activeclaw 2026.4.5 → 2026.4.6

package/dist/{security-cli-CPjzUYo3.js → security-cli-DbRGAdz_.js}

@@ -1,7 +1,7 @@
 import { A as theme, k as isRich, p as defaultRuntime } from "./subsystem-BEF5zTJO.js";
 import { g as resolveStateDir, m as resolveOAuthDir, o as resolveConfigPath } from "./paths-BfR2LXbA.js";
 import "./boolean-BHdNsbzF.js";
-import { Ai as createConfigIO, Mi as loadConfig } from "./auth-profiles-B5hyImOM.js";
+import { Ai as createConfigIO, Mi as loadConfig } from "./auth-profiles-D9Wn945p.js";
 import { i as formatCliCommand } from "./scan-paths-1Ht0wvdC.js";
 import { d as resolveDefaultAgentId } from "./agent-scope-OAwT1oHV.js";
 import { h as DEFAULT_ACCOUNT_ID, s as normalizeAgentId } from "./session-key-9lbhEIb9.js";
@@ -20,23 +20,23 @@ import "./path-alias-guards-DHv0a8uY.js";
 import "./plugins-DRDN4jFP.js";
 import "./paths-B-JdyKTL.js";
 import "./chat-envelope-t_PEbhWC.js";
-import "./exec-approvals-allowlist-DnjttVeB.js";
-import "./exec-safe-bin-runtime-policy-CObmLqq8.js";
+import "./exec-approvals-allowlist-Be63T3oT.js";
+import "./exec-safe-bin-runtime-policy-BnTNRx5O.js";
 import "./errors-BaSZYLcU.js";
 import "./commands-BWrE-bab.js";
-import "./call-5htJiVxi.js";
-import "./tailnet-BII1rF_F.js";
-import "./pi-tools.policy-B8nfuYT3.js";
-import { i as readChannelAllowFromStore } from "./pairing-store-4ajjzoih.js";
+import "./call-Ce8vjHmH.js";
+import "./tailnet-Dd530XEB.js";
+import "./pi-tools.policy-D6UiE_gG.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-BeeSJLPy.js";
 import { t as formatDocsLink } from "./links-hlmnhfEU.js";
 import { t as formatHelpExamples } from "./help-format-D89JlW3L.js";
 import "./dangerous-tools-BZDxNIXz.js";
 import "./skill-scanner-owyfHlsM.js";
 import "./prompt-Bz3qtVYy.js";
 import "./tailscale-aoZb27we.js";
-import "./auth-CCGOm7j4.js";
-import "./probe-auth-Dzz0uFIe.js";
-import { r as collectIncludePathsRecursive, t as runSecurityAudit } from "./audit-Dk_eftLe.js";
+import "./auth-B7N969mv.js";
+import "./probe-auth-CBWjkGhd.js";
+import { r as collectIncludePathsRecursive, t as runSecurityAudit } from "./audit-u873Aqoz.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region src/security/fix.ts

package/dist/{send-DAr4cmzw.js → send-BeUTtwRC.js}

@@ -1,22 +1,22 @@
 import { S as logVerbose, T as shouldLogVerbose, t as createSubsystemLogger, v as danger } from "./subsystem-Dk5WUhC2.js";
 import { g as resolveUserPath } from "./utils-CGU7Q77u.js";
-import { $ as resolveRetryConfig, $a as writeConfigFile, Is as resolveTelegramPreviewStreamMode, Jt as resizeToJpeg, Kt as hasAlphaChannel, Wa as loadConfig, Wt as convertHeicToJpeg, Ya as readConfigFileSnapshotForWrite, Zr as resolveTelegramAccount, et as retryAsync, li as resolveAccountEntry, qt as optimizeImageToPng } from "./model-selection-CftqhKNS.js";
+import { $ as resolveRetryConfig, $a as writeConfigFile, Is as resolveTelegramPreviewStreamMode, Jt as resizeToJpeg, Kt as hasAlphaChannel, Wa as loadConfig, Wt as convertHeicToJpeg, Ya as readConfigFileSnapshotForWrite, Zr as resolveTelegramAccount, et as retryAsync, li as resolveAccountEntry, qt as optimizeImageToPng } from "./model-selection-DU-DNNW7.js";
 import { g as normalizeAccountId } from "./session-key-VV3RvEri.js";
-import { i as redactSensitiveText } from "./path-alias-guards-DJQOJx9a.js";
+import { i as redactSensitiveText } from "./path-alias-guards-DBFU_Tqb.js";
 import { r as normalizeChannelId } from "./plugins-Delv1GbW.js";
-import { a as extensionForMime, c as isGifMedia, f as maxBytesForKind, i as detectMime, l as kindFromMime, n as fetchRemoteMedia, o as getFileExtension, u as normalizeMimeType } from "./fetch-C-yIjbz-.js";
-import { i as formatUncaughtError, n as extractErrorCode, r as formatErrorMessage, s as readErrorName, t as collectErrorGraphCandidates } from "./errors-B27FlGCB.js";
-import { n as getDefaultMediaLocalRoots } from "./local-roots-B0MExwb7.js";
+import { a as extensionForMime, c as isGifMedia, f as maxBytesForKind, i as detectMime, l as kindFromMime, n as fetchRemoteMedia, o as getFileExtension, u as normalizeMimeType } from "./fetch-DAiV9-bR.js";
+import { i as formatUncaughtError, n as extractErrorCode, r as formatErrorMessage, s as readErrorName, t as collectErrorGraphCandidates } from "./errors-Bqf8bSUd.js";
+import { n as getDefaultMediaLocalRoots } from "./local-roots-BZvUgFKO.js";
 import { n as makeProxyFetch } from "./proxy-fetch-Cbsa1-1O.js";
-import { a as chunkText, f as normalizeTelegramChatId, m as parseTelegramTarget, p as normalizeTelegramLookupTarget } from "./chunk-I6GfHIkA.js";
-import { c as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-BLWbfoa6.js";
-import { i as readChannelAllowFromStore } from "./pairing-store-CGmLbKax.js";
+import { a as chunkText, f as normalizeTelegramChatId, m as parseTelegramTarget, p as normalizeTelegramLookupTarget } from "./chunk-D4AO1AEe.js";
+import { c as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-B_UpcQBp.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-Dr8a_B6n.js";
 import { n as isSenderIdAllowed, r as mergeDmAllowFromSources, t as firstDefined } from "./allow-from-6PZpjJrk.js";
 import { t as resolveTelegramFetch } from "./fetch-CLE5aXgx.js";
 import { n as resolveCronStorePath, r as saveCronStore, t as loadCronStore } from "./store-BYAXpd4r.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import { Bot, HttpError, InputFile } from "grammy";
 import "@buape/carbon";
 import MarkdownIt from "markdown-it";
@@ -87,7 +87,7 @@ async function assertLocalMediaAllowed(mediaPath, localRoots) {
 	const roots = localRoots ?? getDefaultLocalRoots();
 	let resolved;
 	try {
-		resolved = await fs.realpath(mediaPath);
+		resolved = await fsPromises.realpath(mediaPath);
 	} catch {
 		resolved = path.resolve(mediaPath);
 	}
@@ -104,7 +104,7 @@ async function assertLocalMediaAllowed(mediaPath, localRoots) {
 	for (const root of roots) {
 		let resolvedRoot;
 		try {
-			resolvedRoot = await fs.realpath(root);
+			resolvedRoot = await fsPromises.realpath(root);
 		} catch {
 			resolvedRoot = path.resolve(root);
 		}

