cclawd 2026.3.32 → 2026.3.34

package/dist/.buildstamp

@@ -1 +1 @@
-{"builtAt":1777454050485,"head":"eb632335a11c87b29d396421f43465d78b7769b4"}
+{"builtAt":1778821873251,"head":"33af9820fbbb92c7a3447f0970231f6607315881"}

package/dist/{agents-Bg_6nINh.js → agents-Dyld1Y9W.js}

@@ -20,7 +20,7 @@ import { i as loadAgentIdentity, n as buildAgentSummaries, o as pruneAgentConfig
 import { a as parseBindingSpecs, i as describeBinding, n as applyAgentBindings, o as removeAgentBindings, r as buildChannelBindings, t as requireValidConfigSnapshot } from "./config-validation-9iWWSktF.js";
 import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Bkr-WsTr.js";
 import { n as applyAuthChoice, t as warnIfModelConfigLooksOff } from "./auth-choice-DdOY5kEs.js";
-import { i as setupChannels } from "./onboard-channels-DG50alVJ.js";
+import { i as setupChannels } from "./onboard-channels-DdliUHhn.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region src/commands/agents.command-shared.ts

package/dist/{agents-DpCTT1k5.js → agents-sKzdFrEs.js}

@@ -252,9 +252,9 @@ import "./setup-core-CcGzCpOK.js";
 import "./shared-x4Yc8-25.js";
 import "./setup-entry-CcHvI1Mu.js";
 import "./reactions-CVOq_v6N.js";
-import "./feishu-BTpHzo5G.js";
+import "./feishu-D7a16iAg.js";
 import "./runtime-api-lhuSYASv.js";
-import "./channel-CpCgSOBB.js";
+import "./channel-Cb_TWyxU.js";
 import "./send-BIaD51-A.js";
 import "./runtime-p5-el0rU.js";
 import "./setup-core-Bw009yg5.js";
@@ -303,7 +303,7 @@ import "./agents.config-siTlMqn8.js";
 import "./provider-auth-choice-helpers-fXJv3eWi.js";
 import "./provider-auth-guidance-DXgeysMX.js";
 import "./config-validation-9iWWSktF.js";
-import { t as agentsListCommand } from "./agents-Bg_6nINh.js";
+import { t as agentsListCommand } from "./agents-Dyld1Y9W.js";
 import "./provider-auth-choices-D3uPSLCc.js";
 import "./provider-wizard-D8q7vx9b.js";
 import "./auth-choice-options-DGRXgwnh.js";
@@ -312,5 +312,5 @@ import "./provider-auth-choice-B6Vf-54o.js";
 import "./auth-choice.apply-helpers-DnZSQbUl.js";
 import "./provider-auth-choice-preference-MiQguMwm.js";
 import "./auth-choice-DdOY5kEs.js";
-import "./onboard-channels-DG50alVJ.js";
+import "./onboard-channels-DdliUHhn.js";
 export { agentsListCommand };

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "2026.3.32",
-  "commit": "eb632335a11c87b29d396421f43465d78b7769b4",
-  "builtAt": "2026-04-29T09:14:29.159Z"
+  "version": "2026.3.34",
+  "commit": "33af9820fbbb92c7a3447f0970231f6607315881",
+  "builtAt": "2026-05-15T05:12:00.197Z"
 }

