remoteclaw 0.1.0-next.049f396 → 0.1.0-next.05abcca

package/dist/doctor-config-flow-CwFFRUic.js

@@ -0,0 +1,979 @@
+import { t as CONFIG_PATH } from "./paths-DHuXVC00.js";
+import { h as resolveHomeDir } from "./utils-DPoNpP7D.js";
+import { n as migrateLegacyConfig, o as readConfigFileSnapshot } from "./config-DwuBnd6D.js";
+import { t as RemoteClawSchema } from "./zod-schema-Y5SQgJLm.js";
+import { n as parseToolsBySenderTypedKey } from "./types.tools-BDJw1yFx.js";
+import { a as resolveTelegramAccount, r as listTelegramAccountIds } from "./accounts-P7cmIXUM.js";
+import { t as formatCliCommand } from "./command-format-Dntg_tnC.js";
+import { t as collectProviderDangerousNameMatchingScopes } from "./dangerous-name-matching-BlTBBZns.js";
+import { t as note } from "./note-B6142LyJ.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-B_9J1XED.js";
+import { t as fetchTelegramChatId } from "./api-wsk9zRVi.js";
+import { a as isMattermostMutableAllowEntry, c as normalizeTelegramAllowFromEntry, i as isMSTeamsMutableAllowEntry, n as isGoogleChatMutableAllowEntry, o as isSlackMutableAllowEntry, r as isIrcMutableAllowEntry, s as isNumericTelegramUserId, t as isDiscordMutableAllowEntry } from "./mutable-allowlist-detectors-BXE7Hr7F.js";
+import path from "node:path";
+import fs from "node:fs/promises";
+
+//#region src/commands/doctor-legacy-config.ts
+function normalizeLegacyConfigValues(cfg) {
+	return {
+		config: cfg,
+		changes: []
+	};
+}
+
+//#endregion
+//#region src/infra/state-migrations.ts
+const EMPTY_RESULT = {
+	migrated: false,
+	skipped: false,
+	changes: [],
+	warnings: []
+};
+const EMPTY_MIGRATION = {
+	changes: [],
+	warnings: []
+};
+const EMPTY_DETECTION = {
+	targetAgentId: "",
+	targetMainKey: "",
+	stateDir: "",
+	oauthDir: "",
+	sessions: {
+		legacyDir: "",
+		legacyStorePath: "",
+		targetDir: "",
+		targetStorePath: "",
+		hasLegacy: false,
+		legacyKeys: []
+	},
+	agentDir: {
+		legacyDir: "",
+		targetDir: "",
+		hasLegacy: false
+	},
+	whatsappAuth: {
+		legacyDir: "",
+		targetDir: "",
+		hasLegacy: false
+	},
+	pairingAllowFrom: {
+		legacyTelegramPath: "",
+		targetTelegramPath: "",
+		hasLegacyTelegram: false
+	},
+	preview: []
+};
+async function autoMigrateLegacyStateDir(_params) {
+	return { ...EMPTY_RESULT };
+}
+async function detectLegacyStateMigrations(_params) {
+	return { ...EMPTY_DETECTION };
+}
+async function runLegacyStateMigrations(_params) {
+	return { ...EMPTY_MIGRATION };
+}
+
+//#endregion
+//#region src/commands/doctor-config-flow.ts
+function normalizeIssuePath(path) {
+	return path.filter((part) => typeof part !== "symbol");
+}
+function isUnrecognizedKeysIssue(issue) {
+	return issue.code === "unrecognized_keys";
+}
+function formatPath(parts) {
+	if (parts.length === 0) return "<root>";
+	let out = "";
+	for (const part of parts) {
+		if (typeof part === "number") {
+			out += `[${part}]`;
+			continue;
+		}
+		out = out ? `${out}.${part}` : part;
+	}
+	return out || "<root>";
+}
+function resolvePathTarget(root, path) {
+	let current = root;
+	for (const part of path) {
+		if (typeof part === "number") {
+			if (!Array.isArray(current)) return null;
+			if (part < 0 || part >= current.length) return null;
+			current = current[part];
+			continue;
+		}
+		if (!current || typeof current !== "object" || Array.isArray(current)) return null;
+		const record = current;
+		if (!(part in record)) return null;
+		current = record[part];
+	}
+	return current;
+}
+function stripUnknownConfigKeys(config) {
+	const parsed = RemoteClawSchema.safeParse(config);
+	if (parsed.success) return {
+		config,
+		removed: []
+	};
+	const next = structuredClone(config);
+	const removed = [];
+	for (const issue of parsed.error.issues) {
+		if (!isUnrecognizedKeysIssue(issue)) continue;
+		const path = normalizeIssuePath(issue.path);
+		const target = resolvePathTarget(next, path);
+		if (!target || typeof target !== "object" || Array.isArray(target)) continue;
+		const record = target;
+		for (const key of issue.keys) {
+			if (typeof key !== "string") continue;
+			if (!(key in record)) continue;
+			delete record[key];
+			removed.push(formatPath([...path, key]));
+		}
+	}
+	return {
+		config: next,
+		removed
+	};
+}
+function noteOpencodeProviderOverrides(_cfg) {}
+function noteIncludeConfinementWarning(snapshot) {
