to sandbox while agents.defaults.sandbox.mode=off. In this mode, exec runs directly on the gateway host.`,remediation:'Enable sandbox mode (`agents.defaults.sandbox.mode="non-main"` or `"all"`) or set tools.exec.host to "gateway" with approvals.'});let a=Array.isArray(e.agents?.list)?e.agents.list:[],o=a.filter(t=>t&&typeof t==`object`&&typeof t.id==`string`&&t.tools?.exec?.host===`sandbox`&&i(e,t.id).mode===`off`).map(e=>e.id).slice(0,5);o.length>0&&t.push({checkId:`tools.exec.host_sandbox_no_sandbox_agents`,severity:`warn`,title:`Agent exec host uses sandbox while sandbox mode is off`,detail:`agents.list.*.tools.exec.host is set to sandbox for: ${o.join(`, `)}. With sandbox mode off, exec runs directly on the gateway host.`,remediation:'Enable sandbox mode for these agents (`agents.list[].sandbox.mode`) or set their tools.exec.host to "gateway".'});let s=e=>Array.isArray(e)?Array.from(new Set(e.map(e=>typeof e==`string`?e.trim().toLowerCase():``).filter(e=>e.length>0))).toSorted():[],c=e=>Array.isArray(e)?l(e.filter(e=>typeof e==`string`)):[],u=e=>{let t=e.trim();if(!t)return null;if(!B.isAbsolute(t))return`relative path (trust boundary depends on process cwd)`;let n=B.resolve(t).replace(/\\/g,`/`).toLowerCase();return n===`/tmp`||n.startsWith(`/tmp/`)||n===`/var/tmp`||n.startsWith(`/var/tmp/`)||n===`/private/tmp`||n.startsWith(`/private/tmp/`)?`temporary directory is mutable and easy to poison`:n===`/usr/local/bin`||n===`/opt/homebrew/bin`||n===`/opt/local/bin`||n===`/home/linuxbrew/.linuxbrew/bin`?`package-manager bin directory (often user-writable)`:n.startsWith(`/users/`)||n.startsWith(`/home/`)||n.includes(`/.local/bin`)||/^[a-z]:\/users\//.test(n)?`home-scoped bin directory (typically user-writable)`:null},d=e.tools?.exec,f=[],p=(e,t)=>{for(let n of c(t)){let t=u(n);t&&f.push(`- ${e}.safeBinTrustedDirs: ${n} (${t})`)}};p(`tools.exec`,d?.safeBinTrustedDirs);for(let e of a)!e||typeof e!=`object`||typeof e.id!=`string`||p(`agents.list.${e.id}.tools.exec`,e.tools?.exec?.safeBinTrustedDirs);let m=[],h=s(d?.safeBins);if(h.length>0){let e=N({global:d})??{},t=re(h).filter(t=>!e[t]);t.length>0&&m.push(`- tools.exec.safeBins: ${t.join(`, `)}`)}for(let e of a){if(!e||typeof e!=`object`||typeof e.id!=`string`)continue;let t=e.tools?.exec,n=s(t?.safeBins);if(n.length===0)continue;let r=N({global:d,local:t})??{},i=re(n).filter(e=>!r[e]);i.length!==0&&m.push(`- agents.list.${e.id}.tools.exec.safeBins: ${i.join(`, `)}`)}return m.length>0&&t.push({checkId:`tools.exec.safe_bins_interpreter_unprofiled`,severity:`warn`,title:`safeBins includes interpreter/runtime binaries without explicit profiles`,detail:`Detected interpreter-like safeBins entries missing explicit profiles:\n${m.join(`
 `)}\nThese entries can turn safeBins into a broad execution surface when used with permissive argv profiles.`,remediation:`Remove interpreter/runtime bins from safeBins (prefer allowlist entries) or define hardened tools.exec.safeBinProfiles.<bin> rules.`}),f.length>0&&t.push({checkId:`tools.exec.safe_bin_trusted_dirs_risky`,severity:`warn`,title:`safeBinTrustedDirs includes risky mutable directories`,detail:`Detected risky safeBinTrustedDirs entries:\n${f.slice(0,10).join(`
