cc-claw 0.2.4 → 0.2.5

package/dist/cli.js

@@ -48,7 +48,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = true ? "0.2.4" : (() => {
+    VERSION = true ? "0.2.5" : (() => {
       try {
         return JSON.parse(readFileSync(join2(process.cwd(), "package.json"), "utf-8")).version ?? "unknown";
       } catch {
@@ -345,7 +345,7 @@ function claimTask(db3, taskId, agentId) {
   if (blockedBy.length > 0) {
     const placeholders = blockedBy.map(() => "?").join(",");
     const incomplete = db3.prepare(
-      `SELECT COUNT(*) as count FROM agent_tasks WHERE id IN (${placeholders}) AND status NOT IN ('completed')`
+      `SELECT COUNT(*) as count FROM agent_tasks WHERE id IN (${placeholders}) AND status NOT IN ('completed', 'failed', 'abandoned')`
     ).get(...blockedBy);
     if (incomplete.count > 0) return false;
   }
@@ -518,19 +518,18 @@ function cleanupActivity(db3) {
   if (aged.changes > 0) {
     log(`[activity] Pruned ${aged.changes} events older than ${RETENTION_DAYS} days`);
   }
-  const chatIds = db3.prepare(
-    "SELECT DISTINCT chatId FROM activity_log"
-  ).all();
-  for (const { chatId } of chatIds) {
-    const excess = db3.prepare(`
-      DELETE FROM activity_log
-      WHERE chatId = ? AND id NOT IN (
-        SELECT id FROM activity_log WHERE chatId = ? ORDER BY createdAt DESC LIMIT ?
-      )
-    `).run(chatId, chatId, MAX_ROWS_PER_CHAT);
-    if (excess.changes > 0) {
-      log(`[activity] Capped chat ${chatId}: pruned ${excess.changes} excess rows`);
-    }
+  const excess = db3.prepare(`
+    DELETE FROM activity_log
+    WHERE id NOT IN (
+      SELECT id FROM (
+        SELECT id, ROW_NUMBER() OVER (PARTITION BY chatId ORDER BY createdAt DESC) AS rn
+        FROM activity_log
+      ) ranked
+      WHERE rn <= ?
+    )
+  `).run(MAX_ROWS_PER_CHAT);
+  if (excess.changes > 0) {
+    log(`[activity] Capped activity log: pruned ${excess.changes} excess rows`);
   }
 }
 var RETENTION_DAYS, MAX_ROWS_PER_CHAT;
@@ -1361,7 +1360,7 @@ function searchMemories(queryText, limit = 3) {
       for (const mem of ftsResults) {
         db.prepare(`
           UPDATE memories
-          SET salience = MIN(salience + 0.1, 5.0),
+          SET salience = MAX(0, MIN(1.0, salience + 0.1)),
               access_count = access_count + 1,
               last_accessed = datetime('now')
           WHERE id = ?
@@ -1640,7 +1639,7 @@ function searchSessionSummaries(queryText, limit = 3) {
       for (const s of results) {
         db.prepare(`
           UPDATE session_summaries
-          SET salience = MIN(salience + 0.1, 5.0)
+          SET salience = MAX(0, MIN(1.0, salience + 0.1))
           WHERE id = ?
