remoteclaw 0.1.0-next.2abd2fa → 0.1.0-next.2e9a6cd

package/dist/config-BupC6eiJ.js

@@ -0,0 +1,4223 @@
+import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
+import { A as normalizeChatChannelId, Bt as resolveDefaultConfigCandidates, Ft as STATE_DIR, Gt as resolveNewStateDir, Ht as resolveGatewayPort, It as isNixMode, Kt as resolveOAuthDir, Lt as resolveCanonicalConfigPath, Nt as CONFIG_PATH, Pt as DEFAULT_GATEWAY_PORT, Rt as resolveConfigPath, S as CHANNEL_IDS, Ut as resolveIsNixMode, Vt as resolveGatewayLockDir, Wt as resolveLegacyStateDirs, Y as isRecord, dn as resolveRequiredHomeDir, et as resolveConfigDir, qt as resolveStateDir, rt as resolveUserPath, ut as isPlainObject$2, zt as resolveConfigPathCandidate } from "./entry.js";
+import { a as shouldEnableShellEnvFallback, i as shouldDeferShellEnvFallback, n as loadShellEnvFallback, r as resolveShellEnvFallbackTimeoutMs } from "./shell-env-hZW9j-Uc.js";
+import { r as VERSION, t as applyConfigEnvVars } from "./env-vars-C8WMB8Ix.js";
+import { _ as isBlockedObjectKey, s as normalizeAgentId, t as DEFAULT_AGENT_ID } from "./session-key-BF-9YzxC.js";
+import { o as parseModelRef } from "./provider-utils-DiLhkKQp.js";
+import { d as resolveDiscordPreviewStreamMode, f as resolveSlackNativeStreaming, l as isSafeExecutableValue, m as resolveTelegramPreviewStreamMode, p as resolveSlackStreamingMode, t as RemoteClawSchema } from "./zod-schema-B9RGngMW.js";
+import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDirOrNull } from "./agent-scope-DxqtYjuJ.js";
+import { d as TOOLS_BY_SENDER_KEY_TYPES, f as parseToolsBySenderTypedKey } from "./dock-D5pZ3a44.js";
+import { fileURLToPath } from "node:url";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import JSON5 from "json5";
+import { isDeepStrictEqual } from "node:util";
+import crypto from "node:crypto";
+import dotenv from "dotenv";
+import AjvPkg from "ajv";
+
+//#region src/agents/owner-display.ts
+function trimToUndefined(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/**
+* Resolve owner display settings for prompt rendering.
+* Keep auth secrets decoupled from owner hash secrets.
+*/
+function resolveOwnerDisplaySetting(config) {
+	const ownerDisplay = config?.commands?.ownerDisplay;
+	if (ownerDisplay !== "hash") return {
+		ownerDisplay,
+		ownerDisplaySecret: void 0
+	};
+	return {
+		ownerDisplay: "hash",
+		ownerDisplaySecret: trimToUndefined(config?.commands?.ownerDisplaySecret)
+	};
+}
+/**
+* Ensure hash mode has a dedicated secret.
+* Returns updated config and generated secret when autofill was needed.
+*/
+function ensureOwnerDisplaySecret(config, generateSecret = () => crypto.randomBytes(32).toString("hex")) {
+	const settings = resolveOwnerDisplaySetting(config);
+	if (settings.ownerDisplay !== "hash" || settings.ownerDisplaySecret) return { config };
+	const generatedSecret = generateSecret();
+	return {
+		config: {
+			...config,
+			commands: {
+				...config.commands,
+				ownerDisplay: "hash",
+				ownerDisplaySecret: generatedSecret
+			}
+		},
+		generatedSecret
+	};
+}
+
+//#endregion
+//#region src/infra/dotenv.ts
+function loadDotEnv(opts) {
+	const quiet = opts?.quiet ?? true;
+	dotenv.config({ quiet });
+	const globalEnvPath = path.join(resolveConfigDir(process.env), ".env");
+	if (!fs.existsSync(globalEnvPath)) return;
+	dotenv.config({
+		quiet,
+		path: globalEnvPath,
+		override: false
+	});
+}
+
+//#endregion
+//#region src/config/agent-dirs.ts
+var DuplicateAgentDirError = class extends Error {
+	constructor(duplicates) {
+		super(formatDuplicateAgentDirError(duplicates));
+		this.name = "DuplicateAgentDirError";
+		this.duplicates = duplicates;
+	}
+};
+function canonicalizeAgentDir(agentDir) {
+	const resolved = path.resolve(agentDir);
