@spacebar_ai/moldclaw-core 2026.3.14 → 2026.3.16

package/dist/setup-BlQPyDPy.js

@@ -0,0 +1,387 @@
+import { n as DEFAULT_GATEWAY_PORT, u as resolveGatewayPort } from "./paths-D6AgsMTU.js";
+import { m as defaultRuntime } from "./subsystem-S4LNMNHd.js";
+import { y as resolveUserPath } from "./utils-rjVNXUns.js";
+import { f as readConfigFileSnapshot, y as writeConfigFile } from "./io-C6XifaT4.js";
+import { l as normalizeSecretInputString } from "./types.secrets-Bojc4omL.js";
+import { t as formatCliCommand } from "./command-format-DIDjlImI.js";
+import { t as WizardCancelledError } from "./prompts-DHs_x86z.js";
+import { t as resolveSetupSecretInputString } from "./setup.secret-input-BZSIeiqy.js";
+//#region src/wizard/setup.ts
+async function requireRiskAcknowledgement(params) {
+	if (params.opts.acceptRisk === true) return;
+	await params.prompter.note([
+		"Security warning — please read.",
+		"",
+		"moldClaw is a hobby project and still in beta. Expect sharp edges.",
+		"By default, moldClaw is a personal agent: one trusted operator boundary.",
+		"This bot can read files and run actions if tools are enabled.",
+		"A bad prompt can trick it into doing unsafe things.",
+		"",
+		"moldClaw is not a hostile multi-tenant boundary by default.",
+		"If multiple users can message one tool-enabled agent, they share that delegated tool authority.",
+		"",
+		"If you’re not comfortable with security hardening and access control, don’t run moldClaw.",
+		"Ask someone experienced to help before enabling tools or exposing it to the internet.",
+		"",
+		"Recommended baseline:",
+		"- Pairing/allowlists + mention gating.",
+		"- Multi-user/shared inbox: split trust boundaries (separate gateway/credentials, ideally separate OS users/hosts).",
+		"- Sandbox + least-privilege tools.",
+		"- Shared inboxes: isolate DM sessions (`session.dmScope: per-channel-peer`) and keep tool access minimal.",
+		"- Keep secrets out of the agent’s reachable filesystem.",
+		"- Use the strongest available model for any bot with tools or untrusted inboxes.",
+		"",
+		"Run regularly:",
+		"moldclaw security audit --deep",
+		"moldclaw security audit --fix",
+		"",
+		"Must read: https://docs.moldclaw.ai/gateway/security"
+	].join("\n"), "Security");
+	if (!await params.prompter.confirm({
+		message: "I understand this is personal-by-default and shared/multi-user use requires lock-down. Continue?",
+		initialValue: false
+	})) throw new WizardCancelledError("risk not accepted");
+}
+async function runSetupWizard(opts, runtime = defaultRuntime, prompter) {
+	const onboardHelpers = await import("./onboard-helpers-DRFi9oaD.js");
+	onboardHelpers.printWizardHeader(runtime);
+	await prompter.intro("moldClaw setup");
+	await requireRiskAcknowledgement({
+		opts,
+		prompter
+	});
+	const snapshot = await readConfigFileSnapshot();
+	let baseConfig = snapshot.valid ? snapshot.exists ? snapshot.config : {} : {};
+	if (snapshot.exists && !snapshot.valid) {
+		await prompter.note(onboardHelpers.summarizeExistingConfig(baseConfig), "Invalid config");
+		if (snapshot.issues.length > 0) await prompter.note([
+			...snapshot.issues.map((iss) => `- ${iss.path}: ${iss.message}`),
+			"",
+			"Docs: https://docs.moldclaw.ai/gateway/configuration"
+		].join("\n"), "Config issues");
