nextclaw-core 0.4.3 → 0.4.5

package/dist/index.js

@@ -1,15 +1,16 @@
 // src/agent/context.ts
-import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
 import { join as join3, extname } from "path";
 
 // src/agent/memory.ts
-import { readFileSync, writeFileSync, existsSync as existsSync2, readdirSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, readdirSync } from "fs";
 import { join } from "path";
 
 // src/utils/helpers.ts
-import { existsSync, mkdirSync } from "fs";
+import { existsSync, mkdirSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { resolve } from "path";
+import { fileURLToPath } from "url";
 
 // src/config/brand.ts
 var ENV_APP_NAME_KEY = "NEXTCLAW_APP_NAME";
@@ -85,6 +86,17 @@ function expandHome(value) {
   }
   return value;
 }
+function getPackageVersion() {
+  try {
+    const dir = resolve(fileURLToPath(new URL(".", import.meta.url)));
+    const pkgPath = resolve(dir, "..", "..", "package.json");
+    const raw = readFileSync(pkgPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.version === "string" ? parsed.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 
 // src/agent/memory.ts
 var MemoryStore = class {
@@ -103,7 +115,7 @@ var MemoryStore = class {
   readToday() {
     const todayFile = this.getTodayFile();
     if (existsSync2(todayFile)) {
-      return readFileSync(todayFile, "utf-8");
+      return readFileSync2(todayFile, "utf-8");
     }
     return "";
   }
@@ -111,7 +123,7 @@ var MemoryStore = class {
     const todayFile = this.getTodayFile();
     let nextContent = content;
     if (existsSync2(todayFile)) {
-      const existing = readFileSync(todayFile, "utf-8");
+      const existing = readFileSync2(todayFile, "utf-8");
       nextContent = `${existing}
 ${content}`;
     } else {
@@ -124,13 +136,13 @@ ${content}`;
   }
   readLongTerm() {
     if (existsSync2(this.memoryFile)) {
-      return readFileSync(this.memoryFile, "utf-8");
+      return readFileSync2(this.memoryFile, "utf-8");
     }
     return "";
   }
   readWorkspaceMemory() {
     if (existsSync2(this.workspaceMemoryFile)) {
-      return readFileSync(this.workspaceMemoryFile, "utf-8");
+      return readFileSync2(this.workspaceMemoryFile, "utf-8");
     }
     return "";
   }
@@ -146,7 +158,7 @@ ${content}`;
       const dateStr = date.toISOString().slice(0, 10);
       const path = join(this.memoryDir, `${dateStr}.md`);
       if (existsSync2(path)) {
-        memories.push(readFileSync(path, "utf-8"));
+        memories.push(readFileSync2(path, "utf-8"));
       }
     }
     return memories.length ? memories.join("\n\n---\n\n") : "";
@@ -179,10 +191,10 @@ ${today}`);
 };
 
 // src/agent/skills.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3, readdirSync as readdirSync2 } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3, readdirSync as readdirSync2 } from "fs";
 import { join as join2 } from "path";
-import { fileURLToPath } from "url";
-var BUILTIN_SKILLS_DIR = join2(fileURLToPath(new URL(".", import.meta.url)), "skills");
+import { fileURLToPath as fileURLToPath2 } from "url";
+var BUILTIN_SKILLS_DIR = join2(fileURLToPath2(new URL(".", import.meta.url)), "skills");
 var SkillsLoader = class {
   constructor(workspace, builtinSkillsDir) {
     this.workspace = workspace;
@@ -223,11 +235,11 @@ var SkillsLoader = class {
   loadSkill(name) {
     const workspaceSkill = join2(this.workspaceSkills, name, "SKILL.md");
     if (existsSync3(workspaceSkill)) {
-      return readFileSync2(workspaceSkill, "utf-8");
+      return readFileSync3(workspaceSkill, "utf-8");
     }
     const builtinSkill = join2(this.builtinSkills, name, "SKILL.md");
     if (existsSync3(builtinSkill)) {
-      return readFileSync2(builtinSkill, "utf-8");
+      return readFileSync3(builtinSkill, "utf-8");
     }
     return null;
   }
@@ -601,7 +613,7 @@ Your workspace is at: ${this.workspace}
     for (const filename of fileList) {
       const filePath = join3(this.workspace, filename);
       if (existsSync4(filePath)) {
-        const raw = readFileSync3(filePath, "utf-8").trim();
+        const raw = readFileSync4(filePath, "utf-8").trim();
         if (!raw) {
           continue;
         }
@@ -674,7 +686,7 @@ ${truncated}`;
         continue;
       }
       try {
-        const b64 = readFileSync3(path).toString("base64");
+        const b64 = readFileSync4(path).toString("base64");
         images.push({ type: "image_url", image_url: { url: `data:${mime};base64,${b64}` } });
       } catch {
         continue;
@@ -746,7 +758,7 @@ var ToolRegistry = class {
 };
 
 // src/agent/tools/filesystem.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync as readdirSync3, statSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync as readdirSync3, statSync } from "fs";
 import { resolve as resolve2, dirname } from "path";
 
