activeclaw 2026.2.12 → 2026.2.13

package/dist/{onboard-skills-DoxkpnEU.js → onboard-skills-DV0Qzvjj.js}

@@ -1,18 +1,18 @@
-import { C as buildAllowedModelSet, M as resolveAllowlistModelKey, N as resolveConfiguredModelRef, O as modelKey, S as resolveOpenClawAgentDir, T as buildModelAliasIndex, Tt as DEFAULT_PROVIDER, Y as VENICE_DEFAULT_MODEL_REF, _ as ensureAuthProfileStore, bt as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, c as CHUTES_AUTHORIZE_ENDPOINT, d as parseOAuthCallbackInput, g as upsertAuthProfile, k as normalizeProviderId, l as exchangeChutesCodeForTokens, n as resolveAuthProfileOrder, nt as SYNTHETIC_DEFAULT_MODEL_REF, ot as getCustomProviderApiKey, p as listProfilesForProvider, pt as normalizeSecretInput, u as generateChutesPkce, ut as resolveEnvApiKey, wt as DEFAULT_MODEL } from "./auth-profiles-CcJ3hrog.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import { c as escapeRegExp, g as resolveConfigDir, s as ensureDir, t as CONFIG_DIR, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
-import { a as resolveAgentModelPrimary, c as resolveDefaultAgentId, r as resolveAgentDir, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-RCSw6gHy.js";
-import { t as resolveBrewExecutable } from "./brew-BIrWdDps.js";
-import { m as openUrl, o as detectBinary, y as resolveNodeManagerOptions } from "./loader-Caow9TPA.js";
-import { a as enablePluginInConfig } from "./onboard-channels-DMcOT0dj.js";
-import { t as scanDirectoryWithSummary } from "./skill-scanner-C_fQzVDu.js";
-import { i as fetchWithSsrFGuard, t as fetchWithTimeout } from "./fetch-timeout-B2KlHXi3.js";
-import { _ as resolveSkillKey, d as hasBinary, i as loadWorkspaceSkillEntries, t as resolveSkillsInstallPreferences } from "./skills-BvPUNjxo.js";
-import { _ as loadModelCatalog } from "./runner-C1G8RFWl.js";
-import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-WVCWJTEb.js";
-import { $ as setAnthropicApiKey, A as applyOpenrouterProviderConfig, B as applyVercelAiGatewayProviderConfig, C as applyLitellmConfig, Ct as ZAI_CODING_GLOBAL_BASE_URL, D as applyMoonshotProviderConfig, E as applyMoonshotConfigCn, Et as validateAnthropicSetupToken, F as applyTogetherConfig, G as applyZaiConfig, H as applyXaiProviderConfig, I as applyTogetherProviderConfig, J as OPENROUTER_DEFAULT_MODEL_REF, K as applyZaiProviderConfig, L as applyVeniceConfig, M as applyQianfanProviderConfig, N as applySyntheticConfig, O as applyMoonshotProviderConfigCn, P as applySyntheticProviderConfig, Q as ZAI_DEFAULT_MODEL_REF, R as applyVeniceProviderConfig, S as applyKimiCodeProviderConfig, St as ZAI_CODING_CN_BASE_URL, T as applyMoonshotConfig, Tt as buildTokenProfileId, U as applyXiaomiConfig, V as applyXaiConfig, W as applyXiaomiProviderConfig, X as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, Y as TOGETHER_DEFAULT_MODEL_REF, Z as XIAOMI_DEFAULT_MODEL_REF, _ as applyMinimaxProviderConfig, _t as KIMI_CODING_MODEL_REF, a as normalizeAlias, at as setMoonshotApiKey, b as applyCloudflareAiGatewayProviderConfig, bt as XAI_DEFAULT_MODEL_REF, ct as setQianfanApiKey, d as resolvePluginProviders, dt as setVeniceApiKey, et as setCloudflareAiGatewayConfig, f as applyOpencodeZenConfig, ft as setVercelAiGatewayApiKey, g as applyMinimaxConfig, gt as writeOAuthCredentials, h as applyMinimaxApiProviderConfig, ht as setZaiApiKey, i as formatTokenK, it as setMinimaxApiKey, j as applyQianfanConfig, k as applyOpenrouterConfig, l as createVpsAwareOAuthHandlers, lt as setSyntheticApiKey, m as applyMinimaxApiConfig, mt as setXiaomiApiKey, nt as setKimiCodingApiKey, ot as setOpencodeZenApiKey, p as applyOpencodeZenProviderConfig, pt as setXaiApiKey, q as LITELLM_DEFAULT_MODEL_REF, rt as setLitellmApiKey, st as setOpenrouterApiKey, t as githubCopilotLoginCommand, tt as setGeminiApiKey, u as isRemoteEnvironment, ut as setTogetherApiKey, v as applyAuthProfileConfig, vt as MOONSHOT_DEFAULT_MODEL_REF, w as applyLitellmProviderConfig, wt as ZAI_GLOBAL_BASE_URL, x as applyKimiCodeConfig, xt as ZAI_CN_BASE_URL, y as applyCloudflareAiGatewayConfig, yt as QIANFAN_DEFAULT_MODEL_REF, z as applyVercelAiGatewayConfig } from "./github-copilot-auth-Cm2SB8Qf.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-DJDaA2Ur.js";
+import { C as buildAllowedModelSet, M as resolveAllowlistModelKey, N as resolveConfiguredModelRef, O as modelKey, S as resolveOpenClawAgentDir, T as buildModelAliasIndex, Tt as DEFAULT_PROVIDER, Y as VENICE_DEFAULT_MODEL_REF, _ as ensureAuthProfileStore, bt as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, c as CHUTES_AUTHORIZE_ENDPOINT, d as parseOAuthCallbackInput, g as upsertAuthProfile, k as normalizeProviderId, l as exchangeChutesCodeForTokens, n as resolveAuthProfileOrder, nt as SYNTHETIC_DEFAULT_MODEL_REF, ot as getCustomProviderApiKey, p as listProfilesForProvider, pt as normalizeSecretInput, u as generateChutesPkce, ut as resolveEnvApiKey, wt as DEFAULT_MODEL } from "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import { c as escapeRegExp, g as resolveConfigDir, s as ensureDir, t as CONFIG_DIR, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