+	const includeIssue = (snapshot.issues ?? []).find((issue) => issue.message.includes("Include path escapes config directory") || issue.message.includes("Include path resolves outside config directory"));
+	if (!includeIssue) return;
+	note([
+		`- $include paths must stay under: ${path.dirname(snapshot.path ?? CONFIG_PATH)}`,
+		"- Move shared include files under that directory and update to relative paths like \"./shared/common.json\".",
+		`- Error: ${includeIssue.message}`
+	].join("\n"), "Doctor warnings");
+}
+function asObjectRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+function collectTelegramAccountScopes(cfg) {
+	const scopes = [];
+	const telegram = asObjectRecord(cfg.channels?.telegram);
+	if (!telegram) return scopes;
+	scopes.push({
+		prefix: "channels.telegram",
+		account: telegram
+	});
+	const accounts = asObjectRecord(telegram.accounts);
+	if (!accounts) return scopes;
+	for (const key of Object.keys(accounts)) {
+		const account = asObjectRecord(accounts[key]);
+		if (!account) continue;
+		scopes.push({
+			prefix: `channels.telegram.accounts.${key}`,
+			account
+		});
+	}
+	return scopes;
+}
+function collectTelegramAllowFromLists(prefix, account) {
+	const refs = [{
+		pathLabel: `${prefix}.allowFrom`,
+		holder: account,
+		key: "allowFrom"
+	}, {
+		pathLabel: `${prefix}.groupAllowFrom`,
+		holder: account,
+		key: "groupAllowFrom"
+	}];
+	const groups = asObjectRecord(account.groups);
+	if (!groups) return refs;
+	for (const groupId of Object.keys(groups)) {
+		const group = asObjectRecord(groups[groupId]);
+		if (!group) continue;
+		refs.push({
+			pathLabel: `${prefix}.groups.${groupId}.allowFrom`,
+			holder: group,
+			key: "allowFrom"
+		});
+		const topics = asObjectRecord(group.topics);
+		if (!topics) continue;
+		for (const topicId of Object.keys(topics)) {
+			const topic = asObjectRecord(topics[topicId]);
+			if (!topic) continue;
+			refs.push({
+				pathLabel: `${prefix}.groups.${groupId}.topics.${topicId}.allowFrom`,
+				holder: topic,
+				key: "allowFrom"
+			});
+		}
+	}
+	return refs;
+}
+function scanTelegramAllowFromUsernameEntries(cfg) {
+	const hits = [];
+	const scanList = (pathLabel, list) => {
+		if (!Array.isArray(list)) return;
+		for (const entry of list) {
+			const normalized = normalizeTelegramAllowFromEntry(entry);
+			if (!normalized || normalized === "*") continue;
+			if (isNumericTelegramUserId(normalized)) continue;
+			hits.push({
+				path: pathLabel,
+				entry: String(entry).trim()
+			});
+		}
+	};
+	for (const scope of collectTelegramAccountScopes(cfg)) for (const ref of collectTelegramAllowFromLists(scope.prefix, scope.account)) scanList(ref.pathLabel, ref.holder[ref.key]);
+	return hits;
+}
+async function maybeRepairTelegramAllowFromUsernames(cfg) {
+	if (scanTelegramAllowFromUsernameEntries(cfg).length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	const tokens = Array.from(new Set(listTelegramAccountIds(cfg).map((accountId) => resolveTelegramAccount({
+		cfg,
+		accountId
+	})).map((account) => account.tokenSource === "none" ? "" : account.token).map((token) => token.trim()).filter(Boolean)));
+	if (tokens.length === 0) return {
+		config: cfg,
+		changes: [`- Telegram allowFrom contains @username entries, but no Telegram bot token is configured; cannot auto-resolve (run onboarding or replace with numeric sender IDs).`]
+	};
+	const resolveUserId = async (raw) => {
+		const trimmed = raw.trim();
+		if (!trimmed) return null;
+		const stripped = normalizeTelegramAllowFromEntry(trimmed);
+		if (!stripped || stripped === "*") return null;
+		if (isNumericTelegramUserId(stripped)) return stripped;
+		if (/\s/.test(stripped)) return null;
+		const username = stripped.startsWith("@") ? stripped : `@${stripped}`;
+		for (const token of tokens) {
+			const controller = new AbortController();
+			const timeout = setTimeout(() => controller.abort(), 4e3);
+			try {
+				const id = await fetchTelegramChatId({
+					token,
+					chatId: username,
+					signal: controller.signal
+				});
+				if (id) return id;
+			} catch {} finally {
+				clearTimeout(timeout);
+			}
+		}
+		return null;
+	};
+	const changes = [];
+	const next = structuredClone(cfg);
+	const repairList = async (pathLabel, holder, key) => {
+		const raw = holder[key];
+		if (!Array.isArray(raw)) return;
+		const out = [];
+		const replaced = [];
+		for (const entry of raw) {