package/dist/{channel-CpCgSOBB.js → channel-Cb_TWyxU.js}

@@ -1051,7 +1051,8 @@ async function checkFeishuRealPersonAuthStatus(params) {
 	if (status === "pending") return {
 		status: "pending",
 		verificationUrl: resolveVerificationUrl(certToken),
-		certToken
+		certToken,
+		promptKind: userAuth.promptKind
 	};
 	return { status: "failed" };
 }
@@ -1064,6 +1065,7 @@ async function resolveFeishuRealPersonAuthGate(params) {
 		params.log(`[real-person-auth] authH5BaseUrl: ${authH5BaseUrl}`);
 		const userAuth = authData[params.senderId];
 		const shouldForceFreshChallenge = params.forceChallenge === true;
+		const promptKind = shouldForceFreshChallenge ? "high-risk" : userAuth?.promptKind ?? "first-contact";
 		if (!params.forceChallenge && userAuth?.authenticated) {
 			if (!userAuth.successNotified) {
 				authData[params.senderId] = {
@@ -1100,7 +1102,8 @@ async function resolveFeishuRealPersonAuthGate(params) {
 			if (status === "pending") return {
 				action: "block",
 				verificationUrl: `${authH5BaseUrl}/authhtml/index.html#/auth?certToken=${userAuth.certToken}&fromSource=Cclawd`,
-				certToken: userAuth.certToken
+				certToken: userAuth.certToken,
+				promptKind
 			};
 		}
 		if (existingCertExpired) params.log(`[real-person-auth] existing certToken expired for ${params.senderId}, requesting a new QR code`);
@@ -1111,13 +1114,15 @@ async function resolveFeishuRealPersonAuthGate(params) {
 			authenticated: false,
 			certToken,
 			issuedAt: Date.now(),
-			successNotified: false
+			successNotified: false,
+			promptKind
 		};
 		await writeRealPersonAuthStore(authFilePath, authData);
 		return {
 			action: "block",
 			verificationUrl: `${authH5BaseUrl}/authhtml/index.html#/auth?certToken=${certToken}&fromSource=Cclawd`,
-			certToken
+			certToken,
+			promptKind
 		};
 	} catch (err) {
 		params.error(`resolveFeishuRealPersonAuthGate error: ${err.message}`, err);
@@ -1925,7 +1930,7 @@ const REAL_PERSON_AUTH_BYPASS_MARKER = "[cclawd-guard-bypass:real-person-auth-on
 const HIGH_RISK_REAL_PERSON_AUTH_PATTERNS = [
 	/powershell(?:\s+)?-enc(?:oded)?\b/i,
 	/\b(?:curl|wget)\b[\s\S]{0,400}\|\s*(?:bash|sh|zsh|python|node|powershell)\b/i,
-	/\brm\s+-rf\s+(?:\/|~|\$home|\/home)\b/i,
+	/\brm\s+-rf\b(?:\s+(?:\/|~|\$home|\/home|\.{1,2}|[A-Za-z]:\\)?)?/i,
 	/\bremove-item\b[\s\S]{0,240}\b-recurse\b[\s\S]{0,240}\b-force\b/i,
 	/\b(?:del\s+\/s\s+\/q|rmdir\s+\/s\s+\/q)\b/i,
 	/\b(?:mkfs(?:\.[a-z0-9]+)?|format\s+[a-z]:\s*\/\w|dd\s+if=\/dev\/(?:zero|random|urandom)\s+of=\/dev\/(?:sd|hd|nvme))\b/i,
@@ -2123,7 +2128,7 @@ async function handleFeishuMessage(params) {
 				});
 				activeAuthPollByKey.set(replayKey, pollPromise);
 			}
-			await sendAuthPrompt(gate.verificationUrl, forceRealPersonAuthChallenge ? "high-risk" : "first-contact");
+			await sendAuthPrompt(gate.verificationUrl, gate.promptKind);
 			return;
 		}
 		if (gate.action === "allow-with-success") await sendAuthSuccess();

package/dist/{channels-Beslqaus.js → channels-BPF8Wy44.js}

@@ -255,9 +255,9 @@ import "./setup-core-CcGzCpOK.js";
 import "./shared-x4Yc8-25.js";
 import "./setup-entry-CcHvI1Mu.js";
 import "./reactions-CVOq_v6N.js";
-import "./feishu-BTpHzo5G.js";
+import "./feishu-D7a16iAg.js";
 import "./runtime-api-lhuSYASv.js";
-import "./channel-CpCgSOBB.js";
+import "./channel-Cb_TWyxU.js";
 import "./send-BIaD51-A.js";
 import "./runtime-p5-el0rU.js";
 import "./setup-core-Bw009yg5.js";
@@ -307,7 +307,7 @@ import { n as buildReadOnlySourceChannelAccountSnapshot, t as buildChannelAccoun
 import { t as collectChannelStatusIssues } from "./channels-status-issues-D1LfcYYR.js";
 import { t as parseLogLine } from "./parse-log-line-fV0tN7JU.js";
 import { i as describeBinding, n as applyAgentBindings, t as requireValidConfigSnapshot } from "./config-validation-9iWWSktF.js";
-import { a as isCatalogChannelInstalled, r as runCollectedChannelOnboardingPostWriteHooks, t as createChannelOnboardingPostWriteHookCollector } from "./onboard-channels-DG50alVJ.js";
+import { a as isCatalogChannelInstalled, r as runCollectedChannelOnboardingPostWriteHooks, t as createChannelOnboardingPostWriteHookCollector } from "./onboard-channels-DdliUHhn.js";
 import fs from "node:fs/promises";
 //#region src/commands/channels/add-mutators.ts
 function applyAccountName(params) {
@@ -377,7 +377,7 @@ async function channelsAddCommand(opts, runtime = defaultRuntime, params) {
 	if (!cfg) return;
 	let nextConfig = cfg;
 	if (shouldUseWizard(params)) {
-		const [{ buildAgentSummaries }, { setupChannels }] = await Promise.all([import("./agents.config-Nk87RmV3.js"), import("./onboard-channels-sHUBIoou.js")]);
+		const [{ buildAgentSummaries }, { setupChannels }] = await Promise.all([import("./agents.config-Nk87RmV3.js"), import("./onboard-channels-DPSYnvku.js")]);
 		const prompter = createClackPrompter();
 		const postWriteHooks = createChannelOnboardingPostWriteHookCollector();
 		let selection = [];