         `).run(s.id);
       }
@@ -2233,7 +2232,7 @@ var init_claude = __esm({
         }
         try {
           this._resolvedPath = execSync("which claude", { encoding: "utf-8" }).trim();
-        } catch {
+        } catch (_err) {
           const candidates = [
             "/opt/homebrew/bin/claude",
             "/usr/local/bin/claude"
@@ -2712,8 +2711,7 @@ function normalizeFtsScores(items) {
   const ranks = items.map((it) => Math.abs(it._ftsRank ?? 0));
   const maxRank = Math.max(...ranks, 1e-3);
   for (let i = 0; i < items.length; i++) {
-    const id = items[i].id;
-    scores.set(id, ranks[i] / maxRank);
+    scores.set(items[i].id, ranks[i] / maxRank);
   }
   return scores;
 }
@@ -2929,13 +2927,13 @@ function syncNativeCliFiles() {
   } catch {
   }
   try {
-    const soulStat = statSync(SOUL_PATH);
-    const userStat = statSync(USER_PATH);
-    if (soulStat.mtimeMs === lastSoulMtime && userStat.mtimeMs === lastUserMtime) {
+    const soulMtime = existsSync4(SOUL_PATH) ? statSync(SOUL_PATH).mtimeMs : 0;
+    const userMtime = existsSync4(USER_PATH) ? statSync(USER_PATH).mtimeMs : 0;
+    if (soulMtime === lastSoulMtime && userMtime === lastUserMtime) {
       return;
     }
-    lastSoulMtime = soulStat.mtimeMs;
-    lastUserMtime = userStat.mtimeMs;
+    lastSoulMtime = soulMtime;
+    lastUserMtime = userMtime;
   } catch {
   }
   const nativeContent = [
@@ -3267,13 +3265,14 @@ ${transcript}`;
         stdio: ["ignore", "pipe", "pipe"],
         ...config2.cwd ? { cwd: config2.cwd } : {}
       });
+      proc.stderr?.resume();
+      const rl2 = createInterface({ input: proc.stdout });
       const timeout = setTimeout(() => {
         warn(`[summarize] Timeout after ${SUMMARIZE_TIMEOUT_MS / 1e3}s for chat ${chatId} \u2014 killing process`);
+        rl2.close();
         proc.kill("SIGTERM");
         setTimeout(() => proc.kill("SIGKILL"), 2e3);
       }, SUMMARIZE_TIMEOUT_MS);
-      proc.stderr?.resume();
-      const rl2 = createInterface({ input: proc.stdout });
       rl2.on("line", (line) => {
         if (!line.trim()) return;
         let msg;
@@ -3295,9 +3294,9 @@ ${transcript}`;
           if (ev.type === "result") {
             resultText = ev.resultText || accumulatedText;
             if (ev.usage) {
-              inputTokens = ev.usage.input;
-              outputTokens = ev.usage.output;
-              cacheReadTokens = ev.usage.cacheRead;
+              inputTokens += ev.usage.input;
+              outputTokens += ev.usage.output;
+              cacheReadTokens += ev.usage.cacheRead;
             }
             if (adapter.shouldKillOnResult()) {
               rl2.close();
@@ -3482,8 +3481,9 @@ import { spawn as spawn2 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
 import { readFileSync as readFileSync4 } from "fs";
 function stripFrontmatter(text) {
-  const match = text.match(/^---\s*\n[\s\S]*?\n---\s*\n?/);
-  return match ? text.slice(match[0].length) : text;
+  const match = text.match(/^---\s*\n[\s\S]*?\n---\s*\n?/m);
+  if (!match || match.index !== 0) return text;
+  return text.slice(match[0].length);
 }
 function buildAgentPrompt(opts, runnerSkillPath) {
   const parts = [];
@@ -3782,8 +3782,8 @@ __export(loader_exports, {
 import { readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
 import { join as join6 } from "path";
 function parseFrontmatter(content) {
-  const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/);
-  if (!match) return { meta: {}, body: content.trim() };
+  const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/m);
+  if (!match || match.index !== 0) return { meta: {}, body: content.trim() };
   const yamlBlock = match[1];
   const body = match[2].trim();
   const meta = {};
@@ -4283,6 +4283,7 @@ function startNextQueued(chatId) {
     maxRuntimeMs: agent.maxRuntimeMs,
