activeclaw 2026.2.11 → 2026.2.13

package/dist/{server-node-events-BzrEnKLX.js → server-node-events-QCvh8EgI.js}

@@ -1,48 +1,52 @@
 import { p as defaultRuntime } from "./entry.js";
-import "./auth-profiles-Bv1AEm-Y.js";
+import "./auth-profiles-ByNs3eEm.js";
 import { u as normalizeMainKey } from "./session-key-DVvxnFKg.js";
-import "./utils-Dk86IbEs.js";
-import "./exec-B8JKbXKW.js";
-import "./agent-scope-DQuy3dwI.js";
-import "./github-copilot-token-SLWintYd.js";
+import "./utils-BLJAc3ZV.js";
+import "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
 import "./pi-model-discovery-DzEIEgHL.js";
-import { i as loadConfig } from "./config-B00lvFac.js";
-import "./manifest-registry-D5SiA3xq.js";
-import "./server-context-fX4xiYRh.js";
-import "./chrome-yIKmOzCO.js";
-import "./control-service-IRAmbcbN.js";
-import "./client-DMloFP_O.js";
-import "./call-7yrB6v4I.js";
-import "./message-channel-BlgPSDAh.js";
-import "./links-7M-j83As.js";
-import { r as normalizeChannelId } from "./plugins-Db5BiELK.js";
+import { i as loadConfig } from "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import "./server-context-BGpGs3qd.js";
+import "./chrome-foEwx3lN.js";
+import "./auth-9x3lqfIY.js";
+import "./control-auth-8Cf4WXpR.js";
+import "./control-service-DKnttEus.js";
+import "./client-CTwXnRl7.js";
+import "./call-DVYCIV8m.js";
+import "./message-channel-C_MmebBt.js";
+import "./links-B8LAzWwg.js";
+import { r as normalizeChannelId } from "./plugins-4Hqd1WGf.js";
 import "./logging-CfEk_PnX.js";
-import "./accounts-DbzMEfKN.js";
-import { er as enqueueSystemEvent, on as loadSessionEntry, rr as requestHeartbeatNow } from "./loader-wXwp4rZJ.js";
-import "./progress-Da1ehW-x.js";
-import "./prompt-style-Dc0C5HC9.js";
-import "./manager-CcVYv0N5.js";
-import "./paths-IivnSNkP.js";
-import "./sqlite-B7FPASCO.js";
-import "./redact-DuEEf1p1.js";
-import "./routes-B4QQiFju.js";
-import "./pi-embedded-helpers-Bkpd4fTr.js";
-import "./deliver-hf-WKyWd.js";
-import { g as updateSessionStore } from "./sandbox-Aks-9EcZ.js";
-import "./tui-formatters-C3NarH24.js";
-import "./wsl-Cwo7X0Un.js";
-import "./skills-D5UZZZSY.js";
-import "./image-Ds4NLGPR.js";
-import "./tool-display-o-dDAlqF.js";
-import "./channel-selection-RZimme3j.js";
-import "./session-cost-usage-CcCEQNuc.js";
-import "./commands-CjEGXOZ_.js";
-import "./pairing-store-CgXR3ZWJ.js";
-import "./login-qr-CGEu5TU-.js";
-import "./pairing-labels-CWFEtSc3.js";
-import "./deps-Bv1kLtwo.js";
-import { t as formatForLog } from "./ws-log-BP3z_g6Z.js";
-import { t as agentCommand } from "./agent-22-R4bNS.js";
+import "./accounts-DCDeFTra.js";
+import { $t as loadSessionEntry, Zn as enqueueSystemEvent, er as requestHeartbeatNow } from "./loader-KjT074JR.js";
+import "./progress-DWqhRakV.js";
+import "./prompt-style-BFH5D5LN.js";
+import "./deliver-CIU9Npgs.js";
+import "./manager-T1XfGchB.js";
+import "./paths-DLINmNFQ.js";
+import "./sqlite-BINzs1U0.js";
+import "./redact-Br9GfacZ.js";
+import "./routes-DewK5tq2.js";
+import "./pi-embedded-helpers-DfwkwPYD.js";
+import "./fetch-timeout-DTK9vxex.js";
+import { g as updateSessionStore } from "./sandbox-BKYnhYQH.js";
+import "./tui-formatters-DePhZK3J.js";
+import "./wsl-BUOkxKJu.js";
+import "./skills-DRjfSQT3.js";
+import "./image-DgtfXMcX.js";
+import "./tool-display-ClRud3pg.js";
+import "./channel-selection-D4D6ImhN.js";
+import "./session-cost-usage-D9hHANWI.js";
+import "./runner-CY0nmVme.js";
+import "./commands-BX_OIIVR.js";
+import "./pairing-store-Dp5_JGnG.js";
+import "./login-qr-CuvemJj4.js";
+import "./pairing-labels-CgNHnjzT.js";
+import "./deps-QSwGcoNZ.js";
+import { t as formatForLog } from "./ws-log-CIXbLCka.js";
+import { t as agentCommand } from "./agent-CyMxTyrG.js";
 import { randomUUID } from "node:crypto";
 
