activeclaw 2026.2.11 → 2026.2.13

package/dist/{config--NUdpACy.js → config-aFQssWKX.js}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { a as resolveCanonicalConfigPath, c as resolveDefaultConfigCandidates, d as resolveIsNixMode, f as resolveLegacyStateDirs, g as resolveStateDir, h as resolveOAuthPath, i as isNixMode, l as resolveGatewayLockDir, m as resolveOAuthDir, n as DEFAULT_GATEWAY_PORT, o as resolveConfigPath, p as resolveNewStateDir, r as STATE_DIR, s as resolveConfigPathCandidate, t as CONFIG_PATH, u as resolveGatewayPort, y as resolveRequiredHomeDir } from "./paths-DVBShlw6.js";
-import { S as normalizeChatChannelId, p as CHANNEL_IDS } from "./subsystem-Bh1Y_6Uv.js";
-import { _ as resolveConfigDir, b as resolveUserPath, d as isPlainObject, f as isRecord } from "./utils-es4ygvQ-.js";
+import { S as normalizeChatChannelId, p as CHANNEL_IDS } from "./subsystem-BoExtIHo.js";
+import { _ as resolveConfigDir, b as resolveUserPath, d as isPlainObject, f as isRecord } from "./utils-Cd9QdCHh.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID } from "./session-key-BWxPj0z_.js";
-import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDir } from "./agent-scope-CGmuusG9.js";
-import { Et as DEFAULT_CONTEXT_TOKENS, J as shouldDeferShellEnvFallback, K as loadShellEnvFallback, Y as shouldEnableShellEnvFallback, c as parseModelRef, q as resolveShellEnvFallbackTimeoutMs } from "./model-selection-BK7DuyH8.js";
-import { c as normalizePluginsConfig, l as resolveEnableState, t as loadPluginManifestRegistry, u as resolveMemorySlotDecision } from "./manifest-registry-3It8Z8yN.js";
+import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDir } from "./agent-scope-CQCus0rI.js";
+import { Et as DEFAULT_CONTEXT_TOKENS, J as shouldDeferShellEnvFallback, K as loadShellEnvFallback, Y as shouldEnableShellEnvFallback, c as parseModelRef, q as resolveShellEnvFallbackTimeoutMs } from "./model-selection-BLuqsGVB.js";
+import { d as resolveMemorySlotDecision, l as normalizePluginsConfig, t as loadPluginManifestRegistry, u as resolveEnableState } from "./manifest-registry-CQhdnDBZ.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
 import os from "node:os";
@@ -2763,7 +2763,8 @@ const BindingsSchema = z.array(z.object({
 			id: z.string()
 		}).strict().optional(),
 		guildId: z.string().optional(),
-		teamId: z.string().optional()
+		teamId: z.string().optional(),
+		roles: z.array(z.string()).optional()
 	}).strict()
 }).strict()).optional();
 const BroadcastStrategySchema = z.enum(["parallel", "sequential"]);
@@ -2836,7 +2837,7 @@ const InternalHookHandlerSchema = z.object({
 const HookConfigSchema = z.object({
 	enabled: z.boolean().optional(),
 	env: z.record(z.string(), z.string()).optional()
-}).strict();
+}).passthrough();
 const HookInstallRecordSchema = z.object({
 	source: z.union([
 		z.literal("npm"),
@@ -3149,6 +3150,7 @@ const DiscordGuildChannelSchema = z.object({
 	skills: z.array(z.string()).optional(),
 	enabled: z.boolean().optional(),
 	users: z.array(z.union([z.string(), z.number()])).optional(),
+	roles: z.array(z.union([z.string(), z.number()])).optional(),
 	systemPrompt: z.string().optional(),
 	includeThreadStarter: z.boolean().optional(),
 	autoThread: z.boolean().optional()
@@ -3165,6 +3167,7 @@ const DiscordGuildSchema = z.object({
 		"allowlist"
 	]).optional(),
 	users: z.array(z.union([z.string(), z.number()])).optional(),
+	roles: z.array(z.union([z.string(), z.number()])).optional(),
 	channels: z.record(z.string(), DiscordGuildChannelSchema.optional()).optional()
 }).strict();
 const DiscordAccountSchema = z.object({
@@ -4022,6 +4025,11 @@ const MemoryQmdLimitsSchema = z.object({
 }).strict();
 const MemoryQmdSchema = z.object({
 	command: z.string().optional(),
+	searchMode: z.union([
+		z.literal("query"),
+		z.literal("search"),
+		z.literal("vsearch")
+	]).optional(),
 	includeDefaultMemory: z.boolean().optional(),
 	paths: z.array(MemoryQmdPathSchema).optional(),
 	sessions: MemoryQmdSessionSchema.optional(),
@@ -4183,6 +4191,9 @@ const OpenClawSchema = z.object({
 		enabled: z.boolean().optional(),
 		path: z.string().optional(),
 		token: z.string().optional(),
+		defaultSessionKey: z.string().optional(),
+		allowRequestSessionKey: z.boolean().optional(),
+		allowedSessionKeyPrefixes: z.array(z.string()).optional(),
 		allowedAgentIds: z.array(z.string()).optional(),
 		maxBodyBytes: z.number().int().positive().optional(),
 		presets: z.array(z.string()).optional(),
@@ -4288,8 +4299,10 @@ const OpenClawSchema = z.object({
 			responses: z.object({
 				enabled: z.boolean().optional(),
 				maxBodyBytes: z.number().int().positive().optional(),
+				maxUrlParts: z.number().int().nonnegative().optional(),
 				files: z.object({
 					allowUrl: z.boolean().optional(),
+					urlAllowlist: z.array(z.string()).optional(),
 					allowedMimes: z.array(z.string()).optional(),
 					maxBytes: z.number().int().positive().optional(),
 					maxChars: z.number().int().positive().optional(),
@@ -4303,6 +4316,7 @@ const OpenClawSchema = z.object({
 				}).strict().optional(),
 				images: z.object({
 					allowUrl: z.boolean().optional(),
+					urlAllowlist: z.array(z.string()).optional(),
 					allowedMimes: z.array(z.string()).optional(),
 					maxBytes: z.number().int().positive().optional(),
 					maxRedirects: z.number().int().nonnegative().optional(),

package/dist/{config-guard-4kCO_rnQ.js → config-guard-CljaSxJd.js}

@@ -1,46 +1,46 @@
