autoclaw 1.3.2 → 1.3.4

package/README.md

@@ -130,6 +130,29 @@ Unattempted tasks are simply absent from the results file, so `--fail-fast` foll
 
 AutoClaw also keeps its own prompt lean: optional tools (web search, email, group notifications, image generation) only register once their credentials are configured, and in long loops older tool results in the model context are replaced by short excerpts.
 
+### Recipes
+
+Daily ops sweep on Linux (crontab):
+```cron
+0 9 * * * autoclaw batch /opt/ops/daily.jsonl -y -n --resume >> /var/log/autoclaw.log 2>&1
+```
+
+Scheduled sweep on Windows (Task Scheduler):
+```bash
+schtasks /create /tn "AutoClaw Daily" /tr "autoclaw batch C:\ops\daily.jsonl -y -n" /sc daily /st 09:00
+```
+
+Pipeline inside one manifest — each task writes files the next task reads:
+```jsonl
+{"id": "sweep", "task": "检查磁盘与关键服务状态,报告写入 report/sweep.md"}
+{"id": "notify", "task": "读取 report/sweep.md,用三句话总结后推送到飞书"}
+```
+
+Diagnostics on a fresh machine or in CI:
+```bash
+autoclaw doctor   # exit 0 = ready; exit 1 = what's missing is printed
+```
+
 ### Auto-Confirm (CI/CD)
 Automatically approve all tool executions (dangerous, use with caution or in sandboxes).
 ```bash
@@ -141,14 +164,18 @@ autoclaw "Refactor src/index.ts to use ES modules" -y
 - `-P, --provider <name>`: Use a provider preset (see [Providers](#providers)).
 - `-n, --no-interactive`: Exit after processing the initial query (Headless mode).
 - `-y, --yes`: Auto-confirm all tool executions (e.g., shell commands).
+- `--allow-dangerous`: Let `-y` run clearly destructive commands (rm -rf, format, shutdown, ...) that the built-in safety gate would block.
 - `--json`: Emit NDJSON events on stdout (for orchestrators; use with `-n`).
 
+### Diagnostics
+`autoclaw doctor` checks everything headlessly and prints ✓/✗ per item: config files, resolved provider/baseUrl/model, API key, a live connection test, resolved shell, registered tools, and playwright browser status. Exit `0` = ready, `1` = a critical item failed (the failing item is printed). Ideal for CI or a fresh machine.
+
 ### Providers
 AutoClaw works with any OpenAI-compatible endpoint. Built-in presets fill in the base URL and a default model for you:
 ```bash
 autoclaw -P deepseek "Check disk usage and save a report" -y -n
 ```
-Available presets: `openai`, `deepseek`, `moonshot` (Kimi), `dashscope` (Qwen), `zhipu` (GLM), `openrouter`, `ollama` (local). You can still override the model with `-m` or config. When `OPENAI_API_KEY` is not set, the API key is read from the provider's own env var (e.g. `DEEPSEEK_API_KEY`, `MOONSHOT_API_KEY`, `DASHSCOPE_API_KEY`, `ZHIPU_API_KEY`, `OPENROUTER_API_KEY`).
+Available presets: `openai`, `deepseek`, `moonshot` (Kimi), `dashscope` (Qwen), `zhipu` (GLM), `ark` (Volcano Ark), `siliconflow`, `openrouter`, `ollama` (local). You can still override the model with `-m` or config. When `OPENAI_API_KEY` is not set, the API key is read from the provider's own env var (e.g. `DEEPSEEK_API_KEY`, `MOONSHOT_API_KEY`, `DASHSCOPE_API_KEY`, `ZHIPU_API_KEY`, `ARK_API_KEY`, `SILICONFLOW_API_KEY`, `OPENROUTER_API_KEY`).
 