package/dist/{channels-cli-Db9Q_dFv.js → channels-cli-CrxiaUMv.js}

@@ -365,25 +365,25 @@ function registerChannelsCli(program) {
 	])}\n\n${theme.muted("Docs:")} ${formatDocsLink("/cli/channels", "docs.openclaw.ai/cli/channels")}\n`);
 	channels.command("list").description("List configured channels + auth profiles").option("--no-usage", "Skip model provider usage/quota snapshots").option("--json", "Output JSON", false).action(async (opts) => {
 		await runChannelsCommand(async () => {
-			const { channelsListCommand } = await import("./channels-Beslqaus.js");
+			const { channelsListCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsListCommand(opts, defaultRuntime);
 		});
 	});
 	channels.command("status").description("Show gateway channel status (use status --deep for local)").option("--probe", "Probe channel credentials", false).option("--timeout <ms>", "Timeout in ms", "10000").option("--json", "Output JSON", false).action(async (opts) => {
 		await runChannelsCommand(async () => {
-			const { channelsStatusCommand } = await import("./channels-Beslqaus.js");
+			const { channelsStatusCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsStatusCommand(opts, defaultRuntime);
 		});
 	});
 	channels.command("capabilities").description("Show provider capabilities (intents/scopes + supported features)").option("--channel <name>", `Channel (${formatCliChannelOptions(["all"])})`).option("--account <id>", "Account id (only with --channel)").option("--target <dest>", "Channel target for permission audit (Discord channel:<id>)").option("--timeout <ms>", "Timeout in ms", "10000").option("--json", "Output JSON", false).action(async (opts) => {
 		await runChannelsCommand(async () => {
-			const { channelsCapabilitiesCommand } = await import("./channels-Beslqaus.js");
+			const { channelsCapabilitiesCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsCapabilitiesCommand(opts, defaultRuntime);
 		});
 	});
 	channels.command("resolve").description("Resolve channel/user names to IDs").argument("<entries...>", "Entries to resolve (names or ids)").option("--channel <name>", `Channel (${channelNames})`).option("--account <id>", "Account id (accountId)").option("--kind <kind>", "Target kind (auto|user|group)", "auto").option("--json", "Output JSON", false).action(async (entries, opts) => {
 		await runChannelsCommand(async () => {
-			const { channelsResolveCommand } = await import("./channels-Beslqaus.js");
+			const { channelsResolveCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsResolveCommand({
 				channel: opts.channel,
 				account: opts.account,
@@ -395,19 +395,19 @@ function registerChannelsCli(program) {
 	});
 	channels.command("logs").description("Show recent channel logs from the gateway log file").option("--channel <name>", `Channel (${formatCliChannelOptions(["all"])})`, "all").option("--lines <n>", "Number of lines (default: 200)", "200").option("--json", "Output JSON", false).action(async (opts) => {
 		await runChannelsCommand(async () => {
-			const { channelsLogsCommand } = await import("./channels-Beslqaus.js");
+			const { channelsLogsCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsLogsCommand(opts, defaultRuntime);
 		});
 	});
 	channels.command("add").description("Add or update a channel account").option("--channel <name>", `Channel (${channelNames})`).option("--account <id>", "Account id (default when omitted)").option("--name <name>", "Display name for this account").option("--token <token>", "Bot token (Telegram/Discord)").option("--private-key <key>", "Nostr private key (nsec... or hex)").option("--token-file <path>", "Bot token file (Telegram)").option("--bot-token <token>", "Slack bot token (xoxb-...)").option("--app-token <token>", "Slack app token (xapp-...)").option("--signal-number <e164>", "Signal account number (E.164)").option("--cli-path <path>", "CLI path (signal-cli or imsg)").option("--db-path <path>", "iMessage database path").option("--service <service>", "iMessage service (imessage|sms|auto)").option("--region <region>", "iMessage region (for SMS)").option("--auth-dir <path>", "WhatsApp auth directory override").option("--http-url <url>", "Signal HTTP daemon base URL").option("--http-host <host>", "Signal HTTP host").option("--http-port <port>", "Signal HTTP port").option("--webhook-path <path>", "Webhook path (Google Chat/BlueBubbles)").option("--webhook-url <url>", "Google Chat webhook URL").option("--audience-type <type>", "Google Chat audience type (app-url|project-number)").option("--audience <value>", "Google Chat audience value (app URL or project number)").option("--homeserver <url>", "Matrix homeserver URL").option("--user-id <id>", "Matrix user ID").option("--access-token <token>", "Matrix access token").option("--password <password>", "Matrix password").option("--device-name <name>", "Matrix device name").option("--initial-sync-limit <n>", "Matrix initial sync limit").option("--ship <ship>", "Tlon ship name (~sampel-palnet)").option("--url <url>", "Tlon ship URL").option("--relay-urls <list>", "Nostr relay URLs (comma-separated)").option("--code <code>", "Tlon login code").option("--group-channels <list>", "Tlon group channels (comma-separated)").option("--dm-allowlist <list>", "Tlon DM allowlist (comma-separated ships)").option("--auto-discover-channels", "Tlon auto-discover group channels").option("--no-auto-discover-channels", "Disable Tlon auto-discovery").option("--use-env", "Use env token (default account only)", false).action(async (opts, command) => {
 		await runChannelsCommand(async () => {
-			const { channelsAddCommand } = await import("./channels-Beslqaus.js");
+			const { channelsAddCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsAddCommand(opts, defaultRuntime, { hasFlags: hasExplicitOptions(command, optionNamesAdd) });
 		});
 	});
 	channels.command("remove").description("Disable or delete a channel account").option("--channel <name>", `Channel (${channelNames})`).option("--account <id>", "Account id (default when omitted)").option("--delete", "Delete config entries (no prompt)", false).action(async (opts, command) => {
 		await runChannelsCommand(async () => {
-			const { channelsRemoveCommand } = await import("./channels-Beslqaus.js");
+			const { channelsRemoveCommand } = await import("./channels-BPF8Wy44.js");
 			await channelsRemoveCommand(opts, defaultRuntime, { hasFlags: hasExplicitOptions(command, optionNamesRemove) });
 		});
 	});