-import { $ as DEFAULT_CHAT_CHANNEL, B as resolveConfigPath, C as setVerbose, D as colorize, J as resolveOAuthDir, L as STATE_DIR, O as isRich, R as isNixMode, W as resolveGatewayPort, X as resolveStateDir, a as parseBooleanValue, f as visibleWidth, k as theme, m as restoreTerminalState, nt as getChatChannelMeta, ot as normalizeChatChannelId, p as defaultRuntime, v as danger, y as info } from "./entry.js";
-import { Ct as DEFAULT_CONTEXT_TOKENS, N as resolveConfiguredModelRef, Tt as DEFAULT_PROVIDER, _ as ensureAuthProfileStore, b as resolveAuthStorePath, ft as normalizeOptionalSecretInput, g as upsertAuthProfile, k as normalizeProviderId, n as resolveAuthProfileOrder, pt as normalizeSecretInput, s as resolveApiKeyForProfile, ut as resolveEnvApiKey, wt as DEFAULT_MODEL } from "./auth-profiles-Bv1AEm-Y.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { A as theme, G as resolveGatewayPort, O as colorize, R as STATE_DIR, V as resolveConfigPath, Y as resolveOAuthDir, Z as resolveStateDir, a as parseBooleanValue, ct as normalizeChatChannelId, f as visibleWidth, it as getChatChannelMeta, k as isRich, m as restoreTerminalState, p as defaultRuntime, tt as DEFAULT_CHAT_CHANNEL, v as danger, w as setVerbose, y as info, z as isNixMode } from "./entry.js";
+import { Ct as DEFAULT_CONTEXT_TOKENS, N as resolveConfiguredModelRef, Tt as DEFAULT_PROVIDER, _ as ensureAuthProfileStore, b as resolveAuthStorePath, ft as normalizeOptionalSecretInput, g as upsertAuthProfile, k as normalizeProviderId, n as resolveAuthProfileOrder, pt as normalizeSecretInput, s as resolveApiKeyForProfile, ut as resolveEnvApiKey, wt as DEFAULT_MODEL } from "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID, t as DEFAULT_ACCOUNT_ID } from "./session-key-DVvxnFKg.js";
-import { S as shortenHomePath, _ as resolveHomeDir, x as shortenHomeInString, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
-import { c as resolveDefaultAgentId, f as DEFAULT_AGENT_WORKSPACE_DIR, h as DEFAULT_IDENTITY_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace } from "./agent-scope-DQuy3dwI.js";
-import { c as writeConfigFile, g as parseDurationMs, i as loadConfig, o as readConfigFileSnapshot, r as createConfigIO } from "./config-B00lvFac.js";
-import { n as movePathToTrash } from "./server-context-fX4xiYRh.js";
-import { i as randomIdempotencyKey, n as callGateway } from "./call-7yrB6v4I.js";
-import { h as GATEWAY_CLIENT_NAMES, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES } from "./message-channel-BlgPSDAh.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
-import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-Db5BiELK.js";
-import { $n as CHANNEL_TARGET_DESCRIPTION, D as runMemoryStatus, Dn as formatTargetDisplay, E as registerMemoryCli, Qn as CHANNEL_TARGETS_DESCRIPTION, _ as randomToken, a as applyWizardMetadata, c as ensureWorkspaceAndSessions, d as handleReset, f as moveToTrash, gn as lookupContextTokens, hn as resolveCommitHash, i as DEFAULT_WORKSPACE, kn as CHANNEL_MESSAGE_ACTION_NAMES, l as formatControlUiSshHint, m as openUrl, s as detectBrowserOpenSupport, v as resolveControlUiLinks, x as waitForGatewayReachable, yn as runMessageAction } from "./loader-wXwp4rZJ.js";
-import { n as withProgress } from "./progress-Da1ehW-x.js";
-import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-Dc0C5HC9.js";
+import { S as shortenHomePath, _ as resolveHomeDir, x as shortenHomeInString, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
+import { c as resolveDefaultAgentId, f as DEFAULT_AGENT_WORKSPACE_DIR, h as DEFAULT_IDENTITY_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace } from "./agent-scope-CsRbLH4l.js";
+import { c as writeConfigFile, g as parseDurationMs, i as loadConfig, o as readConfigFileSnapshot, r as createConfigIO } from "./config-Bdhomfei.js";
+import { n as movePathToTrash } from "./server-context-BGpGs3qd.js";
+import { i as randomIdempotencyKey, n as callGateway } from "./call-DVYCIV8m.js";
+import { h as GATEWAY_CLIENT_NAMES, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES } from "./message-channel-C_MmebBt.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
+import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-4Hqd1WGf.js";
+import { D as runMemoryStatus, E as registerMemoryCli, Gn as CHANNEL_TARGETS_DESCRIPTION, Kn as CHANNEL_TARGET_DESCRIPTION, Sn as CHANNEL_MESSAGE_ACTION_NAMES, _ as randomToken, a as applyWizardMetadata, bn as formatTargetDisplay, c as ensureWorkspaceAndSessions, cn as resolveCommitHash, d as handleReset, f as moveToTrash, fn as runMessageAction, i as DEFAULT_WORKSPACE, l as formatControlUiSshHint, ln as lookupContextTokens, m as openUrl, s as detectBrowserOpenSupport, v as resolveControlUiLinks, x as waitForGatewayReachable } from "./loader-KjT074JR.js";
+import { n as withProgress } from "./progress-DWqhRakV.js";
+import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-BFH5D5LN.js";
 import { t as WizardCancelledError } from "./prompts-CXLLIBwP.js";
-import { t as createClackPrompter } from "./clack-prompter-DuBVnTKy.js";
+import { t as createClackPrompter } from "./clack-prompter-ChCGXfyt.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-DdwqKAAS.js";
-import { n as setupChannels } from "./onboard-channels-DxXvp8og.js";
-import { a as resolveSessionTranscriptsDirForAgent, i as resolveSessionTranscriptsDir, o as resolveStorePath } from "./paths-IivnSNkP.js";
-import { d as loadSessionStore } from "./sandbox-Aks-9EcZ.js";
-import { n as formatTimeAgo } from "./format-relative-79_Y1n2Y.js";
-import { n as runCommandWithRuntime } from "./cli-utils-PlLcDZlM.js";