 //#region src/gateway/server-node-events.ts

package/dist/{service-Cd4BxKuo.js → service--nPk7DvT.js}

@@ -1,6 +1,6 @@
-import { I as colorize, L as isRich, R as theme } from "./subsystem-Bh1Y_6Uv.js";
-import { f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, p as resolveLegacyGatewayLaunchAgentLabels, s as formatGatewayServiceDescription, t as GATEWAY_LAUNCH_AGENT_LABEL } from "./constants-CNTiY-ZN.js";
-import { a as readSystemdServiceRuntime, c as stopSystemdService, f as parseKeyValueOutput, i as readSystemdServiceExecStart, l as uninstallSystemdService, m as resolveHomeDir, n as isSystemdServiceEnabled, p as resolveGatewayStateDir, s as restartSystemdService, t as installSystemdService } from "./systemd-D6wTPnHi.js";
+import { I as colorize, L as isRich, R as theme } from "./subsystem-BoExtIHo.js";
+import { f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, p as resolveLegacyGatewayLaunchAgentLabels, s as formatGatewayServiceDescription, t as GATEWAY_LAUNCH_AGENT_LABEL } from "./constants-BvQ6S8j5.js";
+import { a as readSystemdServiceRuntime, c as stopSystemdService, f as parseKeyValueOutput, i as readSystemdServiceExecStart, l as uninstallSystemdService, m as resolveHomeDir, n as isSystemdServiceEnabled, p as resolveGatewayStateDir, s as restartSystemdService, t as installSystemdService } from "./systemd-DrmBtJ5T.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { execFile } from "node:child_process";
@@ -298,7 +298,11 @@ async function restartLaunchAgent({ stdout, env }) {
 		`${domain}/${label}`
 	]);
 	if (res.code !== 0) throw new Error(`launchctl kickstart failed: ${res.stderr || res.stdout}`.trim());
-	stdout.write(`${formatLine$1("Restarted LaunchAgent", `${domain}/${label}`)}\n`);
+	try {
+		stdout.write(`${formatLine$1("Restarted LaunchAgent", `${domain}/${label}`)}\n`);
+	} catch (err) {
+		if (err?.code !== "EPIPE") throw err;
+	}
 }
 
 //#endregion

package/dist/{service-DDPRbf8a.js → service-99RDXwX4.js}

@@ -1,6 +1,6 @@
-import { D as colorize, O as isRich, k as theme } from "./entry.js";
-import { f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, p as resolveLegacyGatewayLaunchAgentLabels, s as formatGatewayServiceDescription, t as GATEWAY_LAUNCH_AGENT_LABEL } from "./constants-DuoCkWRh.js";
-import { a as readSystemdServiceRuntime, c as stopSystemdService, f as parseKeyValueOutput, i as readSystemdServiceExecStart, l as uninstallSystemdService, m as resolveHomeDir, n as isSystemdServiceEnabled, p as resolveGatewayStateDir, s as restartSystemdService, t as installSystemdService } from "./systemd-BEWwfwn0.js";
+import { A as theme, O as colorize, k as isRich } from "./entry.js";
+import { f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, p as resolveLegacyGatewayLaunchAgentLabels, s as formatGatewayServiceDescription, t as GATEWAY_LAUNCH_AGENT_LABEL } from "./constants-JPeoOZnw.js";
+import { a as readSystemdServiceRuntime, c as stopSystemdService, f as parseKeyValueOutput, i as readSystemdServiceExecStart, l as uninstallSystemdService, m as resolveHomeDir, n as isSystemdServiceEnabled, p as resolveGatewayStateDir, s as restartSystemdService, t as installSystemdService } from "./systemd-C0VZriGM.js";
 import { execFile } from "node:child_process";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -298,7 +298,11 @@ async function restartLaunchAgent({ stdout, env }) {
 		`${domain}/${label}`
 	]);
 	if (res.code !== 0) throw new Error(`launchctl kickstart failed: ${res.stderr || res.stdout}`.trim());
-	stdout.write(`${formatLine$1("Restarted LaunchAgent", `${domain}/${label}`)}\n`);
+	try {
+		stdout.write(`${formatLine$1("Restarted LaunchAgent", `${domain}/${label}`)}\n`);
+	} catch (err) {
+		if (err?.code !== "EPIPE") throw err;
+	}
 }
 