 // src/agent/tools/base.ts
@@ -861,7 +873,7 @@ var ReadFileTool = class extends Tool {
     if (!existsSync5(path)) {
       return `Error: File not found: ${path}`;
     }
-    return readFileSync4(path, "utf-8");
+    return readFileSync5(path, "utf-8");
   }
 };
 var WriteFileTool = class extends Tool {
@@ -925,7 +937,7 @@ var EditFileTool = class extends Tool {
     }
     const oldText = String(params.oldText ?? "");
     const newText = String(params.newText ?? "");
-    const content = readFileSync4(path, "utf-8");
+    const content = readFileSync5(path, "utf-8");
     if (!content.includes(oldText)) {
       return "Error: Text to replace not found";
     }
@@ -982,16 +994,17 @@ var ExecTool = class extends Tool {
       "\\brm\\s+-[rf]{1,2}\\b",
       "\\bdel\\s+/[fq]\\b",
       "\\brmdir\\s+/s\\b",
-      "\\b(format|mkfs|diskpart)\\b",
       "\\bdd\\s+if=",
       ">\\s*/dev/sd",
       "\\b(shutdown|reboot|poweroff)\\b",
       ":\\(\\)\\s*\\{.*\\};\\s*:"
     ]).map((pattern) => new RegExp(pattern, "i"));
     this.allowPatterns = (options.allowPatterns ?? []).map((pattern) => new RegExp(pattern, "i"));
+    this.dangerousCommands = ["format", "diskpart", "mkfs"];
   }
   denyPatterns;
   allowPatterns;
+  dangerousCommands;
   get name() {
     return "exec";
   }
@@ -1037,6 +1050,9 @@ ${stderr}`);
   }
   guardCommand(command, cwd) {
     const normalized = command.trim().toLowerCase();
+    if (this.isDangerousCommand(normalized)) {
+      return "Error: Command blocked by safety guard (dangerous pattern detected)";
+    }
     for (const pattern of this.denyPatterns) {
       if (pattern.test(normalized)) {
         return "Error: Command blocked by safety guard (dangerous pattern detected)";
@@ -1062,6 +1078,26 @@ ${stderr}`);
     }
     return null;
   }
+  isDangerousCommand(command) {
+    const segments = command.split(/\s*(?:\|\||&&|;|\|)\s*/);
+    for (const segment2 of segments) {
+      const match = segment2.trim().match(/^(?:sudo\s+)?([^\s]+)/i);
+      if (!match) {
+        continue;
+      }
+      const token = match[1]?.toLowerCase() ?? "";
+      if (!token) {
+        continue;
+      }
+      if (this.dangerousCommands.includes(token)) {
+        return true;
+      }
+      if (token.startsWith("mkfs")) {
+        return true;
+      }
+    }
+    return false;
+  }
 };
 function truncateOutput(result, maxLen = 1e4) {
   if (result.length <= maxLen) {
@@ -1646,7 +1682,7 @@ var SessionsSendTool = class extends Tool {
 };
 
 // src/agent/tools/memory.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "fs";
 import { join as join4, resolve as resolve4 } from "path";
 var DEFAULT_LIMIT2 = 20;
 var DEFAULT_CONTEXT_LINES = 0;
@@ -1711,7 +1747,7 @@ var MemorySearchTool = class extends Tool {
     const results = [];
     const files = getMemoryFiles(this.workspace);
     for (const filePath of files) {
-      const content = readFileSync5(filePath, "utf-8");
+      const content = readFileSync6(filePath, "utf-8");
       const lines = content.split("\n");
       for (let i = 0; i < lines.length; i += 1) {
         if (lines[i].toLowerCase().includes(lowerQuery)) {
@@ -1775,7 +1811,7 @@ var MemoryGetTool = class extends Tool {
     if (!existsSync6(resolvedPath)) {
       return `Error: file not found: ${resolvedPath}`;
     }
-    const content = readFileSync5(resolvedPath, "utf-8");
+    const content = readFileSync6(resolvedPath, "utf-8");
     const lines = content.split("\n");
     const startLine = toInt2(params.from ?? params.startLine, 1);
     const requestedLines = toInt2(params.lines ?? params.endLine, Math.max(lines.length - startLine + 1, 1));
@@ -2244,7 +2280,7 @@ When you have completed the task, provide a clear summary of your findings or ac
 };
 
 // src/session/manager.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync7, readdirSync as readdirSync5, unlinkSync } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync3, existsSync as existsSync7, readdirSync as readdirSync5, unlinkSync } from "fs";
 import { join as join5 } from "path";
 var SessionManager = class {
   constructor(workspace) {
@@ -2326,7 +2362,7 @@ var SessionManager = class {
       return null;
     }
     try {
-      const lines = readFileSync6(path, "utf-8").split("\n").filter(Boolean);
+      const lines = readFileSync7(path, "utf-8").split("\n").filter(Boolean);
       const messages = [];
       let metadata = {};
       let createdAt = /* @__PURE__ */ new Date();
@@ -2385,7 +2421,7 @@ var SessionManager = class {
         continue;
       }
       const path = join5(this.sessionsDir, entry.name);
-      const firstLine = readFileSync6(path, "utf-8").split("\n")[0];
+      const firstLine = readFileSync7(path, "utf-8").split("\n")[0];
       if (!firstLine) {
         continue;
       }
@@ -3610,7 +3646,7 @@ function parseMdTable(tableText) {
 import { io } from "socket.io-client";
 import { fetch as fetch5 } from "undici";
 import { join as join8 } from "path";
-import { mkdirSync as mkdirSync4, existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync4, existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
 var MAX_SEEN_MESSAGE_IDS = 2e3;
 var CURSOR_SAVE_DEBOUNCE_MS = 500;
 var AsyncLock = class {
@@ -4323,7 +4359,7 @@ var MochatChannel = class extends BaseChannel {
       return;
     }
     try {
-      const raw = readFileSync7(this.cursorPath, "utf-8");
+      const raw = readFileSync8(this.cursorPath, "utf-8");
       const data = JSON.parse(raw);
       const cursors = data.cursors;
       if (cursors && typeof cursors === "object") {
@@ -5279,12 +5315,13 @@ var ChannelManager = class {
 };
 
 // src/config/loader.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync10, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync10, mkdirSync as mkdirSync5 } from "fs";
 import { resolve as resolve5 } from "path";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/config/schema.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
+import { zodToJsonSchema } from "zod-to-json-schema";
 