-import { n as ensurePluginRegistryLoaded, t as hasExplicitOptions } from "./command-options-BTAzyqqb.js";
-import { l as getVerboseFlag, o as getFlagValue, r as registerSubCliCommands, s as getPositiveIntFlagValue, u as hasFlag } from "./register.subclis-DUkirdHn.js";
-import { n as parsePositiveIntOrUndefined, t as collectOption } from "./helpers-CQI-5xS9.js";
-import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-3B5y445n.js";
-import { t as createDefaultDeps } from "./deps-Bv1kLtwo.js";
-import { a as gatewayInstallErrorHint, h as assertSupportedRuntime, i as buildGatewayInstallPlan, r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-c0uXH4Dl.js";
-import { t as resolveGatewayService } from "./service-DDPRbf8a.js";
-import { r as isSystemdUserServiceAvailable } from "./systemd-BEWwfwn0.js";
-import { t as renderTable } from "./table-cCoGqLsk.js";
-import { d as warnIfModelConfigLooksOff, f as applyAuthChoice, g as promptAuthChoiceGrouped, h as applyGoogleGeminiModelDefault, m as upsertSharedEnvVar, p as applyOpenAIConfig } from "./onboard-skills-CBxsRGyf.js";
-import { l as healthCommand } from "./health-format-DrGFg8bx.js";
-import { $ as setMinimaxApiKey, C as applyMoonshotConfig, D as applyOpenrouterConfig, F as applyVeniceConfig, L as applyVercelAiGatewayConfig, N as applyTogetherConfig, Q as setKimiCodingApiKey, U as applyZaiConfig, V as applyXiaomiConfig, X as setCloudflareAiGatewayConfig, Y as setAnthropicApiKey, Z as setGeminiApiKey, _t as validateAnthropicSetupToken, at as setTogetherApiKey, ct as setXaiApiKey, et as setMoonshotApiKey, f as applyOpencodeZenConfig, g as applyMinimaxConfig, gt as buildTokenProfileId, it as setSyntheticApiKey, j as applySyntheticConfig, k as applyQianfanConfig, lt as setXiaomiApiKey, m as applyMinimaxApiConfig, nt as setOpenrouterApiKey, ot as setVeniceApiKey, rt as setQianfanApiKey, st as setVercelAiGatewayApiKey, tt as setOpencodeZenApiKey, ut as setZaiApiKey, v as applyAuthProfileConfig, w as applyMoonshotConfigCn, x as applyKimiCodeConfig, y as applyCloudflareAiGatewayConfig, z as applyXaiConfig } from "./github-copilot-auth-CZxurvdz.js";
-import { n as logConfigUpdated, t as formatConfigPath } from "./logging-DuK6YXuK.js";
-import { a as findAgentEntryIndex, c as pruneAgentConfig, d as parseIdentityMarkdown, f as runOnboardingWizard, i as buildAgentSummaries, l as identityHasValues, o as listAgentEntries, r as applyAgentConfig, s as loadAgentIdentity, t as statusCommand } from "./status-zfL4Yej7.js";
-import { a as createOutboundSendDeps, n as resolveSessionKeyForRequest, t as agentCommand } from "./agent-22-R4bNS.js";
-import { t as formatHelpExamples } from "./help-format-CUnac_bT.js";
-import { i as CONFIGURE_WIZARD_SECTIONS, n as configureCommand, r as configureCommandWithSections } from "./configure-B69emwZv.js";
-import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-CDo2UbHM.js";
-import { n as loadAndMaybeMigrateDoctorConfig, t as doctorCommand } from "./doctor-BJirShBi.js";
+import { n as setupChannels } from "./onboard-channels-C501x8GI.js";
+import { a as resolveSessionTranscriptsDir, o as resolveSessionTranscriptsDirForAgent, s as resolveStorePath } from "./paths-DLINmNFQ.js";
+import { d as loadSessionStore } from "./sandbox-BKYnhYQH.js";
+import { n as formatTimeAgo } from "./format-relative-CZOlQ2pA.js";
+import { n as runCommandWithRuntime } from "./cli-utils-LcHOt63h.js";
+import { n as ensurePluginRegistryLoaded, t as hasExplicitOptions } from "./command-options-BvgxzPbK.js";
+import { l as getVerboseFlag, o as getFlagValue, r as registerSubCliCommands, s as getPositiveIntFlagValue, u as hasFlag } from "./register.subclis-C02e4zuJ.js";
+import { n as parsePositiveIntOrUndefined, t as collectOption } from "./helpers-D_jqdWkd.js";
+import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-BByb2Snz.js";
+import { t as createDefaultDeps } from "./deps-QSwGcoNZ.js";
+import { a as gatewayInstallErrorHint, h as assertSupportedRuntime, i as buildGatewayInstallPlan, r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-B0tg_LsX.js";
+import { t as resolveGatewayService } from "./service-99RDXwX4.js";
+import { r as isSystemdUserServiceAvailable } from "./systemd-C0VZriGM.js";
+import { t as renderTable } from "./table-CwulTLQp.js";
+import { _ as applyOpenAIConfig, a as applyCustomApiConfig, b as applyGoogleGeminiModelDefault, c as resolveCustomProviderId, g as applyAuthChoice, h as warnIfModelConfigLooksOff, i as CustomApiError, o as parseNonInteractiveCustomApiFlags, v as upsertSharedEnvVar, x as promptAuthChoiceGrouped, y as detectZaiEndpoint } from "./onboard-skills-DV0Qzvjj.js";
+import { l as healthCommand } from "./health-format-LZDxu3rv.js";
+import { $ as setAnthropicApiKey, C as applyLitellmConfig, E as applyMoonshotConfigCn, Et as validateAnthropicSetupToken, F as applyTogetherConfig, G as applyZaiConfig, L as applyVeniceConfig, N as applySyntheticConfig, T as applyMoonshotConfig, Tt as buildTokenProfileId, U as applyXiaomiConfig, V as applyXaiConfig, at as setMoonshotApiKey, ct as setQianfanApiKey, dt as setVeniceApiKey, et as setCloudflareAiGatewayConfig, f as applyOpencodeZenConfig, ft as setVercelAiGatewayApiKey, g as applyMinimaxConfig, ht as setZaiApiKey, it as setMinimaxApiKey, j as applyQianfanConfig, k as applyOpenrouterConfig, lt as setSyntheticApiKey, m as applyMinimaxApiConfig, mt as setXiaomiApiKey, nt as setKimiCodingApiKey, ot as setOpencodeZenApiKey, pt as setXaiApiKey, rt as setLitellmApiKey, st as setOpenrouterApiKey, tt as setGeminiApiKey, ut as setTogetherApiKey, v as applyAuthProfileConfig, x as applyKimiCodeConfig, y as applyCloudflareAiGatewayConfig, z as applyVercelAiGatewayConfig } from "./github-copilot-auth-DDispnyz.js";