 //#endregion

package/dist/{service-audit-CCFxuvKs.js → service-audit-DnLmRGQt.js}

@@ -1,7 +1,7 @@
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, n as GATEWAY_SERVICE_KIND, r as GATEWAY_SERVICE_MARKER } from "./constants-CNTiY-ZN.js";
-import { c as getMinimalServicePathPartsFromEnv, l as isSystemNodePath, m as resolveSystemNodePath, u as isVersionManagedNodePath } from "./daemon-runtime-UsK-tOty.js";
-import { o as resolveGatewayLogPaths, s as resolveLaunchAgentPlistPath } from "./service-Cd4BxKuo.js";
-import { o as resolveSystemdUserUnitPath } from "./systemd-D6wTPnHi.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, n as GATEWAY_SERVICE_KIND, r as GATEWAY_SERVICE_MARKER } from "./constants-BvQ6S8j5.js";
+import { c as getMinimalServicePathPartsFromEnv, l as isSystemNodePath, m as resolveSystemNodePath, u as isVersionManagedNodePath } from "./daemon-runtime-Bsjeut6m.js";
+import { o as resolveGatewayLogPaths, s as resolveLaunchAgentPlistPath } from "./service--nPk7DvT.js";
+import { o as resolveSystemdUserUnitPath } from "./systemd-DrmBtJ5T.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { execFile } from "node:child_process";

package/dist/{service-audit-x6jCN-6a.js → service-audit-ckBaRCVC.js}

@@ -1,7 +1,7 @@
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, n as GATEWAY_SERVICE_KIND, r as GATEWAY_SERVICE_MARKER } from "./constants-DuoCkWRh.js";
-import { c as getMinimalServicePathPartsFromEnv, l as isSystemNodePath, m as resolveSystemNodePath, u as isVersionManagedNodePath } from "./daemon-runtime-c0uXH4Dl.js";
-import { o as resolveGatewayLogPaths, s as resolveLaunchAgentPlistPath } from "./service-DDPRbf8a.js";
-import { o as resolveSystemdUserUnitPath } from "./systemd-BEWwfwn0.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel, n as GATEWAY_SERVICE_KIND, r as GATEWAY_SERVICE_MARKER } from "./constants-JPeoOZnw.js";
+import { c as getMinimalServicePathPartsFromEnv, l as isSystemNodePath, m as resolveSystemNodePath, u as isVersionManagedNodePath } from "./daemon-runtime-B0tg_LsX.js";
+import { o as resolveGatewayLogPaths, s as resolveLaunchAgentPlistPath } from "./service-99RDXwX4.js";
+import { o as resolveSystemdUserUnitPath } from "./systemd-C0VZriGM.js";
 import { execFile } from "node:child_process";
 import path from "node:path";
 import { promisify } from "node:util";

package/dist/{session-cost-usage-CcCEQNuc.js → session-cost-usage-D7HuoSSD.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { a as resolveSessionTranscriptsDirForAgent, n as resolveSessionFilePath } from "./paths-IivnSNkP.js";
-import { i as resolveModelCostConfig, t as estimateUsageCost } from "./usage-format-6Uar63S0.js";
-import path from "node:path";
+import { n as resolveSessionFilePath, o as resolveSessionTranscriptsDirForAgent } from "./paths-B49s6UZQ.js";
+import { i as resolveModelCostConfig, t as estimateUsageCost } from "./usage-format-CpORtVCG.js";
 import fs from "node:fs";
+import path from "node:path";
 import readline from "node:readline";
 