package/dist/{command-registry-cxuwbhx3.js → command-registry-BAWmFyJB.js}

@@ -1,5 +1,5 @@
 import { E as getPrimaryCommand, k as hasHelpOrVersion } from "./logger-kwZIqwuw.js";
-import { a as removeCommandByName, i as registerSubCliCommands, o as reparseProgramFromActionArgs } from "./register.subclis-CUyWOoJn.js";
+import { a as removeCommandByName, i as registerSubCliCommands, o as reparseProgramFromActionArgs } from "./register.subclis-DQlt3qEC.js";
 import { t as getCoreCliCommandDescriptors } from "./core-command-descriptors-CCqK_2TG.js";
 //#region src/cli/program/command-registry.ts
 const shouldRegisterCorePrimaryOnly = (argv) => {
@@ -14,7 +14,7 @@ const coreEntries = [
 			hasSubcommands: false
 		}],
 		register: async ({ program }) => {
-			(await import("./register.setup-D2ywkVlC.js")).registerSetupCommand(program);
+			(await import("./register.setup-DTWEak-e.js")).registerSetupCommand(program);
 		}
 	},
 	{
@@ -24,7 +24,7 @@ const coreEntries = [
 			hasSubcommands: false
 		}],
 		register: async ({ program }) => {
-			(await import("./register.onboard-BFnhs7Lp.js")).registerOnboardCommand(program);
+			(await import("./register.onboard-i95q8Aff.js")).registerOnboardCommand(program);
 		}
 	},
 	{
@@ -34,7 +34,7 @@ const coreEntries = [
 			hasSubcommands: false
 		}],
 		register: async ({ program }) => {
-			(await import("./register.configure-BTSJBrPt.js")).registerConfigureCommand(program);
+			(await import("./register.configure-CNrxL42A.js")).registerConfigureCommand(program);
 		}
 	},
 	{
@@ -44,7 +44,7 @@ const coreEntries = [
 			hasSubcommands: true
 		}],
 		register: async ({ program }) => {
-			(await import("./config-cli-BGXS1Dz0.js")).registerConfigCli(program);
+			(await import("./config-cli-D1fPsRr1.js")).registerConfigCli(program);
 		}
 	},
 	{
@@ -81,7 +81,7 @@ const coreEntries = [
 			}
 		],
 		register: async ({ program }) => {
-			(await import("./register.maintenance-CoVoUKo3.js")).registerMaintenanceCommands(program);
+			(await import("./register.maintenance-C46YsfoM.js")).registerMaintenanceCommands(program);
 		}
 	},
 	{
@@ -125,7 +125,7 @@ const coreEntries = [
 			hasSubcommands: true
 		}],
 		register: async ({ program, ctx }) => {
-			(await import("./register.agent-xUUvZ9dt.js")).registerAgentCommands(program, { agentChannelOptions: ctx.agentChannelOptions });
+			(await import("./register.agent-gpH-no5z.js")).registerAgentCommands(program, { agentChannelOptions: ctx.agentChannelOptions });
 		}
 	},
 	{

package/dist/{command-registry-0XvAzqhE.js → command-registry-rwzbJ1w5.js}

@@ -7,7 +7,7 @@ import "./subsystem-DISldKSB.js";
 import "./ansi-BEJF8NKS.js";
 import "./boolean-C3GkJetE.js";
 import "./env-Dnra1IpT.js";
-import "./register.subclis-CUyWOoJn.js";
+import "./register.subclis-DQlt3qEC.js";
 import "./core-command-descriptors-CCqK_2TG.js";
-import { n as registerCoreCliByName } from "./command-registry-cxuwbhx3.js";
+import { n as registerCoreCliByName } from "./command-registry-BAWmFyJB.js";
 export { registerCoreCliByName };