+import { n as logConfigUpdated, t as formatConfigPath } from "./logging-CRq4h04P.js";
+import { a as findAgentEntryIndex, c as pruneAgentConfig, d as parseIdentityMarkdown, f as runOnboardingWizard, i as buildAgentSummaries, l as identityHasValues, o as listAgentEntries, r as applyAgentConfig, s as loadAgentIdentity, t as statusCommand } from "./status-DDWoOpeB.js";
+import { a as createOutboundSendDeps, n as resolveSessionKeyForRequest, t as agentCommand } from "./agent-CyMxTyrG.js";
+import { t as formatHelpExamples } from "./help-format-R5fLToDw.js";
+import { i as CONFIGURE_WIZARD_SECTIONS, n as configureCommand, r as configureCommandWithSections } from "./configure-BXLiucXo.js";
+import { n as ensureSystemdUserLingerNonInteractive } from "./systemd-linger-xdn3BdPh.js";
+import { n as loadAndMaybeMigrateDoctorConfig, t as doctorCommand } from "./doctor-sYG5V4Co.js";
 import path from "node:path";
 import fs from "node:fs";
 import JSON5 from "json5";
@@ -410,7 +410,7 @@ async function agentsAddCommand(opts, runtime = defaultRuntime, params) {
 		await prompter.outro(`Agent "${agentId}" ready.`);
 	} catch (err) {
 		if (err instanceof WizardCancelledError) {
-			runtime.exit(0);
+			runtime.exit(1);
 			return;
 		}
 		throw err;
@@ -1234,7 +1234,7 @@ function registerBrowserFilesAndDownloadsCommands(browser, parentOpts) {
 			defaultRuntime.exit(1);
 		}
 	});
-	browser.command("waitfordownload").description("Wait for the next download (and save it)").argument("[path]", "Save path (default: /tmp/openclaw/downloads/...)").option("--target-id <id>", "CDP target id (or unique prefix)").option("--timeout-ms <ms>", "How long to wait for the next download (default: 120000)", (v) => Number(v)).action(async (outPath, opts, cmd) => {
+	browser.command("waitfordownload").description("Wait for the next download (and save it)").argument("[path]", "Save path (default: /tmp/openclaw/downloads/...; fallback: os.tmpdir()/openclaw/downloads/...)").option("--target-id <id>", "CDP target id (or unique prefix)").option("--timeout-ms <ms>", "How long to wait for the next download (default: 120000)", (v) => Number(v)).action(async (outPath, opts, cmd) => {
 		const { parent, profile } = resolveBrowserActionContext(cmd, parentOpts);
 		try {
 			const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : void 0;
@@ -2782,7 +2782,7 @@ async function loadValidConfig() {
 }
 function registerConfigCli(program) {
 	const cmd = program.command("config").description("Config helpers (get/set/unset). Run without subcommand for the wizard.").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/config", "docs.openclaw.ai/cli/config")}\n`).option("--section <section>", "Configure wizard sections (repeatable). Use with no subcommand.", (value, previous) => [...previous, value], []).action(async (opts) => {
-		const { CONFIGURE_WIZARD_SECTIONS, configureCommand, configureCommandWithSections } = await import("./configure-B69emwZv.js").then((n) => n.t);
+		const { CONFIGURE_WIZARD_SECTIONS, configureCommand, configureCommandWithSections } = await import("./configure-BXLiucXo.js").then((n) => n.t);
 		const sections = Array.isArray(opts.section) ? opts.section.map((value) => typeof value === "string" ? value.trim() : "").filter(Boolean) : [];
 		if (sections.length === 0) {
 			await configureCommand(defaultRuntime);
@@ -4106,7 +4106,7 @@ async function runInteractiveOnboarding(opts, runtime = defaultRuntime) {
 		await runOnboardingWizard(opts, runtime, prompter);
 	} catch (err) {
 		if (err instanceof WizardCancelledError) {
-			runtime.exit(0);
+			runtime.exit(1);
 			return;
 		}
 		throw err;
@@ -4192,13 +4192,22 @@ const AUTH_CHOICE_FLAG_MAP = [
 		flag: "opencodeZenApiKey",
 		authChoice: "opencode-zen",
 		label: "--opencode-zen-api-key"
+	},
+	{
+		flag: "litellmApiKey",
+		authChoice: "litellm-api-key",
+		label: "--litellm-api-key"
 	}
 ];
+function hasStringValue(value) {
+	return typeof value === "string" ? value.trim().length > 0 : Boolean(value);
+}
 function inferAuthChoiceFromFlags(opts) {
-	const matches = AUTH_CHOICE_FLAG_MAP.filter(({ flag }) => {
-		const value = opts[flag];
-		if (typeof value === "string") return value.trim().length > 0;
-		return Boolean(value);
+	const matches = AUTH_CHOICE_FLAG_MAP.filter(({ flag }) => hasStringValue(opts[flag]));
+	if (hasStringValue(opts.customBaseUrl) || hasStringValue(opts.customModelId) || hasStringValue(opts.customApiKey)) matches.push({
+		flag: "customBaseUrl",
+		authChoice: "custom-api-key",
+		label: "--custom-base-url/--custom-model-id/--custom-api-key"
 	});
 	return {
 		choice: matches[0]?.authChoice,
@@ -4238,6 +4247,14 @@ async function resolveNonInteractiveApiKey(params) {
 		key: envResolved.apiKey,
 		source: "env"
 	};
+	const explicitEnvVar = params.envVarName?.trim();
+	if (explicitEnvVar) {
+		const explicitEnvKey = normalizeOptionalSecretInput(process.env[explicitEnvVar]);
+		if (explicitEnvKey) return {
+			key: explicitEnvKey,
+			source: "env"
+		};
+	}
 	if (params.allowProfile ?? true) {
 		const profileKey = await resolveApiKeyFromProfiles({
 			provider: params.provider,
@@ -4249,6 +4266,7 @@ async function resolveNonInteractiveApiKey(params) {
 			source: "profile"
 		};
 	}
+	if (params.required === false) return null;