+			const normalized = normalizeTelegramAllowFromEntry(entry);
+			if (!normalized) continue;
+			if (normalized === "*") {
+				out.push("*");
+				continue;
+			}
+			if (isNumericTelegramUserId(normalized)) {
+				out.push(normalized);
+				continue;
+			}
+			const resolved = await resolveUserId(String(entry));
+			if (resolved) {
+				out.push(resolved);
+				replaced.push({
+					from: String(entry).trim(),
+					to: resolved
+				});
+			} else out.push(String(entry).trim());
+		}
+		const deduped = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const entry of out) {
+			const k = String(entry).trim();
+			if (!k || seen.has(k)) continue;
+			seen.add(k);
+			deduped.push(entry);
+		}
+		holder[key] = deduped;
+		if (replaced.length > 0) {
+			for (const rep of replaced.slice(0, 5)) changes.push(`- ${pathLabel}: resolved ${rep.from} -> ${rep.to}`);
+			if (replaced.length > 5) changes.push(`- ${pathLabel}: resolved ${replaced.length - 5} more @username entries`);
+		}
+	};
+	const repairAccount = async (prefix, account) => {
+		for (const ref of collectTelegramAllowFromLists(prefix, account)) await repairList(ref.pathLabel, ref.holder, ref.key);
+	};
+	for (const scope of collectTelegramAccountScopes(next)) await repairAccount(scope.prefix, scope.account);
+	if (changes.length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	return {
+		config: next,
+		changes
+	};
+}
+function collectDiscordAccountScopes(cfg) {
+	const scopes = [];
+	const discord = asObjectRecord(cfg.channels?.discord);
+	if (!discord) return scopes;
+	scopes.push({
+		prefix: "channels.discord",
+		account: discord
+	});
+	const accounts = asObjectRecord(discord.accounts);
+	if (!accounts) return scopes;
+	for (const key of Object.keys(accounts)) {
+		const account = asObjectRecord(accounts[key]);
+		if (!account) continue;
+		scopes.push({
+			prefix: `channels.discord.accounts.${key}`,
+			account
+		});
+	}
+	return scopes;
+}
+function collectDiscordIdLists(prefix, account) {
+	const refs = [{
+		pathLabel: `${prefix}.allowFrom`,
+		holder: account,
+		key: "allowFrom"
+	}];
+	const dm = asObjectRecord(account.dm);
+	if (dm) {
+		refs.push({
+			pathLabel: `${prefix}.dm.allowFrom`,
+			holder: dm,
+			key: "allowFrom"
+		});
+		refs.push({
+			pathLabel: `${prefix}.dm.groupChannels`,
+			holder: dm,
+			key: "groupChannels"
+		});
+	}
+	const execApprovals = asObjectRecord(account.execApprovals);
+	if (execApprovals) refs.push({
+		pathLabel: `${prefix}.execApprovals.approvers`,
+		holder: execApprovals,
+		key: "approvers"
+	});
+	const guilds = asObjectRecord(account.guilds);
+	if (!guilds) return refs;
+	for (const guildId of Object.keys(guilds)) {
+		const guild = asObjectRecord(guilds[guildId]);
+		if (!guild) continue;
+		refs.push({
+			pathLabel: `${prefix}.guilds.${guildId}.users`,
+			holder: guild,
+			key: "users"
+		});
+		refs.push({
+			pathLabel: `${prefix}.guilds.${guildId}.roles`,
+			holder: guild,
+			key: "roles"
+		});
+		const channels = asObjectRecord(guild.channels);
+		if (!channels) continue;
+		for (const channelId of Object.keys(channels)) {
+			const channel = asObjectRecord(channels[channelId]);
+			if (!channel) continue;
+			refs.push({
+				pathLabel: `${prefix}.guilds.${guildId}.channels.${channelId}.users`,
+				holder: channel,
+				key: "users"
+			});
+			refs.push({
+				pathLabel: `${prefix}.guilds.${guildId}.channels.${channelId}.roles`,
+				holder: channel,
+				key: "roles"
+			});
+		}
+	}
+	return refs;
+}
+function scanDiscordNumericIdEntries(cfg) {
+	const hits = [];
+	const scanList = (pathLabel, list) => {
+		if (!Array.isArray(list)) return;
+		for (const [index, entry] of list.entries()) {
+			if (typeof entry !== "number") continue;
+			hits.push({
+				path: `${pathLabel}[${index}]`,
+				entry
+			});
+		}
+	};
+	for (const scope of collectDiscordAccountScopes(cfg)) for (const ref of collectDiscordIdLists(scope.prefix, scope.account)) scanList(ref.pathLabel, ref.holder[ref.key]);
+	return hits;
+}
+function maybeRepairDiscordNumericIds(cfg) {
+	if (scanDiscordNumericIdEntries(cfg).length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	const next = structuredClone(cfg);
+	const changes = [];
+	const repairList = (pathLabel, holder, key) => {
+		const raw = holder[key];
+		if (!Array.isArray(raw)) return;
+		let converted = 0;