 ## Configuration
 
@@ -167,6 +194,7 @@ AutoClaw uses a hierarchical configuration system.
 - `model`: Default model to use.
 - `maxSteps`: Max LLM turns per task before the agent stops (default: `25`).
 - `shellTimeout`: Shell command timeout in milliseconds (default: `120000`).
+- `taskTimeoutMs`: Whole-task wall-clock timeout in milliseconds (off by default; aborts in-flight API calls and stops with `timeout` status).
 - `shell`: Force a shell for `execute_shell_command` (`bash`, `powershell`, `cmd`, `sh`; default: auto-detect — Git Bash > PowerShell > cmd on Windows).
 - `tavilyApiKey`: API Key for Tavily Web Search.
 - `smtpHost`, `smtpPort`, `smtpUser`, `smtpPass`, `smtpFrom`: SMTP Email settings.
@@ -187,6 +215,7 @@ Create a file at `.autoclaw/setting.json`:
 - `OPENAI_API_KEY`, `OPENAI_BASE_URL`, `OPENAI_MODEL`: main LLM settings.
 - `AUTOCLOW_PROVIDER`: provider preset used when `-P` is not passed.
 - `AUTOCLOW_MAX_STEPS`, `AUTOCLOW_SHELL_TIMEOUT`: reliability limits (max LLM turns per task; shell timeout in ms).
+- `AUTOCLOW_TASK_TIMEOUT_MS`: whole-task wall-clock timeout in ms.
 - `AUTOCLOW_SHELL`: force the shell for shell commands (`bash`, `powershell`, `cmd`, `sh`).
 - `AUTOCLOW_INCLUDE_USAGE`: set to `1`/`true` to request token usage from the API (opt-in).
 - `TAVILY_API_KEY`, `SMTP_HOST`/`SMTP_PORT`/`SMTP_USER`/`SMTP_PASS`, `FEISHU_WEBHOOK`/`FEISHU_KEYWORD`, `DINGTALK_WEBHOOK`/`DINGTALK_KEYWORD`, `WECOM_WEBHOOK`/`WECOM_KEYWORD`: tool credentials as an alternative to setup.

package/README.zh-CN.md

@@ -131,6 +131,29 @@ autoclaw batch big.jsonl -y -c 4            # 最多 4 个任务并行
 
 AutoClaw 同时会自动给提示词瘦身：可选工具（网页搜索、邮件、群通知、图像生成）只在凭据配置后才会注册进工具定义；长循环中较早的工具结果会被替换为短摘要。
 
+### 实战配方
+
+Linux 定时巡检（crontab）：
+```cron
+0 9 * * * autoclaw batch /opt/ops/daily.jsonl -y -n --resume >> /var/log/autoclaw.log 2>&1
+```
+
+Windows 计划任务：
+```bash
+schtasks /create /tn "AutoClaw Daily" /tr "autoclaw batch C:\ops\daily.jsonl -y -n" /sc daily /st 09:00
+```
+
+一个清单内的流水线——前一个任务写文件,后一个任务读：
+```jsonl
+{"id": "sweep", "task": "检查磁盘与关键服务状态,报告写入 report/sweep.md"}
+{"id": "notify", "task": "读取 report/sweep.md,用三句话总结后推送到飞书"}
+```
+
+新机器或 CI 环境自检：
+```bash
+autoclaw doctor   # 退出 0 = 就绪;退出 1 = 打印缺失项
+```
+
 ### 自动确认 (CI/CD)
 自动批准所有工具执行（危险操作，请谨慎使用或在沙箱环境下运行）。
 ```bash
@@ -142,6 +165,11 @@ autoclaw "将 src/index.ts 重构为使用 ES 模块" -y
 - `-P, --provider <name>`: 使用 provider 预设 (见 [Provider 预设](#provider-预设))。
 - `-n, --no-interactive`: 处理完初始查询后退出 (无头模式)。
 - `-y, --yes`: 自动确认所有工具执行 (例如 Shell 命令)。
+- `--allow-dangerous`: 允许 `-y` 直接执行内置安全闸拦截的明显破坏性命令 (rm -rf、format、shutdown 等)。
+- `--json`: 在 stdout 输出 NDJSON 事件流 (供编排器使用,配合 `-n`)。
+
+### 诊断
+`autoclaw doctor` 无头完成全面自检,逐项打印 ✓/✗:配置文件、解析出的 provider/baseUrl/model、API key、真实连接测试、解析出的 shell、已注册工具、playwright 浏览器状态。退出 `0` = 就绪,`1` = 有关键项失败(会打印是哪项)。适合 CI 或新机器。
 - `--json`: 在 stdout 输出 NDJSON 事件流 (供编排器使用,配合 `-n`)。
 