+		await prompter.outro(`Config invalid. Run \`${formatCliCommand("moldclaw doctor")}\` to repair it, then re-run setup.`);
+		runtime.exit(1);
+		return;
+	}
+	const quickstartHint = `Configure details later via ${formatCliCommand("moldclaw configure")}.`;
+	const manualHint = "Configure port, network, Tailscale, and auth options.";
+	const explicitFlowRaw = opts.flow?.trim();
+	const normalizedExplicitFlow = explicitFlowRaw === "manual" ? "advanced" : explicitFlowRaw;
+	if (normalizedExplicitFlow && normalizedExplicitFlow !== "quickstart" && normalizedExplicitFlow !== "advanced") {
+		runtime.error("Invalid --flow (use quickstart, manual, or advanced).");
+		runtime.exit(1);
+		return;
+	}
+	let flow = (normalizedExplicitFlow === "quickstart" || normalizedExplicitFlow === "advanced" ? normalizedExplicitFlow : void 0) ?? await prompter.select({
+		message: "Setup mode",
+		options: [{
+			value: "quickstart",
+			label: "QuickStart",
+			hint: quickstartHint
+		}, {
+			value: "advanced",
+			label: "Manual",
+			hint: manualHint
+		}],
+		initialValue: "quickstart"
+	});
+	if (opts.mode === "remote" && flow === "quickstart") {
+		await prompter.note("QuickStart only supports local gateways. Switching to Manual mode.", "QuickStart");
+		flow = "advanced";
+	}
+	if (snapshot.exists) {
+		await prompter.note(onboardHelpers.summarizeExistingConfig(baseConfig), "Existing config detected");
+		if (await prompter.select({
+			message: "Config handling",
+			options: [
+				{
+					value: "keep",
+					label: "Use existing values"
+				},
+				{
+					value: "modify",
+					label: "Update values"
+				},
+				{
+					value: "reset",
+					label: "Reset"
+				}
+			]
+		}) === "reset") {
+			const workspaceDefault = baseConfig.agents?.defaults?.workspace ?? onboardHelpers.DEFAULT_WORKSPACE;
+			const resetScope = await prompter.select({
+				message: "Reset scope",
+				options: [
+					{
+						value: "config",
+						label: "Config only"
+					},
+					{
+						value: "config+creds+sessions",
+						label: "Config + creds + sessions"
+					},
+					{
+						value: "full",
+						label: "Full reset (config + creds + sessions + workspace)"
+					}
+				]
+			});
+			await onboardHelpers.handleReset(resetScope, resolveUserPath(workspaceDefault), runtime);
+			baseConfig = {};
+		}
+	}
+	const quickstartGateway = (() => {
+		const hasExisting = typeof baseConfig.gateway?.port === "number" || baseConfig.gateway?.bind !== void 0 || baseConfig.gateway?.auth?.mode !== void 0 || baseConfig.gateway?.auth?.token !== void 0 || baseConfig.gateway?.auth?.password !== void 0 || baseConfig.gateway?.customBindHost !== void 0 || baseConfig.gateway?.tailscale?.mode !== void 0;
+		const bindRaw = baseConfig.gateway?.bind;
+		const bind = bindRaw === "loopback" || bindRaw === "lan" || bindRaw === "auto" || bindRaw === "custom" || bindRaw === "tailnet" ? bindRaw : "loopback";
+		let authMode = "token";
+		if (baseConfig.gateway?.auth?.mode === "token" || baseConfig.gateway?.auth?.mode === "password") authMode = baseConfig.gateway.auth.mode;
+		else if (baseConfig.gateway?.auth?.token) authMode = "token";
+		else if (baseConfig.gateway?.auth?.password) authMode = "password";
+		const tailscaleRaw = baseConfig.gateway?.tailscale?.mode;
+		const tailscaleMode = tailscaleRaw === "off" || tailscaleRaw === "serve" || tailscaleRaw === "funnel" ? tailscaleRaw : "off";