+import { a as resolveAgentModelPrimary, c as resolveDefaultAgentId, r as resolveAgentDir, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-CsRbLH4l.js";
+import { t as resolveBrewExecutable } from "./brew-BUIxHEkn.js";
+import { m as openUrl, o as detectBinary, y as resolveNodeManagerOptions } from "./loader-KjT074JR.js";
+import { a as enablePluginInConfig } from "./onboard-channels-C501x8GI.js";
+import { t as scanDirectoryWithSummary } from "./skill-scanner-rHMtUHtP.js";
+import { i as fetchWithSsrFGuard, t as fetchWithTimeout } from "./fetch-timeout-DTK9vxex.js";
+import { b as resolveSkillKey, i as loadWorkspaceSkillEntries, m as hasBinary, t as resolveSkillsInstallPreferences } from "./skills-DRjfSQT3.js";
+import { _ as loadModelCatalog } from "./runner-CY0nmVme.js";
+import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-BaIgNEhY.js";
+import { $ as setAnthropicApiKey, A as applyOpenrouterProviderConfig, B as applyVercelAiGatewayProviderConfig, C as applyLitellmConfig, Ct as ZAI_CODING_GLOBAL_BASE_URL, D as applyMoonshotProviderConfig, E as applyMoonshotConfigCn, Et as validateAnthropicSetupToken, F as applyTogetherConfig, G as applyZaiConfig, H as applyXaiProviderConfig, I as applyTogetherProviderConfig, J as OPENROUTER_DEFAULT_MODEL_REF, K as applyZaiProviderConfig, L as applyVeniceConfig, M as applyQianfanProviderConfig, N as applySyntheticConfig, O as applyMoonshotProviderConfigCn, P as applySyntheticProviderConfig, Q as ZAI_DEFAULT_MODEL_REF, R as applyVeniceProviderConfig, S as applyKimiCodeProviderConfig, St as ZAI_CODING_CN_BASE_URL, T as applyMoonshotConfig, Tt as buildTokenProfileId, U as applyXiaomiConfig, V as applyXaiConfig, W as applyXiaomiProviderConfig, X as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, Y as TOGETHER_DEFAULT_MODEL_REF, Z as XIAOMI_DEFAULT_MODEL_REF, _ as applyMinimaxProviderConfig, _t as KIMI_CODING_MODEL_REF, a as normalizeAlias, at as setMoonshotApiKey, b as applyCloudflareAiGatewayProviderConfig, bt as XAI_DEFAULT_MODEL_REF, ct as setQianfanApiKey, d as resolvePluginProviders, dt as setVeniceApiKey, et as setCloudflareAiGatewayConfig, f as applyOpencodeZenConfig, ft as setVercelAiGatewayApiKey, g as applyMinimaxConfig, gt as writeOAuthCredentials, h as applyMinimaxApiProviderConfig, ht as setZaiApiKey, i as formatTokenK, it as setMinimaxApiKey, j as applyQianfanConfig, k as applyOpenrouterConfig, l as createVpsAwareOAuthHandlers, lt as setSyntheticApiKey, m as applyMinimaxApiConfig, mt as setXiaomiApiKey, nt as setKimiCodingApiKey, ot as setOpencodeZenApiKey, p as applyOpencodeZenProviderConfig, pt as setXaiApiKey, q as LITELLM_DEFAULT_MODEL_REF, rt as setLitellmApiKey, st as setOpenrouterApiKey, t as githubCopilotLoginCommand, tt as setGeminiApiKey, u as isRemoteEnvironment, ut as setTogetherApiKey, v as applyAuthProfileConfig, vt as MOONSHOT_DEFAULT_MODEL_REF, w as applyLitellmProviderConfig, wt as ZAI_GLOBAL_BASE_URL, x as applyKimiCodeConfig, xt as ZAI_CN_BASE_URL, y as applyCloudflareAiGatewayConfig, yt as QIANFAN_DEFAULT_MODEL_REF, z as applyVercelAiGatewayConfig } from "./github-copilot-auth-DDispnyz.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-TDIgVd1K.js";
 import path from "node:path";
 import fs from "node:fs";
 import { loginOpenAICodex } from "@mariozechner/pi-ai";
@@ -419,7 +419,7 @@ const AUTH_CHOICE_GROUP_DEFS = [
 	{
 		value: "minimax",
 		label: "MiniMax",
-		hint: "M2.1 (recommended)",
+		hint: "M2.5 (recommended)",
 		choices: [
 			"minimax-portal",
 			"minimax-api",
@@ -686,11 +686,11 @@ function buildAuthChoiceOptions(params) {
 	});
 	options.push({
 		value: "minimax-api",
-		label: "MiniMax M2.1"
+		label: "MiniMax M2.5"
 	});
 	options.push({
 		value: "minimax-api-lightning",
-		label: "MiniMax M2.1 Lightning",
+		label: "MiniMax M2.5 Lightning",
 		hint: "Faster, higher output cost"
 	});
 	options.push({
@@ -2072,7 +2072,7 @@ async function applyAuthChoiceMiniMax(params) {
 		label: "MiniMax"
 	});
 	if (params.authChoice === "minimax-cloud" || params.authChoice === "minimax-api" || params.authChoice === "minimax-api-lightning") {
-		const modelId = params.authChoice === "minimax-api-lightning" ? "MiniMax-M2.1-lightning" : "MiniMax-M2.1";
+		const modelId = params.authChoice === "minimax-api-lightning" ? "MiniMax-M2.5-Lightning" : "MiniMax-M2.5";
 		let hasCredential = false;
 		const envKey = resolveEnvApiKey("minimax");
 		if (envKey) {