+		const updated = raw.map((entry) => {
+			if (typeof entry === "number") {
+				converted += 1;
+				return String(entry);
+			}
+			return entry;
+		});
+		if (converted === 0) return;
+		holder[key] = updated;
+		changes.push(`- ${pathLabel}: converted ${converted} numeric ${converted === 1 ? "entry" : "entries"} to strings`);
+	};
+	for (const scope of collectDiscordAccountScopes(next)) for (const ref of collectDiscordIdLists(scope.prefix, scope.account)) repairList(ref.pathLabel, ref.holder, ref.key);
+	if (changes.length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	return {
+		config: next,
+		changes
+	};
+}
+function addMutableAllowlistHits(params) {
+	if (!Array.isArray(params.list)) return;
+	for (const entry of params.list) {
+		const text = String(entry).trim();
+		if (!text || text === "*") continue;
+		if (!params.detector(text)) continue;
+		params.hits.push({
+			channel: params.channel,
+			path: params.pathLabel,
+			entry: text,
+			dangerousFlagPath: params.dangerousFlagPath
+		});
+	}
+}
+function scanMutableAllowlistEntries(cfg) {
+	const hits = [];
+	for (const scope of collectProviderDangerousNameMatchingScopes(cfg, "discord")) {
+		if (scope.dangerousNameMatchingEnabled) continue;
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.allowFrom`,
+			list: scope.account.allowFrom,
+			detector: isDiscordMutableAllowEntry,
+			channel: "discord",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const dm = asObjectRecord(scope.account.dm);
+		if (dm) addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.dm.allowFrom`,
+			list: dm.allowFrom,
+			detector: isDiscordMutableAllowEntry,
+			channel: "discord",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const guilds = asObjectRecord(scope.account.guilds);
+		if (!guilds) continue;
+		for (const [guildId, guildRaw] of Object.entries(guilds)) {
+			const guild = asObjectRecord(guildRaw);
+			if (!guild) continue;
+			addMutableAllowlistHits({
+				hits,
+				pathLabel: `${scope.prefix}.guilds.${guildId}.users`,
+				list: guild.users,
+				detector: isDiscordMutableAllowEntry,
+				channel: "discord",
+				dangerousFlagPath: scope.dangerousFlagPath
+			});
+			const channels = asObjectRecord(guild.channels);
+			if (!channels) continue;
+			for (const [channelId, channelRaw] of Object.entries(channels)) {
+				const channel = asObjectRecord(channelRaw);
+				if (!channel) continue;
+				addMutableAllowlistHits({
+					hits,
+					pathLabel: `${scope.prefix}.guilds.${guildId}.channels.${channelId}.users`,
+					list: channel.users,
+					detector: isDiscordMutableAllowEntry,
+					channel: "discord",
+					dangerousFlagPath: scope.dangerousFlagPath
+				});
+			}
+		}
+	}
+	for (const scope of collectProviderDangerousNameMatchingScopes(cfg, "slack")) {
+		if (scope.dangerousNameMatchingEnabled) continue;
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.allowFrom`,
+			list: scope.account.allowFrom,
+			detector: isSlackMutableAllowEntry,
+			channel: "slack",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const dm = asObjectRecord(scope.account.dm);
+		if (dm) addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.dm.allowFrom`,
+			list: dm.allowFrom,
+			detector: isSlackMutableAllowEntry,
+			channel: "slack",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const channels = asObjectRecord(scope.account.channels);
+		if (!channels) continue;
+		for (const [channelKey, channelRaw] of Object.entries(channels)) {
+			const channel = asObjectRecord(channelRaw);
+			if (!channel) continue;
+			addMutableAllowlistHits({
+				hits,
+				pathLabel: `${scope.prefix}.channels.${channelKey}.users`,
+				list: channel.users,
+				detector: isSlackMutableAllowEntry,
+				channel: "slack",
+				dangerousFlagPath: scope.dangerousFlagPath
+			});
+		}
+	}
+	for (const scope of collectProviderDangerousNameMatchingScopes(cfg, "googlechat")) {
+		if (scope.dangerousNameMatchingEnabled) continue;
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.groupAllowFrom`,
+			list: scope.account.groupAllowFrom,
+			detector: isGoogleChatMutableAllowEntry,
+			channel: "googlechat",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const dm = asObjectRecord(scope.account.dm);
+		if (dm) addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.dm.allowFrom`,
+			list: dm.allowFrom,
+			detector: isGoogleChatMutableAllowEntry,