package/dist/{completion-cli-CDckd4dj.js → completion-cli-D-NBATPl.js}

@@ -9,8 +9,8 @@ import "./boolean-C3GkJetE.js";
 import "./env-Dnra1IpT.js";
 import "./utils-CS0Ikux6.js";
 import "./links-8xRhWBQL.js";
-import { a as registerCompletionCli } from "./completion-cli-DopM19Bx.js";
-import "./register.subclis-CUyWOoJn.js";
-import "./command-registry-cxuwbhx3.js";
+import { a as registerCompletionCli } from "./completion-cli-sluwucXI.js";
+import "./register.subclis-DQlt3qEC.js";
+import "./command-registry-BAWmFyJB.js";
 import "./program-context-SgNgozNB.js";
 export { registerCompletionCli };

package/dist/{completion-cli-DopM19Bx.js → completion-cli-sluwucXI.js}

@@ -3,8 +3,8 @@ import { r as theme } from "./theme-CdOoMzRk.js";
 import { c as routeLogsToStderr } from "./subsystem-DISldKSB.js";
 import { h as pathExists } from "./utils-CS0Ikux6.js";
 import { t as formatDocsLink } from "./links-8xRhWBQL.js";
-import { r as registerSubCliByName, t as getSubCliEntries } from "./register.subclis-CUyWOoJn.js";
-import { n as registerCoreCliByName, t as getCoreCliCommandNames } from "./command-registry-cxuwbhx3.js";
+import { r as registerSubCliByName, t as getSubCliEntries } from "./register.subclis-DQlt3qEC.js";
+import { n as registerCoreCliByName, t as getCoreCliCommandNames } from "./command-registry-BAWmFyJB.js";
 import { t as getProgramContext } from "./program-context-SgNgozNB.js";
 import path from "node:path";
 import os from "node:os";

package/dist/{config-cli-BGXS1Dz0.js → config-cli-D1fPsRr1.js}

@@ -917,7 +917,7 @@ async function runConfigValidate(opts = {}) {
 }
 function registerConfigCli(program) {
 	const cmd = program.command("config").description("Non-interactive config helpers (get/set/unset/file/validate). Run without subcommand for guided setup.").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/config", "docs.openclaw.ai/cli/config")}\n`).option("--section <section>", "Configuration sections for guided setup (repeatable). Use with no subcommand.", (value, previous) => [...previous, value], []).action(async (opts) => {
-		const { configureCommandFromSectionsArg } = await import("./configure-CzQIRH-D.js");
+		const { configureCommandFromSectionsArg } = await import("./configure-F6PUQniU.js");
 		await configureCommandFromSectionsArg(opts.section, defaultRuntime);
 	});
 	cmd.command("get").description("Get a config value by dot path").argument("<path>", "Config path (dot or bracket notation)").option("--json", "Output JSON", false).action(async (path, opts) => {

package/dist/{configure-Ddj3kLnA.js → configure-DjTTXlwN.js}

@@ -29,7 +29,7 @@ import { n as resolveProviderPluginChoice } from "./provider-wizard-D8q7vx9b.js"
 import { t as promptAuthChoiceGrouped } from "./auth-choice-prompt-Bkr-WsTr.js";
 import { t as resolvePreferredProviderForAuthChoice } from "./provider-auth-choice-preference-MiQguMwm.js";
 import { n as applyAuthChoice } from "./auth-choice-DdOY5kEs.js";
-import { i as setupChannels, n as noteChannelStatus } from "./onboard-channels-DG50alVJ.js";
+import { i as setupChannels, n as noteChannelStatus } from "./onboard-channels-DdliUHhn.js";
 import { t as ensureSystemdUserLingerInteractive } from "./systemd-linger-BasN9UtI.js";
 import { i as promptModelAllowlist, n as applyModelFallbacksFromSelection, r as promptDefaultModel, t as applyModelAllowlist } from "./model-picker-ewbext_V.js";
 import { i as promptCustomApiConfig } from "./onboard-custom-ojsh_yzx.js";

package/dist/{configure-CzQIRH-D.js → configure-F6PUQniU.js}

@@ -259,9 +259,9 @@ import "./setup-core-CcGzCpOK.js";
 import "./shared-x4Yc8-25.js";
 import "./setup-entry-CcHvI1Mu.js";
 import "./reactions-CVOq_v6N.js";
-import "./feishu-BTpHzo5G.js";
+import "./feishu-D7a16iAg.js";
 import "./runtime-api-lhuSYASv.js";
-import "./channel-CpCgSOBB.js";
+import "./channel-Cb_TWyxU.js";
 import "./send-BIaD51-A.js";
 import "./runtime-p5-el0rU.js";
 import "./setup-core-Bw009yg5.js";
@@ -324,8 +324,8 @@ import "./provider-auth-choice-B6Vf-54o.js";
 import "./auth-choice.apply-helpers-DnZSQbUl.js";
 import "./provider-auth-choice-preference-MiQguMwm.js";
 import "./auth-choice-DdOY5kEs.js";
-import "./onboard-channels-DG50alVJ.js";
-import { n as configureCommandFromSectionsArg } from "./configure-Ddj3kLnA.js";
+import "./onboard-channels-DdliUHhn.js";
+import { n as configureCommandFromSectionsArg } from "./configure-DjTTXlwN.js";
 import "./systemd-linger-BasN9UtI.js";
 import "./model-picker-ewbext_V.js";
 import "./onboard-custom-ojsh_yzx.js";

