@spacebar_ai/moldclaw-core 2026.3.47 → 2026.3.50

package/dist/{auth-choice-C3WmcTWd.js → auth-choice-CQv0bwq8.js}

@@ -15,7 +15,7 @@ import "./warning-filter-B1UOeM0G.js";
 import "./utils-C7ykRPCQ.js";
 import "./links-BcahUP5U.js";
 import "./setup-binary-CcAv8NXz.js";
-import { Gm as applyAuthProfileConfig, Lg as normalizeSecretInputModeInput, lx as resolveEnvApiKey, mE as resolveApiKeyForProfile, n as resolveAuthProfileOrder, wE as ensureAuthProfileStore } from "./auth-profiles-0oIEn5d4.js";
+import { Gm as applyAuthProfileConfig, Lg as normalizeSecretInputModeInput, lx as resolveEnvApiKey, mE as resolveApiKeyForProfile, n as resolveAuthProfileOrder, wE as ensureAuthProfileStore } from "./auth-profiles-Dho6F9Y8.js";
 import "./model-selection-bBBxfXdb.js";
 import { a as resolveAgentDir, m as resolveDefaultAgentId, p as resolveAgentWorkspaceDir } from "./agent-scope-lZlwP1At.js";
 import "./boundary-file-read-tPYh_8fH.js";
@@ -87,7 +87,7 @@ import "./call-gdDAt07d.js";
 import "./multimodal-BJBBn_4F.js";
 import "./memory-search-tTD5o_rU.js";
 import "./query-expansion-D_Mm5Hhi.js";
-import "./search-manager-C_QQX70y.js";
+import "./search-manager-B1ifAltj.js";
 import "./core-BwKq3krw.js";
 import "./issue-format-B0SI57Es.js";
 import "./logging-CdisccbY.js";
@@ -103,7 +103,7 @@ import "./delivery-queue-BOf5wYIc.js";
 import "./pairing-token-bu1e6z6X.js";
 import "./accounts-J2OhhhQi.js";
 import "./process-runtime-D27SftX_.js";
-import "./audit-Dj09wbPx.js";
+import "./audit-CSGucdf8.js";
 import "./cli-runtime-DTCHPjCi.js";
 import "./cli-utils-BCuSS4l6.js";
 import "./help-format-BFzPm_8V.js";
@@ -111,12 +111,12 @@ import "./progress-Cwq59vgZ.js";
 import "./gateway-runtime-CBm3CCoA.js";
 import { t as applyCloudflareAiGatewayConfig } from "./onboard-BON0C360.js";
 import "./onboard-DsKI17iq.js";
-import { t as enablePluginInConfig } from "./enable-DZoawXis.js";
+import { t as enablePluginInConfig } from "./enable-C45wRM0g.js";
 import "./provider-auth-choices-0KaDNPBQ.js";
 import "./auth-choice.apply-helpers-BhbNIV8X.js";
-import { a as setCloudflareAiGatewayConfig, i as applyLitellmConfig, o as setLitellmApiKey, r as normalizeApiKeyTokenProviderAuthChoice, t as resolvePreferredProviderForAuthChoice } from "./provider-auth-choice-preference-tSV1QGS3.js";
-import "./model-picker-BV1hwKha.js";
-import { a as resolveCustomProviderId, n as applyCustomApiConfig, r as parseNonInteractiveCustomApiFlags, t as CustomApiError } from "./onboard-custom-DuwwagQE.js";
+import { a as setCloudflareAiGatewayConfig, i as applyLitellmConfig, o as setLitellmApiKey, r as normalizeApiKeyTokenProviderAuthChoice, t as resolvePreferredProviderForAuthChoice } from "./provider-auth-choice-preference-BWY5r96O.js";
+import "./model-picker-C9S6W21O.js";
+import { a as resolveCustomProviderId, n as applyCustomApiConfig, r as parseNonInteractiveCustomApiFlags, t as CustomApiError } from "./onboard-custom-k_jl8caW.js";
 //#region src/commands/onboard-non-interactive/api-keys.ts
 function parseEnvVarNameFromSourceLabel(source) {
 	if (!source) return;
@@ -217,7 +217,7 @@ async function applySimpleNonInteractiveApiKeyChoice(params) {
 //#region src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.ts
 const PROVIDER_PLUGIN_CHOICE_PREFIX = "provider-plugin:";
 async function loadPluginProviderRuntime() {
-	return import("./auth-choice.plugin-providers.runtime-BnXxELai.js");
+	return import("./auth-choice.plugin-providers.runtime-BpZL2PGS.js");
 }
 const loadAuthChoicePluginProvidersRuntime = createLazyRuntimeSurface(loadPluginProviderRuntime, ({ authChoicePluginProvidersRuntime }) => authChoicePluginProvidersRuntime);
 function buildIsolatedProviderResolutionConfig(cfg, providerId) {

package/dist/{auth-choice-gQSceTlc.js → auth-choice-DvZZdkAT.js}

@@ -15,7 +15,7 @@ import "./warning-filter-B1UOeM0G.js";
 import "./utils-C7ykRPCQ.js";
 import "./links-BcahUP5U.js";
 import "./setup-binary-CcAv8NXz.js";
-import "./auth-profiles-0oIEn5d4.js";
+import "./auth-profiles-Dho6F9Y8.js";
 import "./model-selection-bBBxfXdb.js";
 import "./agent-scope-lZlwP1At.js";
 import "./boundary-file-read-tPYh_8fH.js";
@@ -86,7 +86,7 @@ import "./call-gdDAt07d.js";
 import "./multimodal-BJBBn_4F.js";
 import "./memory-search-tTD5o_rU.js";
 import "./query-expansion-D_Mm5Hhi.js";
-import "./search-manager-C_QQX70y.js";
+import "./search-manager-B1ifAltj.js";