 	const profileHint = params.allowProfile === false ? "" : `, or existing ${params.provider} API-key profile`;
 	params.runtime.error(`Missing ${params.flagName} (or ${params.envVar} in env${profileHint}).`);
 	params.runtime.exit(1);
@@ -4358,7 +4376,7 @@ async function applyNonInteractiveAuthChoice(params) {
 		});
 		return applyGoogleGeminiModelDefault(nextConfig).next;
 	}
-	if (authChoice === "zai-api-key") {
+	if (authChoice === "zai-api-key" || authChoice === "zai-coding-global" || authChoice === "zai-coding-cn" || authChoice === "zai-global" || authChoice === "zai-cn") {
 		const resolved = await resolveNonInteractiveApiKey({
 			provider: "zai",
 			cfg: baseConfig,
@@ -4374,7 +4392,23 @@ async function applyNonInteractiveAuthChoice(params) {
 			provider: "zai",
 			mode: "api_key"
 		});
-		return applyZaiConfig(nextConfig);
+		let endpoint;
+		let modelIdOverride;
+		if (authChoice === "zai-coding-global") endpoint = "coding-global";
+		else if (authChoice === "zai-coding-cn") endpoint = "coding-cn";
+		else if (authChoice === "zai-global") endpoint = "global";
+		else if (authChoice === "zai-cn") endpoint = "cn";
+		else {
+			const detected = await detectZaiEndpoint({ apiKey: resolved.key });
+			if (detected) {
+				endpoint = detected.endpoint;
+				modelIdOverride = detected.modelId;
+			} else endpoint = "global";
+		}
+		return applyZaiConfig(nextConfig, {
+			endpoint,
+			...modelIdOverride ? { modelId: modelIdOverride } : {}
+		});
 	}
 	if (authChoice === "xiaomi-api-key") {
 		const resolved = await resolveNonInteractiveApiKey({
@@ -4468,6 +4502,24 @@ async function applyNonInteractiveAuthChoice(params) {
 		});
 		return applyOpenrouterConfig(nextConfig);
 	}
+	if (authChoice === "litellm-api-key") {
+		const resolved = await resolveNonInteractiveApiKey({
+			provider: "litellm",
+			cfg: baseConfig,
+			flagValue: opts.litellmApiKey,
+			flagName: "--litellm-api-key",
+			envVar: "LITELLM_API_KEY",
+			runtime
+		});
+		if (!resolved) return null;
+		if (resolved.source !== "profile") await setLitellmApiKey(resolved.key);
+		nextConfig = applyAuthProfileConfig(nextConfig, {
+			profileId: "litellm:default",
+			provider: "litellm",
+			mode: "api_key"
+		});
+		return applyLitellmConfig(nextConfig);
+	}
 	if (authChoice === "ai-gateway-api-key") {
 		const resolved = await resolveNonInteractiveApiKey({
 			provider: "vercel-ai-gateway",
@@ -4659,6 +4711,57 @@ async function applyNonInteractiveAuthChoice(params) {
 		});
 		return applyTogetherConfig(nextConfig);
 	}
+	if (authChoice === "custom-api-key") try {
+		const customAuth = parseNonInteractiveCustomApiFlags({
+			baseUrl: opts.customBaseUrl,
+			modelId: opts.customModelId,
+			compatibility: opts.customCompatibility,
+			apiKey: opts.customApiKey,
+			providerId: opts.customProviderId
+		});
+		const resolvedCustomApiKey = await resolveNonInteractiveApiKey({
+			provider: resolveCustomProviderId({
+				config: nextConfig,
+				baseUrl: customAuth.baseUrl,
+				providerId: customAuth.providerId
+			}).providerId,
+			cfg: baseConfig,
+			flagValue: customAuth.apiKey,
+			flagName: "--custom-api-key",
+			envVar: "CUSTOM_API_KEY",
+			envVarName: "CUSTOM_API_KEY",
+			runtime,
+			required: false
+		});
+		const result = applyCustomApiConfig({
+			config: nextConfig,
+			baseUrl: customAuth.baseUrl,
+			modelId: customAuth.modelId,
+			compatibility: customAuth.compatibility,
+			apiKey: resolvedCustomApiKey?.key,
+			providerId: customAuth.providerId
+		});
+		if (result.providerIdRenamedFrom && result.providerId) runtime.log(`Custom provider ID "${result.providerIdRenamedFrom}" already exists for a different base URL. Using "${result.providerId}".`);
+		return result.config;
+	} catch (err) {
+		if (err instanceof CustomApiError) {
+			switch (err.code) {
+				case "missing_required":
+				case "invalid_compatibility":
+					runtime.error(err.message);
+					break;
+				default:
+					runtime.error(`Invalid custom provider config: ${err.message}`);
+					break;
+			}
+			runtime.exit(1);
+			return null;
+		}
+		const reason = err instanceof Error ? err.message : String(err);
+		runtime.error(`Invalid custom provider config: ${reason}`);
+		runtime.exit(1);
+		return null;
+	}
 	if (authChoice === "oauth" || authChoice === "chutes" || authChoice === "openai-codex" || authChoice === "qwen-portal" || authChoice === "minimax-portal") {
 		runtime.error("OAuth requires interactive mode.");
 		runtime.exit(1);
@@ -5076,7 +5179,7 @@ function resolveInstallDaemonFlag(command, opts) {
 	if (getOptionValueSource.call(command, "installDaemon") === "cli") return Boolean(opts.installDaemon);
 }
 function registerOnboardCommand(program) {