 ### Provider 预设
@@ -149,7 +177,7 @@ AutoClaw 可对接任意 OpenAI 兼容端点。内置预设可自动填好 Base
 ```bash
 autoclaw -P deepseek "检查磁盘使用情况并保存报告" -y -n
 ```
-可用预设：`openai`、`deepseek`、`moonshot` (Kimi)、`dashscope` (Qwen)、`zhipu` (GLM)、`openrouter`、`ollama` (本地)。模型仍可用 `-m` 或配置覆盖。未设置 `OPENAI_API_KEY` 时，会自动读取各家自己的环境变量 (如 `DEEPSEEK_API_KEY`、`MOONSHOT_API_KEY`、`DASHSCOPE_API_KEY`、`ZHIPU_API_KEY`、`OPENROUTER_API_KEY`)。
+可用预设：`openai`、`deepseek`、`moonshot` (Kimi)、`dashscope` (Qwen)、`zhipu` (GLM)、`ark` (火山方舟)、`siliconflow` (硅基流动)、`openrouter`、`ollama` (本地)。模型仍可用 `-m` 或配置覆盖。未设置 `OPENAI_API_KEY` 时，会自动读取各家自己的环境变量 (如 `DEEPSEEK_API_KEY`、`MOONSHOT_API_KEY`、`DASHSCOPE_API_KEY`、`ZHIPU_API_KEY`、`ARK_API_KEY`、`SILICONFLOW_API_KEY`、`OPENROUTER_API_KEY`)。
 
 ## 配置
 
@@ -168,6 +196,7 @@ AutoClaw 使用层级配置系统。
 - `model`: 默认使用的模型。
 - `maxSteps`: 单任务最大 LLM 轮数，超出后自动停止 (默认: `25`)。
 - `shellTimeout`: Shell 命令超时时间（毫秒）(默认: `120000`)。
+- `taskTimeoutMs`: 单任务整体墙钟超时（毫秒，默认关闭；会中断进行中的 API 调用并以 `timeout` 状态停止）。
 - `shell`: 强制 `execute_shell_command` 使用的 shell (`bash`、`powershell`、`cmd`、`sh`；默认自动检测——Windows 上优先 Git Bash > PowerShell > cmd)。
 - `tavilyApiKey`: Tavily 网页搜索的 API 密钥。
 - `smtpHost`, `smtpPort`, `smtpUser`, `smtpPass`, `smtpFrom`: SMTP 邮件设置。
@@ -188,6 +217,7 @@ AutoClaw 使用层级配置系统。
 - `OPENAI_API_KEY`, `OPENAI_BASE_URL`, `OPENAI_MODEL`: 主模型设置。
 - `AUTOCLOW_PROVIDER`: 未传 `-P` 时使用的 provider 预设。
 - `AUTOCLOW_MAX_STEPS`, `AUTOCLOW_SHELL_TIMEOUT`: 稳定性限制（单任务最大轮数；Shell 超时毫秒数）。
+- `AUTOCLOW_TASK_TIMEOUT_MS`: 单任务整体墙钟超时（毫秒）。
 - `AUTOCLOW_SHELL`: 强制 shell 命令使用的 shell (`bash`、`powershell`、`cmd`、`sh`)。
 - `AUTOCLOW_INCLUDE_USAGE`: 设为 `1`/`true` 时向 API 请求 token 用量（可选开启）。
 - `TAVILY_API_KEY`, `SMTP_HOST`/`SMTP_PORT`/`SMTP_USER`/`SMTP_PASS`, `FEISHU_WEBHOOK`/`FEISHU_KEYWORD`, `DINGTALK_WEBHOOK`/`DINGTALK_KEYWORD`, `WECOM_WEBHOOK`/`WECOM_KEYWORD`: 工具凭据，可作为 setup 的替代方式。