+		return {
+			hasExisting,
+			port: resolveGatewayPort(baseConfig),
+			bind,
+			authMode,
+			tailscaleMode,
+			token: baseConfig.gateway?.auth?.token,
+			password: baseConfig.gateway?.auth?.password,
+			customBindHost: baseConfig.gateway?.customBindHost,
+			tailscaleResetOnExit: baseConfig.gateway?.tailscale?.resetOnExit ?? false
+		};
+	})();
+	if (flow === "quickstart") {
+		const formatBind = (value) => {
+			if (value === "loopback") return "Loopback (127.0.0.1)";
+			if (value === "lan") return "LAN";
+			if (value === "custom") return "Custom IP";
+			if (value === "tailnet") return "Tailnet (Tailscale IP)";
+			return "Auto";
+		};
+		const formatAuth = (value) => {
+			if (value === "token") return "Token (default)";
+			return "Password";
+		};
+		const formatTailscale = (value) => {
+			if (value === "off") return "Off";
+			if (value === "serve") return "Serve";
+			return "Funnel";
+		};
+		const quickstartLines = quickstartGateway.hasExisting ? [
+			"Keeping your current gateway settings:",
+			`Gateway port: ${quickstartGateway.port}`,
+			`Gateway bind: ${formatBind(quickstartGateway.bind)}`,
+			...quickstartGateway.bind === "custom" && quickstartGateway.customBindHost ? [`Gateway custom IP: ${quickstartGateway.customBindHost}`] : [],
+			`Gateway auth: ${formatAuth(quickstartGateway.authMode)}`,
+			`Tailscale exposure: ${formatTailscale(quickstartGateway.tailscaleMode)}`,
+			"Direct to chat channels."
+		] : [
+			`Gateway port: ${DEFAULT_GATEWAY_PORT}`,
+			"Gateway bind: Loopback (127.0.0.1)",
+			"Gateway auth: Token (default)",
+			"Tailscale exposure: Off",
+			"Direct to chat channels."
+		];
+		await prompter.note(quickstartLines.join("\n"), "QuickStart");
+	}
+	const localPort = resolveGatewayPort(baseConfig);
+	const localUrl = `ws://127.0.0.1:${localPort}`;
+	let localGatewayToken = process.env.MOLDCLAW_GATEWAY_TOKEN ?? process.env.MOLDCLAW_GATEWAY_TOKEN;
+	try {
+		const resolvedGatewayToken = await resolveSetupSecretInputString({
+			config: baseConfig,
+			value: baseConfig.gateway?.auth?.token,
+			path: "gateway.auth.token",
+			env: process.env
+		});
+		if (resolvedGatewayToken) localGatewayToken = resolvedGatewayToken;
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.auth.token SecretRef for setup probe.", error instanceof Error ? error.message : String(error)].join("\n"), "Gateway auth");
+	}
+	let localGatewayPassword = process.env.MOLDCLAW_GATEWAY_PASSWORD ?? process.env.MOLDCLAW_GATEWAY_PASSWORD;
+	try {
+		const resolvedGatewayPassword = await resolveSetupSecretInputString({
+			config: baseConfig,
+			value: baseConfig.gateway?.auth?.password,
+			path: "gateway.auth.password",
+			env: process.env
+		});
+		if (resolvedGatewayPassword) localGatewayPassword = resolvedGatewayPassword;
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.auth.password SecretRef for setup probe.", error instanceof Error ? error.message : String(error)].join("\n"), "Gateway auth");
+	}
+	const localProbe = await onboardHelpers.probeGatewayReachable({
+		url: localUrl,
+		token: localGatewayToken,
+		password: localGatewayPassword
+	});
+	const remoteUrl = baseConfig.gateway?.remote?.url?.trim() ?? "";
+	let remoteGatewayToken = normalizeSecretInputString(baseConfig.gateway?.remote?.token);