 // src/providers/registry.ts
 var PROVIDERS = [
@@ -5517,117 +5554,419 @@ function providerLabel(spec) {
   return spec.displayName || spec.name;
 }
 
+// src/config/schema.hints.ts
+import { z } from "zod";
+
+// src/config/schema.help.ts
+var FIELD_HELP = {
+  "agents.defaults.workspace": "Workspace directory for agent context files and memory.",
+  "agents.defaults.model": "Default model identifier used by the agent.",
+  "agents.defaults.maxTokens": "Maximum tokens per response.",
+  "agents.defaults.temperature": "Sampling temperature for model responses.",
+  "agents.defaults.maxToolIterations": "Maximum tool calls per turn.",
+  "agents.context.bootstrap.files": "Files injected into the system prompt at startup.",
+  "agents.context.bootstrap.minimalFiles": "Minimal file set used for low-context runs.",
+  "agents.context.bootstrap.heartbeatFiles": "Files checked periodically for tasks.",
+  "agents.context.bootstrap.perFileChars": "Max chars per bootstrap file.",
+  "agents.context.bootstrap.totalChars": "Max total chars across bootstrap files.",
+  "agents.context.memory.enabled": "Enable memory injection from memory files.",
+  "agents.context.memory.maxChars": "Max characters of memory injected per turn.",
+  "providers.*.apiKey": "API key for this provider.",
+  "providers.*.apiBase": "Override the provider API base URL if needed.",
+  "providers.*.extraHeaders": "Extra headers to send to the provider.",
+  "providers.*.wireApi": "Select API mode (auto/chat/responses) for providers that support it.",
+  "gateway.host": "Bind address for the gateway server.",
+  "gateway.port": "Port for the gateway server.",
+  "ui.enabled": "Enable the built-in UI server.",
+  "ui.host": "Bind address for the UI server.",
+  "ui.port": "Port for the UI server.",
+  "ui.open": "Open the browser when UI starts.",
+  "tools.web.search.apiKey": "API key for the configured web search provider.",
+  "tools.web.search.maxResults": "Default number of search results.",
+  "tools.exec.timeout": "Command execution timeout (seconds).",
+  "tools.restrictToWorkspace": "Restrict tools to the workspace directory.",
+  "channels.whatsapp.bridgeUrl": "WebSocket URL for the WhatsApp bridge.",
+  "channels.telegram.token": "Telegram bot token.",
+  "channels.telegram.proxy": "Optional HTTP proxy for Telegram.",
+  "channels.discord.token": "Discord bot token.",
+  "channels.discord.gatewayUrl": "Override Discord gateway URL.",
+  "channels.discord.intents": "Gateway intents bitmask.",
+  "channels.feishu.appId": "Feishu app ID.",
+  "channels.feishu.appSecret": "Feishu app secret.",
+  "channels.feishu.encryptKey": "Feishu encrypt key (if enabled).",
+  "channels.feishu.verificationToken": "Feishu verification token.",
+  "channels.dingtalk.clientId": "DingTalk client ID.",
+  "channels.dingtalk.clientSecret": "DingTalk client secret.",
+  "channels.mochat.baseUrl": "Base URL for Mochat API.",
+  "channels.mochat.socketUrl": "WebSocket URL for Mochat (optional override).",
+  "channels.mochat.socketPath": "Socket.IO path for Mochat.",
+  "channels.mochat.clawToken": "Mochat claw token.",
+  "channels.mochat.agentUserId": "Mochat agent user id.",
+  "channels.mochat.replyDelayMode": "Reply delay policy for Mochat.",
+  "channels.mochat.replyDelayMs": "Reply delay duration in milliseconds.",
+  "channels.slack.mode": "Slack connection mode (socket or webhook).",
+  "channels.slack.webhookPath": "Slack webhook path when using webhook mode.",
+  "channels.slack.botToken": "Slack bot token.",
+  "channels.slack.appToken": "Slack app-level token.",
+  "channels.slack.groupPolicy": "Group policy for Slack channels.",
+  "channels.slack.dm.policy": "DM policy for Slack.",
+  "channels.email.imapHost": "IMAP server host.",
+  "channels.email.imapPort": "IMAP server port.",
+  "channels.email.imapUsername": "IMAP username.",
+  "channels.email.imapPassword": "IMAP password.",
+  "channels.email.smtpHost": "SMTP server host.",
+  "channels.email.smtpPort": "SMTP server port.",
+  "channels.email.smtpUsername": "SMTP username.",
+  "channels.email.smtpPassword": "SMTP password.",
+  "channels.email.fromAddress": "Default From address for outgoing mail.",
+  "channels.email.pollIntervalSeconds": "Polling interval in seconds.",
+  "channels.email.maxBodyChars": "Max chars to read from incoming emails.",
+  "channels.email.subjectPrefix": "Prefix used for reply subjects.",
+  "channels.qq.appId": "QQ app ID.",
+  "channels.qq.secret": "QQ app secret."
+};
+
+// src/config/schema.labels.ts
+var FIELD_LABELS = {
+  agents: "Agents",
+  "agents.defaults": "Agent Defaults",
+  "agents.defaults.workspace": "Workspace",
+  "agents.defaults.model": "Default Model",
+  "agents.defaults.maxTokens": "Max Tokens",
+  "agents.defaults.temperature": "Temperature",
+  "agents.defaults.maxToolIterations": "Max Tool Iterations",
+  "agents.context": "Context",
+  "agents.context.bootstrap": "Bootstrap Files",
+  "agents.context.bootstrap.files": "Bootstrap Files",
+  "agents.context.bootstrap.minimalFiles": "Minimal Files",
+  "agents.context.bootstrap.heartbeatFiles": "Heartbeat Files",
+  "agents.context.bootstrap.perFileChars": "Max Chars per File",
+  "agents.context.bootstrap.totalChars": "Total Bootstrap Chars",
+  "agents.context.memory": "Memory",
+  "agents.context.memory.enabled": "Enable Memory",
+  "agents.context.memory.maxChars": "Max Memory Chars",
+  providers: "Providers",
+  "providers.*.apiKey": "API Key",
+  "providers.*.apiBase": "API Base URL",
+  "providers.*.extraHeaders": "Extra Headers",
+  "providers.*.wireApi": "Wire API Mode",
+  channels: "Channels",
+  gateway: "Gateway",
+  "gateway.host": "Gateway Host",
+  "gateway.port": "Gateway Port",
+  ui: "UI",
+  "ui.enabled": "Enable UI",
+  "ui.host": "UI Host",
+  "ui.port": "UI Port",
+  "ui.open": "Open Browser",
+  tools: "Tools",
+  "tools.web": "Web Tools",
+  "tools.web.search": "Web Search",
+  "tools.web.search.apiKey": "Search API Key",
+  "tools.web.search.maxResults": "Max Results",
+  "tools.exec": "Command Execution",
+  "tools.exec.timeout": "Exec Timeout (seconds)",
+  "tools.restrictToWorkspace": "Restrict Tools to Workspace",
+  "channels.whatsapp": "WhatsApp",
+  "channels.whatsapp.enabled": "Enabled",
+  "channels.whatsapp.bridgeUrl": "Bridge URL",
+  "channels.whatsapp.allowFrom": "Allow From",
+  "channels.telegram": "Telegram",
+  "channels.telegram.enabled": "Enabled",
+  "channels.telegram.token": "Bot Token",
+  "channels.telegram.allowFrom": "Allow From",
+  "channels.telegram.proxy": "Proxy",
+  "channels.discord": "Discord",
+  "channels.discord.enabled": "Enabled",
+  "channels.discord.token": "Bot Token",
+  "channels.discord.allowFrom": "Allow From",