package/dist/agent.js

@@ -104,6 +104,13 @@ RULES OF ENGAGEMENT:
     async chat(userInput) {
         this.messages.push({ role: "user", content: userInput });
         const maxSteps = Number(this.config?.maxSteps || process.env.AUTOCLOW_MAX_STEPS || DEFAULT_MAX_STEPS);
+        const taskTimeoutMs = Number(this.config?.taskTimeoutMs || process.env.AUTOCLOW_TASK_TIMEOUT_MS || 0);
+        const deadline = taskTimeoutMs > 0 ? Date.now() + taskTimeoutMs : Number.POSITIVE_INFINITY;
+        const abortController = new AbortController();
+        const abortTimer = taskTimeoutMs > 0
+            ? setTimeout(() => abortController.abort(new Error(`task wall-clock timeout after ${taskTimeoutMs}ms`)), taskTimeoutMs)
+            : null;
+        const startedAt = Date.now();
         let active = true;
         let step = 0;
         let status = 'completed';
@@ -120,6 +127,13 @@ RULES OF ENGAGEMENT:
                 }
                 break;
             }
+            if (Date.now() > deadline) {
+                status = 'timeout';
+                if (!this.jsonMode) {
+                    console.log(chalk.yellow(`\n[TaskTimeout] Wall-clock limit of ${taskTimeoutMs}ms reached; stopping.`));
+                }
+                break;
+            }
             this.trimOldToolResults();
             step++;
             const spinner = this.jsonMode
@@ -133,13 +147,13 @@ RULES OF ENGAGEMENT:
                 stream = await withRetry(async () => this.client.chat.completions.create({
                     model: this.model,
                     messages: this.messages,
-                    tools: getToolDefinitions(),
+                    tools: getToolDefinitions(this.config),
                     tool_choice: "auto",
                     stream: true,
                     // Not every OpenAI-compatible provider accepts stream_options;
                     // usage tracking is therefore opt-in only.
                     ...(this.config?.includeUsage ? { stream_options: { include_usage: true } } : {})
-                }), {
+                }, { signal: abortController.signal }), {
                     onRetry: (err, nextAttempt, delayMs) => {
                         spinner.text = `API error (${err.message}); retrying in ${Math.round(delayMs / 1000)}s (attempt ${nextAttempt})...`;
                     }
@@ -149,8 +163,14 @@ RULES OF ENGAGEMENT:
                 spinner.fail('Error during processing');
                 if (!this.jsonMode)
                     console.error(chalk.red(error.message));
-                status = 'error';
-                errorMessage = error.message;
+                if (abortController.signal.aborted) {
+                    status = 'timeout';
+                    errorMessage = `task wall-clock timeout after ${taskTimeoutMs}ms`;
+                }
+                else {
+                    status = 'error';
+                    errorMessage = error.message;
+                }
                 active = false;
                 break;
             }
@@ -231,8 +251,14 @@ RULES OF ENGAGEMENT:
                 spinner.fail('Error during processing');
                 if (!this.jsonMode)
                     console.error(chalk.red(error.message));
-                status = 'error';
-                errorMessage = error.message;
+                if (abortController.signal.aborted) {
+                    status = 'timeout';
+                    errorMessage = `task wall-clock timeout after ${taskTimeoutMs}ms`;
+                }
+                else {
+                    status = 'error';
+                    errorMessage = error.message;
+                }
                 active = false;
                 break;
             }
@@ -351,6 +377,8 @@ RULES OF ENGAGEMENT:
                 this.emitEvent({ event: 'usage', step, ...totalUsage });
             }
         }
+        if (abortTimer)
+            clearTimeout(abortTimer);
         const result = {
             status,
             steps: step,
@@ -358,9 +386,33 @@ RULES OF ENGAGEMENT:
             ...(errorMessage ? { error: errorMessage } : {}),
             ...(sawUsage ? { usage: totalUsage } : {})
         };
+        this.appendRunLog(userInput, result, startedAt);
         this.emitEvent({ event: 'run_end', ...result });
         return result;
     }
+    // Best-effort local run history: ~/.autoclaw/logs/runs.jsonl, one line
+    // per run, for post-hoc debugging of unattended batches. Logging must
+    // never fail a run.
+    appendRunLog(userInput, result, startedAt) {
+        try {
+            const dir = path.join(os.homedir(), '.autoclaw', 'logs');
+            fs.mkdirSync(dir, { recursive: true });
+            const line = JSON.stringify({
+                time: new Date().toISOString(),
+                model: this.model,
+                task: String(userInput).slice(0, 200),
+                status: result.status,
+                steps: result.steps,
+                ...(result.error ? { error: result.error.slice(0, 300) } : {}),
+                ...(result.usage ? { usage: result.usage } : {}),
+                durationMs: Date.now() - startedAt
+            });
+            fs.appendFileSync(path.join(dir, 'runs.jsonl'), line + '\n');
+        }
+        catch {
+            // ignore
+        }
+    }
     // Every turn resends the full history, so early large tool results
     // dominate context growth. Keep the most recent results intact and bound
     // older ones to a short excerpt (full output stays on disk via /view when