package/dist/{onboard-skills-D-BrCoRN.js → onboard-skills-rlBHcu3Q.js}

@@ -1,18 +1,18 @@
-import { _ as resolveConfigDir, b as resolveUserPath, c as ensureDir, l as escapeRegExp, t as CONFIG_DIR } from "./utils-BHPdZE4h.js";
-import { Nt as resolveNodeManagerOptions, Ot as openUrl, bt as detectBinary } from "./reply-m467_fOC.js";
-import { t as runCommandWithTimeout } from "./exec-DXtR2fhb.js";
-import { a as resolveAgentModelPrimary, c as resolveDefaultAgentId, r as resolveAgentDir, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope---6LLHj0.js";
-import { D as VENICE_DEFAULT_MODEL_REF, Dt as DEFAULT_MODEL, H as resolveEnvApiKey, Ot as DEFAULT_PROVIDER, P as SYNTHETIC_DEFAULT_MODEL_REF, R as getCustomProviderApiKey, St as normalizeSecretInput, X as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, bt as resolveOpenClawAgentDir, ct as generateChutesPkce, d as resolveConfiguredModelRef, dt as listProfilesForProvider, et as resolveAuthProfileOrder, ht as ensureAuthProfileStore, lt as parseOAuthCallbackInput, mt as upsertAuthProfile, o as modelKey, ot as CHUTES_AUTHORIZE_ENDPOINT, r as buildModelAliasIndex, s as normalizeProviderId, st as exchangeChutesCodeForTokens, t as buildAllowedModelSet, u as resolveAllowlistModelKey } from "./model-selection-unMJyUIE.js";
+import { _ as resolveConfigDir, b as resolveUserPath, c as ensureDir, l as escapeRegExp, t as CONFIG_DIR } from "./utils-Cd9QdCHh.js";
+import { Nt as resolveNodeManagerOptions, Ot as openUrl, bt as detectBinary } from "./reply-DICXkh_C.js";
+import { t as runCommandWithTimeout } from "./exec-YIosokWE.js";
+import { a as resolveAgentModelPrimary, c as resolveDefaultAgentId, r as resolveAgentDir, s as resolveAgentWorkspaceDir, w as resolveDefaultAgentWorkspaceDir } from "./agent-scope-CQCus0rI.js";
+import { D as VENICE_DEFAULT_MODEL_REF, Dt as DEFAULT_MODEL, H as resolveEnvApiKey, Ot as DEFAULT_PROVIDER, P as SYNTHETIC_DEFAULT_MODEL_REF, R as getCustomProviderApiKey, St as normalizeSecretInput, X as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, bt as resolveOpenClawAgentDir, ct as generateChutesPkce, d as resolveConfiguredModelRef, dt as listProfilesForProvider, et as resolveAuthProfileOrder, ht as ensureAuthProfileStore, lt as parseOAuthCallbackInput, mt as upsertAuthProfile, o as modelKey, ot as CHUTES_AUTHORIZE_ENDPOINT, r as buildModelAliasIndex, s as normalizeProviderId, st as exchangeChutesCodeForTokens, t as buildAllowedModelSet, u as resolveAllowlistModelKey } from "./model-selection-BLuqsGVB.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { s as loadModelCatalog } from "./runner-CInKPsiP.js";
-import { _ as resolveSkillKey, d as hasBinary, i as loadWorkspaceSkillEntries, t as resolveSkillsInstallPreferences } from "./skills-aFOsriMP.js";
-import { i as fetchWithSsrFGuard, r as fetchWithTimeout } from "./fetch-CqZP8jwB.js";
-import { t as resolveBrewExecutable } from "./brew-6UyogeLe.js";
-import { $ as setAnthropicApiKey, A as applyOpenrouterProviderConfig, B as applyVercelAiGatewayProviderConfig, C as applyLitellmConfig, Ct as ZAI_CODING_GLOBAL_BASE_URL, D as applyMoonshotProviderConfig, E as applyMoonshotConfigCn, Et as validateAnthropicSetupToken, F as applyTogetherConfig, G as applyZaiConfig, H as applyXaiProviderConfig, I as applyTogetherProviderConfig, J as OPENROUTER_DEFAULT_MODEL_REF, K as applyZaiProviderConfig, L as applyVeniceConfig, M as applyQianfanProviderConfig, N as applySyntheticConfig, O as applyMoonshotProviderConfigCn, P as applySyntheticProviderConfig, Q as ZAI_DEFAULT_MODEL_REF, R as applyVeniceProviderConfig, S as applyKimiCodeProviderConfig, St as ZAI_CODING_CN_BASE_URL, T as applyMoonshotConfig, Tt as buildTokenProfileId, U as applyXiaomiConfig, V as applyXaiConfig, W as applyXiaomiProviderConfig, X as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, Y as TOGETHER_DEFAULT_MODEL_REF, Z as XIAOMI_DEFAULT_MODEL_REF, _ as applyMinimaxProviderConfig, _t as KIMI_CODING_MODEL_REF, a as normalizeAlias, at as setMoonshotApiKey, b as applyCloudflareAiGatewayProviderConfig, bt as XAI_DEFAULT_MODEL_REF, ct as setQianfanApiKey, d as resolvePluginProviders, dt as setVeniceApiKey, et as setCloudflareAiGatewayConfig, f as applyOpencodeZenConfig, ft as setVercelAiGatewayApiKey, g as applyMinimaxConfig, gt as writeOAuthCredentials, h as applyMinimaxApiProviderConfig, ht as setZaiApiKey, i as formatTokenK, it as setMinimaxApiKey, j as applyQianfanConfig, k as applyOpenrouterConfig, l as createVpsAwareOAuthHandlers, lt as setSyntheticApiKey, m as applyMinimaxApiConfig, mt as setXiaomiApiKey, nt as setKimiCodingApiKey, ot as setOpencodeZenApiKey, p as applyOpencodeZenProviderConfig, pt as setXaiApiKey, q as LITELLM_DEFAULT_MODEL_REF, rt as setLitellmApiKey, st as setOpenrouterApiKey, t as githubCopilotLoginCommand, tt as setGeminiApiKey, u as isRemoteEnvironment, ut as setTogetherApiKey, v as applyAuthProfileConfig, vt as MOONSHOT_DEFAULT_MODEL_REF, w as applyLitellmProviderConfig, wt as ZAI_GLOBAL_BASE_URL, x as applyKimiCodeConfig, xt as ZAI_CN_BASE_URL, y as applyCloudflareAiGatewayConfig, yt as QIANFAN_DEFAULT_MODEL_REF, z as applyVercelAiGatewayConfig } from "./github-copilot-auth-B3chCDfc.js";