+  "channels.discord.gatewayUrl": "Gateway URL",
+  "channels.discord.intents": "Gateway Intents",
+  "channels.feishu": "Feishu",
+  "channels.feishu.enabled": "Enabled",
+  "channels.feishu.appId": "App ID",
+  "channels.feishu.appSecret": "App Secret",
+  "channels.feishu.encryptKey": "Encrypt Key",
+  "channels.feishu.verificationToken": "Verification Token",
+  "channels.feishu.allowFrom": "Allow From",
+  "channels.dingtalk": "DingTalk",
+  "channels.dingtalk.enabled": "Enabled",
+  "channels.dingtalk.clientId": "Client ID",
+  "channels.dingtalk.clientSecret": "Client Secret",
+  "channels.dingtalk.allowFrom": "Allow From",
+  "channels.mochat": "Mochat",
+  "channels.mochat.enabled": "Enabled",
+  "channels.mochat.baseUrl": "Base URL",
+  "channels.mochat.socketUrl": "Socket URL",
+  "channels.mochat.socketPath": "Socket Path",
+  "channels.mochat.clawToken": "Claw Token",
+  "channels.mochat.agentUserId": "Agent User ID",
+  "channels.mochat.allowFrom": "Allow From",
+  "channels.mochat.replyDelayMode": "Reply Delay Mode",
+  "channels.mochat.replyDelayMs": "Reply Delay (ms)",
+  "channels.slack": "Slack",
+  "channels.slack.enabled": "Enabled",
+  "channels.slack.mode": "Mode",
+  "channels.slack.webhookPath": "Webhook Path",
+  "channels.slack.botToken": "Bot Token",
+  "channels.slack.appToken": "App Token",
+  "channels.slack.userTokenReadOnly": "User Token Read Only",
+  "channels.slack.groupPolicy": "Group Policy",
+  "channels.slack.groupAllowFrom": "Group Allow From",
+  "channels.slack.dm": "DM",
+  "channels.slack.dm.enabled": "Enabled",
+  "channels.slack.dm.policy": "DM Policy",
+  "channels.slack.dm.allowFrom": "Allow From",
+  "channels.email": "Email",
+  "channels.email.enabled": "Enabled",
+  "channels.email.imapHost": "IMAP Host",
+  "channels.email.imapPort": "IMAP Port",
+  "channels.email.imapUsername": "IMAP Username",
+  "channels.email.imapPassword": "IMAP Password",
+  "channels.email.smtpHost": "SMTP Host",
+  "channels.email.smtpPort": "SMTP Port",
+  "channels.email.smtpUsername": "SMTP Username",
+  "channels.email.smtpPassword": "SMTP Password",
+  "channels.email.fromAddress": "From Address",
+  "channels.email.pollIntervalSeconds": "Poll Interval (seconds)",
+  "channels.email.maxBodyChars": "Max Body Chars",
+  "channels.email.subjectPrefix": "Subject Prefix",
+  "channels.email.allowFrom": "Allow From",
+  "channels.qq": "QQ",
+  "channels.qq.enabled": "Enabled",
+  "channels.qq.appId": "App ID",
+  "channels.qq.secret": "App Secret",
+  "channels.qq.markdownSupport": "Markdown Support",
+  "channels.qq.allowFrom": "Allow From"
+};
+
+// src/config/schema.hints.ts
+var GROUP_LABELS = {
+  agents: "Agents",
+  providers: "Providers",
+  channels: "Channels",
+  tools: "Tools",
+  gateway: "Gateway",
+  ui: "UI"
+};
+var GROUP_ORDER = {
+  agents: 20,
+  providers: 30,
+  channels: 40,
+  tools: 50,
+  gateway: 60,
+  ui: 70
+};
+var FIELD_PLACEHOLDERS = {
+  "gateway.host": "0.0.0.0",
+  "gateway.port": "18790",
+  "ui.host": "127.0.0.1",
+  "ui.port": "18791",
+  "providers.*.apiBase": "https://api.example.com"
+};
+var SENSITIVE_KEY_WHITELIST_SUFFIXES = [
+  "maxtokens",
+  "maxoutputtokens",
+  "maxinputtokens",
+  "maxcompletiontokens",
+  "contexttokens",
+  "totaltokens",
+  "tokencount",
+  "tokenlimit",
+  "tokenbudget"
+];
+var NORMALIZED_SENSITIVE_KEY_WHITELIST_SUFFIXES = SENSITIVE_KEY_WHITELIST_SUFFIXES.map(
+  (suffix) => suffix.toLowerCase()
+);
+var SENSITIVE_PATTERNS = [/token$/i, /password/i, /secret/i, /api.?key/i];
+function isWhitelistedSensitivePath(path) {
+  const lowerPath = path.toLowerCase();
+  return NORMALIZED_SENSITIVE_KEY_WHITELIST_SUFFIXES.some((suffix) => lowerPath.endsWith(suffix));
+}
+function matchesSensitivePattern(path) {
+  return SENSITIVE_PATTERNS.some((pattern) => pattern.test(path));
+}
+function isSensitiveConfigPath(path) {
+  return !isWhitelistedSensitivePath(path) && matchesSensitivePattern(path);
+}
+function buildBaseHints() {
+  const hints = {};
+  for (const [group, label] of Object.entries(GROUP_LABELS)) {
+    hints[group] = {
+      label,
+      group: label,
+      order: GROUP_ORDER[group]
+    };
+  }
+  for (const [path, label] of Object.entries(FIELD_LABELS)) {
+    const current = hints[path];
+    hints[path] = current ? { ...current, label } : { label };
+  }
+  for (const [path, help] of Object.entries(FIELD_HELP)) {
+    const current = hints[path];
+    hints[path] = current ? { ...current, help } : { help };
+  }
+  for (const [path, placeholder] of Object.entries(FIELD_PLACEHOLDERS)) {
+    const current = hints[path];
+    hints[path] = current ? { ...current, placeholder } : { placeholder };
+  }
+  return hints;
+}
+function applySensitiveHints(hints) {
+  const next = { ...hints };
+  for (const key of Object.keys(next)) {
+    if (next[key]?.sensitive !== void 0) {
+      continue;
+    }
+    if (isSensitiveConfigPath(key)) {
+      next[key] = { ...next[key], sensitive: true };
+    }
+  }
+  return next;
+}
+function isUnwrappable(object) {
+  return !!object && typeof object === "object" && "unwrap" in object && typeof object.unwrap === "function" && !(object instanceof z.ZodArray);
+}
+function mapSensitivePaths(schema, path, hints) {
+  let next = { ...hints };
+  let currentSchema = schema;
+  while (isUnwrappable(currentSchema)) {
+    currentSchema = currentSchema.unwrap();
+  }
+  if (path && isSensitiveConfigPath(path) && !next[path]?.sensitive) {
+    next[path] = { ...next[path], sensitive: true };
+  }
+  if (currentSchema instanceof z.ZodObject) {
+    const shape = currentSchema.shape;
+    for (const key in shape) {
+      const nextPath = path ? `${path}.${key}` : key;
+      next = mapSensitivePaths(shape[key], nextPath, next);
+    }
+  } else if (currentSchema instanceof z.ZodArray) {
+    const nextPath = path ? `${path}[]` : "[]";
+    next = mapSensitivePaths(currentSchema.element, nextPath, next);
+  } else if (currentSchema instanceof z.ZodRecord) {
+    const nextPath = path ? `${path}.*` : "*";
+    next = mapSensitivePaths(currentSchema._def.valueType, nextPath, next);
+  } else if (currentSchema instanceof z.ZodUnion || currentSchema instanceof z.ZodDiscriminatedUnion) {
+    for (const option of currentSchema.options) {
+      next = mapSensitivePaths(option, path, next);
+    }
+  }
+  return next;
+}
+
 // src/config/schema.ts
-var allowFrom = z.array(z.string()).default([]);
-var WhatsAppConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  bridgeUrl: z.string().default("ws://localhost:3001"),
+var allowFrom = z2.array(z2.string()).default([]);
+var WhatsAppConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  bridgeUrl: z2.string().default("ws://localhost:3001"),
   allowFrom
 });