package/dist/{send-CP84wq9N.js → send-CU6MWFln.js}

@@ -1,20 +1,20 @@
-import { _ as redactSensitiveText } from "./paths-E3CbCLxE.js";
-import { a as resolveOAuthDir, c as expandHomePrefix, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-DHNo4U8q.js";
-import { d as logVerbose, l as danger, m as shouldLogVerbose, t as createSubsystemLogger } from "./subsystem-Br253I8q.js";
-import { q as normalizeAccountId } from "./workspace-DRRA3YH5.js";
-import { a as CONFIG_DIR, g as safeParseJson, h as resolveUserPath } from "./logger-3NSI7j4D.js";
-import { E as retryAsync, Er as writeJsonAtomic, Gn as normalizeChannelId, T as resolveRetryConfig, Un as getChannelPlugin, Wn as listChannelPlugins, Xa as resolveTelegramPreviewStreamMode, do as withFileLock$1, dt as convertHeicToJpeg, fi as readConfigFileSnapshotForWrite, hi as writeConfigFile, ht as resizeToJpeg, li as loadConfig, mt as optimizeImageToPng, pt as hasAlphaChannel, sr as resolveAccountEntry, tr as resolveTelegramAccount } from "./model-selection-BrTh8v9L.js";
-import { a as chunkText, f as normalizeTelegramChatId, m as parseTelegramTarget, p as normalizeTelegramLookupTarget } from "./chunk-DB_LA-72.js";
-import { a as extensionForMime, c as isGifMedia, f as maxBytesForKind, i as detectMime, l as kindFromMime, n as fetchRemoteMedia, o as getFileExtension, u as normalizeMimeType } from "./fetch-BXs0KCX9.js";
-import { n as getDefaultMediaLocalRoots } from "./local-roots-ysSrZ6CP.js";
-import { c as formatErrorMessage, l as formatUncaughtError, o as collectErrorGraphCandidates, s as extractErrorCode, u as readErrorName } from "./fetch-guard-DDQrBzBv.js";
-import { n as makeProxyFetch } from "./proxy-fetch-CuFiQFud.js";
-import { t as resolveTelegramFetch } from "./fetch-aXWb4Ao5.js";
-import { s as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-DqIZh4BQ.js";
+import { _ as redactSensitiveText } from "./paths-Bg_l6kdG.js";
+import { a as resolveOAuthDir, c as expandHomePrefix, s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-L_hqOE5A.js";
+import { d as logVerbose, l as danger, m as shouldLogVerbose, t as createSubsystemLogger } from "./subsystem-CDH9S_yW.js";
+import { q as normalizeAccountId } from "./workspace-DiYGwuGk.js";
+import { a as CONFIG_DIR, g as safeParseJson, h as resolveUserPath } from "./logger-BA9koAaC.js";
+import { E as retryAsync, Er as writeJsonAtomic, Gn as normalizeChannelId, T as resolveRetryConfig, Un as getChannelPlugin, Wn as listChannelPlugins, Xa as resolveTelegramPreviewStreamMode, do as withFileLock$1, dt as convertHeicToJpeg, fi as readConfigFileSnapshotForWrite, hi as writeConfigFile, ht as resizeToJpeg, li as loadConfig, mt as optimizeImageToPng, pt as hasAlphaChannel, sr as resolveAccountEntry, tr as resolveTelegramAccount } from "./model-selection-CvKAj7nY.js";
+import { a as chunkText, f as normalizeTelegramChatId, m as parseTelegramTarget, p as normalizeTelegramLookupTarget } from "./chunk-BSmRwqjw.js";
+import { a as extensionForMime, c as isGifMedia, f as maxBytesForKind, i as detectMime, l as kindFromMime, n as fetchRemoteMedia, o as getFileExtension, u as normalizeMimeType } from "./fetch-LN1gb6p0.js";
+import { n as getDefaultMediaLocalRoots } from "./local-roots-CyRw91V8.js";
+import { c as formatErrorMessage, l as formatUncaughtError, o as collectErrorGraphCandidates, s as extractErrorCode, u as readErrorName } from "./fetch-guard-Bd5oI7xu.js";
+import { n as makeProxyFetch } from "./proxy-fetch-Spr_UMJ3.js";
+import { t as resolveTelegramFetch } from "./fetch-BWClp-zV.js";
+import { s as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-hxxMXweE.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import syncFs from "node:fs";
+import fs$1 from "node:fs";
 import JSON5 from "json5";
 import { fileURLToPath } from "node:url";
 import crypto, { randomBytes } from "node:crypto";
@@ -71,7 +71,7 @@ function getPairingAdapter(channelId) {