+	if (process.platform === "darwin" || process.platform === "win32") return resolved.toLowerCase();
+	return resolved;
+}
+function collectReferencedAgentIds(cfg) {
+	const ids = /* @__PURE__ */ new Set();
+	const agents = Array.isArray(cfg.agents?.list) ? cfg.agents?.list : [];
+	const defaultAgentId = agents.find((agent) => agent?.default)?.id ?? agents[0]?.id ?? DEFAULT_AGENT_ID;
+	ids.add(normalizeAgentId(defaultAgentId));
+	for (const entry of agents) if (entry?.id) ids.add(normalizeAgentId(entry.id));
+	const bindings = cfg.bindings;
+	if (Array.isArray(bindings)) for (const binding of bindings) {
+		const id = binding?.agentId;
+		if (typeof id === "string" && id.trim()) ids.add(normalizeAgentId(id));
+	}
+	return [...ids];
+}
+function resolveEffectiveAgentDir(cfg, agentId, deps) {
+	const id = normalizeAgentId(agentId);
+	const trimmed = (Array.isArray(cfg.agents?.list) ? cfg.agents?.list.find((agent) => normalizeAgentId(agent.id) === id)?.agentDir : void 0)?.trim();
+	if (trimmed) return resolveUserPath(trimmed);
+	const env = deps?.env ?? process.env;
+	const root = resolveStateDir(env, deps?.homedir ?? (() => resolveRequiredHomeDir(env, os.homedir)));
+	return path.join(root, "agents", id, "agent");
+}
+function findDuplicateAgentDirs(cfg, deps) {
+	const byDir = /* @__PURE__ */ new Map();
+	for (const agentId of collectReferencedAgentIds(cfg)) {
+		const agentDir = resolveEffectiveAgentDir(cfg, agentId, deps);
+		const key = canonicalizeAgentDir(agentDir);
+		const entry = byDir.get(key);
+		if (entry) entry.agentIds.push(agentId);
+		else byDir.set(key, {
+			agentDir,
+			agentIds: [agentId]
+		});
+	}
+	return [...byDir.values()].filter((v) => v.agentIds.length > 1);
+}
+function formatDuplicateAgentDirError(dups) {
+	return [
+		"Duplicate agentDir detected (multi-agent config).",
+		"Each agent must have a unique agentDir; sharing it causes auth/session state collisions and token invalidation.",
+		"",
+		"Conflicts:",
+		...dups.map((d) => `- ${d.agentDir}: ${d.agentIds.map((id) => `"${id}"`).join(", ")}`),
+		"",
+		"Fix: remove the shared agents.list[].agentDir override (or give each agent its own directory).",
+		"If you want to share credentials, copy auth-profiles.json instead of sharing the entire agentDir."
+	].join("\n");
+}
+
+//#endregion
+//#region src/config/backup-rotation.ts
+const CONFIG_BACKUP_COUNT = 5;
+async function rotateConfigBackups(configPath, ioFs) {
+	if (CONFIG_BACKUP_COUNT <= 1) return;
+	const backupBase = `${configPath}.bak`;
+	const maxIndex = CONFIG_BACKUP_COUNT - 1;
+	await ioFs.unlink(`${backupBase}.${maxIndex}`).catch(() => {});
+	for (let index = maxIndex - 1; index >= 1; index -= 1) await ioFs.rename(`${backupBase}.${index}`, `${backupBase}.${index + 1}`).catch(() => {});
+	await ioFs.rename(backupBase, `${backupBase}.1`).catch(() => {});
+}
+
+//#endregion
+//#region src/config/agent-limits.ts
+const DEFAULT_AGENT_MAX_CONCURRENT = 4;
+const DEFAULT_SUBAGENT_MAX_CONCURRENT = 8;
+const DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH = 1;
+function resolveAgentMaxConcurrent(cfg) {
+	const raw = cfg?.agents?.defaults?.maxConcurrent;
+	if (typeof raw === "number" && Number.isFinite(raw)) return Math.max(1, Math.floor(raw));
+	return DEFAULT_AGENT_MAX_CONCURRENT;
+}
+function resolveSubagentMaxConcurrent(cfg) {
+	const raw = cfg?.agents?.defaults?.subagents?.maxConcurrent;
+	if (typeof raw === "number" && Number.isFinite(raw)) return Math.max(1, Math.floor(raw));
+	return DEFAULT_SUBAGENT_MAX_CONCURRENT;
+}
+
+//#endregion
+//#region src/config/talk.ts
+const DEFAULT_TALK_PROVIDER = "elevenlabs";
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeVoiceAliases(value) {
+	if (!isPlainObject$1(value)) return;
+	const aliases = {};
+	for (const [alias, rawId] of Object.entries(value)) {
+		if (typeof rawId !== "string") continue;