 //#region src/agents/usage.ts
@@ -46,14 +46,16 @@ function derivePromptTokens(usage) {
 	return sum > 0 ? sum : void 0;
 }
 function deriveSessionTotalTokens(params) {
+	const promptOverride = params.promptTokens;
+	const hasPromptOverride = typeof promptOverride === "number" && Number.isFinite(promptOverride) && promptOverride > 0;
 	const usage = params.usage;
-	if (!usage) return;
-	const input = usage.input ?? 0;
-	let total = derivePromptTokens({
-		input: usage.input,
-		cacheRead: usage.cacheRead,
-		cacheWrite: usage.cacheWrite
-	}) ?? usage.total ?? input;
+	if (!usage && !hasPromptOverride) return;
+	const input = usage?.input ?? 0;
+	let total = (hasPromptOverride ? promptOverride : derivePromptTokens({
+		input: usage?.input,
+		cacheRead: usage?.cacheRead,
+		cacheWrite: usage?.cacheWrite
+	})) ?? usage?.total ?? input;
 	if (!(total > 0)) return;
 	const contextTokens = params.contextTokens;
 	if (typeof contextTokens === "number" && Number.isFinite(contextTokens) && contextTokens > 0) total = Math.min(total, contextTokens);

package/dist/{session-cost-usage-PvyVZz-g.js → session-cost-usage-D9hHANWI.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { a as resolveSessionTranscriptsDirForAgent, n as resolveSessionFilePath } from "./paths-Bkhd_qY8.js";
-import { i as resolveModelCostConfig, t as estimateUsageCost } from "./usage-format-hd37en6b.js";
-import fs from "node:fs";
+import { n as resolveSessionFilePath, o as resolveSessionTranscriptsDirForAgent } from "./paths-DLINmNFQ.js";
+import { i as resolveModelCostConfig, t as estimateUsageCost } from "./usage-format-C4JfTbSp.js";
 import path from "node:path";
+import fs from "node:fs";
 import readline from "node:readline";
 
 //#region src/agents/usage.ts
@@ -46,14 +46,16 @@ function derivePromptTokens(usage) {
 	return sum > 0 ? sum : void 0;
 }
 function deriveSessionTotalTokens(params) {
+	const promptOverride = params.promptTokens;
+	const hasPromptOverride = typeof promptOverride === "number" && Number.isFinite(promptOverride) && promptOverride > 0;
 	const usage = params.usage;
-	if (!usage) return;
-	const input = usage.input ?? 0;
-	let total = derivePromptTokens({
-		input: usage.input,
-		cacheRead: usage.cacheRead,
-		cacheWrite: usage.cacheWrite
-	}) ?? usage.total ?? input;
+	if (!usage && !hasPromptOverride) return;
+	const input = usage?.input ?? 0;
+	let total = (hasPromptOverride ? promptOverride : derivePromptTokens({
+		input: usage?.input,
+		cacheRead: usage?.cacheRead,
+		cacheWrite: usage?.cacheWrite
+	})) ?? usage?.total ?? input;
 	if (!(total > 0)) return;
 	const contextTokens = params.contextTokens;
 	if (typeof contextTokens === "number" && Number.isFinite(contextTokens) && contextTokens > 0) total = Math.min(total, contextTokens);

package/dist/{shared-ILguacOr.js → shared-Bs4vduG4.js}

@@ -1,7 +1,7 @@
-import { c as defaultRuntime } from "./subsystem-Bh1Y_6Uv.js";
+import { c as defaultRuntime } from "./subsystem-BoExtIHo.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-CNTiY-ZN.js";
-import { t as resolveGatewayService } from "./service-Cd4BxKuo.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-BvQ6S8j5.js";
+import { t as resolveGatewayService } from "./service--nPk7DvT.js";
 
 //#region src/cli/gateway-cli/shared.ts
 function parsePort(raw) {

package/dist/{shared-CagUDdmp.js → shared-CEY5IkwG.js}

@@ -1,7 +1,7 @@
 import { p as defaultRuntime } from "./entry.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-DuoCkWRh.js";
-import { t as resolveGatewayService } from "./service-DDPRbf8a.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-JPeoOZnw.js";
+import { t as resolveGatewayService } from "./service-99RDXwX4.js";
 