     mcps: JSON.parse(agent.mcpsAdded)
   }).catch((err) => {
+    updateAgentStatus(db3, next.id, "failed");
     error(`[orchestrator] Failed to start queued agent ${next.id}:`, err);
   });
 }
@@ -5210,7 +5211,6 @@ var init_server = __esm({
 var agent_exports = {};
 __export(agent_exports, {
   askAgent: () => askAgent,
-  askClaude: () => askClaude,
   isAgentActive: () => isAgentActive,
   isChatBusy: () => isChatBusy,
   stopAgent: () => stopAgent
@@ -5310,7 +5310,8 @@ function spawnQuery(adapter, config2, model2, cancelState, onStream, onToolActio
             if (onToolAction && ev.toolName) {
               const toolInput = ev.toolInput ?? {};
               if (ev.toolId) pendingTools.set(ev.toolId, { name: ev.toolName, input: toolInput });
-              onToolAction(ev.toolName, toolInput, void 0).catch(() => {
+              onToolAction(ev.toolName, toolInput, void 0).catch((err) => {
+                error("[agent] tool action error:", err);
               });
             }
             break;
@@ -5319,10 +5320,12 @@ function spawnQuery(adapter, config2, model2, cancelState, onStream, onToolActio
               const pending = ev.toolId ? pendingTools.get(ev.toolId) : void 0;
               if (pending) {
                 pendingTools.delete(ev.toolId);
-                onToolAction(pending.name, pending.input, ev.toolOutput ?? "").catch(() => {
+                onToolAction(pending.name, pending.input, ev.toolOutput ?? "").catch((err) => {
+                  error("[agent] tool action error:", err);
                 });
               } else if (ev.toolName) {
-                onToolAction(ev.toolName, {}, ev.toolOutput ?? "").catch(() => {
+                onToolAction(ev.toolName, {}, ev.toolOutput ?? "").catch((err) => {
+                  error("[agent] tool action error:", err);
                 });
               }
             }
@@ -5344,7 +5347,10 @@ function spawnQuery(adapter, config2, model2, cancelState, onStream, onToolActio
               cacheRead = ev.usage.cacheRead;
             }
             if (adapter.shouldKillOnResult()) {
-              rl2.close();
+              try {
+                rl2.close();
+              } catch {
+              }
               proc.kill("SIGTERM");
             }
             break;
@@ -5466,7 +5472,7 @@ function injectMcpConfig(adapterId, args, mcpConfigPath) {
   if (!flag) return args;
   return [...args, ...flag, mcpConfigPath];
 }
-var __filename2, __dirname2, activeChats, chatLocks, SPAWN_TIMEOUT_MS, MCP_CONFIG_FLAG, askClaude;
+var __filename2, __dirname2, activeChats, chatLocks, SPAWN_TIMEOUT_MS, MCP_CONFIG_FLAG;
 var init_agent = __esm({
   "src/agent.ts"() {
     "use strict";
@@ -5487,7 +5493,6 @@ var init_agent = __esm({
     MCP_CONFIG_FLAG = {
       claude: ["--mcp-config"]
     };
-    askClaude = askAgent;
   }
 });
 
@@ -5917,6 +5922,11 @@ async function executeJob(job) {
     return;
   }
   runningJobs.add(job.id);
+  const timer = activeTimers.get(job.id);
+  if (timer instanceof Cron) {
+    const nextRun = timer.nextRun();
+    if (nextRun) updateJobNextRun(job.id, nextRun.toISOString());
+  }
   const t0 = Date.now();
   const resolvedModel = resolveJobModel(job);
   const runId = insertJobRun(job.id, resolvedModel);
@@ -5942,11 +5952,6 @@ async function executeJob(job) {
       addUsage(job.chatId, response.usage.input, response.usage.output, response.usage.cacheRead, resolvedModel);
     }
     await deliverJobOutput(job, response.text);
-    const timer = activeTimers.get(job.id);
-    if (timer instanceof Cron) {
-      const nextRun = timer.nextRun();
-      if (nextRun) updateJobNextRun(job.id, nextRun.toISOString());
-    }
   } catch (err) {
     const durationMs = Date.now() - t0;
     const errorClass = classifyError(err);
@@ -6082,9 +6087,9 @@ function writeEnvWrapper(server) {