+	try {
+		const resolvedRemoteGatewayToken = await resolveSetupSecretInputString({
+			config: baseConfig,
+			value: baseConfig.gateway?.remote?.token,
+			path: "gateway.remote.token",
+			env: process.env
+		});
+		if (resolvedRemoteGatewayToken) remoteGatewayToken = resolvedRemoteGatewayToken;
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.remote.token SecretRef for setup probe.", error instanceof Error ? error.message : String(error)].join("\n"), "Gateway auth");
+	}
+	const remoteProbe = remoteUrl ? await onboardHelpers.probeGatewayReachable({
+		url: remoteUrl,
+		token: remoteGatewayToken
+	}) : null;
+	const mode = opts.mode ?? (flow === "quickstart" ? "local" : await prompter.select({
+		message: "What do you want to set up?",
+		options: [{
+			value: "local",
+			label: "Local gateway (this machine)",
+			hint: localProbe.ok ? `Gateway reachable (${localUrl})` : `No gateway detected (${localUrl})`
+		}, {
+			value: "remote",
+			label: "Remote gateway (info-only)",
+			hint: !remoteUrl ? "No remote URL configured yet" : remoteProbe?.ok ? `Gateway reachable (${remoteUrl})` : `Configured but unreachable (${remoteUrl})`
+		}]
+	}));
+	if (mode === "remote") {
+		const { promptRemoteGatewayConfig } = await import("./onboard-remote-BTspTgA4.js");
+		const { logConfigUpdated } = await import("./logging-DfaiL4OX.js");
+		let nextConfig = await promptRemoteGatewayConfig(baseConfig, prompter, { secretInputMode: opts.secretInputMode });
+		nextConfig = onboardHelpers.applyWizardMetadata(nextConfig, {
+			command: "onboard",
+			mode
+		});
+		await writeConfigFile(nextConfig);
+		logConfigUpdated(runtime);
+		await prompter.outro("Remote gateway configured.");
+		return;
+	}
+	const workspaceDir = resolveUserPath((opts.workspace ?? (flow === "quickstart" ? baseConfig.agents?.defaults?.workspace ?? onboardHelpers.DEFAULT_WORKSPACE : await prompter.text({
+		message: "Workspace directory",
+		initialValue: baseConfig.agents?.defaults?.workspace ?? onboardHelpers.DEFAULT_WORKSPACE
+	}))).trim() || onboardHelpers.DEFAULT_WORKSPACE);
+	const { applyLocalSetupWorkspaceConfig } = await import("./onboard-config-C2yTQ4QE.js");
+	let nextConfig = applyLocalSetupWorkspaceConfig(baseConfig, workspaceDir);
+	const { ensureAuthProfileStore } = await import("./auth-profiles.runtime-HONFDgiu.js");
+	const { promptAuthChoiceGrouped } = await import("./auth-choice-prompt-BhRqchJx.js");
+	const { promptCustomApiConfig } = await import("./onboard-custom-eIvRswgv.js");
+	const { applyAuthChoice, resolvePreferredProviderForAuthChoice, warnIfModelConfigLooksOff } = await import("./auth-choice-CNppOY_V.js");
+	const { applyPrimaryModel, promptDefaultModel } = await import("./model-picker-CRix4Wwv.js");
+	const authStore = ensureAuthProfileStore(void 0, { allowKeychainPrompt: false });
+	const authChoiceFromPrompt = opts.authChoice === void 0;
+	const authChoice = opts.authChoice ?? await promptAuthChoiceGrouped({
+		prompter,
+		store: authStore,
+		includeSkip: true,
+		config: nextConfig,
+		workspaceDir
+	});
+	if (authChoice === "custom-api-key") nextConfig = (await promptCustomApiConfig({
+		prompter,
+		runtime,
+		config: nextConfig,
+		secretInputMode: opts.secretInputMode
+	})).config;
+	else {
+		const authResult = await applyAuthChoice({