-`)}`+(f.length>10?`\n- +${f.length-10} more entries.`:``),remediation:`Prefer root-owned immutable bins, keep default trust dirs (/bin, /usr/bin), and avoid trusting temporary/home/package-manager paths unless tightly controlled.`}),t}async function Qt(e){let t=ae({config:e.cfg}).url,n=e.cfg.gateway?.mode===`remote`,r=typeof e.cfg.gateway?.remote?.url==`string`?e.cfg.gateway.remote.url.trim():``,i=pe(!n||n&&!r?{cfg:e.cfg,env:e.env,mode:`local`}:{cfg:e.cfg,env:e.env,mode:`remote`}),a=await e.probe({url:t,auth:i.auth,timeoutMs:e.timeoutMs}).catch(e=>({ok:!1,url:t,connectLatencyMs:null,error:String(e),close:null,health:null,status:null,presence:null,configSnapshot:null}));return i.warning&&!a.ok&&(a.error=a.error?`${a.error}; ${i.warning}`:i.warning),{deep:{gateway:{attempted:!0,url:t,ok:a.ok,error:a.ok?null:a.error,close:a.close?{code:a.close.code,reason:a.close.reason}:null}},authWarning:i.warning}}async function $t(t){let r=t.config,i=t.sourceConfig??t.config,a=t.env??process.env,o=t.platform??process.platform,s=t.includeFilesystem!==!1,c=t.includeChannelSecurity!==!1,l=t.deep===!0,u=Math.max(250,t.deepTimeoutMs??5e3),d=t.stateDir??e(a),f=t.configPath??n(a,d),p=s?t.configSnapshot===void 0?await Rt({env:a,configPath:f}).catch(()=>null):t.configSnapshot:null;return{cfg:r,sourceConfig:i,env:a,platform:o,includeFilesystem:s,includeChannelSecurity:c,deep:l,deepTimeoutMs:u,stateDir:d,configPath:f,execIcacls:t.execIcacls,execDockerRawFn:t.execDockerRawFn,probeGatewayFn:t.probeGatewayFn,plugins:t.plugins,configSnapshot:p,codeSafetySummaryCache:t.codeSafetySummaryCache??new Map}}async function en(e){let t=[],n=await $t(e),{cfg:r,env:i,platform:a,stateDir:o,configPath:s}=n;if(t.push(...Ze(r)),t.push(...Qe({stateDir:o,configPath:s})),t.push(...Kt(r,i)),t.push(...Jt(r,i)),t.push(...Yt(r)),t.push(...Xt(r)),t.push(...Zt(r)),t.push(...et(r,i)),t.push(...nt(r,i)),t.push(...tt(r)),t.push(...rt(r)),t.push(...it(r)),t.push(...at(r)),t.push(...ot(r)),t.push(...st(r)),t.push(...$e(r)),t.push(...ct(r)),t.push(...lt({cfg:r,env:i})),t.push(...ut(r)),t.push(...dt(r)),n.includeFilesystem&&(t.push(...await Gt({stateDir:o,configPath:s,env:i,platform:a,execIcacls:n.execIcacls})),n.configSnapshot&&t.push(...await It({configSnapshot:n.configSnapshot,env:i,platform:a,execIcacls:n.execIcacls})),t.push(...await Lt({cfg:r,env:i,stateDir:o,platform:a,execIcacls:n.execIcacls})),t.push(...await Ft({cfg:r})),t.push(...await Nt({execDockerRawFn:n.execDockerRawFn})),t.push(...await Pt({cfg:r,stateDir:o})),n.deep&&(t.push(...await zt({stateDir:o,summaryCache:n.codeSafetySummaryCache})),t.push(...await Bt({cfg:r,stateDir:o,summaryCache:n.codeSafetySummaryCache})))),n.includeChannelSecurity){let e=n.plugins??ne();t.push(...await Ee({cfg:r,sourceConfig:n.sourceConfig,plugins:e}))}let c=n.deep?await Qt({cfg:r,env:i,timeoutMs:n.deepTimeoutMs,probe:n.probeGatewayFn??fe}):void 0,l=c?.deep;l?.gateway?.attempted&&!l.gateway.ok&&t.push({checkId:`gateway.probe_failed`,severity:`warn`,title:`Gateway probe failed (deep)`,detail:l.gateway.error??`gateway unreachable`,remediation:`Run "${S(`openclaw status --all`)}" to debug connectivity/auth, then re-run "${S(`openclaw security audit --deep`)}".`}),c?.authWarning&&t.push({checkId:`gateway.probe_auth_secretref_unavailable`,severity:`warn`,title:`Gateway probe auth SecretRef is unavailable`,detail:c.authWarning,remediation:`Set OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD in this shell or resolve the external secret provider, then re-run "${S(`openclaw security audit --deep`)}".`});let u=Ht(t);return{ts:Date.now(),summary:u,findings:t,deep:l}}export{Vt as n,mt as r,en as t};