-import { a as enablePluginInConfig } from "./onboard-channels-CsT3E4bT.js";
-import { t as scanDirectoryWithSummary } from "./skill-scanner-CprFkZib.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-D4vbIMnz.js";
-import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-BWYPcfby.js";
+import { s as loadModelCatalog } from "./runner-D_dujMod.js";
+import { b as resolveSkillKey, i as loadWorkspaceSkillEntries, m as hasBinary, t as resolveSkillsInstallPreferences } from "./skills-DprQj9X2.js";
+import { i as fetchWithSsrFGuard, r as fetchWithTimeout } from "./fetch-DmiOpALK.js";
+import { t as resolveBrewExecutable } from "./brew-ROHf0-Xp.js";
+import { $ as setAnthropicApiKey, A as applyOpenrouterProviderConfig, B as applyVercelAiGatewayProviderConfig, C as applyLitellmConfig, Ct as ZAI_CODING_GLOBAL_BASE_URL, D as applyMoonshotProviderConfig, E as applyMoonshotConfigCn, Et as validateAnthropicSetupToken, F as applyTogetherConfig, G as applyZaiConfig, H as applyXaiProviderConfig, I as applyTogetherProviderConfig, J as OPENROUTER_DEFAULT_MODEL_REF, K as applyZaiProviderConfig, L as applyVeniceConfig, M as applyQianfanProviderConfig, N as applySyntheticConfig, O as applyMoonshotProviderConfigCn, P as applySyntheticProviderConfig, Q as ZAI_DEFAULT_MODEL_REF, R as applyVeniceProviderConfig, S as applyKimiCodeProviderConfig, St as ZAI_CODING_CN_BASE_URL, T as applyMoonshotConfig, Tt as buildTokenProfileId, U as applyXiaomiConfig, V as applyXaiConfig, W as applyXiaomiProviderConfig, X as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, Y as TOGETHER_DEFAULT_MODEL_REF, Z as XIAOMI_DEFAULT_MODEL_REF, _ as applyMinimaxProviderConfig, _t as KIMI_CODING_MODEL_REF, a as normalizeAlias, at as setMoonshotApiKey, b as applyCloudflareAiGatewayProviderConfig, bt as XAI_DEFAULT_MODEL_REF, ct as setQianfanApiKey, d as resolvePluginProviders, dt as setVeniceApiKey, et as setCloudflareAiGatewayConfig, f as applyOpencodeZenConfig, ft as setVercelAiGatewayApiKey, g as applyMinimaxConfig, gt as writeOAuthCredentials, h as applyMinimaxApiProviderConfig, ht as setZaiApiKey, i as formatTokenK, it as setMinimaxApiKey, j as applyQianfanConfig, k as applyOpenrouterConfig, l as createVpsAwareOAuthHandlers, lt as setSyntheticApiKey, m as applyMinimaxApiConfig, mt as setXiaomiApiKey, nt as setKimiCodingApiKey, ot as setOpencodeZenApiKey, p as applyOpencodeZenProviderConfig, pt as setXaiApiKey, q as LITELLM_DEFAULT_MODEL_REF, rt as setLitellmApiKey, st as setOpenrouterApiKey, t as githubCopilotLoginCommand, tt as setGeminiApiKey, u as isRemoteEnvironment, ut as setTogetherApiKey, v as applyAuthProfileConfig, vt as MOONSHOT_DEFAULT_MODEL_REF, w as applyLitellmProviderConfig, wt as ZAI_GLOBAL_BASE_URL, x as applyKimiCodeConfig, xt as ZAI_CN_BASE_URL, y as applyCloudflareAiGatewayConfig, yt as QIANFAN_DEFAULT_MODEL_REF, z as applyVercelAiGatewayConfig } from "./github-copilot-auth-D7ewvpMd.js";
+import { a as enablePluginInConfig } from "./onboard-channels-Dxzroasd.js";
+import { t as scanDirectoryWithSummary } from "./skill-scanner-CucvxYhu.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-5U3P3YfJ.js";
+import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-DzuRdwk5.js";
 import fs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
@@ -38,7 +38,7 @@ const AUTH_CHOICE_GROUP_DEFS = [
 	{
 		value: "minimax",
 		label: "MiniMax",
-		hint: "M2.1 (recommended)",
+		hint: "M2.5 (recommended)",
 		choices: [
 			"minimax-portal",
 			"minimax-api",
@@ -305,11 +305,11 @@ function buildAuthChoiceOptions(params) {
 	});
 	options.push({
 		value: "minimax-api",
-		label: "MiniMax M2.1"
+		label: "MiniMax M2.5"
 	});
 	options.push({
 		value: "minimax-api-lightning",
-		label: "MiniMax M2.1 Lightning",
+		label: "MiniMax M2.5 Lightning",
 		hint: "Faster, higher output cost"
 	});
 	options.push({
@@ -1691,7 +1691,7 @@ async function applyAuthChoiceMiniMax(params) {
 		label: "MiniMax"
 	});
 	if (params.authChoice === "minimax-cloud" || params.authChoice === "minimax-api" || params.authChoice === "minimax-api-lightning") {
-		const modelId = params.authChoice === "minimax-api-lightning" ? "MiniMax-M2.1-lightning" : "MiniMax-M2.1";
+		const modelId = params.authChoice === "minimax-api-lightning" ? "MiniMax-M2.5-Lightning" : "MiniMax-M2.5";
 		let hasCredential = false;
 		const envKey = resolveEnvApiKey("minimax");
 		if (envKey) {