+			authChoice,
+			config: nextConfig,
+			prompter,
+			runtime,
+			setDefaultModel: true,
+			opts: {
+				tokenProvider: opts.tokenProvider,
+				token: opts.authChoice === "apiKey" && opts.token ? opts.token : void 0
+			}
+		});
+		nextConfig = authResult.config;
+		if (authResult.agentModelOverride) nextConfig = applyPrimaryModel(nextConfig, authResult.agentModelOverride);
+	}
+	if (authChoiceFromPrompt && authChoice !== "custom-api-key") {
+		const modelSelection = await promptDefaultModel({
+			config: nextConfig,
+			prompter,
+			allowKeep: true,
+			ignoreAllowlist: true,
+			includeProviderPluginSetups: true,
+			preferredProvider: await resolvePreferredProviderForAuthChoice({
+				choice: authChoice,
+				config: nextConfig,
+				workspaceDir
+			}),
+			workspaceDir,
+			runtime
+		});
+		if (modelSelection.config) nextConfig = modelSelection.config;
+		if (modelSelection.model) nextConfig = applyPrimaryModel(nextConfig, modelSelection.model);
+	}
+	await warnIfModelConfigLooksOff(nextConfig, prompter);
+	const { configureGatewayForSetup } = await import("./setup.gateway-config-C8hdtlbw.js");
+	const gateway = await configureGatewayForSetup({
+		flow,
+		baseConfig,
+		nextConfig,
+		localPort,
+		quickstartGateway,
+		secretInputMode: opts.secretInputMode,
+		prompter,
+		runtime
+	});
+	nextConfig = gateway.nextConfig;
+	const settings = gateway.settings;
+	if (opts.skipChannels ?? opts.skipProviders) await prompter.note("Skipping channel setup.", "Channels");
+	else {
+		const { listChannelPlugins } = await import("./plugins-C4PiDdjc.js");
+		const { setupChannels } = await import("./onboard-channels-vaO3nWLL.js");
+		const quickstartAllowFromChannels = flow === "quickstart" ? listChannelPlugins().filter((plugin) => plugin.meta.quickstartAllowFrom).map((plugin) => plugin.id) : [];
+		nextConfig = await setupChannels(nextConfig, runtime, prompter, {
+			allowSignalInstall: true,
+			forceAllowFromChannels: quickstartAllowFromChannels,
+			skipDmPolicyPrompt: flow === "quickstart",
+			skipConfirm: flow === "quickstart",
+			quickstartDefaults: flow === "quickstart",
+			secretInputMode: opts.secretInputMode
+		});
+	}
+	await writeConfigFile(nextConfig);
+	const { logConfigUpdated } = await import("./logging-DfaiL4OX.js");
+	logConfigUpdated(runtime);
+	await onboardHelpers.ensureWorkspaceAndSessions(workspaceDir, runtime, { skipBootstrap: Boolean(nextConfig.agents?.defaults?.skipBootstrap) });
+	if (opts.skipSearch) await prompter.note("Skipping search setup.", "Search");
+	else {
+		const { setupSearch } = await import("./onboard-search-DS0tZS24.js");
+		nextConfig = await setupSearch(nextConfig, runtime, prompter, {
+			quickstartDefaults: flow === "quickstart",
+			secretInputMode: opts.secretInputMode
+		});
+	}
+	if (opts.skipSkills) await prompter.note("Skipping skills setup.", "Skills");
+	else {
+		const { setupSkills } = await import("./onboard-skills-so0a_BJV.js");
+		nextConfig = await setupSkills(nextConfig, workspaceDir, runtime, prompter);
+	}
+	const { setupInternalHooks } = await import("./onboard-hooks-xT101X4i.js");
+	nextConfig = await setupInternalHooks(nextConfig, runtime, prompter);
+	nextConfig = onboardHelpers.applyWizardMetadata(nextConfig, {
+		command: "onboard",
+		mode
+	});
+	await writeConfigFile(nextConfig);