 //#region src/plugin-sdk/json-store.ts
 async function readJsonFileWithFallback(filePath, fallback) {
 	try {
-		const parsed = safeParseJson(await syncFs.promises.readFile(filePath, "utf-8"));
+		const parsed = safeParseJson(await fs$1.promises.readFile(filePath, "utf-8"));
 		if (parsed == null) return {
 			value: fallback,
 			exists: true
@@ -157,7 +157,7 @@ async function readPairingRequests(filePath) {
 }
 async function ensureJsonFile(filePath, fallback) {
 	try {
-		await syncFs.promises.access(filePath);
+		await fs$1.promises.access(filePath);
 	} catch {
 		await writeJsonFile(filePath, fallback);
 	}
@@ -313,7 +313,7 @@ function resolveAllowFromReadCacheOrMissing(filePath, stat) {
 async function readAllowFromStateForPathWithExists(channel, filePath) {
 	let stat = null;
 	try {
-		stat = await syncFs.promises.stat(filePath);
+		stat = await fs$1.promises.stat(filePath);
 	} catch (err) {
 		if (err.code !== "ENOENT") throw err;
 	}
@@ -356,7 +356,7 @@ async function writeAllowFromState(filePath, allowFrom) {
 	});
 	let stat = null;
 	try {
-		stat = await syncFs.promises.stat(filePath);
+		stat = await fs$1.promises.stat(filePath);
 	} catch {}
 	setAllowFromReadCache(filePath, {
 		exists: true,
@@ -1285,7 +1285,7 @@ function resolveCronStorePath(storePath) {
 }
 async function loadCronStore(storePath) {
 	try {
-		const raw = await syncFs.promises.readFile(storePath, "utf-8");
+		const raw = await fs$1.promises.readFile(storePath, "utf-8");
 		let parsed;
 		try {
 			parsed = JSON5.parse(raw);
@@ -1311,21 +1311,21 @@ async function loadCronStore(storePath) {
 	}
 }
 async function setSecureFileMode(filePath) {
-	await syncFs.promises.chmod(filePath, 384).catch(() => void 0);
+	await fs$1.promises.chmod(filePath, 384).catch(() => void 0);
 }
 async function saveCronStore(storePath, store, opts) {
 	const storeDir = path.dirname(storePath);
-	await syncFs.promises.mkdir(storeDir, {
+	await fs$1.promises.mkdir(storeDir, {
 		recursive: true,
 		mode: 448
 	});
-	await syncFs.promises.chmod(storeDir, 448).catch(() => void 0);
+	await fs$1.promises.chmod(storeDir, 448).catch(() => void 0);
 	const json = JSON.stringify(store, null, 2);
 	const cached = serializedStoreCache.get(storePath);
 	if (cached === json) return;
 	let previous = cached ?? null;
 	if (previous === null) try {
-		previous = await syncFs.promises.readFile(storePath, "utf-8");
+		previous = await fs$1.promises.readFile(storePath, "utf-8");
 	} catch (err) {
 		if (err.code !== "ENOENT") throw err;
 	}
@@ -1334,14 +1334,14 @@ async function saveCronStore(storePath, store, opts) {
 		return;
 	}
 	const tmp = `${storePath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
-	await syncFs.promises.writeFile(tmp, json, {
+	await fs$1.promises.writeFile(tmp, json, {
 		encoding: "utf-8",
 		mode: 384
 	});
 	await setSecureFileMode(tmp);
 	if (previous !== null && !opts?.skipBackup) try {
 		const backupPath = `${storePath}.bak`;
-		await syncFs.promises.copyFile(storePath, backupPath);
+		await fs$1.promises.copyFile(storePath, backupPath);
 		await setSecureFileMode(backupPath);
 	} catch {}
 	await renameWithRetry(tmp, storePath);
@@ -1352,7 +1352,7 @@ const RENAME_MAX_RETRIES = 3;
 const RENAME_BASE_DELAY_MS = 50;
 async function renameWithRetry(src, dest) {
 	for (let attempt = 0; attempt <= RENAME_MAX_RETRIES; attempt++) try {
-		await syncFs.promises.rename(src, dest);
+		await fs$1.promises.rename(src, dest);
 		return;
 	} catch (err) {
 		const code = err.code;
@@ -1361,8 +1361,8 @@ async function renameWithRetry(src, dest) {
 			continue;
 		}
 		if (code === "EPERM" || code === "EEXIST") {
-			await syncFs.promises.copyFile(src, dest);
-			await syncFs.promises.unlink(src).catch(() => {});
+			await fs$1.promises.copyFile(src, dest);
+			await fs$1.promises.unlink(src).catch(() => {});
 			return;
 		}
 		throw err;