 import "./core-BwKq3krw.js";
 import "./issue-format-B0SI57Es.js";
 import "./logging-CdisccbY.js";
@@ -102,7 +102,7 @@ import "./delivery-queue-BOf5wYIc.js";
 import "./pairing-token-bu1e6z6X.js";
 import "./accounts-J2OhhhQi.js";
 import "./process-runtime-D27SftX_.js";
-import "./audit-Dj09wbPx.js";
+import "./audit-CSGucdf8.js";
 import "./cli-runtime-DTCHPjCi.js";
 import "./cli-utils-BCuSS4l6.js";
 import "./help-format-BFzPm_8V.js";
@@ -112,11 +112,11 @@ import "./control-ui-shared-Dm5Dh0Lo.js";
 import "./onboard-helpers-DiSRTpZC.js";
 import "./setup-browser-C4eRV3h6.js";
 import "./provider-auth-choice-helpers-hzDkh3f1.js";
-import "./provider-auth-guidance-BOyik44T.js";
-import "./enable-DZoawXis.js";
+import "./provider-auth-guidance-ioVdVouy.js";
+import "./enable-C45wRM0g.js";
 import "./provider-auth-choices-0KaDNPBQ.js";
-import "./provider-auth-choice-LTU00nWq.js";
+import "./provider-auth-choice-DbROD3BK.js";
 import "./auth-choice.apply-helpers-BhbNIV8X.js";
-import { t as resolvePreferredProviderForAuthChoice } from "./provider-auth-choice-preference-tSV1QGS3.js";
-import { n as applyAuthChoice, t as warnIfModelConfigLooksOff } from "./auth-choice-DMvgACeq.js";
+import { t as resolvePreferredProviderForAuthChoice } from "./provider-auth-choice-preference-BWY5r96O.js";
+import { n as applyAuthChoice, t as warnIfModelConfigLooksOff } from "./auth-choice-C8fcTD7-.js";
 export { applyAuthChoice, resolvePreferredProviderForAuthChoice, warnIfModelConfigLooksOff };

package/dist/{auth-choice-options-CUvAY9RB.js → auth-choice-options-CdTbWTyI.js}

@@ -1,5 +1,5 @@
 import { r as resolveManifestProviderAuthChoices } from "./provider-auth-choices-0KaDNPBQ.js";
-import { r as resolveProviderWizardOptions } from "./provider-wizard-DbPwTZqs.js";
+import { r as resolveProviderWizardOptions } from "./provider-wizard-BhrIqFdZ.js";
 import { t as AUTH_CHOICE_LEGACY_ALIASES_FOR_CLI } from "./auth-choice-legacy-CSR3WV5B.js";
 //#region src/commands/auth-choice-options.static.ts
 const CORE_AUTH_CHOICE_OPTIONS = [

package/dist/{auth-choice-prompt-D7Y5Thyf.js → auth-choice-prompt-B3K-aa9e.js}

@@ -15,7 +15,7 @@ import "./warning-filter-B1UOeM0G.js";
 import "./utils-C7ykRPCQ.js";
 import "./links-BcahUP5U.js";
 import "./setup-binary-CcAv8NXz.js";
-import "./auth-profiles-0oIEn5d4.js";
+import "./auth-profiles-Dho6F9Y8.js";
 import "./model-selection-bBBxfXdb.js";
 import "./agent-scope-lZlwP1At.js";
 import "./boundary-file-read-tPYh_8fH.js";
@@ -86,7 +86,7 @@ import "./call-gdDAt07d.js";
 import "./multimodal-BJBBn_4F.js";
 import "./memory-search-tTD5o_rU.js";
 import "./query-expansion-D_Mm5Hhi.js";
-import "./search-manager-C_QQX70y.js";
+import "./search-manager-B1ifAltj.js";
 import "./core-BwKq3krw.js";
 import "./issue-format-B0SI57Es.js";
 import "./logging-CdisccbY.js";
@@ -102,14 +102,14 @@ import "./delivery-queue-BOf5wYIc.js";
 import "./pairing-token-bu1e6z6X.js";
 import "./accounts-J2OhhhQi.js";
 import "./process-runtime-D27SftX_.js";
-import "./audit-Dj09wbPx.js";
+import "./audit-CSGucdf8.js";
 import "./cli-runtime-DTCHPjCi.js";
 import "./cli-utils-BCuSS4l6.js";
 import "./help-format-BFzPm_8V.js";
 import "./progress-Cwq59vgZ.js";
 import "./gateway-runtime-CBm3CCoA.js";
 import "./provider-auth-choices-0KaDNPBQ.js";
-import "./provider-wizard-DbPwTZqs.js";
-import "./auth-choice-options-CUvAY9RB.js";
-import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-CQIBXjEi.js";
+import "./provider-wizard-BhrIqFdZ.js";
+import "./auth-choice-options-CdTbWTyI.js";
+import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-BLyYvRRp.js";
 export { promptAuthChoiceGrouped };

package/dist/{auth-choice-prompt-CQIBXjEi.js → auth-choice-prompt-BLyYvRRp.js}

@@ -1,4 +1,4 @@
-import { t as buildAuthChoiceGroups } from "./auth-choice-options-CUvAY9RB.js";
+import { t as buildAuthChoiceGroups } from "./auth-choice-options-CdTbWTyI.js";
 //#region src/commands/auth-choice-prompt.ts
 const BACK_VALUE = "__back";
 async function promptAuthChoiceGrouped(params) {

package/dist/{auth-choice.plugin-providers.runtime-BnXxELai.js → auth-choice.plugin-providers.runtime-BpZL2PGS.js}

@@ -15,7 +15,7 @@ import "./warning-filter-B1UOeM0G.js";
 import "./utils-C7ykRPCQ.js";
 import "./links-BcahUP5U.js";
 import "./setup-binary-CcAv8NXz.js";
-import { Nn as resolveOwningPluginIdsForProvider, Pn as resolvePluginProviders } from "./auth-profiles-0oIEn5d4.js";