package/dist/{onboarding-B92952fz.js → onboarding-CN-EDLjd.js}

@@ -1,43 +1,43 @@
 import { n as DEFAULT_GATEWAY_PORT, u as resolveGatewayPort } from "./paths-DVBShlw6.js";
-import { D as info, L as isRich, R as theme, c as defaultRuntime, l as restoreTerminalState } from "./subsystem-Bv7dGhES.js";
-import { b as resolveUserPath, g as pathExists, w as sleep } from "./utils-BHPdZE4h.js";
-import { At as probeGatewayReachable, Bt as getRemoteSkillEligibility, Ct as formatControlUiSshHint, Dt as normalizeGatewayTokenInput, Ft as waitForGatewayReachable, J as summarizeRestartSentinel, Mt as resolveControlUiLinks, Ot as openUrl, Pt as summarizeExistingConfig, Rt as normalizeControlUiBasePath, Sr as lookupContextTokens, St as ensureWorkspaceAndSessions, Tt as handleReset, Vn as getMemorySearchManager, a as buildChannelSummary, dt as loadProviderUsageSummary, f as sha256HexPrefix, ft as formatUsageReportLines, h as listAgentsForGateway, jt as randomToken, kr as peekSystemEvents, kt as printWizardHeader, q as readRestartSentinel, vt as DEFAULT_WORKSPACE, xt as detectBrowserOpenSupport, yt as applyWizardMetadata } from "./reply-m467_fOC.js";
+import { D as info, L as isRich, R as theme, c as defaultRuntime, l as restoreTerminalState } from "./subsystem-BoExtIHo.js";
+import { b as resolveUserPath, g as pathExists, w as sleep } from "./utils-Cd9QdCHh.js";
+import { At as probeGatewayReachable, Bt as getRemoteSkillEligibility, Ct as formatControlUiSshHint, Dt as normalizeGatewayTokenInput, Ft as waitForGatewayReachable, J as summarizeRestartSentinel, Mt as resolveControlUiLinks, Ot as openUrl, Pt as summarizeExistingConfig, Rt as normalizeControlUiBasePath, Sr as lookupContextTokens, St as ensureWorkspaceAndSessions, Tt as handleReset, Vn as getMemorySearchManager, a as buildChannelSummary, dt as loadProviderUsageSummary, f as sha256HexPrefix, ft as formatUsageReportLines, h as listAgentsForGateway, jt as randomToken, kr as peekSystemEvents, kt as printWizardHeader, q as readRestartSentinel, vt as DEFAULT_WORKSPACE, xt as detectBrowserOpenSupport, yt as applyWizardMetadata } from "./reply-DICXkh_C.js";
 import { l as normalizeAgentId, y as parseAgentSessionKey } from "./session-key-BWxPj0z_.js";
-import { n as runExec } from "./exec-DXtR2fhb.js";
+import { n as runExec } from "./exec-YIosokWE.js";
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-1VeFrph_.js";
-import { c as resolveDefaultAgentId, h as DEFAULT_IDENTITY_FILENAME, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir } from "./agent-scope---6LLHj0.js";
-import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, d as resolveConfiguredModelRef, ht as ensureAuthProfileStore } from "./model-selection-unMJyUIE.js";
+import { c as resolveDefaultAgentId, h as DEFAULT_IDENTITY_FILENAME, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir } from "./agent-scope-CQCus0rI.js";
+import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, d as resolveConfiguredModelRef, ht as ensureAuthProfileStore } from "./model-selection-BLuqsGVB.js";
 import { r as resolveCliName, t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { M as VERSION, c as writeConfigFile, i as loadConfig, o as readConfigFileSnapshot } from "./config-DH9TLUNc.js";
-import { n as listChannelPlugins } from "./plugins-BL9lIXSA.js";
-import { L as resolveMainSessionKey, d as loadSessionStore } from "./sandbox-BW8Xnkw1.js";
-import { d as inspectPortUsage, f as resolveLsofCommandSync, p as formatPortDiagnostics } from "./chrome-juQxt0zf.js";
-import { o as resolveStorePath } from "./paths-RITJT4UY.js";
-import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-C9az806y.js";
+import { M as VERSION, c as writeConfigFile, i as loadConfig, o as readConfigFileSnapshot } from "./config-aFQssWKX.js";
+import { n as listChannelPlugins } from "./plugins-X7d_tfTE.js";
+import { L as resolveMainSessionKey, d as loadSessionStore } from "./sandbox-Bhjnh1Xg.js";
+import { d as inspectPortUsage, f as resolveLsofCommandSync, p as formatPortDiagnostics } from "./chrome-Cvr-57lg.js";
+import { s as resolveStorePath } from "./paths-B49s6UZQ.js";
+import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-SolyGS1r.js";
 import { r as formatDurationPrecise } from "./format-duration-84n6_DgO.js";
 import { n as formatTimeAgo } from "./format-relative-cegC_FF5.js";
-import { n as withProgress } from "./progress-g9R--HZD.js";
-import { a as findTailscaleBinary, o as getTailnetHostname, s as readTailscaleStatusJson } from "./tailscale-DHfcfRCx.js";
-import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-B05PME1z.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-BDvtkJjw.js";
-import { n as logConfigUpdated } from "./logging-CeHn2itV.js";
-import { t as WizardCancelledError } from "./prompts-BOz5176z.js";
-import { S as promptAuthChoiceGrouped, _ as applyAuthChoice, c as promptCustomApiConfig, f as applyPrimaryModel, g as warnIfModelConfigLooksOff, h as resolvePreferredProviderForAuthChoice, p as promptDefaultModel, r as promptRemoteGatewayConfig, t as setupSkills } from "./onboard-skills-D-BrCoRN.js";
-import { n as setupChannels } from "./onboard-channels-CsT3E4bT.js";
-import { l as healthCommand, n as ensureControlUiAssetsBuilt, s as formatHealthChannelLines, t as formatHealthCheckFailure, u as resolveHeartbeatSummaryForAgent } from "./health-format-C0C_Apce.js";
-import { C as resolveEffectiveUpdateChannel, S as normalizeUpdateChannel, d as formatUpdateOneLiner, f as getUpdateCheckResult, h as compareSemverStrings, l as ensureCompletionCacheExists, m as checkUpdateStatus, p as resolveUpdateAvailability, s as checkShellCompletionStatus, u as formatUpdateAvailableHint, x as formatUpdateChannelLabel } from "./update-runner-C_FDpmA3.js";
-import { i as probeGateway, t as runSecurityAudit } from "./audit-CQzrm61N.js";
-import { t as renderTable } from "./table-DzBBIqHO.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-D4vbIMnz.js";
-import { o as resolveGatewayLogPaths, t as resolveGatewayService } from "./service-DZMXgMra.js";
-import { r as isSystemdUserServiceAvailable } from "./systemd-CUJJHgHa.js";
-import { o as readLastGatewayErrorLine } from "./service-audit-0WLGnoNT.js";
-import { t as resolveNodeService } from "./node-service-D_Cdq1JI.js";
-import { t as collectChannelStatusIssues } from "./channels-status-issues-CbULFg2X.js";
+import { n as withProgress } from "./progress-C9kngsTD.js";
+import { d as getTailnetHostname, f as readTailscaleStatusJson, u as findTailscaleBinary } from "./auth-CQNl_IaI.js";
+import { a as gatewayInstallErrorHint, i as buildGatewayInstallPlan, n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-Bsjeut6m.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-HyeZXsnu.js";
+import { n as logConfigUpdated } from "./logging-BAyPwvdH.js";
+import { t as WizardCancelledError } from "./prompts-Bg96reub.js";
+import { S as promptAuthChoiceGrouped, _ as applyAuthChoice, c as promptCustomApiConfig, f as applyPrimaryModel, g as warnIfModelConfigLooksOff, h as resolvePreferredProviderForAuthChoice, p as promptDefaultModel, r as promptRemoteGatewayConfig, t as setupSkills } from "./onboard-skills-rlBHcu3Q.js";
+import { n as setupChannels } from "./onboard-channels-Dxzroasd.js";
+import { l as healthCommand, n as ensureControlUiAssetsBuilt, s as formatHealthChannelLines, t as formatHealthCheckFailure, u as resolveHeartbeatSummaryForAgent } from "./health-format-KGPokKJH.js";
+import { C as resolveEffectiveUpdateChannel, S as normalizeUpdateChannel, d as formatUpdateOneLiner, f as getUpdateCheckResult, h as compareSemverStrings, l as ensureCompletionCacheExists, m as checkUpdateStatus, p as resolveUpdateAvailability, s as checkShellCompletionStatus, u as formatUpdateAvailableHint, x as formatUpdateChannelLabel } from "./update-runner-7Qa1T9y6.js";
+import { i as probeGateway, t as runSecurityAudit } from "./audit-Dmww_503.js";
+import { t as renderTable } from "./table-B8dx3v4v.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-5U3P3YfJ.js";
+import { o as resolveGatewayLogPaths, t as resolveGatewayService } from "./service--nPk7DvT.js";
+import { r as isSystemdUserServiceAvailable } from "./systemd-DrmBtJ5T.js";
+import { o as readLastGatewayErrorLine } from "./service-audit-DnLmRGQt.js";
+import { t as resolveNodeService } from "./node-service-C8DTHTMg.js";
+import { t as collectChannelStatusIssues } from "./channels-status-issues-DDAWeT-6.js";
 import { n as redactSecrets, t as formatGatewayAuthUsed } from "./format-DcfK-dwd.js";
-import { r as installCompletion } from "./completion-cli-DECEgBWR.js";
-import { t as buildWorkspaceHookStatus } from "./hooks-status--xVLpAXz.js";
-import { t as runTui } from "./tui-nGp8ltQK.js";
+import { r as installCompletion } from "./completion-cli-DnjpxAag.js";
+import { t as buildWorkspaceHookStatus } from "./hooks-status-D9MhwHRp.js";
+import { t as runTui } from "./tui-CVTQn-dC.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -2535,7 +2535,7 @@ async function finalizeOnboardingWizard(options) {
 	const systemdAvailable = process.platform === "linux" ? await isSystemdUserServiceAvailable() : true;
 	if (process.platform === "linux" && !systemdAvailable) await prompter.note("Systemd user services are unavailable. Skipping lingering checks and service install.", "Systemd");
 	if (process.platform === "linux" && systemdAvailable) {
-		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-XvT9Y9sb.js").then((n) => n.r);
+		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-NC2kl1SC.js").then((n) => n.r);
 		await ensureSystemdUserLingerInteractive({
 			runtime,
 			prompter: {