+`)}`+(f.length>10?`\n- +${f.length-10} more entries.`:``),remediation:`Prefer root-owned immutable bins, keep default trust dirs (/bin, /usr/bin), and avoid trusting temporary/home/package-manager paths unless tightly controlled.`}),t}async function Qt(e){let t=ae({config:e.cfg}).url,n=e.cfg.gateway?.mode===`remote`,r=typeof e.cfg.gateway?.remote?.url==`string`?e.cfg.gateway.remote.url.trim():``,i=pe(!n||n&&!r?{cfg:e.cfg,env:e.env,mode:`local`}:{cfg:e.cfg,env:e.env,mode:`remote`}),a=await e.probe({url:t,auth:i.auth,timeoutMs:e.timeoutMs}).catch(e=>({ok:!1,url:t,connectLatencyMs:null,error:String(e),close:null,health:null,status:null,presence:null,configSnapshot:null}));return i.warning&&!a.ok&&(a.error=a.error?`${a.error}; ${i.warning}`:i.warning),{deep:{gateway:{attempted:!0,url:t,ok:a.ok,error:a.ok?null:a.error,close:a.close?{code:a.close.code,reason:a.close.reason}:null}},authWarning:i.warning}}async function $t(t){let r=t.config,i=t.sourceConfig??t.config,a=t.env??process.env,o=t.platform??process.platform,s=t.includeFilesystem!==!1,c=t.includeChannelSecurity!==!1,l=t.deep===!0,u=Math.max(250,t.deepTimeoutMs??5e3),d=t.stateDir??e(a),f=t.configPath??n(a,d),p=s?t.configSnapshot===void 0?await Rt({env:a,configPath:f}).catch(()=>null):t.configSnapshot:null;return{cfg:r,sourceConfig:i,env:a,platform:o,includeFilesystem:s,includeChannelSecurity:c,deep:l,deepTimeoutMs:u,stateDir:d,configPath:f,execIcacls:t.execIcacls,execDockerRawFn:t.execDockerRawFn,probeGatewayFn:t.probeGatewayFn,plugins:t.plugins,configSnapshot:p,codeSafetySummaryCache:t.codeSafetySummaryCache??new Map}}async function en(e){let t=[],n=await $t(e),{cfg:r,env:i,platform:a,stateDir:o,configPath:s}=n;if(t.push(...Ze(r)),t.push(...Qe({stateDir:o,configPath:s})),t.push(...Kt(r,i)),t.push(...Jt(r,i)),t.push(...Yt(r)),t.push(...Xt(r)),t.push(...Zt(r)),t.push(...et(r,i)),t.push(...nt(r,i)),t.push(...tt(r)),t.push(...rt(r)),t.push(...it(r)),t.push(...at(r)),t.push(...ot(r)),t.push(...st(r)),t.push(...$e(r)),t.push(...ct(r)),t.push(...lt({cfg:r,env:i})),t.push(...ut(r)),t.push(...dt(r)),n.includeFilesystem&&(t.push(...await Gt({stateDir:o,configPath:s,env:i,platform:a,execIcacls:n.execIcacls})),n.configSnapshot&&t.push(...await It({configSnapshot:n.configSnapshot,env:i,platform:a,execIcacls:n.execIcacls})),t.push(...await Lt({cfg:r,env:i,stateDir:o,platform:a,execIcacls:n.execIcacls})),t.push(...await Ft({cfg:r})),t.push(...await Nt({execDockerRawFn:n.execDockerRawFn})),t.push(...await Pt({cfg:r,stateDir:o})),n.deep&&(t.push(...await zt({stateDir:o,summaryCache:n.codeSafetySummaryCache})),t.push(...await Bt({cfg:r,stateDir:o,summaryCache:n.codeSafetySummaryCache})))),n.includeChannelSecurity){let e=n.plugins??ne();t.push(...await Ee({cfg:r,sourceConfig:n.sourceConfig,plugins:e}))}let c=n.deep?await Qt({cfg:r,env:i,timeoutMs:n.deepTimeoutMs,probe:n.probeGatewayFn??fe}):void 0,l=c?.deep;l?.gateway?.attempted&&!l.gateway.ok&&t.push({checkId:`gateway.probe_failed`,severity:`warn`,title:`Gateway probe failed (deep)`,detail:l.gateway.error??