+			channel: "googlechat",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const groups = asObjectRecord(scope.account.groups);
+		if (!groups) continue;
+		for (const [groupKey, groupRaw] of Object.entries(groups)) {
+			const group = asObjectRecord(groupRaw);
+			if (!group) continue;
+			addMutableAllowlistHits({
+				hits,
+				pathLabel: `${scope.prefix}.groups.${groupKey}.users`,
+				list: group.users,
+				detector: isGoogleChatMutableAllowEntry,
+				channel: "googlechat",
+				dangerousFlagPath: scope.dangerousFlagPath
+			});
+		}
+	}
+	for (const scope of collectProviderDangerousNameMatchingScopes(cfg, "msteams")) {
+		if (scope.dangerousNameMatchingEnabled) continue;
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.allowFrom`,
+			list: scope.account.allowFrom,
+			detector: isMSTeamsMutableAllowEntry,
+			channel: "msteams",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.groupAllowFrom`,
+			list: scope.account.groupAllowFrom,
+			detector: isMSTeamsMutableAllowEntry,
+			channel: "msteams",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+	}
+	for (const scope of collectProviderDangerousNameMatchingScopes(cfg, "mattermost")) {
+		if (scope.dangerousNameMatchingEnabled) continue;
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.allowFrom`,
+			list: scope.account.allowFrom,
+			detector: isMattermostMutableAllowEntry,
+			channel: "mattermost",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.groupAllowFrom`,
+			list: scope.account.groupAllowFrom,
+			detector: isMattermostMutableAllowEntry,
+			channel: "mattermost",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+	}
+	for (const scope of collectProviderDangerousNameMatchingScopes(cfg, "irc")) {
+		if (scope.dangerousNameMatchingEnabled) continue;
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.allowFrom`,
+			list: scope.account.allowFrom,
+			detector: isIrcMutableAllowEntry,
+			channel: "irc",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		addMutableAllowlistHits({
+			hits,
+			pathLabel: `${scope.prefix}.groupAllowFrom`,
+			list: scope.account.groupAllowFrom,
+			detector: isIrcMutableAllowEntry,
+			channel: "irc",
+			dangerousFlagPath: scope.dangerousFlagPath
+		});
+		const groups = asObjectRecord(scope.account.groups);
+		if (!groups) continue;
+		for (const [groupKey, groupRaw] of Object.entries(groups)) {
+			const group = asObjectRecord(groupRaw);
+			if (!group) continue;
+			addMutableAllowlistHits({
+				hits,
+				pathLabel: `${scope.prefix}.groups.${groupKey}.allowFrom`,
+				list: group.allowFrom,
+				detector: isIrcMutableAllowEntry,
+				channel: "irc",
+				dangerousFlagPath: scope.dangerousFlagPath
+			});
+		}
+	}
+	return hits;
+}
+/**
+* Scan all channel configs for dmPolicy="open" without allowFrom including "*".
+* This configuration is rejected by the schema validator but can easily occur when
+* users (or integrations) set dmPolicy to "open" without realising that an explicit
+* allowFrom wildcard is also required.
+*/
+function maybeRepairOpenPolicyAllowFrom(cfg) {
+	const channels = cfg.channels;
+	if (!channels || typeof channels !== "object") return {
+		config: cfg,
+		changes: []
+	};
+	const next = structuredClone(cfg);
+	const changes = [];
+	const resolveAllowFromMode = (channelName) => {
+		if (channelName === "googlechat") return "nestedOnly";
+		if (channelName === "discord" || channelName === "slack") return "topOrNested";
+		return "topOnly";
+	};
+	const hasWildcard = (list) => list?.some((v) => String(v).trim() === "*") ?? false;
+	const ensureWildcard = (account, prefix, mode) => {
+		const dmEntry = account.dm;
+		const dm = dmEntry && typeof dmEntry === "object" && !Array.isArray(dmEntry) ? dmEntry : void 0;
+		if ((account.dmPolicy ?? dm?.policy ?? void 0) !== "open") return;
+		const topAllowFrom = account.allowFrom;
+		const nestedAllowFrom = dm?.allowFrom;
+		if (mode === "nestedOnly") {
+			if (hasWildcard(nestedAllowFrom)) return;
+			if (Array.isArray(nestedAllowFrom)) {
+				nestedAllowFrom.push("*");
+				changes.push(`- ${prefix}.dm.allowFrom: added "*" (required by dmPolicy="open")`);
+				return;
+			}
+			const nextDm = dm ?? {};
+			nextDm.allowFrom = ["*"];
+			account.dm = nextDm;
+			changes.push(`- ${prefix}.dm.allowFrom: set to ["*"] (required by dmPolicy="open")`);
+			return;
+		}