 //#region src/cli/gateway-cli/shared.ts
 function parsePort(raw) {

package/dist/{shared-gOyV38rM.js → shared-DRohONn_.js}

@@ -1,8 +1,8 @@
-import { V as getResolvedLoggerSettings, c as defaultRuntime } from "./subsystem-Bh1Y_6Uv.js";
+import { V as getResolvedLoggerSettings, c as defaultRuntime } from "./subsystem-BoExtIHo.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { s as pickPrimaryLanIPv4 } from "./ws-DtDKpbLR.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-CNTiY-ZN.js";
-import { o as resolveGatewayLogPaths } from "./service-Cd4BxKuo.js";
+import { s as pickPrimaryLanIPv4 } from "./ws-CHCQHs0F.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-BvQ6S8j5.js";
+import { o as resolveGatewayLogPaths } from "./service--nPk7DvT.js";
 import { Writable } from "node:stream";
 
 //#region src/cli/daemon-cli/response.ts

package/dist/{shared-BDk_zC9p.js → shared-ICqOZibV.js}

@@ -1,8 +1,8 @@
-import { M as getResolvedLoggerSettings, p as defaultRuntime } from "./entry.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { N as getResolvedLoggerSettings, p as defaultRuntime } from "./entry.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
 import { s as pickPrimaryLanIPv4 } from "./ws-C0k_dhCP.js";
-import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-DuoCkWRh.js";
-import { o as resolveGatewayLogPaths } from "./service-DDPRbf8a.js";
+import { d as resolveGatewaySystemdServiceName, f as resolveGatewayWindowsTaskName, l as resolveGatewayLaunchAgentLabel } from "./constants-JPeoOZnw.js";
+import { o as resolveGatewayLogPaths } from "./service-99RDXwX4.js";
 import { Writable } from "node:stream";
 
 //#region src/cli/daemon-cli/response.ts

package/dist/{skill-scanner-C_fQzVDu.js → skill-scanner-CucvxYhu.js}

@@ -1,4 +1,4 @@
-import { i as hasErrnoCode } from "./errors-x4NYs-1P.js";
+import { i as hasErrnoCode } from "./errors-Bv81hF2P.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 

package/dist/{skill-scanner-DrVEHfC6.js → skill-scanner-rHMtUHtP.js}

@@ -1,4 +1,4 @@
-import { i as hasErrnoCode } from "./errors-B0eT3jVv.js";
+import { i as hasErrnoCode } from "./errors-DjZBTJJ3.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 

package/dist/{skills-D5UZZZSY.js → skills-DRjfSQT3.js}

@@ -1,10 +1,12 @@
 import { a as parseBooleanValue, o as createSubsystemLogger } from "./entry.js";
-import { t as CONFIG_DIR, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { n as resolveOpenClawPackageRootSync } from "./openclaw-root-Dw6gumSU.js";
-import { a as MANIFEST_KEY, c as normalizePluginsConfig, i as LEGACY_MANIFEST_KEYS, l as resolveEnableState, t as loadPluginManifestRegistry, u as resolveMemorySlotDecision } from "./manifest-registry-D5SiA3xq.js";
+import { t as CONFIG_DIR, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { n as resolveOpenClawPackageRootSync } from "./openclaw-root-BNlEap4i.js";
+import { a as MANIFEST_KEY, d as resolveMemorySlotDecision, i as LEGACY_MANIFEST_KEYS, l as normalizePluginsConfig, t as loadPluginManifestRegistry, u as resolveEnableState } from "./manifest-registry-u0okVSkU.js";
 import path from "node:path";
+import os from "node:os";
 import fs from "node:fs";
 import JSON5 from "json5";
+import fs$1 from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { formatSkillsForPrompt, loadSkillsFromDir } from "@mariozechner/pi-coding-agent";
 import YAML from "yaml";
@@ -360,6 +362,83 @@ function applySkillEnvOverridesFromSnapshot(params) {
 	};
 }
 