-	program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.openclaw.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.openclaw/workspace)").option("--reset", "Reset config + credentials + sessions + workspace before running wizard").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--auth-choice <choice>", "Auth: setup-token|token|chutes|openai-codex|openai-api-key|xai-api-key|qianfan-api-key|openrouter-api-key|ai-gateway-api-key|cloudflare-ai-gateway-api-key|moonshot-api-key|moonshot-api-key-cn|kimi-code-api-key|synthetic-api-key|venice-api-key|gemini-api-key|zai-api-key|xiaomi-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip|together-api-key").option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--anthropic-api-key <key>", "Anthropic API key").option("--openai-api-key <key>", "OpenAI API key").option("--openrouter-api-key <key>", "OpenRouter API key").option("--ai-gateway-api-key <key>", "Vercel AI Gateway API key").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID").option("--cloudflare-ai-gateway-api-key <key>", "Cloudflare AI Gateway API key").option("--moonshot-api-key <key>", "Moonshot API key").option("--kimi-code-api-key <key>", "Kimi Coding API key").option("--gemini-api-key <key>", "Gemini API key").option("--zai-api-key <key>", "Z.AI API key").option("--xiaomi-api-key <key>", "Xiaomi API key").option("--minimax-api-key <key>", "MiniMax API key").option("--synthetic-api-key <key>", "Synthetic API key").option("--venice-api-key <key>", "Venice API key").option("--together-api-key <key>", "Together AI API key").option("--opencode-zen-api-key <key>", "OpenCode Zen API key").option("--xai-api-key <key>", "xAI API key").option("--qianfan-api-key <key>", "QIANFAN API key").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false).action(async (opts, command) => {
+	program.command("onboard").description("Interactive wizard to set up the gateway, workspace, and skills").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/onboard", "docs.openclaw.ai/cli/onboard")}\n`).option("--workspace <dir>", "Agent workspace directory (default: ~/.openclaw/workspace)").option("--reset", "Reset config + credentials + sessions + workspace before running wizard").option("--non-interactive", "Run without prompts", false).option("--accept-risk", "Acknowledge that agents are powerful and full system access is risky (required for --non-interactive)", false).option("--flow <flow>", "Wizard flow: quickstart|advanced|manual").option("--mode <mode>", "Wizard mode: local|remote").option("--auth-choice <choice>", "Auth: setup-token|token|chutes|openai-codex|openai-api-key|xai-api-key|qianfan-api-key|openrouter-api-key|litellm-api-key|ai-gateway-api-key|cloudflare-ai-gateway-api-key|moonshot-api-key|moonshot-api-key-cn|kimi-code-api-key|synthetic-api-key|venice-api-key|gemini-api-key|zai-api-key|zai-coding-global|zai-coding-cn|zai-global|zai-cn|xiaomi-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|custom-api-key|skip|together-api-key").option("--token-provider <id>", "Token provider id (non-interactive; used with --auth-choice token)").option("--token <token>", "Token value (non-interactive; used with --auth-choice token)").option("--token-profile-id <id>", "Auth profile id (non-interactive; default: <provider>:manual)").option("--token-expires-in <duration>", "Optional token expiry duration (e.g. 365d, 12h)").option("--anthropic-api-key <key>", "Anthropic API key").option("--openai-api-key <key>", "OpenAI API key").option("--openrouter-api-key <key>", "OpenRouter API key").option("--ai-gateway-api-key <key>", "Vercel AI Gateway API key").option("--cloudflare-ai-gateway-account-id <id>", "Cloudflare Account ID").option("--cloudflare-ai-gateway-gateway-id <id>", "Cloudflare AI Gateway ID").option("--cloudflare-ai-gateway-api-key <key>", "Cloudflare AI Gateway API key").option("--moonshot-api-key <key>", "Moonshot API key").option("--kimi-code-api-key <key>", "Kimi Coding API key").option("--gemini-api-key <key>", "Gemini API key").option("--zai-api-key <key>", "Z.AI API key").option("--xiaomi-api-key <key>", "Xiaomi API key").option("--minimax-api-key <key>", "MiniMax API key").option("--synthetic-api-key <key>", "Synthetic API key").option("--venice-api-key <key>", "Venice API key").option("--together-api-key <key>", "Together AI API key").option("--opencode-zen-api-key <key>", "OpenCode Zen API key").option("--xai-api-key <key>", "xAI API key").option("--litellm-api-key <key>", "LiteLLM API key").option("--qianfan-api-key <key>", "QIANFAN API key").option("--custom-base-url <url>", "Custom provider base URL").option("--custom-api-key <key>", "Custom provider API key (optional)").option("--custom-model-id <id>", "Custom provider model ID").option("--custom-provider-id <id>", "Custom provider ID (optional; auto-derived by default)").option("--custom-compatibility <mode>", "Custom provider API compatibility: openai|anthropic (default: openai)").option("--gateway-port <port>", "Gateway port").option("--gateway-bind <mode>", "Gateway bind: loopback|tailnet|lan|auto|custom").option("--gateway-auth <mode>", "Gateway auth: token|password").option("--gateway-token <token>", "Gateway token (token auth)").option("--gateway-password <password>", "Gateway password (password auth)").option("--remote-url <url>", "Remote Gateway WebSocket URL").option("--remote-token <token>", "Remote Gateway token (optional)").option("--tailscale <mode>", "Tailscale: off|serve|funnel").option("--tailscale-reset-on-exit", "Reset tailscale serve/funnel on exit").option("--install-daemon", "Install gateway service").option("--no-install-daemon", "Skip gateway service install").option("--skip-daemon", "Skip gateway service install").option("--daemon-runtime <runtime>", "Daemon runtime: node|bun").option("--skip-channels", "Skip channel setup").option("--skip-skills", "Skip skills setup").option("--skip-health", "Skip health check").option("--skip-ui", "Skip Control UI/TUI prompts").option("--node-manager <name>", "Node manager for skills: npm|pnpm|bun").option("--json", "Output JSON summary", false).action(async (opts, command) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			const installDaemon = resolveInstallDaemonFlag(command, { installDaemon: Boolean(opts.installDaemon) });