package/dist/{send-CeA0VP-c.js → send-TlYsQWZw.js}

@@ -1,16 +1,16 @@
 import { S as logVerbose, T as shouldLogVerbose, t as createSubsystemLogger, v as danger } from "./subsystem-BEF5zTJO.js";
-import { $s as resolveRetryConfig, F as hasAlphaChannel, I as optimizeImageToPng, L as resizeToJpeg, Li as readConfigFileSnapshotForWrite, Mi as loadConfig, N as convertHeicToJpeg, So as resolveTelegramPreviewStreamMode, Vi as writeConfigFile, Zn as resolveAccountEntry, ec as retryAsync, zn as resolveTelegramAccount } from "./auth-profiles-B5hyImOM.js";
+import { $s as resolveRetryConfig, F as hasAlphaChannel, I as optimizeImageToPng, L as resizeToJpeg, Li as readConfigFileSnapshotForWrite, Mi as loadConfig, N as convertHeicToJpeg, So as resolveTelegramPreviewStreamMode, Vi as writeConfigFile, Zn as resolveAccountEntry, ec as retryAsync, zn as resolveTelegramAccount } from "./auth-profiles-D9Wn945p.js";
 import { g as normalizeAccountId } from "./session-key-9lbhEIb9.js";
 import { h as resolveUserPath } from "./utils-qah6hFG0.js";
 import { n as redactSensitiveText } from "./redact-CxtZhh9L.js";
 import { r as normalizeChannelId } from "./plugins-DRDN4jFP.js";
-import { a as chunkText, f as normalizeTelegramChatId, m as parseTelegramTarget, p as normalizeTelegramLookupTarget } from "./chunk-cNotV828.js";
-import { a as extensionForMime, c as isGifMedia, f as maxBytesForKind, i as detectMime, l as kindFromMime, n as fetchRemoteMedia, o as getFileExtension, u as normalizeMimeType } from "./fetch-3V1gxxYH.js";
+import { a as chunkText, f as normalizeTelegramChatId, m as parseTelegramTarget, p as normalizeTelegramLookupTarget } from "./chunk-B0PHAL_m.js";
+import { a as extensionForMime, c as isGifMedia, f as maxBytesForKind, i as detectMime, l as kindFromMime, n as fetchRemoteMedia, o as getFileExtension, u as normalizeMimeType } from "./fetch-hiM4UODI.js";
 import { n as getDefaultMediaLocalRoots } from "./local-roots-CY11yrWR.js";
 import { i as formatUncaughtError, n as extractErrorCode, r as formatErrorMessage, s as readErrorName, t as collectErrorGraphCandidates } from "./errors-BaSZYLcU.js";
 import { n as makeProxyFetch } from "./proxy-fetch-DNrsTLo-.js";
 import { c as readLocalFileSafely, t as SafeOpenError } from "./fs-safe-DOZviZ8W.js";
-import { i as readChannelAllowFromStore } from "./pairing-store-4ajjzoih.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-BeeSJLPy.js";
 import { t as resolveTelegramFetch } from "./fetch-Dp611IaP.js";
 import { n as isSenderIdAllowed, r as mergeDmAllowFromSources, t as firstDefined } from "./allow-from-bowAr2Nr.js";
 import { n as resolveCronStorePath, r as saveCronStore, t as loadCronStore } from "./store-Dinmjfnl.js";