+//#endregion
+//#region src/agents/sandbox-paths.ts
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+const HTTP_URL_RE = /^https?:\/\//i;
+const DATA_URL_RE = /^data:/i;
+function normalizeUnicodeSpaces(str) {
+	return str.replace(UNICODE_SPACES, " ");
+}
+function expandPath(filePath) {
+	const normalized = normalizeUnicodeSpaces(filePath);
+	if (normalized === "~") return os.homedir();
+	if (normalized.startsWith("~/")) return os.homedir() + normalized.slice(1);
+	return normalized;
+}
+function resolveToCwd(filePath, cwd) {
+	const expanded = expandPath(filePath);
+	if (path.isAbsolute(expanded)) return expanded;
+	return path.resolve(cwd, expanded);
+}
+function resolveSandboxPath(params) {
+	const resolved = resolveToCwd(params.filePath, params.cwd);
+	const rootResolved = path.resolve(params.root);
+	const relative = path.relative(rootResolved, resolved);
+	if (!relative || relative === "") return {
+		resolved,
+		relative: ""
+	};
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Path escapes sandbox root (${shortPath(rootResolved)}): ${params.filePath}`);
+	return {
+		resolved,
+		relative
+	};
+}
+async function assertSandboxPath(params) {
+	const resolved = resolveSandboxPath(params);
+	await assertNoSymlink(resolved.relative, path.resolve(params.root));
+	return resolved;
+}
+function assertMediaNotDataUrl(media) {
+	const raw = media.trim();
+	if (DATA_URL_RE.test(raw)) throw new Error("data: URLs are not supported for media. Use buffer instead.");
+}
+async function resolveSandboxedMediaSource(params) {
+	const raw = params.media.trim();
+	if (!raw) return raw;
+	if (HTTP_URL_RE.test(raw)) return raw;
+	let candidate = raw;
+	if (/^file:\/\//i.test(candidate)) try {
+		candidate = fileURLToPath(candidate);
+	} catch {
+		throw new Error(`Invalid file:// URL for sandboxed media: ${raw}`);
+	}
+	return (await assertSandboxPath({
+		filePath: candidate,
+		cwd: params.sandboxRoot,
+		root: params.sandboxRoot
+	})).resolved;
+}
+async function assertNoSymlink(relative, root) {
+	if (!relative) return;
+	const parts = relative.split(path.sep).filter(Boolean);
+	let current = root;
+	for (const part of parts) {
+		current = path.join(current, part);
+		try {
+			if ((await fs$1.lstat(current)).isSymbolicLink()) throw new Error(`Symlink not allowed in sandbox path: ${current}`);
+		} catch (err) {
+			if (err.code === "ENOENT") return;
+			throw err;
+		}
+	}
+}
+function shortPath(value) {
+	if (value.startsWith(os.homedir())) return `~${value.slice(os.homedir().length)}`;
+	return value;
+}
+
 //#endregion
 //#region src/agents/skills/bundled-dir.ts
 function looksLikeSkillsDir(dir) {
@@ -517,7 +596,7 @@ function loadSkillEntries(workspaceDir, opts) {
 		return [];
 	};
 	const managedSkillsDir = opts?.managedSkillsDir ?? path.join(CONFIG_DIR, "skills");
-	const workspaceSkillsDir = path.join(workspaceDir, "skills");
+	const workspaceSkillsDir = path.resolve(workspaceDir, "skills");
 	const bundledSkillsDir = opts?.bundledSkillsDir ?? resolveBundledSkillsDir();
 	const extraDirs = (opts?.config?.skills?.load?.extraDirs ?? []).map((d) => typeof d === "string" ? d.trim() : "").filter(Boolean);
 	const pluginSkillDirs = resolvePluginSkillDirs({
@@ -539,6 +618,14 @@ function loadSkillEntries(workspaceDir, opts) {
 		dir: managedSkillsDir,
 		source: "openclaw-managed"
 	});
+	const personalAgentsSkills = loadSkills({
+		dir: path.resolve(os.homedir(), ".agents", "skills"),
+		source: "agents-skills-personal"
+	});
+	const projectAgentsSkills = loadSkills({
+		dir: path.resolve(workspaceDir, ".agents", "skills"),
+		source: "agents-skills-project"
+	});
 	const workspaceSkills = loadSkills({
 		dir: workspaceSkillsDir,
 		source: "openclaw-workspace"
@@ -547,6 +634,8 @@ function loadSkillEntries(workspaceDir, opts) {
 	for (const skill of extraSkills) merged.set(skill.name, skill);
 	for (const skill of bundledSkills) merged.set(skill.name, skill);
 	for (const skill of managedSkills) merged.set(skill.name, skill);
+	for (const skill of personalAgentsSkills) merged.set(skill.name, skill);
+	for (const skill of projectAgentsSkills) merged.set(skill.name, skill);
 	for (const skill of workspaceSkills) merged.set(skill.name, skill);
 	return Array.from(merged.values()).map((skill) => {
 		let frontmatter = {};
@@ -593,6 +682,36 @@ function resolveSkillsPromptForRun(params) {
 function loadWorkspaceSkillEntries(workspaceDir, opts) {
 	return loadSkillEntries(workspaceDir, opts);
 }
+function resolveUniqueSyncedSkillDirName(base, used) {
+	if (!used.has(base)) {
+		used.add(base);
+		return base;
+	}
+	for (let index = 2; index < 1e4; index += 1) {
+		const candidate = `${base}-${index}`;
+		if (!used.has(candidate)) {
+			used.add(candidate);
+			return candidate;
+		}
+	}
+	let fallbackIndex = 1e4;
+	let fallback = `${base}-${fallbackIndex}`;
+	while (used.has(fallback)) {
+		fallbackIndex += 1;
+		fallback = `${base}-${fallbackIndex}`;
+	}
+	used.add(fallback);
+	return fallback;
+}
+function resolveSyncedSkillDestinationPath(params) {
+	const sourceDirName = path.basename(params.entry.skill.baseDir).trim();
+	if (!sourceDirName || sourceDirName === "." || sourceDirName === "..") return null;
+	return resolveSandboxPath({
+		filePath: resolveUniqueSyncedSkillDirName(sourceDirName, params.usedDirNames),
+		cwd: params.targetSkillsDir,
+		root: params.targetSkillsDir
+	}).resolved;
+}
 async function syncSkillsToWorkspace(params) {
 	const sourceDir = resolveUserPath(params.sourceWorkspaceDir);
 	const targetDir = resolveUserPath(params.targetWorkspaceDir);
@@ -609,8 +728,24 @@ async function syncSkillsToWorkspace(params) {
 			force: true
 		});
 		await fsp.mkdir(targetSkillsDir, { recursive: true });
+		const usedDirNames = /* @__PURE__ */ new Set();
 		for (const entry of entries) {
-			const dest = path.join(targetSkillsDir, entry.skill.name);
+			let dest = null;
+			try {
+				dest = resolveSyncedSkillDestinationPath({
+					targetSkillsDir,
+					entry,
+					usedDirNames
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : JSON.stringify(error);
+				console.warn(`[skills] Failed to resolve safe destination for ${entry.skill.name}: ${message}`);
+				continue;
+			}
+			if (!dest) {
+				console.warn(`[skills] Failed to resolve safe destination for ${entry.skill.name}: invalid source directory name`);
+				continue;
+			}
 			try {
 				await fsp.cp(entry.skill.baseDir, dest, {
 					recursive: true,
@@ -690,4 +825,4 @@ function resolveSkillsInstallPreferences(config) {
 }
 