   mkdirSync4(dir, { recursive: true, mode: 448 });
   const lines = ["#!/bin/sh"];
   for (const [k, v] of Object.entries(server.env ?? {})) {
-    lines.push(`export ${k}="${v.replace(/"/g, '\\"')}"`);
+    lines.push(`export ${k}='${v.replace(/'/g, "'\\''")}'`);
   }
-  lines.push(`exec ${server.command} ${(server.args ?? []).map((a) => `"${a}"`).join(" ")}`);
+  lines.push(`exec ${server.command} ${(server.args ?? []).map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`);
   const path = join8(dir, `wrapper-${server.name}.sh`);
   writeFileSync4(path, lines.join("\n") + "\n", { mode: 448 });
   return path;
@@ -6254,12 +6259,7 @@ function templateReplace(args, vars) {
 }
 function configToRunner(config2) {
   const exePath = resolveExecutable(config2);
-  let parseLine;
-  if (config2.outputParsing.preset) {
-    parseLine = buildGenericParser(config2);
-  } else {
-    parseLine = buildGenericParser(config2);
-  }
+  const parseLine = buildGenericParser(config2);
   return {
     id: config2.id,
     displayName: config2.displayName,
@@ -6355,6 +6355,12 @@ function registerConfigRunners() {
 }
 function watchRunnerConfigs(onChange) {
   if (!existsSync9(RUNNERS_PATH)) return;
+  for (const prev of watchedFiles) {
+    if (!existsSync9(prev)) {
+      unwatchFile(prev);
+      watchedFiles.delete(prev);
+    }
+  }
   const files = readdirSync4(RUNNERS_PATH).filter((f) => f.endsWith(".json"));
   for (const file of files) {
     const fullPath = join9(RUNNERS_PATH, file);
@@ -6521,7 +6527,10 @@ function formatForTelegram(markdown) {
   html = html.replace(/^#{1,6}\s+(.+)$/gm, "<b>$1</b>");
   html = html.replace(/^[-*_]{3,}$/gm, "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   html = html.replace(/^[\s]*[-*]\s+/gm, "\u2022 ");
-  html = html.replace(/\x00CODE(\d+)\x00/g, (_, idx) => codeBlocks[parseInt(idx, 10)]);
+  html = html.replace(/\x00CODE(\d+)\x00/g, (match, idx) => {
+    const block = codeBlocks[parseInt(idx, 10)];
+    return block !== void 0 ? block : match;
+  });
   return html.trim();
 }
 function escapeOutsideCode(text) {
@@ -6561,6 +6570,10 @@ var init_telegram = __esm({
 
 // src/channels/telegram.ts
 import { Bot, InlineKeyboard, InputFile } from "grammy";
+function numericChatId(chatId) {
+  const raw = chatId.includes(":") ? chatId.split(":").pop() : chatId;
+  return parseInt(raw);
+}
 var TelegramChannel;
 var init_telegram2 = __esm({
   "src/channels/telegram.ts"() {
@@ -6710,13 +6723,13 @@ var init_telegram2 = __esm({
         await this.bot.stop();
       }
       async sendTyping(chatId) {
-        await this.bot.api.sendChatAction(parseInt(chatId), "typing");
+        await this.bot.api.sendChatAction(numericChatId(chatId), "typing");
       }
       async sendText(chatId, text, parseMode) {
         if (parseMode === "plain") {
           const plainChunks = splitMessage(text);
           for (const chunk of plainChunks) {
-            await this.bot.api.sendMessage(parseInt(chatId), chunk);
+            await this.bot.api.sendMessage(numericChatId(chatId), chunk);
           }
           return;
         }
@@ -6724,12 +6737,12 @@ var init_telegram2 = __esm({
         const chunks = splitMessage(formatted);
         for (const chunk of chunks) {
           try {
-            await this.bot.api.sendMessage(parseInt(chatId), chunk, {
+            await this.bot.api.sendMessage(numericChatId(chatId), chunk, {
               parse_mode: "HTML"
             });
           } catch {
             await this.bot.api.sendMessage(
-              parseInt(chatId),
+              numericChatId(chatId),
               chunk.replace(/<[^>]+>/g, "")
             );
           }
@@ -6737,13 +6750,13 @@ var init_telegram2 = __esm({
       }
       async sendVoice(chatId, audioBuffer, fileName) {
         await this.bot.api.sendVoice(