package/dist/{service-Cfk6VWeP.js → service-kXk8K3mn.js}

@@ -1,8 +1,8 @@
 import { i as parseStrictPositiveInteger, n as parseStrictInteger } from "./parse-finite-number-Drzqkcy7.js";
 import { a as resolveGatewayLaunchAgentLabel, l as resolveLegacyGatewayLaunchAgentLabels, s as resolveGatewayServiceDescription, t as GATEWAY_LAUNCH_AGENT_LABEL } from "./constants-BeQGpTEh.js";
-import { _ as resolveHomeDir, a as readSystemdServiceExecStart, b as writeFormattedLines, c as restartSystemdService, d as uninstallSystemdService, g as resolveGatewayStateDir, h as parseKeyValueOutput, l as stopSystemdService, o as readSystemdServiceRuntime, r as isSystemdServiceEnabled, t as installSystemdService, v as formatLine, x as execFileUtf8, y as toPosixPath } from "./systemd-B5QGtWUt.js";
+import { _ as resolveHomeDir, a as readSystemdServiceExecStart, b as writeFormattedLines, c as restartSystemdService, d as uninstallSystemdService, g as resolveGatewayStateDir, h as parseKeyValueOutput, l as stopSystemdService, o as readSystemdServiceRuntime, r as isSystemdServiceEnabled, t as installSystemdService, v as formatLine, x as execFileUtf8, y as toPosixPath } from "./systemd-lqHMKF03.js";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 const plistEscape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
 const plistUnescape = (value) => value.replaceAll("&apos;", "'").replaceAll("&quot;", "\"").replaceAll("&gt;", ">").replaceAll("&lt;", "<").replaceAll("&amp;", "&");
 const renderEnvDict = (env) => {
@@ -13,7 +13,7 @@ const renderEnvDict = (env) => {
 };
 async function readLaunchAgentProgramArgumentsFromFile(plistPath) {
 	try {
-		const plist = await fs.readFile(plistPath, "utf8");
+		const plist = await fsPromises.readFile(plistPath, "utf8");
 		const programMatch = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/i);
 		if (!programMatch) return null;
 		const args = Array.from(programMatch[1].matchAll(/<string>([\s\S]*?)<\/string>/gi)).map((match) => plistUnescape(match[1] ?? "").trim());
@@ -98,14 +98,14 @@ function resolveGuiDomain() {
 	return `gui/${process.getuid()}`;
 }
 async function ensureSecureDirectory(targetPath) {
-	await fs.mkdir(targetPath, {
+	await fsPromises.mkdir(targetPath, {
 		recursive: true,
 		mode: LAUNCH_AGENT_DIR_MODE
 	});
 	try {
-		const mode = (await fs.stat(targetPath)).mode & 511;
+		const mode = (await fsPromises.stat(targetPath)).mode & 511;
 		const tightenedMode = mode & -19;
-		if (tightenedMode !== mode) await fs.chmod(targetPath, tightenedMode);
+		if (tightenedMode !== mode) await fsPromises.chmod(targetPath, tightenedMode);
 	} catch {}
 }
 function parseLaunchctlPrint(output) {
@@ -139,7 +139,7 @@ async function isLaunchAgentListed(args) {
 async function launchAgentPlistExists(env) {
 	try {
 		const plistPath = resolveLaunchAgentPlistPath(env);
-		await fs.access(plistPath);
+		await fsPromises.access(plistPath);
 		return true;
 	} catch {
 		return false;
@@ -201,7 +201,7 @@ async function uninstallLaunchAgent({ env, stdout }) {
 	]);
 	await execLaunchctl(["unload", plistPath]);
 	try {
-		await fs.access(plistPath);
+		await fsPromises.access(plistPath);
 	} catch {
 		stdout.write(`LaunchAgent not found at ${plistPath}\n`);
 		return;
@@ -210,8 +210,8 @@ async function uninstallLaunchAgent({ env, stdout }) {
 	const trashDir = path.posix.join(home, ".Trash");
 	const dest = path.join(trashDir, `${label}.plist`);
 	try {
-		await fs.mkdir(trashDir, { recursive: true });
-		await fs.rename(plistPath, dest);
+		await fsPromises.mkdir(trashDir, { recursive: true });
+		await fsPromises.rename(plistPath, dest);
 		stdout.write(`${formatLine("Moved LaunchAgent to Trash", dest)}\n`);
 	} catch {
 		stdout.write(`LaunchAgent remains at ${plistPath} (could not move)\n`);
@@ -267,7 +267,7 @@ async function installLaunchAgent({ env, stdout, programArguments, workingDirect
 		]);
 		await execLaunchctl(["unload", legacyPlistPath]);
 		try {
-			await fs.unlink(legacyPlistPath);
+			await fsPromises.unlink(legacyPlistPath);
 		} catch {}
 	}
 	const plistPath = resolveLaunchAgentPlistPathForLabel(env, label);
@@ -289,11 +289,11 @@ async function installLaunchAgent({ env, stdout, programArguments, workingDirect
 		stderrPath,
 		environment
 	});
-	await fs.writeFile(plistPath, plist, {
+	await fsPromises.writeFile(plistPath, plist, {
 		encoding: "utf8",
 		mode: LAUNCH_AGENT_PLIST_MODE
 	});
-	await fs.chmod(plistPath, LAUNCH_AGENT_PLIST_MODE).catch(() => void 0);
+	await fsPromises.chmod(plistPath, LAUNCH_AGENT_PLIST_MODE).catch(() => void 0);
 	await execLaunchctl([
 		"bootout",
 		domain,