+		if (mode === "topOrNested") {
+			if (hasWildcard(topAllowFrom) || hasWildcard(nestedAllowFrom)) return;
+			if (Array.isArray(topAllowFrom)) {
+				topAllowFrom.push("*");
+				changes.push(`- ${prefix}.allowFrom: added "*" (required by dmPolicy="open")`);
+			} else if (Array.isArray(nestedAllowFrom)) {
+				nestedAllowFrom.push("*");
+				changes.push(`- ${prefix}.dm.allowFrom: added "*" (required by dmPolicy="open")`);
+			} else {
+				account.allowFrom = ["*"];
+				changes.push(`- ${prefix}.allowFrom: set to ["*"] (required by dmPolicy="open")`);
+			}
+			return;
+		}
+		if (hasWildcard(topAllowFrom)) return;
+		if (Array.isArray(topAllowFrom)) {
+			topAllowFrom.push("*");
+			changes.push(`- ${prefix}.allowFrom: added "*" (required by dmPolicy="open")`);
+		} else {
+			account.allowFrom = ["*"];
+			changes.push(`- ${prefix}.allowFrom: set to ["*"] (required by dmPolicy="open")`);
+		}
+	};
+	const nextChannels = next.channels;
+	for (const [channelName, channelConfig] of Object.entries(nextChannels)) {
+		if (!channelConfig || typeof channelConfig !== "object") continue;
+		const allowFromMode = resolveAllowFromMode(channelName);
+		ensureWildcard(channelConfig, `channels.${channelName}`, allowFromMode);
+		const accounts = channelConfig.accounts;
+		if (accounts && typeof accounts === "object") {
+			for (const [accountName, accountConfig] of Object.entries(accounts)) if (accountConfig && typeof accountConfig === "object") ensureWildcard(accountConfig, `channels.${channelName}.accounts.${accountName}`, allowFromMode);
+		}
+	}
+	if (changes.length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	return {
+		config: next,
+		changes
+	};
+}
+function collectLegacyToolsBySenderKeyHits(value, pathParts, hits) {
+	if (Array.isArray(value)) {
+		for (const [index, entry] of value.entries()) collectLegacyToolsBySenderKeyHits(entry, [...pathParts, index], hits);
+		return;
+	}
+	const record = asObjectRecord(value);
+	if (!record) return;
+	const toolsBySender = asObjectRecord(record.toolsBySender);
+	if (toolsBySender) {
+		const path = [...pathParts, "toolsBySender"];
+		const pathLabel = formatPath(path);
+		for (const rawKey of Object.keys(toolsBySender)) {
+			const trimmed = rawKey.trim();
+			if (!trimmed || trimmed === "*" || parseToolsBySenderTypedKey(trimmed)) continue;
+			hits.push({
+				toolsBySenderPath: path,
+				pathLabel,
+				key: rawKey,
+				targetKey: `id:${trimmed}`
+			});
+		}
+	}
+	for (const [key, nested] of Object.entries(record)) {
+		if (key === "toolsBySender") continue;
+		collectLegacyToolsBySenderKeyHits(nested, [...pathParts, key], hits);
+	}
+}
+function scanLegacyToolsBySenderKeys(cfg) {
+	const hits = [];
+	collectLegacyToolsBySenderKeyHits(cfg, [], hits);
+	return hits;
+}
+function maybeRepairLegacyToolsBySenderKeys(cfg) {
+	const next = structuredClone(cfg);
+	const hits = scanLegacyToolsBySenderKeys(next);
+	if (hits.length === 0) return {
+		config: cfg,
+		changes: []
+	};
+	const summary = /* @__PURE__ */ new Map();
+	let changed = false;
+	for (const hit of hits) {
+		const toolsBySender = asObjectRecord(resolvePathTarget(next, hit.toolsBySenderPath));
+		if (!toolsBySender || !(hit.key in toolsBySender)) continue;
+		const row = summary.get(hit.pathLabel) ?? {
+			migrated: 0,
+			dropped: 0,
+			examples: []
+		};
+		if (toolsBySender[hit.targetKey] === void 0) {
+			toolsBySender[hit.targetKey] = toolsBySender[hit.key];
+			row.migrated++;
+			if (row.examples.length < 3) row.examples.push(`${hit.key} -> ${hit.targetKey}`);
+		} else {
+			row.dropped++;
+			if (row.examples.length < 3) row.examples.push(`${hit.key} (kept existing ${hit.targetKey})`);
+		}
+		delete toolsBySender[hit.key];
+		summary.set(hit.pathLabel, row);
+		changed = true;
+	}
+	if (!changed) return {
+		config: cfg,
+		changes: []
+	};
+	const changes = [];
+	for (const [pathLabel, row] of summary) {
+		if (row.migrated > 0) {
+			const suffix = row.examples.length > 0 ? ` (${row.examples.join(", ")})` : "";
+			changes.push(`- ${pathLabel}: migrated ${row.migrated} legacy key${row.migrated === 1 ? "" : "s"} to typed id: entries${suffix}.`);
+		}
+		if (row.dropped > 0) changes.push(`- ${pathLabel}: removed ${row.dropped} legacy key${row.dropped === 1 ? "" : "s"} where typed id: entries already existed.`);
+	}
+	return {
+		config: next,
+		changes
+	};
+}