package/dist/batch.js

@@ -25,6 +25,8 @@ export function parseManifest(raw) {
         const entry = { lineNo, id, task: parsed.task.trim() };
         if (typeof parsed.maxSteps === 'number' && parsed.maxSteps > 0)
             entry.maxSteps = parsed.maxSteps;
+        if (typeof parsed.taskTimeoutMs === 'number' && parsed.taskTimeoutMs > 0)
+            entry.taskTimeoutMs = parsed.taskTimeoutMs;
         if (typeof parsed.model === 'string' && parsed.model.trim())
             entry.model = parsed.model.trim();
         if (typeof parsed.provider === 'string' && parsed.provider.trim())

package/dist/doctor.js

@@ -0,0 +1,81 @@
+import * as fs from 'fs';
+import { createRequire } from 'module';
+import { testConnection } from './setup.js';
+import { getBashPath, resolveShellType } from './shell.js';
+import { getToolDefinitions, listUnavailableTools } from './tools/index.js';
+const require = createRequire(import.meta.url);
+function playwrightBrowserStatus() {
+    try {
+        const { chromium } = require('playwright');
+        const exe = chromium.executablePath();
+        if (exe && fs.existsSync(exe)) {
+            return { ok: true, detail: exe };
+        }
+        return { ok: false, detail: 'playwright installed but no browser downloaded (run: npx playwright install chromium)' };
+    }
+    catch (err) {
+        return { ok: false, detail: `playwright not available (${String(err?.message ?? err).split('\n')[0]})` };
+    }
+}
+function maskKey(key) {
+    if (!key)
+        return 'missing';
+    if (key.length < 8)
+        return '***';
+    return `${key.slice(0, 6)}***${key.slice(-4)}`;
+}
+// Headless self-diagnosis: every check reports ok/critical/detail, so the
+// CLI can render ✓/✗ and derive an exit code without any interaction.
+export async function collectDoctorChecks(cfg) {
+    const checks = [];
+    checks.push({
+        name: 'Global config',
+        ok: cfg.globalExists,
+        critical: true,
+        detail: cfg.globalExists ? cfg.globalFile : `${cfg.globalFile} (missing — run: autoclaw setup)`
+    });
+    checks.push({
+        name: 'Project config',
+        ok: true,
+        critical: false,
+        detail: cfg.projectExists ? cfg.projectFile : '(none)'
+    });
+    checks.push({
+        name: 'API key',
+        ok: !!cfg.apiKey,
+        critical: true,
+        detail: maskKey(cfg.apiKey)
+    });
+    checks.push({
+        name: 'Endpoint',
+        ok: !!cfg.baseUrl,
+        critical: true,
+        detail: `${cfg.providerLabel} | ${cfg.baseUrl || '?'} | model: ${cfg.model}`
+    });
+    if (cfg.apiKey && cfg.baseUrl && cfg.model) {
+        const t = await testConnection(cfg.baseUrl, cfg.apiKey, cfg.model);
+        checks.push({ name: 'Connection', ok: t.ok, critical: true, detail: t.message });
+    }
+    else {
+        checks.push({ name: 'Connection', ok: false, critical: true, detail: 'skipped (key / baseUrl / model missing)' });
+    }
+    const shellType = resolveShellType(cfg.toolConfig);
+    const bashPath = shellType === 'bash' ? getBashPath() : null;
+    checks.push({
+        name: 'Shell',
+        ok: true,
+        critical: false,
+        detail: bashPath ? `${shellType} (${bashPath})` : shellType
+    });
+    const registered = getToolDefinitions(cfg.toolConfig).length;
+    const missing = listUnavailableTools(cfg.toolConfig);
+    checks.push({
+        name: 'Tools',
+        ok: true,
+        critical: false,
+        detail: `${registered} registered${missing.length ? ` (not configured: ${missing.join(', ')})` : ''}`
+    });
+    const pw = playwrightBrowserStatus();
+    checks.push({ name: 'Playwright browsers', ok: pw.ok, critical: false, detail: pw.detail });
+    return checks;
+}