package/dist/{pairing-cli-BDUJ5VoX.js → pairing-cli-CDHG4xuI.js}

@@ -1,19 +1,19 @@
-import { k as theme, p as defaultRuntime } from "./entry.js";
-import "./auth-profiles-CcJ3hrog.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
-import "./utils-Dk86IbEs.js";
-import "./exec-B8JKbXKW.js";
-import "./agent-scope-RCSw6gHy.js";
-import "./github-copilot-token-SLWintYd.js";
-import { i as loadConfig } from "./config-B7sno9eI.js";
-import "./manifest-registry-BTgLN_W2.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
-import { r as normalizeChannelId } from "./plugins-3GyCj5KL.js";
+import { A as theme, p as defaultRuntime } from "./entry.js";
+import "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
+import "./utils-BLJAc3ZV.js";
+import "./exec-CACT5OAW.js";
+import "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
+import { i as loadConfig } from "./config-Bdhomfei.js";
+import "./manifest-registry-u0okVSkU.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
+import { r as normalizeChannelId } from "./plugins-4Hqd1WGf.js";
 import "./logging-CfEk_PnX.js";
-import "./accounts-DbzMEfKN.js";
-import { c as listPairingChannels, l as notifyPairingApproved, n as approveChannelPairingCode, r as listChannelPairingRequests } from "./pairing-store-fIWI3pXG.js";
-import { t as resolvePairingIdLabel } from "./pairing-labels-Bin1K7_f.js";
-import { t as renderTable } from "./table-oJQPTUL6.js";
+import "./accounts-DCDeFTra.js";
+import { c as listPairingChannels, l as notifyPairingApproved, n as approveChannelPairingCode, r as listChannelPairingRequests } from "./pairing-store-Dp5_JGnG.js";
+import { t as resolvePairingIdLabel } from "./pairing-labels-CgNHnjzT.js";
+import { t as renderTable } from "./table-CwulTLQp.js";
 
 //#region src/cli/pairing-cli.ts
 /** Parse channel, allowing extension channels not in core registry. */

package/dist/{pairing-cli-0wbU1u8d.js → pairing-cli-CQP34Dlx.js}

@@ -1,22 +1,22 @@
 import "./paths-DVBShlw6.js";
-import { R as theme, c as defaultRuntime } from "./subsystem-Bv7dGhES.js";
-import "./utils-BHPdZE4h.js";
-import "./exec-DXtR2fhb.js";
-import "./agent-scope---6LLHj0.js";
-import "./model-selection-unMJyUIE.js";
+import { R as theme, c as defaultRuntime } from "./subsystem-BoExtIHo.js";
+import "./utils-Cd9QdCHh.js";
+import "./exec-YIosokWE.js";
+import "./agent-scope-CQCus0rI.js";
+import "./model-selection-BLuqsGVB.js";
 import "./github-copilot-token-BW-SEg7E.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
 import "./boolean-BgXe2hyu.js";
-import "./env-DE9xvYOL.js";
-import { i as loadConfig } from "./config-DH9TLUNc.js";
-import "./manifest-registry-DFckk-L8.js";
-import { r as normalizeChannelId } from "./plugins-BL9lIXSA.js";
+import "./env-ONzUVAG2.js";
+import { i as loadConfig } from "./config-aFQssWKX.js";
+import "./manifest-registry-CQhdnDBZ.js";
+import { r as normalizeChannelId } from "./plugins-X7d_tfTE.js";
 import "./logging-fywhKCmE.js";
-import "./accounts-DimKrt7j.js";
-import { c as listPairingChannels, l as notifyPairingApproved, n as approveChannelPairingCode, r as listChannelPairingRequests } from "./pairing-store-CL4rJ7m7.js";
-import { t as formatDocsLink } from "./links-CV4oki2u.js";
-import { t as resolvePairingIdLabel } from "./pairing-labels-3o3QO3Qn.js";
-import { t as renderTable } from "./table-DzBBIqHO.js";
+import "./accounts-DeqIQjo1.js";
+import { c as listPairingChannels, l as notifyPairingApproved, n as approveChannelPairingCode, r as listChannelPairingRequests } from "./pairing-store-CmlRVqOz.js";
+import { t as formatDocsLink } from "./links-Eax1UO3w.js";
+import { t as resolvePairingIdLabel } from "./pairing-labels-B6CN0SNH.js";
+import { t as renderTable } from "./table-B8dx3v4v.js";
 
 //#region src/cli/pairing-cli.ts
 /** Parse channel, allowing extension channels not in core registry. */

package/dist/{pairing-labels-3o3QO3Qn.js → pairing-labels-B6CN0SNH.js}

@@ -1,4 +1,4 @@
-import { s as getPairingAdapter } from "./pairing-store-CL4rJ7m7.js";
+import { s as getPairingAdapter } from "./pairing-store-CmlRVqOz.js";
 
 //#region src/pairing/pairing-labels.ts
 function resolvePairingIdLabel(channel) {

package/dist/{pairing-labels-Bin1K7_f.js → pairing-labels-CgNHnjzT.js}

@@ -1,4 +1,4 @@
-import { s as getPairingAdapter } from "./pairing-store-fIWI3pXG.js";
+import { s as getPairingAdapter } from "./pairing-store-Dp5_JGnG.js";
 
 //#region src/pairing/pairing-labels.ts
 function resolvePairingIdLabel(channel) {

package/dist/{pairing-store-CL4rJ7m7.js → pairing-store-CmlRVqOz.js}

@@ -1,6 +1,6 @@
 import { g as resolveStateDir, m as resolveOAuthDir, y as resolveRequiredHomeDir } from "./paths-DVBShlw6.js";
-import { x as safeParseJson } from "./utils-BHPdZE4h.js";
-import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-BL9lIXSA.js";
+import { x as safeParseJson } from "./utils-Cd9QdCHh.js";
+import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-X7d_tfTE.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";

package/dist/{pairing-store-fIWI3pXG.js → pairing-store-Dp5_JGnG.js}

@@ -1,6 +1,6 @@
-import { J as resolveOAuthDir, X as resolveStateDir, pt as resolveRequiredHomeDir } from "./entry.js";
-import { b as safeParseJson } from "./utils-Dk86IbEs.js";
-import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-3GyCj5KL.js";
+import { Y as resolveOAuthDir, Z as resolveStateDir, ht as resolveRequiredHomeDir } from "./entry.js";
+import { b as safeParseJson } from "./utils-BLJAc3ZV.js";
+import { n as listChannelPlugins, t as getChannelPlugin } from "./plugins-4Hqd1WGf.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";

package/dist/{path-env-CXWUFfFv.js → path-env-CLvYNwtL.js}

@@ -1,5 +1,5 @@
 import { n as isTruthyEnvValue } from "./entry.js";
-import { n as resolveBrewPathDirs } from "./brew-BIrWdDps.js";
+import { n as resolveBrewPathDirs } from "./brew-BUIxHEkn.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";

package/dist/{path-env-C5FR_Eay.js → path-env-CaYUVIML.js}

@@ -1,5 +1,5 @@
-import { t as isTruthyEnvValue } from "./env-DE9xvYOL.js";
-import { n as resolveBrewPathDirs } from "./brew-6UyogeLe.js";
+import { t as isTruthyEnvValue } from "./env-ONzUVAG2.js";
+import { n as resolveBrewPathDirs } from "./brew-ROHf0-Xp.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";

package/dist/{paths-DwKNqk_S.js → paths-B0a4ywSO.js}

@@ -1,5 +1,5 @@
 import { c as expandHomePrefix, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BZtyHNCi.js";
-import { M as normalizeAgentId, T as DEFAULT_AGENT_ID } from "./agent-scope-rXQ7WARN.js";
+import { M as normalizeAgentId, T as DEFAULT_AGENT_ID } from "./agent-scope-BIEhVP4_.js";
 import os from "node:os";
 import path from "node:path";
 