+async function maybeMigrateLegacyConfig() {
+	const changes = [];
+	const home = resolveHomeDir();
+	if (!home) return changes;
+	const targetDir = path.join(home, ".remoteclaw");
+	const targetPath = path.join(targetDir, "remoteclaw.json");
+	try {
+		await fs.access(targetPath);
+		return changes;
+	} catch {}
+	const legacyCandidates = [
+		path.join(home, ".clawdbot", "clawdbot.json"),
+		path.join(home, ".moldbot", "moldbot.json"),
+		path.join(home, ".moltbot", "moltbot.json")
+	];
+	let legacyPath = null;
+	for (const candidate of legacyCandidates) try {
+		await fs.access(candidate);
+		legacyPath = candidate;
+		break;
+	} catch {}
+	if (!legacyPath) return changes;
+	await fs.mkdir(targetDir, { recursive: true });
+	try {
+		await fs.copyFile(legacyPath, targetPath, fs.constants.COPYFILE_EXCL);
+		changes.push(`Migrated legacy config: ${legacyPath} -> ${targetPath}`);
+	} catch {}
+	return changes;
+}
+async function loadAndMaybeMigrateDoctorConfig(params) {
+	const shouldRepair = params.options.repair === true || params.options.yes === true;
+	const stateDirResult = await autoMigrateLegacyStateDir({ env: process.env });
+	if (stateDirResult.changes.length > 0) note(stateDirResult.changes.map((entry) => `- ${entry}`).join("\n"), "Doctor changes");
+	if (stateDirResult.warnings.length > 0) note(stateDirResult.warnings.map((entry) => `- ${entry}`).join("\n"), "Doctor warnings");
+	const legacyConfigChanges = await maybeMigrateLegacyConfig();
+	if (legacyConfigChanges.length > 0) note(legacyConfigChanges.map((entry) => `- ${entry}`).join("\n"), "Doctor changes");
+	let snapshot = await readConfigFileSnapshot();
+	const baseCfg = snapshot.config ?? {};
+	let cfg = baseCfg;
+	let candidate = structuredClone(baseCfg);
+	let pendingChanges = false;
+	let shouldWriteConfig = false;
+	const fixHints = [];
+	if (snapshot.exists && !snapshot.valid && snapshot.legacyIssues.length === 0) {
+		note("Config invalid; doctor will run with best-effort config.", "Config");
+		noteIncludeConfinementWarning(snapshot);
+	}
+	const warnings = snapshot.warnings ?? [];
+	if (warnings.length > 0) note(warnings.map((issue) => `- ${issue.path}: ${issue.message}`).join("\n"), "Config warnings");
+	if (snapshot.legacyIssues.length > 0) {
+		note(snapshot.legacyIssues.map((issue) => `- ${issue.path}: ${issue.message}`).join("\n"), "Legacy config keys detected");
+		const { config: migrated, changes } = migrateLegacyConfig(snapshot.parsed);
+		if (changes.length > 0) note(changes.join("\n"), "Doctor changes");
+		if (migrated) {
+			candidate = migrated;
+			pendingChanges = pendingChanges || changes.length > 0;
+		}
+		if (shouldRepair) {
+			if (migrated) cfg = migrated;
+		} else fixHints.push(`Run "${formatCliCommand("remoteclaw doctor --fix")}" to apply legacy migrations.`);
+	}
+	const normalized = normalizeLegacyConfigValues(candidate);
+	if (normalized.changes.length > 0) {
+		note(normalized.changes.join("\n"), "Doctor changes");
+		candidate = normalized.config;
+		pendingChanges = true;
+		if (shouldRepair) cfg = normalized.config;
+		else fixHints.push(`Run "${formatCliCommand("remoteclaw doctor --fix")}" to apply these changes.`);
+	}
+	const autoEnable = applyPluginAutoEnable({
+		config: candidate,
+		env: process.env
+	});
+	if (autoEnable.changes.length > 0) {
+		note(autoEnable.changes.join("\n"), "Doctor changes");
+		candidate = autoEnable.config;
+		pendingChanges = true;
+		if (shouldRepair) cfg = autoEnable.config;
+		else fixHints.push(`Run "${formatCliCommand("remoteclaw doctor --fix")}" to apply these changes.`);
+	}
+	if (shouldRepair) {
+		const repair = await maybeRepairTelegramAllowFromUsernames(candidate);
+		if (repair.changes.length > 0) {
+			note(repair.changes.join("\n"), "Doctor changes");
+			candidate = repair.config;
+			pendingChanges = true;
+			cfg = repair.config;
+		}
+		const discordRepair = maybeRepairDiscordNumericIds(candidate);
+		if (discordRepair.changes.length > 0) {
+			note(discordRepair.changes.join("\n"), "Doctor changes");
+			candidate = discordRepair.config;
+			pendingChanges = true;
+			cfg = discordRepair.config;
+		}
+		const allowFromRepair = maybeRepairOpenPolicyAllowFrom(candidate);
+		if (allowFromRepair.changes.length > 0) {
+			note(allowFromRepair.changes.join("\n"), "Doctor changes");
+			candidate = allowFromRepair.config;
+			pendingChanges = true;