 			const gatewayPort = typeof opts.gatewayPort === "string" ? Number.parseInt(opts.gatewayPort, 10) : void 0;
@@ -5110,6 +5213,12 @@ function registerOnboardCommand(program) {
 				togetherApiKey: opts.togetherApiKey,
 				opencodeZenApiKey: opts.opencodeZenApiKey,
 				xaiApiKey: opts.xaiApiKey,
+				litellmApiKey: opts.litellmApiKey,
+				customBaseUrl: opts.customBaseUrl,
+				customApiKey: opts.customApiKey,
+				customModelId: opts.customModelId,
+				customProviderId: opts.customProviderId,
+				customCompatibility: opts.customCompatibility,
 				gatewayPort: typeof gatewayPort === "number" && Number.isFinite(gatewayPort) ? gatewayPort : void 0,
 				gatewayBind: opts.gatewayBind,
 				gatewayAuth: opts.gatewayAuth,

package/dist/{configure-B69emwZv.js → configure-BXLiucXo.js}

@@ -1,24 +1,24 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { F as CONFIG_PATH, W as resolveGatewayPort, p as defaultRuntime } from "./entry.js";
-import { _ as ensureAuthProfileStore } from "./auth-profiles-Bv1AEm-Y.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import { S as shortenHomePath, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { c as writeConfigFile, i as loadConfig, o as readConfigFileSnapshot } from "./config-B00lvFac.js";
-import { a as findTailscaleBinary } from "./tailscale-DU6DgqVy.js";
-import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-Db5BiELK.js";
-import { _ as randomToken, a as applyWizardMetadata, b as summarizeExistingConfig, c as ensureWorkspaceAndSessions, g as probeGatewayReachable, h as printWizardHeader, i as DEFAULT_WORKSPACE, p as normalizeGatewayTokenInput, u as guardCancel, v as resolveControlUiLinks, x as waitForGatewayReachable } from "./loader-wXwp4rZJ.js";
-import { n as withProgress } from "./progress-Da1ehW-x.js";
-import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-Dc0C5HC9.js";
-import { t as note$1 } from "./note-Ci08TSbV.js";
+import { G as resolveGatewayPort, I as CONFIG_PATH, p as defaultRuntime } from "./entry.js";
+import { _ as ensureAuthProfileStore } from "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import { S as shortenHomePath, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { c as writeConfigFile, i as loadConfig, o as readConfigFileSnapshot } from "./config-Bdhomfei.js";
+import { u as findTailscaleBinary } from "./auth-9x3lqfIY.js";
+import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-4Hqd1WGf.js";
+import { _ as randomToken, a as applyWizardMetadata, b as summarizeExistingConfig, c as ensureWorkspaceAndSessions, g as probeGatewayReachable, h as printWizardHeader, i as DEFAULT_WORKSPACE, p as normalizeGatewayTokenInput, u as guardCancel, v as resolveControlUiLinks, x as waitForGatewayReachable } from "./loader-KjT074JR.js";
+import { n as withProgress } from "./progress-DWqhRakV.js";
+import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-BFH5D5LN.js";
+import { t as note$1 } from "./note-hhtubr2j.js";
 import { t as WizardCancelledError } from "./prompts-CXLLIBwP.js";
-import { t as createClackPrompter } from "./clack-prompter-DuBVnTKy.js";
-import { n as setupChannels, t as noteChannelStatus } from "./onboard-channels-DxXvp8og.js";
-import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-c0uXH4Dl.js";
-import { t as resolveGatewayService } from "./service-DDPRbf8a.js";
-import { a as applyModelAllowlist, c as promptDefaultModel, f as applyAuthChoice, g as promptAuthChoiceGrouped, i as promptCustomApiConfig, l as promptModelAllowlist, o as applyModelFallbacksFromSelection, r as promptRemoteGatewayConfig, s as applyPrimaryModel, t as setupSkills, u as resolvePreferredProviderForAuthChoice } from "./onboard-skills-CBxsRGyf.js";
-import { l as healthCommand, n as ensureControlUiAssetsBuilt, t as formatHealthCheckFailure } from "./health-format-DrGFg8bx.js";
-import { n as logConfigUpdated } from "./logging-DuK6YXuK.js";
-import { t as ensureSystemdUserLingerInteractive } from "./systemd-linger-CDo2UbHM.js";
+import { t as createClackPrompter } from "./clack-prompter-ChCGXfyt.js";
+import { n as setupChannels, t as noteChannelStatus } from "./onboard-channels-C501x8GI.js";
+import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-B0tg_LsX.js";
+import { t as resolveGatewayService } from "./service-99RDXwX4.js";
+import { d as applyPrimaryModel, f as promptDefaultModel, g as applyAuthChoice, l as applyModelAllowlist, m as resolvePreferredProviderForAuthChoice, p as promptModelAllowlist, r as promptRemoteGatewayConfig, s as promptCustomApiConfig, t as setupSkills, u as applyModelFallbacksFromSelection, x as promptAuthChoiceGrouped } from "./onboard-skills-DV0Qzvjj.js";
+import { l as healthCommand, n as ensureControlUiAssetsBuilt, t as formatHealthCheckFailure } from "./health-format-LZDxu3rv.js";
+import { n as logConfigUpdated } from "./logging-CRq4h04P.js";
+import { t as ensureSystemdUserLingerInteractive } from "./systemd-linger-xdn3BdPh.js";
 import { confirm, intro, outro, select, text } from "@clack/prompts";
 
 //#region src/commands/configure.shared.ts
@@ -255,11 +255,14 @@ function buildGatewayAuthConfig(params) {
 	const allowTailscale = params.existing?.allowTailscale;
 	const base = {};
 	if (typeof allowTailscale === "boolean") base.allowTailscale = allowTailscale;
-	if (params.mode === "token") return {
-		...base,
-		mode: "token",
-		token: params.token
-	};
+	if (params.mode === "token") {
+		const safeToken = params.token?.trim() || randomToken();
+		return {
+			...base,
+			mode: "token",
+			token: safeToken
+		};
+	}
 	return {
 		...base,