+import { Nn as resolveOwningPluginIdsForProvider, Pn as resolvePluginProviders } from "./auth-profiles-Dho6F9Y8.js";
 import "./model-selection-bBBxfXdb.js";
 import "./agent-scope-lZlwP1At.js";
 import "./boundary-file-read-tPYh_8fH.js";
@@ -86,7 +86,7 @@ import "./call-gdDAt07d.js";
 import "./multimodal-BJBBn_4F.js";
 import "./memory-search-tTD5o_rU.js";
 import "./query-expansion-D_Mm5Hhi.js";
-import "./search-manager-C_QQX70y.js";
+import "./search-manager-B1ifAltj.js";
 import "./core-BwKq3krw.js";
 import "./issue-format-B0SI57Es.js";
 import "./logging-CdisccbY.js";
@@ -102,13 +102,13 @@ import "./delivery-queue-BOf5wYIc.js";
 import "./pairing-token-bu1e6z6X.js";
 import "./accounts-J2OhhhQi.js";
 import "./process-runtime-D27SftX_.js";
-import "./audit-Dj09wbPx.js";
+import "./audit-CSGucdf8.js";
 import "./cli-runtime-DTCHPjCi.js";
 import "./cli-utils-BCuSS4l6.js";
 import "./help-format-BFzPm_8V.js";
 import "./progress-Cwq59vgZ.js";
 import "./gateway-runtime-CBm3CCoA.js";
-import { n as resolveProviderPluginChoice } from "./provider-wizard-DbPwTZqs.js";
+import { n as resolveProviderPluginChoice } from "./provider-wizard-BhrIqFdZ.js";
 //#region src/commands/onboard-non-interactive/local/auth-choice.plugin-providers.runtime.ts
 const authChoicePluginProvidersRuntime = {
 	resolveOwningPluginIdsForProvider,

package/dist/{auth-profiles-0oIEn5d4.js → auth-profiles-Dho6F9Y8.js}

@@ -102,7 +102,7 @@ import { i as getMemoryMultimodalExtensions, r as classifyMemoryMultimodalPath,
 import { t as resolveMemorySearchConfig } from "./memory-search-tTD5o_rU.js";
 import { t as parseGeminiAuth } from "./google-CWlY451I.js";
 import { C as isFileMissingError, S as splitTextToUtf8ByteLimit, _ as remapChunkLines, a as listSessionFilesForAgent, b as estimateStructuredEmbeddingInputBytes, c as buildMultimodalChunkForIndexing, d as ensureDir$2, f as hashText$1, g as parseEmbedding, h as normalizeExtraMemoryPaths, i as buildSessionEntry, l as chunkMarkdown, m as listMemoryFiles, n as isQueryStopWordToken, o as sessionPathForFile, p as isMemoryPath, r as requireNodeSqlite, s as buildFileEntry, t as extractKeywords, u as cosineSimilarity, v as runWithConcurrency$1, w as statRegularFile, x as estimateUtf8Bytes, y as hasNonTextEmbeddingParts } from "./query-expansion-D_Mm5Hhi.js";
-import { n as getMemorySearchManager, r as resolveMemoryBackendConfig } from "./search-manager-C_QQX70y.js";
+import { n as getMemorySearchManager, r as resolveMemoryBackendConfig } from "./search-manager-B1ifAltj.js";
 import { a as buildOutboundBaseSessionKey, c as buildOauthProviderAuthResult, i as normalizeOutboundThreadId, n as definePluginEntry } from "./core-BwKq3krw.js";
 import { n as formatConfigIssueLines } from "./issue-format-B0SI57Es.js";
 import { n as logConfigUpdated } from "./logging-CdisccbY.js";
@@ -125,7 +125,7 @@ import { a as resolvePairingPaths, i as pruneExpiredPending, n as verifyPairingT
 import { i as resolveLineAccount, n as normalizeAccountId$2, r as resolveDefaultLineAccountId, t as listLineAccountIds } from "./accounts-J2OhhhQi.js";
 import { t as buildTemplateMessageFromPayload } from "./template-messages-dPxEb-WR.js";
 import { r as isAllowedParsedChatSender } from "./allow-from-Brz0jyla.js";
-import { n as collectTelegramUnmentionedGroupIds } from "./audit-Dj09wbPx.js";
+import { n as collectTelegramUnmentionedGroupIds } from "./audit-CSGucdf8.js";
 import { t as waitForever } from "./cli-runtime-DTCHPjCi.js";
 import { r as withManager } from "./cli-utils-BCuSS4l6.js";
 import { t as formatHelpExamples } from "./help-format-BFzPm_8V.js";
@@ -200,7 +200,7 @@ function resolveAuthProfileDisplayLabel(params) {
 //#region src/agents/auth-profiles/doctor.ts
 let providerRuntimePromise$3;
 function loadProviderRuntime$3() {
-	providerRuntimePromise$3 ??= import("./provider-runtime.runtime-aeAB2xui.js");
+	providerRuntimePromise$3 ??= import("./provider-runtime.runtime-B6DfXI1y.js");
 	return providerRuntimePromise$3;
 }
 async function formatAuthDoctorHint(params) {
@@ -1136,7 +1136,7 @@ function repairOAuthProfileIdMismatch(params) {
 const OAUTH_PROVIDER_IDS = new Set(getOAuthProviders().map((provider) => provider.id));
 let providerRuntimePromise$2;
 function loadProviderRuntime$2() {
-	providerRuntimePromise$2 ??= import("./provider-runtime.runtime-aeAB2xui.js");