-          parseInt(chatId),
+          numericChatId(chatId),
           new InputFile(audioBuffer, fileName ?? "response.ogg")
         );
       }
       async sendFile(chatId, buffer, fileName) {
         await this.bot.api.sendDocument(
-          parseInt(chatId),
+          numericChatId(chatId),
           new InputFile(buffer, fileName)
         );
       }
@@ -6755,7 +6768,7 @@ var init_telegram2 = __esm({
       }
       async sendTextReturningId(chatId, text, parseMode) {
         try {
-          const msg = await this.bot.api.sendMessage(parseInt(chatId), text);
+          const msg = await this.bot.api.sendMessage(numericChatId(chatId), text);
           return msg.message_id.toString();
         } catch {
           return void 0;
@@ -6764,14 +6777,14 @@ var init_telegram2 = __esm({
       async editText(chatId, messageId, text, parseMode) {
         const formatted = parseMode === "html" ? text : formatForTelegram(text);
         try {
-          await this.bot.api.editMessageText(parseInt(chatId), parseInt(messageId), formatted, {
+          await this.bot.api.editMessageText(numericChatId(chatId), parseInt(messageId), formatted, {
             parse_mode: "HTML"
           });
           return true;
         } catch {
           try {
             await this.bot.api.editMessageText(
-              parseInt(chatId),
+              numericChatId(chatId),
               parseInt(messageId),
               formatted.replace(/<[^>]+>/g, "")
             );
@@ -6793,13 +6806,13 @@ var init_telegram2 = __esm({
           }
           keyboard.row();
         }
-        await this.bot.api.sendMessage(parseInt(chatId), text, {
+        await this.bot.api.sendMessage(numericChatId(chatId), text, {
           reply_markup: keyboard
         });
       }
       async reactToMessage(chatId, messageId, emoji) {
         try {
-          await this.bot.api.setMessageReaction(parseInt(chatId), parseInt(messageId), [
+          await this.bot.api.setMessageReaction(numericChatId(chatId), parseInt(messageId), [
             { type: "emoji", emoji }
           ]);
         } catch {
@@ -7093,6 +7106,9 @@ async function installSkillFromGitHub(urlOrShorthand) {
       stdio: "pipe",
       timeout: 3e4
     });
+    if (!existsSync10(join11(tmpDir, ".git"))) {
+      return { success: false, error: "Git clone failed: no .git directory produced" };
+    }
     const searchRoot = subPath ? join11(tmpDir, subPath) : tmpDir;
     const skillDir = await findSkillDir(searchRoot);
     if (!skillDir) {
@@ -7165,7 +7181,12 @@ async function findSkillDir(root) {
     const entries = await readdir2(root, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-      const subEntries = await readdir2(join11(root, entry.name), { withFileTypes: true });
+      let subEntries;
+      try {
+        subEntries = await readdir2(join11(root, entry.name), { withFileTypes: true });
+      } catch {
+        continue;
+      }
       for (const sub of subEntries) {
         if (!sub.isDirectory() || sub.name.startsWith(".")) continue;
         for (const c of candidates) {
@@ -7371,8 +7392,7 @@ function stopAllHeartbeats() {
 }
 function startAllHeartbeats() {
   try {
-    const { getDb: getDb2 } = (init_store4(), __toCommonJS(store_exports2));
-    const db3 = getDb2();
+    const db3 = getDb();
     const rows = db3.prepare(
       "SELECT chat_id FROM chat_heartbeat WHERE enabled = 1"
     ).all();
@@ -7610,9 +7630,11 @@ async function macOsTts(text) {
   await execFileAsync2("say", ["-o", tmpAiff, sanitized]);
   await execFileAsync2("ffmpeg", ["-y", "-i", tmpAiff, "-c:a", "libopus", "-b:a", "64k", tmpOgg]);
   const oggBuffer = await readFile4(tmpOgg);
-  unlink(tmpAiff).catch(() => {
+  unlink(tmpAiff).catch((err) => {
+    error("[tts] cleanup failed:", err);
   });
-  unlink(tmpOgg).catch(() => {