@@ -15,14 +15,39 @@ function resolveSessionTranscriptsDirForAgent(agentId, env = process.env, homedi
 function resolveDefaultSessionStorePath(agentId) {
 	return path.join(resolveAgentSessionsDir(agentId), "sessions.json");
 }
-function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+const SAFE_SESSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+function validateSessionId(sessionId) {
+	const trimmed = sessionId.trim();
+	if (!SAFE_SESSION_ID_RE.test(trimmed)) throw new Error(`Invalid session ID: ${sessionId}`);
+	return trimmed;
+}
+function resolveSessionsDir(opts) {
+	const sessionsDir = opts?.sessionsDir?.trim();
+	if (sessionsDir) return path.resolve(sessionsDir);
+	return resolveAgentSessionsDir(opts?.agentId);
+}
+function resolvePathWithinSessionsDir(sessionsDir, candidate) {
+	const trimmed = candidate.trim();
+	if (!trimmed) throw new Error("Session file path must not be empty");
+	const resolvedBase = path.resolve(sessionsDir);
+	const resolvedCandidate = path.resolve(resolvedBase, trimmed);
+	const relative = path.relative(resolvedBase, resolvedCandidate);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("Session file path must be within sessions directory");
+	return resolvedCandidate;
+}
+function resolveSessionTranscriptPathInDir(sessionId, sessionsDir, topicId) {
+	const safeSessionId = validateSessionId(sessionId);
 	const safeTopicId = typeof topicId === "string" ? encodeURIComponent(topicId) : typeof topicId === "number" ? String(topicId) : void 0;
-	const fileName = safeTopicId !== void 0 ? `${sessionId}-topic-${safeTopicId}.jsonl` : `${sessionId}.jsonl`;
-	return path.join(resolveAgentSessionsDir(agentId), fileName);
+	return resolvePathWithinSessionsDir(sessionsDir, safeTopicId !== void 0 ? `${safeSessionId}-topic-${safeTopicId}.jsonl` : `${safeSessionId}.jsonl`);
+}
+function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+	return resolveSessionTranscriptPathInDir(sessionId, resolveAgentSessionsDir(agentId), topicId);
 }
 function resolveSessionFilePath(sessionId, entry, opts) {
+	const sessionsDir = resolveSessionsDir(opts);
 	const candidate = entry?.sessionFile?.trim();
-	return candidate ? candidate : resolveSessionTranscriptPath(sessionId, opts?.agentId);
+	if (candidate) return resolvePathWithinSessionsDir(sessionsDir, candidate);
+	return resolveSessionTranscriptPathInDir(sessionId, sessionsDir);
 }
 function resolveStorePath(store, opts) {
 	const agentId = normalizeAgentId(opts?.agentId ?? DEFAULT_AGENT_ID);

package/dist/{paths-RITJT4UY.js → paths-B49s6UZQ.js}

@@ -18,14 +18,39 @@ function resolveSessionTranscriptsDirForAgent(agentId, env = process.env, homedi
 function resolveDefaultSessionStorePath(agentId) {
 	return path.join(resolveAgentSessionsDir(agentId), "sessions.json");
 }
-function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+const SAFE_SESSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+function validateSessionId(sessionId) {
+	const trimmed = sessionId.trim();
+	if (!SAFE_SESSION_ID_RE.test(trimmed)) throw new Error(`Invalid session ID: ${sessionId}`);
+	return trimmed;
+}
+function resolveSessionsDir(opts) {
+	const sessionsDir = opts?.sessionsDir?.trim();
+	if (sessionsDir) return path.resolve(sessionsDir);
+	return resolveAgentSessionsDir(opts?.agentId);
+}
+function resolvePathWithinSessionsDir(sessionsDir, candidate) {
+	const trimmed = candidate.trim();
+	if (!trimmed) throw new Error("Session file path must not be empty");
+	const resolvedBase = path.resolve(sessionsDir);
+	const resolvedCandidate = path.resolve(resolvedBase, trimmed);
+	const relative = path.relative(resolvedBase, resolvedCandidate);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("Session file path must be within sessions directory");
+	return resolvedCandidate;
+}
+function resolveSessionTranscriptPathInDir(sessionId, sessionsDir, topicId) {
+	const safeSessionId = validateSessionId(sessionId);
 	const safeTopicId = typeof topicId === "string" ? encodeURIComponent(topicId) : typeof topicId === "number" ? String(topicId) : void 0;
-	const fileName = safeTopicId !== void 0 ? `${sessionId}-topic-${safeTopicId}.jsonl` : `${sessionId}.jsonl`;
-	return path.join(resolveAgentSessionsDir(agentId), fileName);
+	return resolvePathWithinSessionsDir(sessionsDir, safeTopicId !== void 0 ? `${safeSessionId}-topic-${safeTopicId}.jsonl` : `${safeSessionId}.jsonl`);
+}
+function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+	return resolveSessionTranscriptPathInDir(sessionId, resolveAgentSessionsDir(agentId), topicId);
 }
 function resolveSessionFilePath(sessionId, entry, opts) {
+	const sessionsDir = resolveSessionsDir(opts);
 	const candidate = entry?.sessionFile?.trim();
-	return candidate ? candidate : resolveSessionTranscriptPath(sessionId, opts?.agentId);
+	if (candidate) return resolvePathWithinSessionsDir(sessionsDir, candidate);
+	return resolveSessionTranscriptPathInDir(sessionId, sessionsDir);
 }
 function resolveStorePath(store, opts) {
 	const agentId = normalizeAgentId(opts?.agentId ?? DEFAULT_AGENT_ID);
@@ -48,4 +73,4 @@ function resolveStorePath(store, opts) {
 }
 
 //#endregion
-export { resolveSessionTranscriptsDirForAgent as a, resolveSessionTranscriptsDir as i, resolveSessionFilePath as n, resolveStorePath as o, resolveSessionTranscriptPath as r, resolveDefaultSessionStorePath as t };
+export { resolveSessionTranscriptsDir as a, resolveSessionTranscriptPathInDir as i, resolveSessionFilePath as n, resolveSessionTranscriptsDirForAgent as o, resolveSessionTranscriptPath as r, resolveStorePath as s, resolveDefaultSessionStorePath as t };

package/dist/{paths-CB2fqqbX.js → paths-D0O87MfH.js}

@@ -1,5 +1,5 @@
 import { c as expandHomePrefix, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-rb94mUrR.js";
-import { M as normalizeAgentId, T as DEFAULT_AGENT_ID } from "./agent-scope-CN8DM4Xb.js";
+import { M as normalizeAgentId, T as DEFAULT_AGENT_ID } from "./agent-scope-DPIFau3f.js";
 import path from "node:path";
 import os from "node:os";
 