package/dist/{session-utils-G8TPVqDh.js → session-utils-5dTolcMA.js}

@@ -1,11 +1,11 @@
 import { tt as consumeRootOptionToken } from "./subsystem-BEF5zTJO.js";
 import { g as resolveStateDir } from "./paths-BfR2LXbA.js";
-import { Aa as isAvatarDataUrl, Cn as resolveAgentMainSessionKey, Dc as DEFAULT_PROVIDER, Ec as DEFAULT_MODEL, Fa as isWorkspaceRelativeAvatarPath, Jo as resolveOpenClawAgentDir, Kt as normalizeSessionDeliveryFields, La as resolveAvatarMime, Mi as loadConfig, Na as isPathWithinRoot, Ot as loadSessionStore, Sn as canonicalizeMainSessionAlias, Tn as resolveMainSessionKey, bn as resolveFreshSessionTotalTokens, cs as parseModelRef, ds as resolveConfiguredModelRef, en as readSessionTitleFieldsFromTranscript, fs as resolveDefaultModelForAgent, ir as buildGroupDisplayName, ja as isAvatarHttpUrl, ka as AVATAR_MAX_BYTES, ns as inferUniqueProviderFromConfiguredModels } from "./auth-profiles-B5hyImOM.js";
+import { Aa as isAvatarDataUrl, Cn as resolveAgentMainSessionKey, Dc as DEFAULT_PROVIDER, Ec as DEFAULT_MODEL, Fa as isWorkspaceRelativeAvatarPath, Jo as resolveOpenClawAgentDir, Kt as normalizeSessionDeliveryFields, La as resolveAvatarMime, Mi as loadConfig, Na as isPathWithinRoot, Ot as loadSessionStore, Sn as canonicalizeMainSessionAlias, Tn as resolveMainSessionKey, bn as resolveFreshSessionTotalTokens, cs as parseModelRef, ds as resolveConfiguredModelRef, en as readSessionTitleFieldsFromTranscript, fs as resolveDefaultModelForAgent, ir as buildGroupDisplayName, ja as isAvatarHttpUrl, ka as AVATAR_MAX_BYTES, ns as inferUniqueProviderFromConfiguredModels } from "./auth-profiles-D9Wn945p.js";
 import { d as resolveDefaultAgentId, u as resolveAgentWorkspaceDir } from "./agent-scope-OAwT1oHV.js";
 import { S as isCronRunSessionKey, T as parseAgentSessionKey, c as normalizeMainKey, s as normalizeAgentId } from "./session-key-9lbhEIb9.js";
 import { r as openBoundaryFileSync } from "./boundary-file-read-BAjRF13y.js";
 import { c as resolveStorePath } from "./paths-B-JdyKTL.js";
-import { t as ensureOpenClawModelsJson } from "./models-config-B9HFg-NI.js";
+import { t as ensureOpenClawModelsJson } from "./models-config-Cg9vUkxp.js";
 import path from "node:path";
 import fs from "node:fs";
 import { setTimeout } from "node:timers/promises";
@@ -111,7 +111,7 @@ function ensureContextWindowCacheLoaded() {
 			await ensureOpenClawModelsJson(cfg);
 		} catch {}
 		try {
-			const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery-DmsAxxli.js").then((n) => n.r);
+			const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery-DFqVpswz.js").then((n) => n.r);
 			const agentDir = resolveOpenClawAgentDir();
 			const modelRegistry = discoverModels(discoverAuthStorage(agentDir), agentDir);
 			applyDiscoveredContextWindows({

package/dist/{sessions-DghMB51-.js → sessions-CNRe8TkE.js}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
 import { A as theme, k as isRich, y as info } from "./subsystem-BEF5zTJO.js";
-import { Mi as loadConfig, Ot as loadSessionStore, bn as resolveFreshSessionTotalTokens, ds as resolveConfiguredModelRef } from "./auth-profiles-B5hyImOM.js";
+import { Mi as loadConfig, Ot as loadSessionStore, bn as resolveFreshSessionTotalTokens, ds as resolveConfiguredModelRef } from "./auth-profiles-D9Wn945p.js";
 import { d as resolveDefaultAgentId, r as listAgentIds } from "./agent-scope-OAwT1oHV.js";
 import { T as parseAgentSessionKey, s as normalizeAgentId } from "./session-key-9lbhEIb9.js";
 import { c as resolveStorePath } from "./paths-B-JdyKTL.js";
-import { l as resolveSessionModelRef, n as classifySessionKey, u as lookupContextTokens } from "./session-utils-G8TPVqDh.js";
+import { l as resolveSessionModelRef, n as classifySessionKey, u as lookupContextTokens } from "./session-utils-5dTolcMA.js";
 import { t as formatTimeAgo } from "./format-relative-ciFDmLBH.js";
 //#region src/commands/session-store-targets.ts
 function dedupeTargetsByStorePath(targets) {

package/dist/{shared-C6ksnJEO.js → shared-C_hG8rgh.js}

@@ -1,7 +1,7 @@
 import { p as defaultRuntime } from "./subsystem-Dk5WUhC2.js";
 import { i as formatCliCommand } from "./scan-paths-meOkBmZg.js";
 import { a as resolveGatewayLaunchAgentLabel, c as resolveGatewaySystemdServiceName } from "./constants-BeQGpTEh.js";
-import { t as resolveGatewayService } from "./service-Cfk6VWeP.js";
+import { t as resolveGatewayService } from "./service-kXk8K3mn.js";
 //#region src/cli/gateway-cli/shared.ts
 const toOptionString = (value) => {
 	if (typeof value === "string") return value;