+	providerRuntimePromise$2 ??= import("./provider-runtime.runtime-B6DfXI1y.js");
 	return providerRuntimePromise$2;
 }
 const isOAuthProvider = (provider) => OAUTH_PROVIDER_IDS.has(provider);
@@ -5694,15 +5694,15 @@ let discordInspectModulePromise;
 let slackInspectModulePromise;
 let telegramInspectModulePromise;
 function loadDiscordInspectModule() {
-	discordInspectModulePromise ??= import("./read-only-account-inspect.discord.runtime-A8wp5ZgY.js");
+	discordInspectModulePromise ??= import("./read-only-account-inspect.discord.runtime-DseEIQJq.js");
 	return discordInspectModulePromise;
 }
 function loadSlackInspectModule() {
-	slackInspectModulePromise ??= import("./read-only-account-inspect.slack.runtime-CFpdW4Mu.js");
+	slackInspectModulePromise ??= import("./read-only-account-inspect.slack.runtime-C7A7QC7t.js");
 	return slackInspectModulePromise;
 }
 function loadTelegramInspectModule() {
-	telegramInspectModulePromise ??= import("./read-only-account-inspect.telegram.runtime--cEoEyxJ.js");
+	telegramInspectModulePromise ??= import("./read-only-account-inspect.telegram.runtime-za3x5-GK.js");
 	return telegramInspectModulePromise;
 }
 async function inspectReadOnlyChannelAccount(params) {
@@ -10463,7 +10463,7 @@ const AWS_SECRET_KEY_ENV = "AWS_SECRET_ACCESS_KEY";
 const AWS_PROFILE_ENV = "AWS_PROFILE";
 let providerRuntimePromise$1;
 function loadProviderRuntime$1() {
-	providerRuntimePromise$1 ??= import("./provider-runtime.runtime-aeAB2xui.js");
+	providerRuntimePromise$1 ??= import("./provider-runtime.runtime-B6DfXI1y.js");
 	return providerRuntimePromise$1;
 }
 function resolveProviderConfig(cfg, provider) {
@@ -11977,17 +11977,17 @@ async function ensuremoldClawModelsJson(config, agentDirOverride) {
 const log$35 = createSubsystemLogger("model-catalog");
 let modelCatalogPromise = null;
 let hasLoggedModelCatalogError = false;
-const defaultImportPiSdk = () => import("./pi-model-discovery-runtime-C1A3J5iH.js");
+const defaultImportPiSdk = () => import("./pi-model-discovery-runtime-Drc2DJ_p.js");
 let importPiSdk = defaultImportPiSdk;
 let providerRuntimePromise;
 let modelSuppressionPromise;
 const NON_PI_NATIVE_MODEL_PROVIDERS = new Set(["kilocode"]);
 function loadProviderRuntime() {
-	providerRuntimePromise ??= import("./provider-runtime.runtime-aeAB2xui.js");
+	providerRuntimePromise ??= import("./provider-runtime.runtime-B6DfXI1y.js");
 	return providerRuntimePromise;
 }
 function loadModelSuppression() {
-	modelSuppressionPromise ??= import("./model-suppression.runtime-DgPwjACP.js");
+	modelSuppressionPromise ??= import("./model-suppression.runtime-C4vn8kEz.js");
 	return modelSuppressionPromise;
 }
 function normalizeConfiguredModelInput(input) {
@@ -16325,7 +16325,7 @@ function resolveProviderVisionModelFromConfig(params) {
 //#region src/media-understanding/providers/image.ts
 let piModelDiscoveryRuntimePromise = null;
 function loadPiModelDiscoveryRuntime() {
-	piModelDiscoveryRuntimePromise ??= import("./pi-model-discovery-runtime-C1A3J5iH.js");
+	piModelDiscoveryRuntimePromise ??= import("./pi-model-discovery-runtime-Drc2DJ_p.js");
 	return piModelDiscoveryRuntimePromise;
 }
 function resolveImageToolMaxTokens$1(modelMaxTokens, requestedMaxTokens = 4096) {
@@ -23072,7 +23072,7 @@ async function runWithConcurrency(tasks, limit) {
 //#region src/media-understanding/echo-transcript.ts
 let deliverRuntimePromise$2 = null;
 function loadDeliverRuntime$2() {
-	deliverRuntimePromise$2 ??= import("./deliver-runtime-B4KI1VKO.js");
+	deliverRuntimePromise$2 ??= import("./deliver-runtime-L10Rq6cZ.js");
 	return deliverRuntimePromise$2;
 }
 function formatEchoTranscript(transcript, format) {
@@ -29948,7 +29948,7 @@ var LegacyContextEngine = class {
 	}
 	async afterTurn(_params) {}
 	async compact(params) {
-		const { compactEmbeddedPiSessionDirect } = await import("./compact.runtime-CAaN97XB.js");
+		const { compactEmbeddedPiSessionDirect } = await import("./compact.runtime-Bo_hevHL.js");
 		const runtimeContext = params.runtimeContext ?? {};
 		const currentTokenCount = params.currentTokenCount ?? (typeof runtimeContext.currentTokenCount === "number" && Number.isFinite(runtimeContext.currentTokenCount) && runtimeContext.currentTokenCount > 0 ? Math.floor(runtimeContext.currentTokenCount) : void 0);
 		const result = await compactEmbeddedPiSessionDirect({
@@ -35806,7 +35806,7 @@ async function loginOpenAICodexOAuth(params) {