+	const { finalizeSetupWizard } = await import("./setup.finalize-B5ETm3Ui.js");
+	const { launchedTui } = await finalizeSetupWizard({
+		flow,
+		opts,
+		baseConfig,
+		nextConfig,
+		workspaceDir,
+		settings,
+		prompter,
+		runtime
+	});
+	if (launchedTui) return;
+}
+//#endregion
+export { runSetupWizard as t };

package/dist/setup-DcSZ_pTn.d.ts

@@ -0,0 +1,37 @@
+import { Ll as moldClawConfig, eO as ChannelSetupWizard, rO as ChannelSetupDmPolicy, tP as RuntimeEnv } from "./types-DBhDdMQd.js";
+
+//#region src/plugins/setup-binary.d.ts
+declare function detectBinary(name: string): Promise<boolean>;
+//#endregion
+//#region src/plugins/signal-cli-install.d.ts
+type SignalInstallResult = {
+  ok: boolean;
+  cliPath?: string;
+  version?: string;
+  error?: string;
+};
+declare function installSignalCli(runtime: RuntimeEnv): Promise<SignalInstallResult>;
+//#endregion
+//#region src/channels/plugins/setup-wizard-proxy.d.ts
+type PromptAllowFromParams = Parameters<NonNullable<ChannelSetupDmPolicy["promptAllowFrom"]>>[0];
+type ResolveAllowFromEntriesParams = Parameters<NonNullable<ChannelSetupWizard["allowFrom"]>["resolveEntries"]>[0];
+type ResolveAllowFromEntriesResult = Awaited<ReturnType<NonNullable<ChannelSetupWizard["allowFrom"]>["resolveEntries"]>>;
+type ResolveGroupAllowlistParams = Parameters<NonNullable<NonNullable<ChannelSetupWizard["groupAccess"]>["resolveAllowlist"]>>[0];
+declare function createAllowlistSetupWizardProxy<TGroupResolved>(params: {
+  loadWizard: () => Promise<ChannelSetupWizard>;
+  createBase: (handlers: {
+    promptAllowFrom: (params: PromptAllowFromParams) => Promise<moldClawConfig>;
+    resolveAllowFromEntries: (params: ResolveAllowFromEntriesParams) => Promise<ResolveAllowFromEntriesResult>;
+    resolveGroupAllowlist: (params: ResolveGroupAllowlistParams) => Promise<TGroupResolved>;
+  }) => ChannelSetupWizard;
+  fallbackResolvedGroupAllowlist: (entries: string[]) => TGroupResolved;
+}): ChannelSetupWizard;
+//#endregion
+//#region src/plugin-sdk/resolution-notes.d.ts
+/** Format a short note that separates successfully resolved targets from unresolved passthrough values. */
+declare function formatResolvedUnresolvedNote(params: {
+  resolved: string[];
+  unresolved: string[];
+}): string | undefined;
+//#endregion
+export { detectBinary as i, createAllowlistSetupWizardProxy as n, installSignalCli as r, formatResolvedUnresolvedNote as t };

package/dist/setup-core-B9mdZYnU.js

@@ -0,0 +1,166 @@
+import { m as normalizeE164 } from "./utils-rjVNXUns.js";
+import { t as formatDocsLink } from "./links-C5I443Xb.js";
+import { Bx as listSignalAccountIds, Eg as setChannelDmPolicyWithAllowFrom, Hx as resolveSignalAccount, Og as setSetupChannelEnabled, Ow as createPatchedAccountSetupAdapter, Vx as resolveDefaultSignalAccountId, hg as parseSetupEntriesAllowingWildcard, yg as promptParsedAllowFromForScopedChannel } from "./auth-profiles-9zZdaXJK.js";
+import { t as formatCliCommand } from "./command-format-DIDjlImI.js";
+//#region extensions/signal/src/setup-core.ts
+const channel = "signal";
+const MIN_E164_DIGITS = 5;
+const MAX_E164_DIGITS = 15;
+const DIGITS_ONLY = /^\d+$/;
+const INVALID_SIGNAL_ACCOUNT_ERROR = "Invalid E.164 phone number (must start with + and country code, e.g. +15555550123)";