`gateway unreachable`,remediation:`Run "${S(`openclaw status --all`)}" to debug connectivity/auth, then re-run "${S(`openclaw security audit --deep`)}".`}),c?.authWarning&&t.push({checkId:`gateway.probe_auth_secretref_unavailable`,severity:`warn`,title:`Gateway probe auth SecretRef is unavailable`,detail:c.authWarning,remediation:`Set OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD in this shell or resolve the external secret provider, then re-run "${S(`openclaw security audit --deep`)}".`});let u=Ht(t);return{ts:Date.now(),summary:u,findings:t,deep:l}}export{Vt as n,mt as r,en as t};

package/dist/audit-membership-runtime-BpRsMj5-.js

@@ -1 +1 @@
-import{r as e}from"./utils-R-mFyVJi.js";import"./proxy-env-DrC3TIGh.js";import{r as t}from"./fetch-D0rZDHKO.js";import{n,t as r}from"./fetch-DsjPfQlp.js";async function i(i){let a=r(i.proxyUrl?n(i.proxyUrl):void 0,{network:i.network}),o=`https://api.telegram.org/bot${i.token}`,s=[];for(let n of i.groupIds)try{let r=await t(`${o}/getChatMember?chat_id=${encodeURIComponent(n)}&user_id=${encodeURIComponent(String(i.botId))}`,{},i.timeoutMs,a),c=await r.json();if(!r.ok||!e(c)||!c.ok){let t=e(c)&&!c.ok&&typeof c.description==`string`?c.description:`getChatMember failed (${r.status})`;s.push({chatId:n,ok:!1,status:null,error:t,matchKey:n,matchSource:`id`});continue}let l=e(c.result)?c.result.status??null:null,u=l===`creator`||l===`administrator`||l===`member`;s.push({chatId:n,ok:u,status:l,error:u?null:`bot not in group`,matchKey:n,matchSource:`id`})}catch(e){s.push({chatId:n,ok:!1,status:null,error:e instanceof Error?e.message:String(e),matchKey:n,matchSource:`id`})}return{ok:s.every(e=>e.ok),checkedGroups:s.length,unresolvedGroups:0,hasWildcardUnmentionedGroups:!1,groups:s}}export{i as auditTelegramGroupMembershipImpl};
+import{r as e}from"./utils-R-mFyVJi.js";import"./proxy-env-DrC3TIGh.js";import{r as t}from"./fetch-D0rZDHKO.js";import{n,t as r}from"./fetch-DsjPfQlp.js";async function i(i){let a=r(i.proxyUrl?n(i.proxyUrl):void 0,{network:i.network}),o=`https://api.telegram.org/bot${i.token}`,s=[];for(let n of i.groupIds)try{let r=await t(`${o}/getChatMember?chat_id=${encodeURIComponent(n)}&user_id=${encodeURIComponent(String(i.botId))}`,{},i.timeoutMs,a),c=await r.json();if(!r.ok||!e(c)||!c.ok){let t=e(c)&&!c.ok&&typeof c.description==`string`?c.description:`getChatMember failed (${r.status})`;s.push({chatId:n,ok:!1,status:null,error:t,matchKey:n,matchSource:`id`});continue}let l=e(c.result)?c.result.status??null:null,u=l===`creator`||l===`administrator`||l===`member`;s.push({chatId:n,ok:u,status:l,error:u?null:`bot not in group`,matchKey:n,matchSource:`id`})}catch(e){s.push({chatId:n,ok:!1,status:null,error:e instanceof Error?e.message:String(e),matchKey:n,matchSource:`id`})}return{ok:s.every(e=>e.ok),checkedGroups:s.length,unresolvedGroups:0,hasWildcardUnmentionedGroups:!1,groups:s}}export{i as auditTelegramGroupMembershipImpl};