package/dist/index.js

@@ -7,6 +7,7 @@ import { Agent } from './agent.js';
 import { parseManifest, runBatch } from './batch.js';
 import { PROVIDER_PRESETS, providerNames, resolveProvider } from './providers.js';
 import { fetchModelIds, normalizeBaseUrl, testConnection } from './setup.js';
+import { collectDoctorChecks } from './doctor.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -45,7 +46,7 @@ dotenv.config({ path: GLOBAL_ENV_FILE });
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // In dist/index.js, package.json is usually up one level in the root
 const pkgPath = path.join(__dirname, '..', 'package.json');
-let version = '1.3.2';
+let version = '1.3.4';
 try {
     const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
     version = pkg.version;
@@ -59,9 +60,10 @@ program
     .description('A lightweight AI agent CLI tool')
     .version(version)
     .option('-m, --model <model>', 'Model to use')
-    .option('-P, --provider <name>', 'Use a provider preset (openai, deepseek, moonshot, dashscope, zhipu, openrouter, ollama)')
+    .option('-P, --provider <name>', 'Use a provider preset (openai, deepseek, moonshot, dashscope, zhipu, ark, siliconflow, openrouter, ollama)')
     .option('-n, --no-interactive', 'Exit after processing the initial query (Headless mode)')
     .option('-y, --yes', 'Auto-confirm all tool executions (e.g., shell commands)')
+    .option('--allow-dangerous', 'Let -y run clearly destructive commands (rm -rf, format, shutdown, ...) without the safety block')
     .option('--json', 'Emit NDJSON events on stdout (for orchestrators; use with -n)');
 program
     .command('setup')
@@ -88,6 +90,36 @@ program
     const options = program.opts();
     await runBatchCommand(manifest, options, cmdOptions);
 });
+program
+    .command('doctor')
+    .description('Diagnose configuration and environment (headless)')
+    .action(async () => {
+    const options = program.opts();
+    const { apiKey, baseURL, model, fullConfig } = await resolveRuntime(options, { interactive: false });
+    const providerName = options.provider || process.env.AUTOCLOW_PROVIDER || fullConfig.provider;
+    console.log(chalk.bold.cyan('AutoClaw Doctor 🦞\n'));
+    const checks = await collectDoctorChecks({
+        apiKey,
+        baseUrl: baseURL,
+        model,
+        providerLabel: providerName || 'custom',
+        globalFile: GLOBAL_CONFIG_FILE,
+        projectFile: LOCAL_CONFIG_FILE,
+        globalExists: fs.existsSync(GLOBAL_CONFIG_FILE),
+        projectExists: fs.existsSync(LOCAL_CONFIG_FILE),
+        toolConfig: fullConfig
+    });
+    for (const c of checks) {
+        const mark = c.ok ? chalk.green('✓') : c.critical ? chalk.red('✗') : chalk.yellow('!');
+        console.log(`${mark} ${c.name.padEnd(20)} ${chalk.dim(c.detail)}`);
+    }
+    const failed = checks.filter(c => c.critical && !c.ok);
+    if (failed.length === 0)
+        console.log(chalk.green('\nAll critical checks passed.'));
+    else