+  unlink(tmpOgg).catch((err) => {
+    error("[tts] cleanup failed:", err);
   });
   return oggBuffer;
 }
@@ -7743,8 +7765,7 @@ async function startWizard(chatId, input, channel) {
     step: "schedule",
     task: parsed?.task || input,
     scheduleType: parsed?.scheduleType,
-    cron: parsed?.cron,
-    everyMs: parsed?.everyMs
+    cron: parsed?.cron
   };
   if (parsed?.cron) {
     pending.step = "timezone";
@@ -10548,10 +10569,18 @@ async function main() {
   bootstrapBuiltinMcps(getDb());
   const SUMMARIZE_TIMEOUT_MS = 3e4;
   try {
-    await Promise.race([
-      summarizeAllPending(),
-      new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), SUMMARIZE_TIMEOUT_MS))
-    ]);
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timeout")), SUMMARIZE_TIMEOUT_MS);
+    });
+    try {
+      await Promise.race([
+        summarizeAllPending(),
+        timeoutPromise
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
   } catch {
     log("[cc-claw] Session summarization skipped (timeout or backend unavailable)");
   }
@@ -10782,7 +10811,7 @@ function uninstallMacOS() {
 }
 function statusMacOS() {
   try {
-    const out = execSync5("launchctl list | grep cc-claw", { encoding: "utf-8" }).trim();
+    const out = execSync5("launchctl list | grep cc-claw", { shell: "/bin/sh", encoding: "utf-8" }).trim();
     if (out) {
       const parts = out.split(/\s+/);
       const pid = parts[0];
@@ -11324,7 +11353,9 @@ async function doctorCommand(globalOpts, localOpts) {
       const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store4(), store_exports2));
       const readDb = openDatabaseReadOnly2();
       const journal = readDb.prepare("PRAGMA journal_mode").get();
-      if (journal.journal_mode === "wal") {
+      if (!journal) {
+        checks.push({ name: "WAL mode", status: "warning", message: "could not read journal_mode" });
+      } else if (journal.journal_mode === "wal") {
         checks.push({ name: "WAL mode", status: "ok", message: "enabled" });
       } else {
         checks.push({ name: "WAL mode", status: "warning", message: `${journal.journal_mode} (expected wal)` });
@@ -12128,8 +12159,8 @@ async function agentsSpawn(globalOpts, opts) {
     role: opts.role
   });
   if (res.ok) {
+    const { success: s } = await Promise.resolve().then(() => (init_format(), format_exports));
     output(res.data, (d) => {
-      const { success: s } = (init_format(), __toCommonJS(format_exports));
       return `
   ${s(`Agent spawned: ${d.agentId?.slice(0, 8) ?? "?"} (${opts.runner})`)}
 `;
@@ -12393,13 +12424,21 @@ async function usageTokens(globalOpts) {
   const { getAllAdapters: getAllAdapters2, getAllBackendIds: getAllBackendIds2 } = await Promise.resolve().then(() => (init_backends(), backends_exports));
   const readDb = openDatabaseReadOnly2();
   const backendIds = getAllBackendIds2();
+  const adapters2 = getAllAdapters2();
   const cutoff24h = new Date(Date.now() - 864e5).toISOString();
   const data = backendIds.map((bid) => {
-    const row = readDb.prepare(`
-      SELECT COALESCE(SUM(input_tokens),0) as input_tokens, COALESCE(SUM(output_tokens),0) as output_tokens, COUNT(*) as request_count
-      FROM usage_log WHERE model IN (SELECT DISTINCT model FROM usage_log) AND created_at > ?
-    `).get(cutoff24h);
-    const adapter = getAllAdapters2().find((a) => a.id === bid);
+    const adapter = adapters2.find((a) => a.id === bid);
+    const modelIds = adapter ? Object.keys(adapter.pricing) : [];
+    let row;
+    if (modelIds.length > 0) {
+      const placeholders = modelIds.map(() => "?").join(",");
+      row = readDb.prepare(`
+        SELECT COALESCE(SUM(input_tokens),0) as input_tokens, COALESCE(SUM(output_tokens),0) as output_tokens, COUNT(*) as request_count
+        FROM usage_log WHERE model IN (${placeholders}) AND created_at > ?