-var TelegramConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  token: z.string().default(""),
+var TelegramConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  token: z2.string().default(""),
   allowFrom,
-  proxy: z.string().nullable().default(null)
+  proxy: z2.string().nullable().default(null)
 });
-var FeishuConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  appId: z.string().default(""),
-  appSecret: z.string().default(""),
-  encryptKey: z.string().default(""),
-  verificationToken: z.string().default(""),
+var FeishuConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  appId: z2.string().default(""),
+  appSecret: z2.string().default(""),
+  encryptKey: z2.string().default(""),
+  verificationToken: z2.string().default(""),
   allowFrom
 });
-var DingTalkConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  clientId: z.string().default(""),
-  clientSecret: z.string().default(""),
+var DingTalkConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  clientId: z2.string().default(""),
+  clientSecret: z2.string().default(""),
   allowFrom
 });
-var DiscordConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  token: z.string().default(""),
+var DiscordConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  token: z2.string().default(""),
   allowFrom,
-  gatewayUrl: z.string().default("wss://gateway.discord.gg/?v=10&encoding=json"),
-  intents: z.number().int().default(37377)
+  gatewayUrl: z2.string().default("wss://gateway.discord.gg/?v=10&encoding=json"),
+  intents: z2.number().int().default(37377)
 });
-var EmailConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  consentGranted: z.boolean().default(false),
-  imapHost: z.string().default(""),
-  imapPort: z.number().int().default(993),
-  imapUsername: z.string().default(""),
-  imapPassword: z.string().default(""),
-  imapMailbox: z.string().default("INBOX"),
-  imapUseSsl: z.boolean().default(true),
-  smtpHost: z.string().default(""),
-  smtpPort: z.number().int().default(587),
-  smtpUsername: z.string().default(""),
-  smtpPassword: z.string().default(""),
-  smtpUseTls: z.boolean().default(true),
-  smtpUseSsl: z.boolean().default(false),
-  fromAddress: z.string().default(""),
-  autoReplyEnabled: z.boolean().default(true),
-  pollIntervalSeconds: z.number().int().default(30),
-  markSeen: z.boolean().default(true),
-  maxBodyChars: z.number().int().default(12e3),
-  subjectPrefix: z.string().default("Re: "),
+var EmailConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  consentGranted: z2.boolean().default(false),
+  imapHost: z2.string().default(""),
+  imapPort: z2.number().int().default(993),
+  imapUsername: z2.string().default(""),
+  imapPassword: z2.string().default(""),
+  imapMailbox: z2.string().default("INBOX"),
+  imapUseSsl: z2.boolean().default(true),
+  smtpHost: z2.string().default(""),
+  smtpPort: z2.number().int().default(587),
+  smtpUsername: z2.string().default(""),
+  smtpPassword: z2.string().default(""),
+  smtpUseTls: z2.boolean().default(true),
+  smtpUseSsl: z2.boolean().default(false),
+  fromAddress: z2.string().default(""),
+  autoReplyEnabled: z2.boolean().default(true),
+  pollIntervalSeconds: z2.number().int().default(30),
+  markSeen: z2.boolean().default(true),
+  maxBodyChars: z2.number().int().default(12e3),
+  subjectPrefix: z2.string().default("Re: "),
   allowFrom
 });
-var MochatMentionSchema = z.object({
-  requireInGroups: z.boolean().default(false)
+var MochatMentionSchema = z2.object({
+  requireInGroups: z2.boolean().default(false)
 });
-var MochatGroupRuleSchema = z.object({
-  requireMention: z.boolean().default(false)
+var MochatGroupRuleSchema = z2.object({
+  requireMention: z2.boolean().default(false)
 });
-var MochatConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  baseUrl: z.string().default("https://mochat.io"),
-  socketUrl: z.string().default(""),
-  socketPath: z.string().default("/socket.io"),
-  socketDisableMsgpack: z.boolean().default(false),
-  socketReconnectDelayMs: z.number().int().default(1e3),
-  socketMaxReconnectDelayMs: z.number().int().default(1e4),
-  socketConnectTimeoutMs: z.number().int().default(1e4),
-  refreshIntervalMs: z.number().int().default(3e4),
-  watchTimeoutMs: z.number().int().default(25e3),
-  watchLimit: z.number().int().default(100),
-  retryDelayMs: z.number().int().default(500),
-  maxRetryAttempts: z.number().int().default(0),
-  clawToken: z.string().default(""),
-  agentUserId: z.string().default(""),
-  sessions: z.array(z.string()).default([]),
-  panels: z.array(z.string()).default([]),
+var MochatConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  baseUrl: z2.string().default("https://mochat.io"),
+  socketUrl: z2.string().default(""),
+  socketPath: z2.string().default("/socket.io"),
+  socketDisableMsgpack: z2.boolean().default(false),
+  socketReconnectDelayMs: z2.number().int().default(1e3),
+  socketMaxReconnectDelayMs: z2.number().int().default(1e4),
+  socketConnectTimeoutMs: z2.number().int().default(1e4),
+  refreshIntervalMs: z2.number().int().default(3e4),
+  watchTimeoutMs: z2.number().int().default(25e3),
+  watchLimit: z2.number().int().default(100),
+  retryDelayMs: z2.number().int().default(500),
+  maxRetryAttempts: z2.number().int().default(0),
+  clawToken: z2.string().default(""),
+  agentUserId: z2.string().default(""),
+  sessions: z2.array(z2.string()).default([]),
+  panels: z2.array(z2.string()).default([]),
   allowFrom,
   mention: MochatMentionSchema.default({}),
-  groups: z.record(MochatGroupRuleSchema).default({}),
-  replyDelayMode: z.string().default("non-mention"),
-  replyDelayMs: z.number().int().default(12e4)
+  groups: z2.record(MochatGroupRuleSchema).default({}),
+  replyDelayMode: z2.string().default("non-mention"),
+  replyDelayMs: z2.number().int().default(12e4)
 });
-var SlackDMSchema = z.object({
-  enabled: z.boolean().default(true),
-  policy: z.string().default("open"),
+var SlackDMSchema = z2.object({
+  enabled: z2.boolean().default(true),
+  policy: z2.string().default("open"),
   allowFrom
 });
-var SlackConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  mode: z.string().default("socket"),
-  webhookPath: z.string().default("/slack/events"),
-  botToken: z.string().default(""),
-  appToken: z.string().default(""),
-  userTokenReadOnly: z.boolean().default(true),
-  groupPolicy: z.string().default("mention"),
+var SlackConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  mode: z2.string().default("socket"),
+  webhookPath: z2.string().default("/slack/events"),
+  botToken: z2.string().default(""),
+  appToken: z2.string().default(""),
+  userTokenReadOnly: z2.boolean().default(true),
+  groupPolicy: z2.string().default("mention"),