+function normalizeSignalAccountInput(value) {
+	const trimmed = value?.trim();
+	if (!trimmed) return null;
+	const digits = normalizeE164(trimmed).slice(1);
+	if (!DIGITS_ONLY.test(digits)) return null;
+	if (digits.length < MIN_E164_DIGITS || digits.length > MAX_E164_DIGITS) return null;
+	return `+${digits}`;
+}
+function isUuidLike(value) {
+	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function parseSignalAllowFromEntries(raw) {
+	return parseSetupEntriesAllowingWildcard(raw, (entry) => {
+		if (entry.toLowerCase().startsWith("uuid:")) {
+			const id = entry.slice(5).trim();
+			if (!id) return { error: "Invalid uuid entry" };
+			return { value: `uuid:${id}` };
+		}
+		if (isUuidLike(entry)) return { value: `uuid:${entry}` };
+		const normalized = normalizeSignalAccountInput(entry);
+		if (!normalized) return { error: `Invalid entry: ${entry}` };
+		return { value: normalized };
+	});
+}
+function buildSignalSetupPatch(input) {
+	return {
+		...input.signalNumber ? { account: input.signalNumber } : {},
+		...input.cliPath ? { cliPath: input.cliPath } : {},
+		...input.httpUrl ? { httpUrl: input.httpUrl } : {},
+		...input.httpHost ? { httpHost: input.httpHost } : {},
+		...input.httpPort ? { httpPort: Number(input.httpPort) } : {}
+	};
+}
+async function promptSignalAllowFrom(params) {
+	return promptParsedAllowFromForScopedChannel({
+		cfg: params.cfg,
+		channel,
+		accountId: params.accountId,
+		defaultAccountId: resolveDefaultSignalAccountId(params.cfg),
+		prompter: params.prompter,
+		noteTitle: "Signal allowlist",
+		noteLines: [
+			"Allowlist Signal DMs by sender id.",
+			"Examples:",
+			"- +15555550123",
+			"- uuid:123e4567-e89b-12d3-a456-426614174000",
+			"Multiple entries: comma-separated.",
+			`Docs: ${formatDocsLink("/signal", "signal")}`
+		],
+		message: "Signal allowFrom (E.164 or uuid)",
+		placeholder: "+15555550123, uuid:123e4567-e89b-12d3-a456-426614174000",
+		parseEntries: parseSignalAllowFromEntries,
+		getExistingAllowFrom: ({ cfg, accountId }) => resolveSignalAccount({
+			cfg,
+			accountId
+		}).config.allowFrom ?? []
+	});
+}
+const signalDmPolicy = {
+	label: "Signal",
+	channel,
+	policyKey: "channels.signal.dmPolicy",
+	allowFromKey: "channels.signal.allowFrom",
+	getCurrent: (cfg) => cfg.channels?.signal?.dmPolicy ?? "pairing",
+	setPolicy: (cfg, policy) => setChannelDmPolicyWithAllowFrom({
+		cfg,
+		channel,
+		dmPolicy: policy
+	}),
+	promptAllowFrom: promptSignalAllowFrom
+};
+function resolveSignalCliPath(params) {
+	return (typeof params.credentialValues.cliPath === "string" ? params.credentialValues.cliPath : void 0) ?? resolveSignalAccount({
+		cfg: params.cfg,
+		accountId: params.accountId
+	}).config.cliPath ?? "signal-cli";
+}
+function createSignalCliPathTextInput(shouldPrompt) {
+	return {
+		inputKey: "cliPath",
+		message: "signal-cli path",
+		currentValue: ({ cfg, accountId, credentialValues }) => resolveSignalCliPath({
+			cfg,
+			accountId,
+			credentialValues
+		}),
+		initialValue: ({ cfg, accountId, credentialValues }) => resolveSignalCliPath({
+			cfg,
+			accountId,
+			credentialValues
+		}),
+		shouldPrompt,
+		confirmCurrentValue: false,
+		applyCurrentValue: true,
+		helpTitle: "Signal",
+		helpLines: ["signal-cli not found. Install it, then rerun this step or set channels.signal.cliPath."]