+        console.log(chalk.red(`\n${failed.length} critical check(s) failed.`));
+    process.exit(failed.length === 0 ? 0 : 1);
+});
 program.parse(process.argv);
 async function runSetup(options = {}) {
     const isProject = options.project;
@@ -438,7 +470,9 @@ async function runSetup(options = {}) {
 }
 // Shared by `chat` and `batch`: resolve credentials, endpoints and runtime
 // flags from CLI args > env > project config > global config > provider preset.
-async function resolveRuntime(options) {
+// With interactive: false (doctor), a missing key resolves to '' instead of
+// prompting, so the caller can report it.
+async function resolveRuntime(options, opts = {}) {
     // 1. Load Global JSON
     const globalConfig = loadJsonConfig(GLOBAL_CONFIG_FILE);
     // 2. Load Local JSON (Project Level)
@@ -461,6 +495,7 @@ async function resolveRuntime(options) {
     let model = options.model || process.env.OPENAI_MODEL || fullConfig.model || preset?.defaultModel || 'gpt-5.6';
     // Inject Runtime Flags
     fullConfig.autoConfirm = options.yes;
+    fullConfig.allowDangerous = !!options.allowDangerous;
     fullConfig.jsonMode = !!options.json;
     // Usage tracking is opt-in: not every OpenAI-compatible provider accepts
     // stream_options.include_usage, so never force it on.
@@ -492,6 +527,9 @@ async function resolveRuntime(options) {
     if (process.env.WECOM_KEYWORD)
         fullConfig.wecomKeyword = process.env.WECOM_KEYWORD;
     if (!apiKey) {
+        if (opts.interactive === false) {
+            return { apiKey: '', baseURL, model, fullConfig };
+        }
         console.log(chalk.yellow("API Key not found."));
         const { doSetup } = await inquirer.prompt([
             {
@@ -577,7 +615,8 @@ async function runBatchCommand(manifestPath, globalOptions, cmdOptions) {
             ...fullConfig,
             // The results file is the machine-readable contract in batch mode.
             jsonMode: false,
-            maxSteps: entry.maxSteps ?? fullConfig.maxSteps
+            maxSteps: entry.maxSteps ?? fullConfig.maxSteps,
+            taskTimeoutMs: entry.taskTimeoutMs ?? fullConfig.taskTimeoutMs
         };
         const agent = new Agent(apiKey, taskBaseURL, taskModel, taskConfig);
         const start = Date.now();
@@ -629,9 +668,9 @@ async function runChat(queryParts, options) {
         }
         const result = await agent.chat(initialQuery);
         // Headless mode exit — the exit code is the orchestrator-facing outcome:
-        // 0 completed, 1 hard failure, 2 step cap reached (task unfinished).
+        // 0 completed, 1 hard failure, 2 unfinished (step cap or wall-clock timeout).
         if (!options.interactive) {
-            process.exit(result.status === 'completed' ? 0 : result.status === 'max_steps' ? 2 : 1);
+            process.exit(result.status === 'completed' ? 0 : result.status === 'max_steps' || result.status === 'timeout' ? 2 : 1);
         }
     }
     // Main chat loop