   groupAllowFrom: allowFrom,
   dm: SlackDMSchema.default({})
 });
-var QQConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  appId: z.string().default(""),
-  secret: z.string().default(""),
-  markdownSupport: z.boolean().default(false),
+var QQConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  appId: z2.string().default(""),
+  secret: z2.string().default(""),
+  markdownSupport: z2.boolean().default(false),
   allowFrom
 });
-var ChannelsConfigSchema = z.object({
+var ChannelsConfigSchema = z2.object({
   whatsapp: WhatsAppConfigSchema.default({}),
   telegram: TelegramConfigSchema.default({}),
   discord: DiscordConfigSchema.default({}),
@@ -5638,15 +5977,15 @@ var ChannelsConfigSchema = z.object({
   slack: SlackConfigSchema.default({}),
   qq: QQConfigSchema.default({})
 });
-var AgentDefaultsSchema = z.object({
-  workspace: z.string().default(DEFAULT_WORKSPACE_PATH),
-  model: z.string().default("anthropic/claude-opus-4-5"),
-  maxTokens: z.number().int().default(8192),
-  temperature: z.number().default(0.7),
-  maxToolIterations: z.number().int().default(20)
+var AgentDefaultsSchema = z2.object({
+  workspace: z2.string().default(DEFAULT_WORKSPACE_PATH),
+  model: z2.string().default("anthropic/claude-opus-4-5"),
+  maxTokens: z2.number().int().default(8192),
+  temperature: z2.number().default(0.7),
+  maxToolIterations: z2.number().int().default(20)
 });
-var ContextBootstrapSchema = z.object({
-  files: z.array(z.string()).default([
+var ContextBootstrapSchema = z2.object({
+  files: z2.array(z2.string()).default([
     "AGENTS.md",
     "SOUL.md",
     "USER.md",
@@ -5656,30 +5995,30 @@ var ContextBootstrapSchema = z.object({
     "BOOTSTRAP.md",
     "HEARTBEAT.md"
   ]),
-  minimalFiles: z.array(z.string()).default(["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"]),
-  heartbeatFiles: z.array(z.string()).default(["HEARTBEAT.md"]),
-  perFileChars: z.number().int().default(4e3),
-  totalChars: z.number().int().default(12e3)
+  minimalFiles: z2.array(z2.string()).default(["AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md"]),
+  heartbeatFiles: z2.array(z2.string()).default(["HEARTBEAT.md"]),
+  perFileChars: z2.number().int().default(4e3),
+  totalChars: z2.number().int().default(12e3)
 });
-var ContextMemorySchema = z.object({
-  enabled: z.boolean().default(true),
-  maxChars: z.number().int().default(8e3)
+var ContextMemorySchema = z2.object({
+  enabled: z2.boolean().default(true),
+  maxChars: z2.number().int().default(8e3)
 });
-var ContextConfigSchema = z.object({
+var ContextConfigSchema = z2.object({
   bootstrap: ContextBootstrapSchema.default({}),
   memory: ContextMemorySchema.default({})
 });
-var AgentsConfigSchema = z.object({
+var AgentsConfigSchema = z2.object({
   defaults: AgentDefaultsSchema.default({}),
   context: ContextConfigSchema.default({})
 });
-var ProviderConfigSchema = z.object({
-  apiKey: z.string().default(""),
-  apiBase: z.string().nullable().default(null),
-  extraHeaders: z.record(z.string()).nullable().default(null),
-  wireApi: z.enum(["auto", "chat", "responses"]).default("auto")
+var ProviderConfigSchema = z2.object({
+  apiKey: z2.string().default(""),
+  apiBase: z2.string().nullable().default(null),
+  extraHeaders: z2.record(z2.string()).nullable().default(null),
+  wireApi: z2.enum(["auto", "chat", "responses"]).default("auto")
 });
-var ProvidersConfigSchema = z.object({
+var ProvidersConfigSchema = z2.object({
   anthropic: ProviderConfigSchema.default({}),
   openai: ProviderConfigSchema.default({}),
   openrouter: ProviderConfigSchema.default({}),
@@ -5693,32 +6032,32 @@ var ProvidersConfigSchema = z.object({
   minimax: ProviderConfigSchema.default({}),
   aihubmix: ProviderConfigSchema.default({})
 });
-var GatewayConfigSchema = z.object({
-  host: z.string().default("0.0.0.0"),
-  port: z.number().int().default(18790)
+var GatewayConfigSchema = z2.object({
+  host: z2.string().default("0.0.0.0"),
+  port: z2.number().int().default(18790)
 });
-var UiConfigSchema = z.object({
-  enabled: z.boolean().default(false),
-  host: z.string().default("127.0.0.1"),
-  port: z.number().int().default(18791),
-  open: z.boolean().default(false)
+var UiConfigSchema = z2.object({
+  enabled: z2.boolean().default(false),
+  host: z2.string().default("127.0.0.1"),
+  port: z2.number().int().default(18791),
+  open: z2.boolean().default(false)
 });
-var WebSearchConfigSchema = z.object({
-  apiKey: z.string().default(""),
-  maxResults: z.number().int().default(5)
+var WebSearchConfigSchema = z2.object({
+  apiKey: z2.string().default(""),
+  maxResults: z2.number().int().default(5)
 });
-var WebToolsConfigSchema = z.object({
+var WebToolsConfigSchema = z2.object({
   search: WebSearchConfigSchema.default({})
 });
-var ExecToolConfigSchema = z.object({
-  timeout: z.number().int().default(60)
+var ExecToolConfigSchema = z2.object({
+  timeout: z2.number().int().default(60)
 });
-var ToolsConfigSchema = z.object({
+var ToolsConfigSchema = z2.object({
   web: WebToolsConfigSchema.default({}),
   exec: ExecToolConfigSchema.default({}),
-  restrictToWorkspace: z.boolean().default(false)
+  restrictToWorkspace: z2.boolean().default(false)
 });
-var ConfigSchema = z.object({
+var ConfigSchema = z2.object({
   agents: AgentsConfigSchema.default({}),
   channels: ChannelsConfigSchema.default({}),
   providers: ProvidersConfigSchema.default({}),
@@ -5768,6 +6107,22 @@ function getApiBase(config, model) {
   }
   return null;
 }
+function buildConfigSchema(options) {
+  const schema = zodToJsonSchema(ConfigSchema, {
+    name: "NextClawConfig",
+    target: "jsonSchema7"
+  });
+  if (schema && typeof schema === "object") {
+    schema.title = "NextClawConfig";
+  }
+  const hints = mapSensitivePaths(ConfigSchema, "", buildBaseHints());
+  return {
+    schema,
+    uiHints: hints,
+    version: options?.version ?? getPackageVersion(),
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 
 // src/config/loader.ts
 function getConfigPath() {
@@ -5780,12 +6135,12 @@ function loadConfig(configPath) {
   const path = configPath ?? getConfigPath();
   if (existsSync10(path)) {
     try {
-      const raw = readFileSync8(path, "utf-8");
+      const raw = readFileSync9(path, "utf-8");
       const data = JSON.parse(raw);
       const migrated = migrateConfig(data);
       return ConfigSchema.parse(migrated);
     } catch (err) {
-      const message = err instanceof z2.ZodError ? err.message : String(err);
+      const message = err instanceof z3.ZodError ? err.message : String(err);
       console.warn(`Warning: Failed to load config from ${path}: ${message}`);
     }
   }
@@ -5894,8 +6249,66 @@ function buildReloadPlan(changedPaths) {
   return plan;
 }
 