+	};
+}
+const signalNumberTextInput = {
+	inputKey: "signalNumber",
+	message: "Signal bot number (E.164)",
+	currentValue: ({ cfg, accountId }) => normalizeSignalAccountInput(resolveSignalAccount({
+		cfg,
+		accountId
+	}).config.account) ?? void 0,
+	keepPrompt: (value) => `Signal account set (${value}). Keep it?`,
+	validate: ({ value }) => normalizeSignalAccountInput(value) ? void 0 : INVALID_SIGNAL_ACCOUNT_ERROR,
+	normalizeValue: ({ value }) => normalizeSignalAccountInput(value) ?? value
+};
+const signalCompletionNote = {
+	title: "Signal next steps",
+	lines: [
+		"Link device with: signal-cli link -n \"MoldClaw\"",
+		"Scan QR in Signal -> Linked Devices",
+		`Then run: ${formatCliCommand("moldclaw gateway call channels.status --params '{\"probe\":true}'")}`,
+		`Docs: ${formatDocsLink("/signal", "signal")}`
+	]
+};
+const signalSetupAdapter = createPatchedAccountSetupAdapter({
+	channelKey: channel,
+	validateInput: ({ input }) => {
+		if (!input.signalNumber && !input.httpUrl && !input.httpHost && !input.httpPort && !input.cliPath) return "Signal requires --signal-number or --http-url/--http-host/--http-port/--cli-path.";
+		return null;
+	},
+	buildPatch: (input) => buildSignalSetupPatch(input)
+});
+function createSignalSetupWizardProxy(loadWizard) {
+	return {
+		channel,
+		status: {
+			configuredLabel: "configured",
+			unconfiguredLabel: "needs setup",
+			configuredHint: "signal-cli found",
+			unconfiguredHint: "signal-cli missing",
+			configuredScore: 1,
+			unconfiguredScore: 0,
+			resolveConfigured: ({ cfg }) => listSignalAccountIds(cfg).some((accountId) => resolveSignalAccount({
+				cfg,
+				accountId
+			}).configured),
+			resolveStatusLines: async (params) => (await loadWizard()).signalSetupWizard.status.resolveStatusLines?.(params) ?? [],
+			resolveSelectionHint: async (params) => await (await loadWizard()).signalSetupWizard.status.resolveSelectionHint?.(params),
+			resolveQuickstartScore: async (params) => await (await loadWizard()).signalSetupWizard.status.resolveQuickstartScore?.(params)
+		},
+		prepare: async (params) => await (await loadWizard()).signalSetupWizard.prepare?.(params),
+		credentials: [],
+		textInputs: [createSignalCliPathTextInput(async (params) => {
+			return await ((await loadWizard()).signalSetupWizard.textInputs?.find((entry) => entry.inputKey === "cliPath"))?.shouldPrompt?.(params) ?? false;
+		}), signalNumberTextInput],
+		completionNote: signalCompletionNote,
+		dmPolicy: signalDmPolicy,
+		disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
+	};
+}
+//#endregion
+export { signalNumberTextInput as a, signalDmPolicy as i, createSignalSetupWizardProxy as n, signalSetupAdapter as o, signalCompletionNote as r, createSignalCliPathTextInput as t };

package/dist/setup-core-Cj0sLkpP.js

@@ -0,0 +1,47 @@
+import { Tw as applyAccountNameToChannelSection, kw as migrateBaseNameToDefaultAccount } from "./auth-profiles-9zZdaXJK.js";
+import { n as normalizeAccountId } from "./account-id-O4Og6DrK.js";
+//#region extensions/whatsapp/src/setup-core.ts
+const channel = "whatsapp";
+const whatsappSetupAdapter = {
+	resolveAccountId: ({ accountId }) => normalizeAccountId(accountId),
+	applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
+		cfg,
+		channelKey: channel,
+		accountId,
+		name,
+		alwaysUseAccounts: true
+	}),
+	applyAccountConfig: ({ cfg, accountId, input }) => {
+		const next = migrateBaseNameToDefaultAccount({
+			cfg: applyAccountNameToChannelSection({
+				cfg,
+				channelKey: channel,
+				accountId,
+				name: input.name,
+				alwaysUseAccounts: true
+			}),
+			channelKey: channel,
+			alwaysUseAccounts: true
+		});
+		const entry = {
+			...next.channels?.whatsapp?.accounts?.[accountId],
+			...input.authDir ? { authDir: input.authDir } : {},
+			enabled: true
+		};
+		return {
+			...next,
+			channels: {
+				...next.channels,
+				whatsapp: {
+					...next.channels?.whatsapp,
+					accounts: {
+						...next.channels?.whatsapp?.accounts,
+						[accountId]: entry
+					}
+				}
+			}
+		};
+	}
+};
+//#endregion
+export { whatsappSetupAdapter as t };