 //#endregion
-export { resolveSkillKey as _, resolveSkillsPromptForRun as a, resolveBundledSkillsDir as c, hasBinary as d, isBundledSkillAllowed as f, resolveSkillConfig as g, resolveConfigPath as h, loadWorkspaceSkillEntries as i, applySkillEnvOverrides as l, resolveBundledAllowlist as m, buildWorkspaceSkillCommandSpecs as n, syncSkillsToWorkspace as o, isConfigPathTruthy as p, buildWorkspaceSkillSnapshot as r, resolvePluginSkillDirs as s, resolveSkillsInstallPreferences as t, applySkillEnvOverridesFromSnapshot as u, parseFrontmatterBlock as v };
+export { resolveBundledAllowlist as _, resolveSkillsPromptForRun as a, resolveSkillKey as b, resolveBundledSkillsDir as c, resolveSandboxedMediaSource as d, applySkillEnvOverrides as f, isConfigPathTruthy as g, isBundledSkillAllowed as h, loadWorkspaceSkillEntries as i, assertMediaNotDataUrl as l, hasBinary as m, buildWorkspaceSkillCommandSpecs as n, syncSkillsToWorkspace as o, applySkillEnvOverridesFromSnapshot as p, buildWorkspaceSkillSnapshot as r, resolvePluginSkillDirs as s, resolveSkillsInstallPreferences as t, assertSandboxPath as u, resolveConfigPath as v, parseFrontmatterBlock as x, resolveSkillConfig as y };