+// src/config/redact.ts
+function matchHint(path, hints) {
+  const direct = hints[path];
+  if (direct) {
+    return direct;
+  }
+  const segments = path.split(".");
+  for (const [hintKey, hint] of Object.entries(hints)) {
+    if (!hintKey.includes("*")) {
+      continue;
+    }
+    const hintSegments = hintKey.split(".");
+    if (hintSegments.length !== segments.length) {
+      continue;
+    }
+    let match = true;
+    for (let i = 0; i < segments.length; i += 1) {
+      if (hintSegments[i] !== "*" && hintSegments[i] !== segments[i]) {
+        match = false;
+        break;
+      }
+    }
+    if (match) {
+      return hint;
+    }
+  }
+  return void 0;
+}
+function isSensitivePath(path, hints) {
+  if (hints) {
+    const hint = matchHint(path, hints);
+    if (hint?.sensitive !== void 0) {
+      return Boolean(hint.sensitive);
+    }
+  }
+  return isSensitiveConfigPath(path);
+}
+function redactConfigObject(value, hints, prefix = "") {
+  if (Array.isArray(value)) {
+    const nextPath = prefix ? `${prefix}[]` : "[]";
+    return value.map((entry) => redactConfigObject(entry, hints, nextPath));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  const entries = value;
+  const output = {};
+  for (const [key, val] of Object.entries(entries)) {
+    const nextPath = prefix ? `${prefix}.${key}` : key;
+    if (isSensitivePath(nextPath, hints)) {
+      output[key] = val ? "***" : val;
+      continue;
+    }
+    output[key] = redactConfigObject(val, hints, nextPath);
+  }
+  return output;
+}
+
 // src/cron/service.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, existsSync as existsSync11, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, existsSync as existsSync11, mkdirSync as mkdirSync6 } from "fs";
 import { dirname as dirname2 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import cronParser from "cron-parser";
@@ -5935,7 +6348,7 @@ var CronService = class {
     }
     if (existsSync11(this.storePath)) {
       try {
-        const data = JSON.parse(readFileSync9(this.storePath, "utf-8"));
+        const data = JSON.parse(readFileSync10(this.storePath, "utf-8"));
         const jobs = (data.jobs ?? []).map((job) => ({
           id: String(job.id),
           name: String(job.name),
@@ -6138,7 +6551,7 @@ var CronService = class {
 };
 