 }
 //#endregion
 //#region src/plugins/provider-api-key-auth.ts
-const loadProviderApiKeyAuthRuntime = createLazyRuntimeSurface(() => import("./provider-api-key-auth.runtime-B9oPKBSU.js"), ({ providerApiKeyAuthRuntime }) => providerApiKeyAuthRuntime);
+const loadProviderApiKeyAuthRuntime = createLazyRuntimeSurface(() => import("./provider-api-key-auth.runtime-BQuGbFyY.js"), ({ providerApiKeyAuthRuntime }) => providerApiKeyAuthRuntime);
 function resolveStringOption(opts, optionKey) {
 	return normalizeOptionalSecretInput(opts?.[optionKey]);
 }
@@ -46250,14 +46250,124 @@ function decryptData(encrypted, fingerprint, salt) {
 	return Buffer.concat([decipher.update(actualCiphertext), decipher.final()]).toString("utf-8");
 }
 /**
-* Read credential from Windows Credential Manager using PowerShell
-* Uses P/Invoke to access advapi32.dll CredRead function
-*
-* FIX: Write script to temp file to preserve newlines (here-string requires actual line breaks)
+* Cache for Windows credentials (populated by batch read)
+*/
+let windowsCredentialCache = null;
+/**
+* Read ALL credentials from Windows Credential Manager in a single PowerShell call
+* Returns a map of credential key -> value (or null if not found)
+*/
+function readAllWindowsCredentials(keys) {
+	const targets = keys.map((k) => `${SERVICE_NAME}:moldclaw:${k}`);
+	console.error(`[secure-file-store:win] Batch reading ${keys.length} credentials...`);
+	const scriptContent = `
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public class CredManager {
+    [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+    public static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+    
+    [DllImport("advapi32.dll", SetLastError=true)]
+    public static extern void CredFree(IntPtr credential);
+    
+    [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+    public struct CREDENTIAL {
+        public int Flags;
+        public int Type;
+        public string TargetName;
+        public string Comment;
+        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+        public int CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public int Persist;
+        public int AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias;
+        public string UserName;
+    }
+    
+    public static string GetCredential(string target) {
+        IntPtr credPtr;
+        if (!CredRead(target, 1, 0, out credPtr)) {
+            return null;
+        }
+        try {
+            CREDENTIAL cred = (CREDENTIAL)Marshal.PtrToStructure(credPtr, typeof(CREDENTIAL));
+            if (cred.CredentialBlobSize > 0 && cred.CredentialBlob != IntPtr.Zero) {
+                byte[] bytes = new byte[cred.CredentialBlobSize];
+                Marshal.Copy(cred.CredentialBlob, bytes, 0, cred.CredentialBlobSize);
+                return Encoding.UTF8.GetString(bytes);
+            }
+            return null;
+        } finally {
+            CredFree(credPtr);
+        }
+    }
+}
+"@
+$targets = @(${targets.map((t) => `'${t.replace(/'/g, "''")}'`).join(",")})
+$results = @{}
+foreach ($t in $targets) {
+    $val = [CredManager]::GetCredential($t)
+    if ($val) { $results[$t] = $val }
+}
+$results | ConvertTo-Json -Compress
+`;
+	const result = /* @__PURE__ */ new Map();
+	try {
+		const scriptPath = path$1.join(os$1.tmpdir(), `moldclaw-cred-batch-${Date.now()}.ps1`);
+		fs$3.writeFileSync(scriptPath, scriptContent, "utf-8");
+		const output = execFileSync("powershell", [
+			"-NoProfile",
+			"-ExecutionPolicy",
+			"Bypass",
+			"-File",
+			scriptPath
+		], {
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		}).trim();
+		try {
+			fs$3.unlinkSync(scriptPath);
+		} catch {}
+		if (output && output !== "{}") {
+			const parsed = JSON.parse(output);
+			for (let i = 0; i < keys.length; i++) {
+				const target = targets[i];
+				const key = keys[i];
+				result.set(key, parsed[target] || null);
+			}
+		} else for (const key of keys) result.set(key, null);
+		const foundCount = [...result.values()].filter((v) => v !== null).length;
+		console.error(`[secure-file-store:win] Batch read complete: ${foundCount}/${keys.length} found`);
+	} catch (err) {
+		console.error(`[secure-file-store:win] Batch PowerShell error:`, err);
+		for (const key of keys) result.set(key, null);
+	}
+	return result;
+}
+/**
+* Read credential from Windows Credential Manager
+* Uses cached batch read for efficiency