+      `).get(...modelIds, cutoff24h);
+    } else {
+      row = { input_tokens: 0, output_tokens: 0, request_count: 0 };
+    }
     return { backend: bid, displayName: adapter?.displayName ?? bid, ...row };
   });
   readDb.close();
@@ -12496,6 +12535,7 @@ async function configList(globalOpts) {
   const config2 = {};
   for (const key of RUNTIME_KEYS) {
     const { table, col } = KEY_TABLE_MAP[key];
+    if (!ALLOWED_TABLES.has(table) || !ALLOWED_COLS.has(col)) continue;
     try {
       const row = readDb.prepare(`SELECT ${col} FROM ${table} WHERE chat_id = ?`).get(chatId);
       config2[key] = row ? row[col] : null;
@@ -12527,6 +12567,10 @@ async function configGet(globalOpts, key) {
   const readDb = openDatabaseReadOnly2();
   const chatId = resolveChatId(globalOpts);
   const { table, col } = KEY_TABLE_MAP[key];
+  if (!ALLOWED_TABLES.has(table) || !ALLOWED_COLS.has(col)) {
+    outputError("INVALID_KEY", `Invalid config mapping for "${key}".`);
+    process.exit(1);
+  }
   let value = null;
   try {
     const row = readDb.prepare(`SELECT ${col} FROM ${table} WHERE chat_id = ?`).get(chatId);
@@ -12585,7 +12629,7 @@ async function configEnv(_globalOpts) {
     return lines.join("\n");
   });
 }
-var RUNTIME_KEYS, KEY_TABLE_MAP;
+var RUNTIME_KEYS, KEY_TABLE_MAP, ALLOWED_TABLES, ALLOWED_COLS;
 var init_config = __esm({
   "src/cli/commands/config.ts"() {
     "use strict";
@@ -12603,6 +12647,8 @@ var init_config = __esm({
       cwd: { table: "chat_cwd", col: "cwd" },
       voice: { table: "chat_voice", col: "enabled" }
     };
+    ALLOWED_TABLES = new Set(Object.values(KEY_TABLE_MAP).map((v) => v.table));
+    ALLOWED_COLS = new Set(Object.values(KEY_TABLE_MAP).map((v) => v.col));
   }
 });
 
@@ -12676,11 +12722,14 @@ __export(permissions_exports, {
   verboseSet: () => verboseSet
 });
 import { existsSync as existsSync30 } from "fs";
-async function permissionsGet(globalOpts) {
+function ensureDb2() {
   if (!existsSync30(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
+}
+async function permissionsGet(globalOpts) {
+  ensureDb2();
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store4(), store_exports2));
   const readDb = openDatabaseReadOnly2();
   const chatId = resolveChatId(globalOpts);
@@ -12712,10 +12761,7 @@ async function permissionsSet(globalOpts, mode) {
   }
 }
 async function toolsList(globalOpts) {
-  if (!existsSync30(DB_PATH)) {
-    outputError("DB_NOT_FOUND", "Database not found.");
-    process.exit(1);
-  }
+  ensureDb2();
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store4(), store_exports2));
   const readDb = openDatabaseReadOnly2();
   const chatId = resolveChatId(globalOpts);
@@ -12776,10 +12822,7 @@ async function toggleTool2(globalOpts, name, enabled) {
   }
 }
 async function verboseGet(globalOpts) {
-  if (!existsSync30(DB_PATH)) {
-    outputError("DB_NOT_FOUND", "Database not found.");
-    process.exit(1);
-  }
+  ensureDb2();
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store4(), store_exports2));
   const readDb = openDatabaseReadOnly2();
   const chatId = resolveChatId(globalOpts);
@@ -13682,7 +13725,7 @@ async function requiredInput(prompt, existing) {
 }
 async function validateBotToken(token) {
   try {
-    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
+    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`, { signal: AbortSignal.timeout(1e4) });
     const data = await res.json();
     if (data.ok && data.result?.username) {
       return { valid: true, botName: data.result.username };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-claw",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "CC-Claw: Personal AI assistant on Telegram — multi-backend (Claude, Gemini, Codex), sub-agent orchestration, MCP management",
   "type": "module",
   "main": "dist/cli.js",