 		mode: "password",
@@ -871,7 +874,7 @@ async function runConfigureWizard(opts, runtime = defaultRuntime) {
 		outro$1("Configure complete.");
 	} catch (err) {
 		if (err instanceof WizardCancelledError) {
-			runtime.exit(0);
+			runtime.exit(1);
 			return;
 		}
 		throw err;

package/dist/{configure-sMhpLzFf.js → configure-BYPqXzGZ.js}

@@ -1,25 +1,25 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as CONFIG_PATH, u as resolveGatewayPort } from "./paths-DVBShlw6.js";
-import { c as defaultRuntime } from "./subsystem-Bh1Y_6Uv.js";
-import { C as shortenHomePath, b as resolveUserPath } from "./utils-es4ygvQ-.js";
-import { At as probeGatewayReachable, Dt as normalizeGatewayTokenInput, Ft as waitForGatewayReachable, Mt as resolveControlUiLinks, Pt as summarizeExistingConfig, St as ensureWorkspaceAndSessions, jt as randomToken, kt as printWizardHeader, vt as DEFAULT_WORKSPACE, wt as guardCancel, yt as applyWizardMetadata } from "./reply--b7BsXGP.js";
-import { ht as ensureAuthProfileStore } from "./model-selection-BK7DuyH8.js";
+import { c as defaultRuntime } from "./subsystem-BoExtIHo.js";
+import { C as shortenHomePath, b as resolveUserPath } from "./utils-Cd9QdCHh.js";
+import { At as probeGatewayReachable, Dt as normalizeGatewayTokenInput, Ft as waitForGatewayReachable, Mt as resolveControlUiLinks, Pt as summarizeExistingConfig, St as ensureWorkspaceAndSessions, jt as randomToken, kt as printWizardHeader, vt as DEFAULT_WORKSPACE, wt as guardCancel, yt as applyWizardMetadata } from "./reply-DICXkh_C.js";
+import { ht as ensureAuthProfileStore } from "./model-selection-BLuqsGVB.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { c as writeConfigFile, i as loadConfig, o as readConfigFileSnapshot } from "./config--NUdpACy.js";
-import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-CNaHNND_.js";
-import { n as withProgress } from "./progress-DIQJt9Va.js";
-import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-CjQRlDx4.js";
-import { a as findTailscaleBinary } from "./tailscale-Cu-2HNvU.js";
-import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-UsK-tOty.js";
-import { n as logConfigUpdated } from "./logging-MMRGFxGI.js";
-import { t as note$1 } from "./note-5WqioBRA.js";
-import { t as WizardCancelledError } from "./prompts--d-6l5Ln.js";
-import { t as createClackPrompter } from "./clack-prompter-BCiBkJVr.js";
-import { _ as promptAuthChoiceGrouped, a as promptCustomApiConfig, c as applyPrimaryModel, d as resolvePreferredProviderForAuthChoice, l as promptDefaultModel, o as applyModelAllowlist, p as applyAuthChoice, r as promptRemoteGatewayConfig, s as applyModelFallbacksFromSelection, t as setupSkills, u as promptModelAllowlist } from "./onboard-skills-DQwOQ6Ry.js";
-import { n as setupChannels, t as noteChannelStatus } from "./onboard-channels-CXhnVy4E.js";
-import { l as healthCommand, n as ensureControlUiAssetsBuilt, t as formatHealthCheckFailure } from "./health-format-Dy1caGsq.js";
-import { t as resolveGatewayService } from "./service-Cd4BxKuo.js";
-import { t as ensureSystemdUserLingerInteractive } from "./systemd-linger-BxjTrgoH.js";
+import { c as writeConfigFile, i as loadConfig, o as readConfigFileSnapshot } from "./config-aFQssWKX.js";
+import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-X7d_tfTE.js";
+import { n as withProgress } from "./progress-C9kngsTD.js";
+import { n as stylePromptMessage, r as stylePromptTitle, t as stylePromptHint } from "./prompt-style-CIbmaxSa.js";
+import { u as findTailscaleBinary } from "./auth-CQNl_IaI.js";
+import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-Bsjeut6m.js";
+import { n as logConfigUpdated } from "./logging-BAyPwvdH.js";
+import { t as note$1 } from "./note-BhRSeNeu.js";
+import { t as WizardCancelledError } from "./prompts-Bg96reub.js";
+import { t as createClackPrompter } from "./clack-prompter-Bz3Mmcl-.js";
+import { S as promptAuthChoiceGrouped, _ as applyAuthChoice, c as promptCustomApiConfig, d as applyModelFallbacksFromSelection, f as applyPrimaryModel, h as resolvePreferredProviderForAuthChoice, m as promptModelAllowlist, p as promptDefaultModel, r as promptRemoteGatewayConfig, t as setupSkills, u as applyModelAllowlist } from "./onboard-skills-rlBHcu3Q.js";
+import { n as setupChannels, t as noteChannelStatus } from "./onboard-channels-Dxzroasd.js";
+import { l as healthCommand, n as ensureControlUiAssetsBuilt, t as formatHealthCheckFailure } from "./health-format-KGPokKJH.js";
+import { t as resolveGatewayService } from "./service--nPk7DvT.js";
+import { t as ensureSystemdUserLingerInteractive } from "./systemd-linger-NC2kl1SC.js";
 import { confirm, intro, outro, select, text } from "@clack/prompts";
 
 //#region src/commands/configure.shared.ts
@@ -256,11 +256,14 @@ function buildGatewayAuthConfig(params) {
 	const allowTailscale = params.existing?.allowTailscale;
 	const base = {};
 	if (typeof allowTailscale === "boolean") base.allowTailscale = allowTailscale;
-	if (params.mode === "token") return {
-		...base,
-		mode: "token",
-		token: params.token
-	};
+	if (params.mode === "token") {
+		const safeToken = params.token?.trim() || randomToken();
+		return {
+			...base,
+			mode: "token",
+			token: safeToken
+		};
+	}
 	return {
 		...base,
 		mode: "password",
@@ -872,7 +875,7 @@ async function runConfigureWizard(opts, runtime = defaultRuntime) {
 		outro$1("Configure complete.");
 	} catch (err) {
 		if (err instanceof WizardCancelledError) {
-			runtime.exit(0);
+			runtime.exit(1);
 			return;
 		}
 		throw err;