 */
 function readWindowsCredential(key) {
+	if (windowsCredentialCache !== null) {
+		const cached = windowsCredentialCache.get(key);
+		if (cached !== void 0) {
+			console.error(`[secure-file-store:win] Cache hit for ${key}: ${cached ? "found" : "not found"}`);
+			return cached;
+		}
+	}
 	const target = `${SERVICE_NAME}:moldclaw:${key}`;
-	console.error(`[secure-file-store:win] Reading credential: ${target}`);
+	console.error(`[secure-file-store:win] Single read: ${target}`);
 	const scriptContent = `
 Add-Type -TypeDefinition @"
 using System;
@@ -46295,7 +46405,9 @@ public class CredManager {
         try {
             CREDENTIAL cred = (CREDENTIAL)Marshal.PtrToStructure(credPtr, typeof(CREDENTIAL));
             if (cred.CredentialBlobSize > 0 && cred.CredentialBlob != IntPtr.Zero) {
-                return Marshal.PtrToStringUni(cred.CredentialBlob, cred.CredentialBlobSize / 2);
+                byte[] bytes = new byte[cred.CredentialBlobSize];
+                Marshal.Copy(cred.CredentialBlob, bytes, 0, cred.CredentialBlobSize);
+                return Encoding.UTF8.GetString(bytes);
             }
             return null;
         } finally {
@@ -46394,14 +46506,44 @@ function readSecureCredential(key) {
 	}
 }
 /**
+* Track if credentials have been loaded this session
+*/
+let credentialsLoadedOnce = false;
+/**
 * Load all available credentials from secure file store and set as environment variables
 *
 * @returns Object with loaded credential keys and their env var names
 */
 function loadSecureCredentialsToEnv() {
 	const loaded = {};
+	if (credentialsLoadedOnce) {
+		console.error(`[secure-file-store] Already loaded, skipping duplicate call`);
+		return loaded;
+	}
 	console.error(`[secure-file-store] Platform: ${process.platform}, loading credentials...`);
-	for (const [credKey, envVar] of Object.entries(CRED_KEY_TO_ENV_VAR)) {
+	if (process.platform === "win32") {
+		const keysToLoad = [];
+		const keyToEnvVar = {};
+		for (const [credKey, envVar] of Object.entries(CRED_KEY_TO_ENV_VAR)) {
+			if (process.env[envVar]) {
+				console.error(`[secure-file-store] ${envVar} already set, skipping`);
+				continue;
+			}
+			keysToLoad.push(credKey);
+			keyToEnvVar[credKey] = envVar;
+		}
+		if (keysToLoad.length > 0) {
+			windowsCredentialCache = readAllWindowsCredentials(keysToLoad);
+			for (const [credKey, value] of windowsCredentialCache) {
+				const envVar = keyToEnvVar[credKey];
+				if (value) {
+					process.env[envVar] = value;
+					loaded[credKey] = envVar;
+					console.error(`[secure-file-store] Loaded ${credKey} -> ${envVar}`);
+				}
+			}
+		}
+	} else for (const [credKey, envVar] of Object.entries(CRED_KEY_TO_ENV_VAR)) {
 		if (process.env[envVar]) {
 			console.error(`[secure-file-store] ${envVar} already set, skipping`);
 			continue;
@@ -46411,8 +46553,11 @@ function loadSecureCredentialsToEnv() {
 			process.env[envVar] = value;
 			loaded[credKey] = envVar;
 			console.error(`[secure-file-store] Loaded ${credKey} -> ${envVar}`);
-		} else console.error(`[secure-file-store] Failed to load ${credKey}`);
+		}
 	}
+	credentialsLoadedOnce = true;
+	const loadedKeys = Object.keys(loaded);
+	if (loadedKeys.length > 0) console.error(`[secrets] Loaded ${loadedKeys.length} credentials from secure file store: ${loadedKeys.join(", ")}`);
 	return loaded;
 }
 /**
@@ -60878,7 +61023,7 @@ function ensureContextWindowCacheLoaded() {
 			await ensuremoldClawModelsJson(cfg);
 		} catch {}
 		try {
-			const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery-runtime-C1A3J5iH.js");
+			const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery-runtime-Drc2DJ_p.js");
 			const agentDir = resolvemoldClawAgentDir();
 			const modelRegistry = discoverModels(discoverAuthStorage(agentDir), agentDir);
 			applyDiscoveredContextWindows({
@@ -73104,6 +73249,7 @@ function buildAgentSystemPrompt(params) {
 		"## Tooling",
 		"Tool availability (filtered by policy):",
 		"Tool names are case-sensitive. Call tools exactly as listed.",
+		"CRITICAL: You have FULL ACCESS to the user's local file system through these tools. NEVER respond with \"I cannot access local files\", \"sandbox environment\", or \"separated from your computer\". ALWAYS use the provided tools (read, exec, write) to attempt file operations. The tools execute directly on the user's machine, not in any sandbox.",