package/dist/{doctor-completion-BsywKEM9.js → doctor-completion-WcbYQyAy.js}

@@ -1,7 +1,7 @@
 import { t as resolveOpenClawPackageRoot } from "./openclaw-root-ax52pETb.js";
 import { n as resolveCliName } from "./cli-name-CgLQPAaK.js";
 import { t as note } from "./note-CrfOOz26.js";
-import { c as usesSlowDynamicCompletion, i as isCompletionInstalled, o as resolveCompletionCachePath, r as installCompletion, s as resolveShellFromEnv, t as completionCacheExists } from "./completion-cli-DopM19Bx.js";
+import { c as usesSlowDynamicCompletion, i as isCompletionInstalled, o as resolveCompletionCachePath, r as installCompletion, s as resolveShellFromEnv, t as completionCacheExists } from "./completion-cli-sluwucXI.js";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 //#region src/commands/doctor-completion.ts

package/dist/entry.js

@@ -200,7 +200,7 @@ function tryHandleRootHelpFastPath(argv, deps = {}) {
 }
 function runMainOrRootHelp(argv) {
 	if (tryHandleRootHelpFastPath(argv)) return;
-	import("./run-main-D-TG-N2a.js").then(({ runCli }) => runCli(argv)).catch((error) => {
+	import("./run-main-Dio5aKnH.js").then(({ runCli }) => runCli(argv)).catch((error) => {
 		console.error("[openclaw] Failed to start CLI:", error instanceof Error ? error.stack ?? error.message : error);
 		process$1.exitCode = 1;
 	});