+			cfg = allowFromRepair.config;
+		}
+		const toolsBySenderRepair = maybeRepairLegacyToolsBySenderKeys(candidate);
+		if (toolsBySenderRepair.changes.length > 0) {
+			note(toolsBySenderRepair.changes.join("\n"), "Doctor changes");
+			candidate = toolsBySenderRepair.config;
+			pendingChanges = true;
+			cfg = toolsBySenderRepair.config;
+		}
+	} else {
+		const hits = scanTelegramAllowFromUsernameEntries(candidate);
+		if (hits.length > 0) note([`- Telegram allowFrom contains ${hits.length} non-numeric entries (e.g. ${hits[0]?.entry ?? "@"}); Telegram authorization requires numeric sender IDs.`, `- Run "${formatCliCommand("remoteclaw doctor --fix")}" to auto-resolve @username entries to numeric IDs (requires a Telegram bot token).`].join("\n"), "Doctor warnings");
+		const discordHits = scanDiscordNumericIdEntries(candidate);
+		if (discordHits.length > 0) note([`- Discord allowlists contain ${discordHits.length} numeric entries (e.g. ${discordHits[0]?.path}=${discordHits[0]?.entry}).`, `- Discord IDs must be strings; run "${formatCliCommand("remoteclaw doctor --fix")}" to convert numeric IDs to quoted strings.`].join("\n"), "Doctor warnings");
+		const allowFromScan = maybeRepairOpenPolicyAllowFrom(candidate);
+		if (allowFromScan.changes.length > 0) note([...allowFromScan.changes, `- Run "${formatCliCommand("remoteclaw doctor --fix")}" to add missing allowFrom wildcards.`].join("\n"), "Doctor warnings");
+		const toolsBySenderHits = scanLegacyToolsBySenderKeys(candidate);
+		if (toolsBySenderHits.length > 0) {
+			const sample = toolsBySenderHits[0];
+			const sampleLabel = sample ? `${sample.pathLabel}.${sample.key}` : "toolsBySender";
+			note([
+				`- Found ${toolsBySenderHits.length} legacy untyped toolsBySender key${toolsBySenderHits.length === 1 ? "" : "s"} (for example ${sampleLabel}).`,
+				"- Untyped sender keys are deprecated; use explicit prefixes (id:, e164:, username:, name:).",
+				`- Run "${formatCliCommand("remoteclaw doctor --fix")}" to migrate legacy keys to typed id: entries.`
+			].join("\n"), "Doctor warnings");
+		}
+	}
+	const mutableAllowlistHits = scanMutableAllowlistEntries(candidate);
+	if (mutableAllowlistHits.length > 0) {
+		const channels = Array.from(new Set(mutableAllowlistHits.map((hit) => hit.channel))).toSorted();
+		const exampleLines = mutableAllowlistHits.slice(0, 8).map((hit) => `- ${hit.path}: ${hit.entry}`).join("\n");
+		const remaining = mutableAllowlistHits.length > 8 ? `- +${mutableAllowlistHits.length - 8} more mutable allowlist entries.` : null;
+		const flagPaths = Array.from(new Set(mutableAllowlistHits.map((hit) => hit.dangerousFlagPath)));
+		const flagHint = flagPaths.length === 1 ? flagPaths[0] : `${flagPaths[0]} (and ${flagPaths.length - 1} other scope flags)`;
+		note([
+			`- Found ${mutableAllowlistHits.length} mutable allowlist ${mutableAllowlistHits.length === 1 ? "entry" : "entries"} across ${channels.join(", ")} while name matching is disabled by default.`,
+			exampleLines,
+			...remaining ? [remaining] : [],
+			`- Option A (break-glass): enable ${flagHint}=true to keep name/email/nick matching.`,
+			"- Option B (recommended): resolve names/emails/nicks to stable sender IDs and rewrite the allowlist entries."
+		].join("\n"), "Doctor warnings");
+	}
+	const unknown = stripUnknownConfigKeys(candidate);
+	if (unknown.removed.length > 0) {
+		const lines = unknown.removed.map((path) => `- ${path}`).join("\n");
+		candidate = unknown.config;
+		pendingChanges = true;
+		if (shouldRepair) {
+			cfg = unknown.config;
+			note(lines, "Doctor changes");
+		} else {
+			note(lines, "Unknown config keys");
+			fixHints.push("Run \"remoteclaw doctor --fix\" to remove these keys.");
+		}
+	}
+	if (!shouldRepair && pendingChanges) {
+		if (await params.confirm({
+			message: "Apply recommended config repairs now?",
+			initialValue: true
+		})) {
+			cfg = candidate;
+			shouldWriteConfig = true;
+		} else if (fixHints.length > 0) note(fixHints.join("\n"), "Doctor");
+	}
+	if (shouldRepair && pendingChanges) shouldWriteConfig = true;
+	noteOpencodeProviderOverrides(cfg);
+	return {
+		cfg,
+		path: snapshot.path ?? CONFIG_PATH,
+		shouldWriteConfig,
+		sourceConfigValid: snapshot.valid
+	};
+}
+
+//#endregion
+export { detectLegacyStateMigrations as n, runLegacyStateMigrations as r, loadAndMaybeMigrateDoctorConfig as t };