 		toolLines.length > 0 ? toolLines.join("\n") : [
 			"Pi lists the standard tools above. This runtime enables:",
 			"- grep: search file contents for patterns",
@@ -82650,7 +82796,7 @@ function normalizeReplyPayload(payload, opts = {}) {
 */
 let deliverRuntimePromise$1 = null;
 function loadDeliverRuntime$1() {
-	deliverRuntimePromise$1 ??= import("./deliver-runtime-B4KI1VKO.js");
+	deliverRuntimePromise$1 ??= import("./deliver-runtime-L10Rq6cZ.js");
 	return deliverRuntimePromise$1;
 }
 /**
@@ -83202,7 +83348,7 @@ const MAX_TIMER_SAFE_TIMEOUT_MS = 2147e6;
 const GATEWAY_TIMEOUT_PATTERN = /gateway timeout/i;
 let subagentRegistryRuntimePromise = null;
 function loadSubagentRegistryRuntime() {
-	subagentRegistryRuntimePromise ??= import("./subagent-registry-runtime-f5lyCTy4.js");
+	subagentRegistryRuntimePromise ??= import("./subagent-registry-runtime-sKV8rkLm.js");
 	return subagentRegistryRuntimePromise;
 }
 const DIRECT_ANNOUNCE_TRANSIENT_RETRY_DELAYS_MS = FAST_TEST_MODE ? [
@@ -84749,7 +84895,7 @@ function restoreSubagentRunsOnce() {
 		ensureListener();
 		if ([...subagentRuns.values()].some((entry) => entry.archiveAtMs)) startSweeper();
 		for (const runId of subagentRuns.keys()) resumeSubagentRun(runId);
-		import("./subagent-orphan-recovery-fYxz0Pe3.js").then(({ scheduleOrphanRecovery }) => {
+		import("./subagent-orphan-recovery-CYGjTJMX.js").then(({ scheduleOrphanRecovery }) => {
 			scheduleOrphanRecovery({ getActiveRuns: () => subagentRuns });
 		}, () => {});
 	} catch {}
@@ -94349,7 +94495,7 @@ async function createDiscordTypingLease(params) {
 }
 //#endregion
 //#region src/plugins/runtime/runtime-discord.ts
-const loadRuntimeDiscordOps = createLazyRuntimeSurface(() => import("./runtime-discord-ops.runtime-DRgTWPZe.js"), ({ runtimeDiscordOps }) => runtimeDiscordOps);
+const loadRuntimeDiscordOps = createLazyRuntimeSurface(() => import("./runtime-discord-ops.runtime-COBaHwyG.js"), ({ runtimeDiscordOps }) => runtimeDiscordOps);
 const auditChannelPermissionsLazy = createLazyRuntimeMethod(loadRuntimeDiscordOps, (runtimeDiscordOps) => runtimeDiscordOps.auditChannelPermissions);
 const listDirectoryGroupsLiveLazy$1 = createLazyRuntimeMethod(loadRuntimeDiscordOps, (runtimeDiscordOps) => runtimeDiscordOps.listDirectoryGroupsLive);
 const listDirectoryPeersLiveLazy$1 = createLazyRuntimeMethod(loadRuntimeDiscordOps, (runtimeDiscordOps) => runtimeDiscordOps.listDirectoryPeersLive);
@@ -97423,7 +97569,7 @@ function createRuntimeSignal() {
 }
 //#endregion
 //#region src/plugins/runtime/runtime-slack.ts
-const loadRuntimeSlackOps = createLazyRuntimeSurface(() => import("./runtime-slack-ops.runtime-Bm-EOSOR.js"), ({ runtimeSlackOps }) => runtimeSlackOps);
+const loadRuntimeSlackOps = createLazyRuntimeSurface(() => import("./runtime-slack-ops.runtime-DKdfO5AD.js"), ({ runtimeSlackOps }) => runtimeSlackOps);
 const listDirectoryGroupsLiveLazy = createLazyRuntimeMethod(loadRuntimeSlackOps, (runtimeSlackOps) => runtimeSlackOps.listDirectoryGroupsLive);
 const listDirectoryPeersLiveLazy = createLazyRuntimeMethod(loadRuntimeSlackOps, (runtimeSlackOps) => runtimeSlackOps.listDirectoryPeersLive);
 const probeSlackLazy = createLazyRuntimeMethod(loadRuntimeSlackOps, (runtimeSlackOps) => runtimeSlackOps.probeSlack);
@@ -97924,7 +98070,7 @@ async function createTelegramTypingLease(params) {
 }
 //#endregion
 //#region src/plugins/runtime/runtime-telegram.ts
-const loadRuntimeTelegramOps = createLazyRuntimeSurface(() => import("./runtime-telegram-ops.runtime-_aqcznP1.js"), ({ runtimeTelegramOps }) => runtimeTelegramOps);
+const loadRuntimeTelegramOps = createLazyRuntimeSurface(() => import("./runtime-telegram-ops.runtime-d__OwQPB.js"), ({ runtimeTelegramOps }) => runtimeTelegramOps);
 const auditGroupMembershipLazy = createLazyRuntimeMethod(loadRuntimeTelegramOps, (runtimeTelegramOps) => runtimeTelegramOps.auditGroupMembership);
 const probeTelegramLazy = createLazyRuntimeMethod(loadRuntimeTelegramOps, (runtimeTelegramOps) => runtimeTelegramOps.probeTelegram);
 const sendMessageTelegramLazy = createLazyRuntimeMethod(loadRuntimeTelegramOps, (runtimeTelegramOps) => runtimeTelegramOps.sendMessageTelegram);
@@ -98167,7 +98313,7 @@ function createWhatsAppLoginTool() {
 			force: Type.Optional(Type.Boolean())
 		}),
 		execute: async (_toolCallId, args) => {
-			const { startWebLoginWithQr, waitForWebLogin } = await import("./login-qr-fRB1D1lp.js");