 // src/heartbeat/service.ts
-import { readFileSync as readFileSync10, existsSync as existsSync12 } from "fs";
+import { readFileSync as readFileSync11, existsSync as existsSync12 } from "fs";
 import { join as join9 } from "path";
 var DEFAULT_HEARTBEAT_INTERVAL_S = 30 * 60;
 var HEARTBEAT_PROMPT = "Read HEARTBEAT.md in your workspace (if it exists).\nFollow any instructions or tasks listed there.\nIf nothing needs attention, reply with just: HEARTBEAT_OK";
@@ -6172,7 +6585,7 @@ var HeartbeatService = class {
   readHeartbeatFile() {
     if (existsSync12(this.heartbeatFile)) {
       try {
-        return readFileSync10(this.heartbeatFile, "utf-8");
+        return readFileSync11(this.heartbeatFile, "utf-8");
       } catch {
         return null;
       }
@@ -6615,6 +7028,9 @@ export {
   WebSearchConfigSchema,
   WebToolsConfigSchema,
   WhatsAppConfigSchema,
+  applySensitiveHints,
+  buildBaseHints,
+  buildConfigSchema,
   buildReloadPlan,
   diffConfigPaths,
   ensureDir,
@@ -6628,17 +7044,21 @@ export {
   getDataDir,
   getDataPath,
   getMemoryPath,
+  getPackageVersion,
   getProvider,
   getProviderName,
   getSessionsPath,
   getSkillsPath,
   getWorkspacePath,
   getWorkspacePathFromConfig,
+  isSensitiveConfigPath,
   loadConfig,
+  mapSensitivePaths,
   matchProvider,
   parseSessionKey,
   probeFeishu,
   providerLabel,
+  redactConfigObject,
   safeFilename,
   saveConfig,
   timestamp,