package/dist/providers.js

@@ -29,6 +29,18 @@ export const PROVIDER_PRESETS = {
         defaultModel: 'glm-5',
         apiKeyEnv: 'ZHIPU_API_KEY'
     },
+    ark: {
+        label: 'Volcano Ark (Doubao/DeepSeek)',
+        baseUrl: 'https://ark.cn-beijing.volces.com/api/v3',
+        defaultModel: 'deepseek-v4-flash',
+        apiKeyEnv: 'ARK_API_KEY'
+    },
+    siliconflow: {
+        label: 'SiliconFlow',
+        baseUrl: 'https://api.siliconflow.cn/v1',
+        defaultModel: 'deepseek-ai/DeepSeek-V4',
+        apiKeyEnv: 'SILICONFLOW_API_KEY'
+    },
     openrouter: {
         label: 'OpenRouter',
         baseUrl: 'https://openrouter.ai/api/v1',

package/dist/tools/core.js

@@ -3,11 +3,49 @@ import * as path from 'path';
 import inquirer from 'inquirer';
 import chalk from 'chalk';
 import { execShellCommand } from '../shell.js';
+import * as os from 'os';
 const DEFAULT_SHELL_TIMEOUT_MS = 120000;
 const SHELL_MAX_BUFFER = 10 * 1024 * 1024;
 // Bounded reads keep a huge file from exhausting memory or the model context;
 // the agent-level truncation in truncate.ts applies on top of this.
 const READ_FILE_MAX_BYTES = 1024 * 1024;
+// Even with -y, an unattended agent must not execute clearly destructive
+// commands — a poisoned tool result (e.g. prompt injection via a web page)
+// would otherwise reach the shell directly. Matched commands are refused
+// with a message the model can act on; --allow-dangerous overrides.
+export const DANGEROUS_PATTERNS = [
+    { re: /\brm\s+(?:-\w+\s+)*-\w*[rR]\w*[fF]\b/, label: 'rm with recursive+force' },
+    { re: /\b(?:rd|rmdir|del|erase)\s+\/[sS]\b/, label: 'Windows recursive delete (rd/del /s)' },
+    { re: /\bRemove-Item\b[^;\n]*-(?:Recurse[^;\n]*Force|Force[^;\n]*Recurse)/i, label: 'PowerShell Remove-Item -Recurse -Force' },
+    { re: /\b(?:format|diskpart)\b/i, label: 'disk format / diskpart' },
+    { re: /\bmkfs(?:\.\w+)?\b/i, label: 'mkfs' },
+    { re: /\bdd\b[^|]*\bof=/i, label: 'dd raw write' },
+    { re: /(?:>>?|tee)\s*\/dev\/(?:sd|nvme|hd|vd)[a-z]/i, label: 'write to block device' },
+    { re: /\b(?:shutdown|reboot|halt|poweroff)\b/i, label: 'host power control' },
+    { re: /\breg\s+delete\b/i, label: 'registry delete' }
+];
+export function matchDangerousPattern(command) {
+    const hit = DANGEROUS_PATTERNS.find(p => p.re.test(command));
+    return hit ? hit.label : null;
+}
+// An unattended agent reads web pages and repos; a prompt injection must not
+// end up reading AutoClaw's own credential stores (or classic .env files)
+// and exfiltrating them. Blocked for read_file/write_file unless
+// --allow-dangerous. execute_shell_command is not pattern-restricted here.
+export function isSensitivePath(p) {
+    const norm = path.normalize(String(p)).toLowerCase();
+    const protectedFiles = [
+        path.join(os.homedir(), '.autoclaw', 'setting.json').toLowerCase(),
+        path.join(os.homedir(), '.autoclaw', '.env').toLowerCase(),
+        path.join(process.cwd(), '.autoclaw', 'setting.json').toLowerCase()
+    ];
+    if (protectedFiles.includes(norm))
+        return true;
+    return path.basename(norm).startsWith('.env');
+}
+function sensitivePathBlock(p, verb) {
+    return `Error: ${p} is blocked by AutoClaw safety policy (credential/secret store). It was NOT ${verb === 'read' ? 'read' : 'written'}. If this task genuinely requires it, restart AutoClaw with --allow-dangerous.`;
+}
 export const ShellTool = {
     name: "Shell Execution",
     definition: {
@@ -28,6 +66,14 @@ export const ShellTool = {
     handler: async (args, config) => {
         console.log(chalk.yellow(`\nAI wants to execute: `) + chalk.bold(args.command));
         console.log(chalk.dim(`Reason: ${args.rationale}`));
+        // Safety gate runs first: blocked commands are refused even with --yes.
+        if (!config?.allowDangerous) {
+            const label = matchDangerousPattern(args.command);
+            if (label) {
+                console.log(chalk.red(`\n[blocked] ${label}`));
+                return `Error: command blocked by AutoClaw safety policy (matched: ${label}). It was NOT executed. If this task genuinely requires it, the user must restart AutoClaw with --allow-dangerous; otherwise find a safer way to achieve the same goal.`;
+            }
+        }
         const timeoutMs = Number(config?.shellTimeout || process.env.AUTOCLOW_SHELL_TIMEOUT || DEFAULT_SHELL_TIMEOUT_MS);
         // Check for auto-confirm flag
         if (!config?.autoConfirm) {
@@ -80,7 +126,10 @@ export const ReadFileTool = {
             }
         }
     },
-    handler: async (args) => {
+    handler: async (args, config) => {
+        if (!config?.allowDangerous && isSensitivePath(args.path)) {
+            return sensitivePathBlock(args.path, 'read');
+        }
         let fh;
         try {
             fh = await fs.open(args.path, 'r');
@@ -124,7 +173,10 @@ export const WriteFileTool = {
             }
         }
     },
-    handler: async (args) => {
+    handler: async (args, config) => {
+        if (!config?.allowDangerous && isSensitivePath(args.path)) {
+            return sensitivePathBlock(args.path, 'write');
+        }
         try {
             await fs.mkdir(path.dirname(args.path), { recursive: true });
             await fs.writeFile(args.path, args.content, 'utf-8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autoclaw",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "type": "module",
   "main": "dist/index.js",
   "bin": {