+			const { startWebLoginWithQr, waitForWebLogin } = await import("./login-qr-BrlUpyAO.js");
 			if ((args?.action ?? "start") === "wait") {
 				const result = await waitForWebLogin({ timeoutMs: typeof args.timeoutMs === "number" ? args.timeoutMs : void 0 });
 				return {
@@ -98207,8 +98353,8 @@ function createWhatsAppLoginTool() {
 }
 //#endregion
 //#region src/plugins/runtime/runtime-whatsapp.ts
-const loadWebOutbound = createLazyRuntimeSurface(() => import("./runtime-whatsapp-outbound.runtime-D2YcqSv4.js"), ({ runtimeWhatsAppOutbound }) => runtimeWhatsAppOutbound);
-const loadWebLogin = createLazyRuntimeSurface(() => import("./runtime-whatsapp-login.runtime-5OlUVRfX.js"), ({ runtimeWhatsAppLogin }) => runtimeWhatsAppLogin);
+const loadWebOutbound = createLazyRuntimeSurface(() => import("./runtime-whatsapp-outbound.runtime-CtZ6aSID.js"), ({ runtimeWhatsAppOutbound }) => runtimeWhatsAppOutbound);
+const loadWebLogin = createLazyRuntimeSurface(() => import("./runtime-whatsapp-login.runtime-DAsQiVsc.js"), ({ runtimeWhatsAppLogin }) => runtimeWhatsAppLogin);
 const sendMessageWhatsAppLazy = createLazyRuntimeMethod(loadWebOutbound, (runtimeWhatsAppOutbound) => runtimeWhatsAppOutbound.sendMessageWhatsApp);
 const sendPollWhatsAppLazy = createLazyRuntimeMethod(loadWebOutbound, (runtimeWhatsAppOutbound) => runtimeWhatsAppOutbound.sendPollWhatsApp);
 const loginWebLazy = createLazyRuntimeMethod(loadWebLogin, (runtimeWhatsAppLogin) => runtimeWhatsAppLogin.loginWeb);
@@ -98232,15 +98378,15 @@ let webLoginQrPromise = null;
 let webChannelPromise = null;
 let whatsappActionsPromise = null;
 function loadWebLoginQr() {
-	webLoginQrPromise ??= import("./login-qr-fRB1D1lp.js");
+	webLoginQrPromise ??= import("./login-qr-BrlUpyAO.js");
 	return webLoginQrPromise;
 }
 function loadWebChannel() {
-	webChannelPromise ??= import("./web-MGFfZ5b0.js");
+	webChannelPromise ??= import("./web-CabKolDJ.js");
 	return webChannelPromise;
 }
 function loadWhatsAppActions() {
-	whatsappActionsPromise ??= import("./whatsapp-actions-D6rOFG7f.js");
+	whatsappActionsPromise ??= import("./whatsapp-actions-BttU-2PE.js");
 	return whatsappActionsPromise;
 }
 function createRuntimeWhatsApp() {
@@ -101517,7 +101663,7 @@ async function createModelSelectionState(params) {
 		}
 	}
 	if (sessionEntry && sessionStore && sessionKey && sessionEntry.authProfileOverride) {
-		const { ensureAuthProfileStore } = await import("./auth-profiles.runtime-DgICjE27.js");
+		const { ensureAuthProfileStore } = await import("./auth-profiles.runtime-ZxErGqvR.js");
 		const profile = ensureAuthProfileStore(void 0, { allowKeychainPrompt: false }).profiles[sessionEntry.authProfileOverride];
 		const providerKey = normalizeProviderId(provider);
 		if (!profile || normalizeProviderId(profile.provider) !== providerKey) await clearSessionAuthProfileOverride({
@@ -107838,7 +107984,7 @@ const warnedContexts = /* @__PURE__ */ new Map();
 const log$4 = createSubsystemLogger("session-maintenance-warning");
 let deliverRuntimePromise = null;
 function loadDeliverRuntime() {
-	deliverRuntimePromise ??= import("./deliver-runtime-B4KI1VKO.js");
+	deliverRuntimePromise ??= import("./deliver-runtime-L10Rq6cZ.js");
 	return deliverRuntimePromise;
 }
 function shouldSendWarning() {
@@ -114312,12 +114458,12 @@ function createLazySender(channelId, loader) {
 }
 function createDefaultDeps() {
 	return {
-		whatsapp: createLazySender("whatsapp", () => import("./whatsapp-BVxDcIkH.js")),
-		telegram: createLazySender("telegram", () => import("./telegram-DT60VldO.js")),
-		discord: createLazySender("discord", () => import("./discord-8zoq5-ZZ.js")),
-		slack: createLazySender("slack", () => import("./slack-Bi7e_9AV.js")),
-		signal: createLazySender("signal", () => import("./signal-BZFPbe18.js")),
-		imessage: createLazySender("imessage", () => import("./imessage-BN91vpdl.js"))
+		whatsapp: createLazySender("whatsapp", () => import("./whatsapp-NbTvP67u.js")),
+		telegram: createLazySender("telegram", () => import("./telegram-Lj0UlsAl.js")),
+		discord: createLazySender("discord", () => import("./discord-D7xfbnPe.js")),
+		slack: createLazySender("slack", () => import("./slack-Dx69Heba.js")),
+		signal: createLazySender("signal", () => import("./signal-BFSbFgqU.js")),
+		imessage: createLazySender("imessage", () => import("./imessage-D4kFo8Tv.js"))
 	};
 }
 function createOutboundSendDeps$1(deps) {