@@ -15,14 +15,39 @@ function resolveSessionTranscriptsDirForAgent(agentId, env = process.env, homedi
 function resolveDefaultSessionStorePath(agentId) {
 	return path.join(resolveAgentSessionsDir(agentId), "sessions.json");
 }
-function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+const SAFE_SESSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+function validateSessionId(sessionId) {
+	const trimmed = sessionId.trim();
+	if (!SAFE_SESSION_ID_RE.test(trimmed)) throw new Error(`Invalid session ID: ${sessionId}`);
+	return trimmed;
+}
+function resolveSessionsDir(opts) {
+	const sessionsDir = opts?.sessionsDir?.trim();
+	if (sessionsDir) return path.resolve(sessionsDir);
+	return resolveAgentSessionsDir(opts?.agentId);
+}
+function resolvePathWithinSessionsDir(sessionsDir, candidate) {
+	const trimmed = candidate.trim();
+	if (!trimmed) throw new Error("Session file path must not be empty");
+	const resolvedBase = path.resolve(sessionsDir);
+	const resolvedCandidate = path.resolve(resolvedBase, trimmed);
+	const relative = path.relative(resolvedBase, resolvedCandidate);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("Session file path must be within sessions directory");
+	return resolvedCandidate;
+}
+function resolveSessionTranscriptPathInDir(sessionId, sessionsDir, topicId) {
+	const safeSessionId = validateSessionId(sessionId);
 	const safeTopicId = typeof topicId === "string" ? encodeURIComponent(topicId) : typeof topicId === "number" ? String(topicId) : void 0;
-	const fileName = safeTopicId !== void 0 ? `${sessionId}-topic-${safeTopicId}.jsonl` : `${sessionId}.jsonl`;
-	return path.join(resolveAgentSessionsDir(agentId), fileName);
+	return resolvePathWithinSessionsDir(sessionsDir, safeTopicId !== void 0 ? `${safeSessionId}-topic-${safeTopicId}.jsonl` : `${safeSessionId}.jsonl`);
+}
+function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+	return resolveSessionTranscriptPathInDir(sessionId, resolveAgentSessionsDir(agentId), topicId);
 }
 function resolveSessionFilePath(sessionId, entry, opts) {
+	const sessionsDir = resolveSessionsDir(opts);
 	const candidate = entry?.sessionFile?.trim();
-	return candidate ? candidate : resolveSessionTranscriptPath(sessionId, opts?.agentId);
+	if (candidate) return resolvePathWithinSessionsDir(sessionsDir, candidate);
+	return resolveSessionTranscriptPathInDir(sessionId, sessionsDir);
 }
 function resolveStorePath(store, opts) {
 	const agentId = normalizeAgentId(opts?.agentId ?? DEFAULT_AGENT_ID);

package/dist/{paths-IivnSNkP.js → paths-DLINmNFQ.js}

@@ -1,4 +1,4 @@
-import { X as resolveStateDir, dt as expandHomePrefix, pt as resolveRequiredHomeDir } from "./entry.js";
+import { Z as resolveStateDir, ht as resolveRequiredHomeDir, pt as expandHomePrefix } from "./entry.js";
 import { l as normalizeAgentId, n as DEFAULT_AGENT_ID } from "./session-key-DVvxnFKg.js";
 import path from "node:path";
 import os from "node:os";
@@ -18,14 +18,39 @@ function resolveSessionTranscriptsDirForAgent(agentId, env = process.env, homedi
 function resolveDefaultSessionStorePath(agentId) {
 	return path.join(resolveAgentSessionsDir(agentId), "sessions.json");
 }
-function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+const SAFE_SESSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+function validateSessionId(sessionId) {
+	const trimmed = sessionId.trim();
+	if (!SAFE_SESSION_ID_RE.test(trimmed)) throw new Error(`Invalid session ID: ${sessionId}`);
+	return trimmed;
+}
+function resolveSessionsDir(opts) {
+	const sessionsDir = opts?.sessionsDir?.trim();
+	if (sessionsDir) return path.resolve(sessionsDir);
+	return resolveAgentSessionsDir(opts?.agentId);
+}
+function resolvePathWithinSessionsDir(sessionsDir, candidate) {
+	const trimmed = candidate.trim();
+	if (!trimmed) throw new Error("Session file path must not be empty");
+	const resolvedBase = path.resolve(sessionsDir);
+	const resolvedCandidate = path.resolve(resolvedBase, trimmed);
+	const relative = path.relative(resolvedBase, resolvedCandidate);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("Session file path must be within sessions directory");
+	return resolvedCandidate;
+}
+function resolveSessionTranscriptPathInDir(sessionId, sessionsDir, topicId) {
+	const safeSessionId = validateSessionId(sessionId);
 	const safeTopicId = typeof topicId === "string" ? encodeURIComponent(topicId) : typeof topicId === "number" ? String(topicId) : void 0;
-	const fileName = safeTopicId !== void 0 ? `${sessionId}-topic-${safeTopicId}.jsonl` : `${sessionId}.jsonl`;
-	return path.join(resolveAgentSessionsDir(agentId), fileName);
+	return resolvePathWithinSessionsDir(sessionsDir, safeTopicId !== void 0 ? `${safeSessionId}-topic-${safeTopicId}.jsonl` : `${safeSessionId}.jsonl`);
+}
+function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+	return resolveSessionTranscriptPathInDir(sessionId, resolveAgentSessionsDir(agentId), topicId);
 }
 function resolveSessionFilePath(sessionId, entry, opts) {
+	const sessionsDir = resolveSessionsDir(opts);
 	const candidate = entry?.sessionFile?.trim();
-	return candidate ? candidate : resolveSessionTranscriptPath(sessionId, opts?.agentId);
+	if (candidate) return resolvePathWithinSessionsDir(sessionsDir, candidate);
+	return resolveSessionTranscriptPathInDir(sessionId, sessionsDir);
 }
 function resolveStorePath(store, opts) {
 	const agentId = normalizeAgentId(opts?.agentId ?? DEFAULT_AGENT_ID);
@@ -48,4 +73,4 @@ function resolveStorePath(store, opts) {
 }
 
 //#endregion
-export { resolveSessionTranscriptsDirForAgent as a, resolveSessionTranscriptsDir as i, resolveSessionFilePath as n, resolveStorePath as o, resolveSessionTranscriptPath as r, resolveDefaultSessionStorePath as t };
+export { resolveSessionTranscriptsDir as a, resolveSessionTranscriptPathInDir as i, resolveSessionFilePath as n, resolveSessionTranscriptsDirForAgent as o, resolveSessionTranscriptPath as r, resolveStorePath as s, resolveDefaultSessionStorePath as t };