package/dist/{skill-scanner-B8J7JGHG.js → skill-scanner-djTgcKux.js}

@@ -1,7 +1,7 @@
 import { n as isPathInside } from "./scan-paths-meOkBmZg.js";
-import { a as hasErrnoCode } from "./errors-B27FlGCB.js";
+import { a as hasErrnoCode } from "./errors-Bqf8bSUd.js";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 //#region src/security/skill-scanner.ts
 const SCANNABLE_EXTENSIONS = new Set([
 	".js",
@@ -194,7 +194,7 @@ async function walkDirWithLimit(dirPath, maxFiles) {
 async function readDirEntriesWithCache(dirPath) {
 	let st = null;
 	try {
-		st = await fs.stat(dirPath);
+		st = await fsPromises.stat(dirPath);
 	} catch (err) {
 		if (hasErrnoCode(err, "ENOENT")) return [];
 		throw err;
@@ -202,7 +202,7 @@ async function readDirEntriesWithCache(dirPath) {
 	if (!st?.isDirectory()) return [];
 	const cached = DIR_ENTRY_CACHE.get(dirPath);
 	if (cached && cached.mtimeMs === st.mtimeMs) return cached.entries;
-	const dirents = await fs.readdir(dirPath, { withFileTypes: true });
+	const dirents = await fsPromises.readdir(dirPath, { withFileTypes: true });
 	const entries = [];
 	for (const entry of dirents) if (entry.isDirectory()) entries.push({
 		name: entry.name,
@@ -229,7 +229,7 @@ async function resolveForcedFiles(params) {
 		if (seen.has(includePath)) continue;
 		let st = null;
 		try {
-			st = await fs.stat(includePath);
+			st = await fsPromises.stat(includePath);
 		} catch (err) {
 			if (hasErrnoCode(err, "ENOENT")) continue;
 			throw err;
@@ -262,7 +262,7 @@ async function scanFileWithCache(params) {
 	const { filePath, maxFileBytes } = params;
 	let st = null;
 	try {
-		st = await fs.stat(filePath);
+		st = await fsPromises.stat(filePath);
 	} catch (err) {
 		if (hasErrnoCode(err, "ENOENT")) return {
 			scanned: false,
@@ -299,7 +299,7 @@ async function scanFileWithCache(params) {
 	}
 	let source;
 	try {
-		source = await fs.readFile(filePath, "utf-8");
+		source = await fsPromises.readFile(filePath, "utf-8");
 	} catch (err) {
 		if (hasErrnoCode(err, "ENOENT")) return {
 			scanned: false,

package/dist/{skills-Mq1GCIyL.js → skills-D7xInzjY.js}

@@ -1,11 +1,11 @@
 import { V as resolvePreferredOpenClawTmpDir, t as createSubsystemLogger } from "./subsystem-Dk5WUhC2.js";
 import { d as isRecord, g as resolveUserPath, m as resolveConfigDir, t as CONFIG_DIR } from "./utils-CGU7Q77u.js";
-import { a as openBoundaryFileSync, g as normalizeSkillFilter, n as resolveOpenClawPackageRootSync, p as isPathInside$1 } from "./openclaw-root-B6cGCDGF.js";
+import { a as openBoundaryFileSync, g as normalizeSkillFilter, n as resolveOpenClawPackageRootSync, p as isPathInside$1 } from "./openclaw-root-DbbVtnL2.js";
 import { r as isPathInsideWithRealpath } from "./scan-paths-meOkBmZg.js";
 import { d as resolveOpenClawMetadata, f as resolveSkillInvocationPolicy, l as shouldIncludeSkill, u as parseFrontmatter } from "./env-overrides-CSdE_DWV.js";
 import { M as defaultSlotIdForKey, l as normalizeChatChannelId } from "./registry-BKJyEPHE.js";
 import { m as MANIFEST_KEY } from "./frontmatter-DTFXPyoL.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-DJQOJx9a.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-DBFU_Tqb.js";
 import { URL, fileURLToPath } from "node:url";
 import fs from "node:fs";
 import os from "node:os";