package/dist/extensions/cclawd-guard/index.js

@@ -4,10 +4,65 @@ import fs, { existsSync, mkdirSync, readdirSync, unlinkSync, writeFileSync } fro
 import path from "node:path";
 import os, { networkInterfaces } from "node:os";
 import { createHash, randomBytes } from "node:crypto";
+//#region extensions/cclawd-guard/agent/machine-id.ts
+let cachedMachineInfo = null;
+/**
+* Build a stable per-device ID from hostname + first non-internal MAC.
+* Hashing avoids sending raw MAC addresses.
+*/
+function getMachineInfo() {
+	if (cachedMachineInfo) return cachedMachineInfo;
+	const machineName = os.hostname();
+	const interfaces = networkInterfaces();
+	let mac = "";
+	for (const iface of Object.values(interfaces)) {
+		if (!iface) continue;
+		for (const info of iface) if (!info.internal && info.mac && info.mac !== "00:00:00:00:00:00") {
+			mac = info.mac;
+			break;
+		}
+		if (mac) break;
+	}
+	const input = `${machineName}:${mac || "unknown"}`;
+	cachedMachineInfo = {
+		machineId: createHash("sha256").update(input).digest("hex").slice(0, 16),
+		machineName
+	};
+	return cachedMachineInfo;
+}
+//#endregion
 //#region extensions/cclawd-guard/agent/config.ts
 const DEFAULT_CORE_URL = defaultCoreUrl;
 const CREDENTIALS_DIR = path.join(os.homedir(), ".openclaw/credentials/cclawd-guard");
 const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
+function normalizeCoreUrl(coreUrl) {
+	return coreUrl.replace(/\/+$/, "");
+}
+function loadSharedCredentialState(configuredCoreUrl) {
+	try {
+		if (!existsSync(CREDENTIALS_FILE)) return null;
+		const data = JSON.parse(loadTextSync(CREDENTIALS_FILE));
+		const expectedUrl = normalizeCoreUrl(configuredCoreUrl ?? DEFAULT_CORE_URL);
+		const issuedCoreUrl = typeof data.coreUrl === "string" ? normalizeCoreUrl(data.coreUrl) : "";
+		if (issuedCoreUrl && issuedCoreUrl !== expectedUrl) return null;
+		const normalized = {
+			apiKey: typeof data.apiKey === "string" ? data.apiKey.trim() : "",
+			agentId: typeof data.agentId === "string" ? data.agentId.trim() : "",
+			claimUrl: typeof data.claimUrl === "string" ? data.claimUrl.trim() : "",
+			verificationCode: typeof data.verificationCode === "string" ? data.verificationCode.trim() : "",
+			email: typeof data.email === "string" ? data.email.trim() : "",
+			coreUrl: issuedCoreUrl || expectedUrl,
+			orgToken: typeof data.orgToken === "string" ? data.orgToken.trim() : "",
+			orgId: typeof data.orgId === "string" ? data.orgId.trim() : "",
+			userId: typeof data.userId === "string" ? data.userId.trim() : "",
+			machineId: typeof data.machineId === "string" ? data.machineId.trim() : ""
+		};
+		if (!Object.values(normalized).some((value) => typeof value === "string" && value.length > 0)) return null;
+		return normalized;
+	} catch {
+		return null;
+	}
+}
 /**
 * Load credentials from disk.
 * If the credentials were issued by a different Core URL, returns null
@@ -17,32 +72,40 @@ const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
 *   When provided, credentials are validated against this URL instead of DEFAULT_CORE_URL.
 */
 function loadCoreCredentials(configuredCoreUrl) {
-	try {
-		if (!existsSync(CREDENTIALS_FILE)) return null;
-		const data = JSON.parse(loadTextSync(CREDENTIALS_FILE));
-		if (typeof data.apiKey === "string" && typeof data.agentId === "string") {
-			const creds = data;
-			const expectedUrl = configuredCoreUrl ?? DEFAULT_CORE_URL;
-			if (creds.coreUrl && creds.coreUrl !== expectedUrl) return null;
-			return creds;
-		}
-		return null;
-	} catch {
-		return null;
-	}
+	const shared = loadSharedCredentialState(configuredCoreUrl);
+	if (!shared?.apiKey || !shared?.agentId) return null;
+	return {
+		apiKey: shared.apiKey,
+		agentId: shared.agentId,
+		claimUrl: shared.claimUrl ?? "",
+		verificationCode: shared.verificationCode ?? "",
+		email: shared.email,
+		coreUrl: shared.coreUrl
+	};
 }
 function saveCoreCredentials(creds, coreUrl) {
 	if (!existsSync(CREDENTIALS_DIR)) mkdirSync(CREDENTIALS_DIR, { recursive: true });
 	const toSave = {
+		...loadSharedCredentialState(coreUrl) ?? {},
 		...creds,
-		coreUrl: coreUrl ?? DEFAULT_CORE_URL
+		coreUrl: normalizeCoreUrl(coreUrl ?? DEFAULT_CORE_URL)
 	};
 	writeFileSync(CREDENTIALS_FILE, JSON.stringify(toSave, null, 2), "utf-8");
 }
 function deleteCoreCredentials() {
 	try {
 		if (existsSync(CREDENTIALS_FILE)) {
-			unlinkSync(CREDENTIALS_FILE);
+			const current = loadSharedCredentialState();
+			if (current?.orgToken || current?.orgId || current?.userId || current?.machineId) {
+				const preserved = {
+					orgToken: current.orgToken ?? "",
+					orgId: current.orgId ?? "",
+					userId: current.userId ?? "",
+					machineId: current.machineId ?? "",
+					coreUrl: current.coreUrl ?? normalizeCoreUrl(DEFAULT_CORE_URL)
+				};
+				writeFileSync(CREDENTIALS_FILE, JSON.stringify(preserved, null, 2), "utf-8");
+			} else unlinkSync(CREDENTIALS_FILE);
 			return true;
 		}
 		return false;
@@ -51,12 +114,19 @@ function deleteCoreCredentials() {
 	}
 }
 async function registerWithCore(name, description, coreUrl = DEFAULT_CORE_URL) {
-	const url = coreUrl.replace(/\/+$/, "");
-	const response = await fetch(`${url}/api/v1/agents/register`, {
+	const url = normalizeCoreUrl(coreUrl);
+	const orgToken = loadSharedCredentialState(url)?.orgToken ?? "";
+	if (!orgToken) throw new Error("Registration failed: 401 Missing org token");
+	const { machineId, machineName } = getMachineInfo();
+	const response = await fetch(`${url}/api/v1/agents/bind`, {
 		method: "POST",
-		headers: { "Content-Type": "application/json" },
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${orgToken}`
+		},
 		body: JSON.stringify({
-			name,
+			machineId,
+			name: name || machineName || "cclawd-guard-agent",
 			description
 		})
 	});
@@ -379,33 +449,6 @@ function sanitizeContent(content) {
 	};
 }
 //#endregion
-//#region extensions/cclawd-guard/agent/machine-id.ts
-let cachedMachineInfo = null;
-/**
-* Build a stable per-device ID from hostname + first non-internal MAC.
-* Hashing avoids sending raw MAC addresses.
-*/
-function getMachineInfo() {
-	if (cachedMachineInfo) return cachedMachineInfo;
-	const machineName = os.hostname();
-	const interfaces = networkInterfaces();
-	let mac = "";
-	for (const iface of Object.values(interfaces)) {
-		if (!iface) continue;
-		for (const info of iface) if (!info.internal && info.mac && info.mac !== "00:00:00:00:00:00") {
-			mac = info.mac;
-			break;
-		}
-		if (mac) break;
-	}
-	const input = `${machineName}:${mac || "unknown"}`;
-	cachedMachineInfo = {
-		machineId: createHash("sha256").update(input).digest("hex").slice(0, 16),
-		machineName
-	};
-	return cachedMachineInfo;
-}
-//#endregion
 //#region extensions/cclawd-guard/agent/behavior-detector.ts
 /**
 * Behavioral anomaly detector — runs at before_tool_call.
@@ -1753,57 +1796,7 @@ const openClawGuardPlugin = {
 			}
 		}
 		async function initPersonalDashboard(coreUrl) {
-			debugLog(`initPersonalDashboard: called, personalDashboardStarted=${personalDashboardStarted}`);
-			if (personalDashboardStarted) {
-				debugLog("initPersonalDashboard: already started, skipping");
-				return;
-			}
-			personalDashboardStarted = true;
-			await new Promise((resolve) => {
-				setTimeout(resolve, 5e3).unref();
-			});
-			try {
-				const { startLocalDashboard, getPluginDataDir, DASHBOARD_PORT, DevModeError } = await import("./dashboard-launcher.js");
-				const dataDir = getPluginDataDir();
-				const result = await startLocalDashboard({
-					apiKey: globalCoreCredentials?.apiKey ?? "",
-					agentId: globalCoreCredentials?.agentId ?? "",
-					coreUrl,
-					dataDir,
-					autoStart: true
-				});
-				log.info(`CClawd Guard dashboard started at ${result.localUrl}`);
-				initDashboardClient(result.token, `http://localhost:${DASHBOARD_PORT}`);
-			} catch (err) {
-				const { DASHBOARD_PORT } = await import("./dashboard-launcher.js");
-				if (await checkDashboardRunning(DASHBOARD_PORT)) {
-					const token = loadDashboardToken();
-					if (token) {
-						debugLog(`initPersonalDashboard: connecting to existing dashboard on port ${DASHBOARD_PORT}`);
-						initDashboardClient(token, `http://localhost:${DASHBOARD_PORT}`);
-						log.info(`Connected to existing CClawd Guard dashboard at http://localhost:${DASHBOARD_PORT}`);
-					} else debugLog("initPersonalDashboard: dashboard running but no token found");
-				} else {
-					debugLog(`initPersonalDashboard FAILED: ${err}`);
-					log.debug?.(`Dashboard auto-start skipped: ${err}`);
-				}
-			}
-		}
-		/** Check if dashboard is already running */
-		async function checkDashboardRunning(port) {
-			try {
-				return (await fetch(`http://localhost:${port}/health`, { signal: AbortSignal.timeout(1e3) })).ok;
-			} catch {
-				return false;
-			}
-		}
-		/** Load dashboard session token from file */
-		function loadDashboardToken() {
-			const tokenFile = path.join(openclawHome, "credentials", "cclawd-guard", "dashboard-session-token");
-			try {
-				if (fs.existsSync(tokenFile)) return JSON.parse(fs.readFileSync(tokenFile, "utf-8")).token || null;
-			} catch {}
-			return null;
+			debugLog("initPersonalDashboard: auto-start disabled");
 		}
 		function initDashboardClient(sessionToken, dashboardUrl) {
 			debugLog(`initDashboardClient: dashboardUrl=${dashboardUrl} token=${sessionToken?.slice(0, 8)}...`);
@@ -1839,7 +1832,6 @@ const openClawGuardPlugin = {
 			dashboardHeartbeatTimer = globalDashboardClient.startHeartbeat(6e4);
 			log.debug?.(`Dashboard: connected to ${dashboardUrl}`);
 		}
-		initPersonalDashboard(config.coreUrl);
 		async function initBusinessFeatures(coreUrl) {
 			debugLog(`initBusinessFeatures: called, credentials=${!!globalCoreCredentials}, isEnterprise=${isEnterprise}`);
 			if (!globalCoreCredentials) {
@@ -1927,6 +1919,7 @@ const openClawGuardPlugin = {
 			log.debug?.(`before_tool_call: ${event.toolName}`);
 			let blocked = false;
 			let blockReason;
+			let blockFindings;
 			if (globalBehaviorDetector) {
 				const decision = await globalBehaviorDetector.onBeforeToolCall({
 					sessionKey: ctx.sessionKey ?? "",
@@ -1938,9 +1931,24 @@ const openClawGuardPlugin = {
 				if (decision?.block) {
 					blocked = true;
 					blockReason = decision.blockReason;
+					blockFindings = decision.findings;
 					log.warn(`BLOCKED "${event.toolName}": ${decision.blockReason}`);
 				}
 			}
+			if (blocked) await globalEventReporter?.report(ctx.sessionKey ?? "", "before_tool_call", {
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				toolName: event.toolName,
+				params: event.params,
+				blocked: true,
+				blockReason,
+				findings: blockFindings?.map((finding) => ({
+					riskLevel: finding.riskLevel,
+					riskType: finding.riskType,
+					reason: finding.reason,
+					matchedText: finding.riskContent,
+					riskContent: finding.riskContent
+				}))
+			}, true);
 			if (globalDashboardClient?.agentId) globalDashboardClient.reportToolCall({
 				agentId: globalDashboardClient.agentId,
 				sessionKey: ctx.sessionKey,