package/dist/{sqlite-DMwlw8gY.js → sqlite-BXiqNpZr.js}

@@ -1,11 +1,11 @@
 import { t as createSubsystemLogger } from "./subsystem-Dk5WUhC2.js";
 import { n as isPrimarySessionTranscriptFileName, s as runTasksWithConcurrency } from "./artifacts-BVEmBB-K.js";
-import { i as redactSensitiveText } from "./path-alias-guards-DJQOJx9a.js";
+import { i as redactSensitiveText } from "./path-alias-guards-DBFU_Tqb.js";
 import { s as resolveSessionTranscriptsDirForAgent } from "./paths-DHrunYJK.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import crypto from "node:crypto";
 //#region src/memory/query-expansion.ts
 /**
@@ -640,7 +640,7 @@ function isFileMissingError(err) {
 async function statRegularFile(absPath) {
 	let stat;
 	try {
-		stat = await fs$1.lstat(absPath);
+		stat = await fsPromises.lstat(absPath);
 	} catch (err) {
 		if (isFileMissingError(err)) return { missing: true };
 		throw err;
@@ -752,13 +752,13 @@ function sanitizeIndexedTextContent(content) {
 	return redactSensitiveText(content, { mode: "tools" });
 }
 async function readIndexedTextContent(absPath) {
-	return sanitizeIndexedTextContent(await fs$1.readFile(absPath, "utf-8"));
+	return sanitizeIndexedTextContent(await fsPromises.readFile(absPath, "utf-8"));
 }
 async function shouldIncludeIndexedFile(absPath, excludedPaths) {
 	if (isExcludedMemoryPath(absPath, excludedPaths)) return false;
 	if (!isIndexedTextPath(absPath)) return false;
 	try {
-		const stat = await fs$1.stat(absPath);
+		const stat = await fsPromises.stat(absPath);
 		return stat.isFile() && stat.size <= MAX_INDEX_FILE_BYTES;
 	} catch {
 		return false;
@@ -766,7 +766,7 @@ async function shouldIncludeIndexedFile(absPath, excludedPaths) {
 }
 async function walkDir(dir, files, excludedPaths) {
 	if (isExcludedMemoryPath(dir, excludedPaths)) return;
-	const entries = await fs$1.readdir(dir, { withFileTypes: true });
+	const entries = await fsPromises.readdir(dir, { withFileTypes: true });
 	for (const entry of entries) {
 		const full = path.join(dir, entry.name);
 		if (isExcludedMemoryPath(full, excludedPaths)) continue;
@@ -790,7 +790,7 @@ async function listMemoryFiles(workspaceDir, extraPaths, excludePaths) {
 	const addMarkdownFile = async (absPath) => {
 		try {
 			if (isExcludedMemoryPath(absPath, normalizedExcludedPaths)) return;
-			const stat = await fs$1.lstat(absPath);
+			const stat = await fsPromises.lstat(absPath);
 			if (stat.isSymbolicLink() || !stat.isFile()) return;
 			if (!isIndexedTextPath(absPath) || stat.size > MAX_INDEX_FILE_BYTES) return;
 			result.push(absPath);
@@ -799,14 +799,14 @@ async function listMemoryFiles(workspaceDir, extraPaths, excludePaths) {
 	await addMarkdownFile(memoryFile);
 	await addMarkdownFile(altMemoryFile);
 	try {
-		const dirStat = await fs$1.lstat(memoryDir);
+		const dirStat = await fsPromises.lstat(memoryDir);
 		if (!dirStat.isSymbolicLink() && dirStat.isDirectory()) await walkDir(memoryDir, result, normalizedExcludedPaths);
 	} catch {}
 	const normalizedExtraPaths = normalizeExtraMemoryPaths(workspaceDir, extraPaths);
 	if (normalizedExtraPaths.length > 0) for (const inputPath of normalizedExtraPaths) {
 		if (isExcludedMemoryPath(inputPath, normalizedExcludedPaths)) continue;
 		try {
-			const stat = await fs$1.lstat(inputPath);
+			const stat = await fsPromises.lstat(inputPath);
 			if (stat.isSymbolicLink()) continue;
 			if (stat.isDirectory()) {
 				await walkDir(inputPath, result, normalizedExcludedPaths);
@@ -821,7 +821,7 @@ async function listMemoryFiles(workspaceDir, extraPaths, excludePaths) {
 	for (const entry of result) {
 		let key = entry;
 		try {
-			key = await fs$1.realpath(entry);
+			key = await fsPromises.realpath(entry);
 		} catch {}
 		if (seen.has(key)) continue;
 		seen.add(key);
@@ -836,7 +836,7 @@ async function buildFileEntry(absPath, workspaceDir) {
 	if (!isIndexedTextPath(absPath)) return null;
 	let stat;
 	try {
-		stat = await fs$1.stat(absPath);
+		stat = await fsPromises.stat(absPath);
 	} catch (err) {
 		if (isFileMissingError(err)) return null;
 		throw err;
@@ -977,7 +977,7 @@ const log = createSubsystemLogger("memory");
 async function listSessionFilesForAgent(agentId) {
 	const dir = resolveSessionTranscriptsDirForAgent(agentId);
 	try {
-		return (await fs$1.readdir(dir, { withFileTypes: true })).filter((entry) => entry.isFile()).map((entry) => entry.name).filter(isPrimarySessionTranscriptFileName).map((name) => path.join(dir, name));
+		return (await fsPromises.readdir(dir, { withFileTypes: true })).filter((entry) => entry.isFile()).map((entry) => entry.name).filter(isPrimarySessionTranscriptFileName).map((name) => path.join(dir, name));
 	} catch {
 		return [];
 	}
@@ -1007,8 +1007,8 @@ function extractSessionText(content) {
 }
 async function buildSessionEntry(absPath) {
 	try {
-		const stat = await fs$1.stat(absPath);
-		const lines = (await fs$1.readFile(absPath, "utf-8")).split("\n");
+		const stat = await fsPromises.stat(absPath);
+		const lines = (await fsPromises.readFile(absPath, "utf-8")).split("\n");
 		const collected = [];
 		const lineMap = [];
 		for (let jsonlIdx = 0; jsonlIdx < lines.length; jsonlIdx++) {

package/dist/{status-BkoerIVk.js → status-BWvpeDQr.js}

@@ -1,4 +1,4 @@
-import { _ as projectSafeChannelAccountSnapshotFields, m as inspectReadOnlyChannelAccount } from "./pi-tools.policy-B8nfuYT3.js";
+import { _ as projectSafeChannelAccountSnapshotFields, m as inspectReadOnlyChannelAccount } from "./pi-tools.policy-D6UiE_gG.js";
 //#region src/channels/plugins/status.ts
 async function buildSnapshotFromAccount(params) {
 	if (params.plugin.status?.buildAccountSnapshot) return await params.plugin.status.buildAccountSnapshot({

package/dist/{status-C2lZy-Fn.js → status-DlhZNZRA.js}

@@ -1,4 +1,4 @@
-import { i as projectSafeChannelAccountSnapshotFields, t as inspectReadOnlyChannelAccount } from "./read-only-account-inspect-CWAyFOOe.js";
+import { i as projectSafeChannelAccountSnapshotFields, t as inspectReadOnlyChannelAccount } from "./read-only-account-inspect-sMyuBIwr.js";
 //#region src/channels/plugins/status.ts
 async function buildSnapshotFromAccount(params) {
 	if (params.plugin.status?.buildAccountSnapshot) return await params.plugin.status.buildAccountSnapshot({