+		aliases[alias] = rawId;
+	}
+	return Object.keys(aliases).length > 0 ? aliases : void 0;
+}
+function normalizeTalkProviderConfig(value) {
+	if (!isPlainObject$1(value)) return;
+	const provider = {};
+	for (const [key, raw] of Object.entries(value)) {
+		if (raw === void 0) continue;
+		if (key === "voiceAliases") {
+			const aliases = normalizeVoiceAliases(raw);
+			if (aliases) provider.voiceAliases = aliases;
+			continue;
+		}
+		if (key === "voiceId" || key === "modelId" || key === "outputFormat" || key === "apiKey") {
+			const normalized = normalizeString(raw);
+			if (normalized) provider[key] = normalized;
+			continue;
+		}
+		provider[key] = raw;
+	}
+	return Object.keys(provider).length > 0 ? provider : void 0;
+}
+function normalizeTalkProviders(value) {
+	if (!isPlainObject$1(value)) return;
+	const providers = {};
+	for (const [rawProviderId, providerConfig] of Object.entries(value)) {
+		const providerId = normalizeString(rawProviderId);
+		if (!providerId) continue;
+		const normalizedProvider = normalizeTalkProviderConfig(providerConfig);
+		if (!normalizedProvider) continue;
+		providers[providerId] = normalizedProvider;
+	}
+	return Object.keys(providers).length > 0 ? providers : void 0;
+}
+function normalizedLegacyTalkFields(source) {
+	const legacy = {};
+	const voiceId = normalizeString(source.voiceId);
+	if (voiceId) legacy.voiceId = voiceId;
+	const voiceAliases = normalizeVoiceAliases(source.voiceAliases);
+	if (voiceAliases) legacy.voiceAliases = voiceAliases;
+	const modelId = normalizeString(source.modelId);
+	if (modelId) legacy.modelId = modelId;
+	const outputFormat = normalizeString(source.outputFormat);
+	if (outputFormat) legacy.outputFormat = outputFormat;
+	const apiKey = normalizeString(source.apiKey);
+	if (apiKey) legacy.apiKey = apiKey;
+	return legacy;
+}
+function legacyProviderConfigFromTalk(source) {
+	return normalizeTalkProviderConfig({
+		voiceId: source.voiceId,
+		voiceAliases: source.voiceAliases,
+		modelId: source.modelId,
+		outputFormat: source.outputFormat,
+		apiKey: source.apiKey
+	});
+}
+function activeProviderFromTalk(talk) {
+	const provider = normalizeString(talk.provider);
+	if (provider) return provider;
+	const providerIds = talk.providers ? Object.keys(talk.providers) : [];
+	return providerIds.length === 1 ? providerIds[0] : void 0;
+}
+function legacyTalkFieldsFromProviderConfig(config) {
+	if (!config) return {};
+	const legacy = {};
+	if (typeof config.voiceId === "string") legacy.voiceId = config.voiceId;
+	if (config.voiceAliases && typeof config.voiceAliases === "object" && !Array.isArray(config.voiceAliases)) {
+		const aliases = normalizeVoiceAliases(config.voiceAliases);
+		if (aliases) legacy.voiceAliases = aliases;
+	}
+	if (typeof config.modelId === "string") legacy.modelId = config.modelId;
+	if (typeof config.outputFormat === "string") legacy.outputFormat = config.outputFormat;
+	if (typeof config.apiKey === "string") legacy.apiKey = config.apiKey;
+	return legacy;
+}
+function normalizeTalkSection(value) {
+	if (!isPlainObject$1(value)) return;
+	const source = value;
+	const hasNormalizedShape = typeof source.provider === "string" || isPlainObject$1(source.providers);
+	const normalized = {};
+	const legacy = normalizedLegacyTalkFields(source);
+	if (Object.keys(legacy).length > 0) Object.assign(normalized, legacy);
+	if (typeof source.interruptOnSpeech === "boolean") normalized.interruptOnSpeech = source.interruptOnSpeech;
+	if (hasNormalizedShape) {
+		const providers = normalizeTalkProviders(source.providers);
+		const provider = normalizeString(source.provider);
+		if (providers) normalized.providers = providers;
+		if (provider) normalized.provider = provider;
+		else if (providers) {
+			const ids = Object.keys(providers);
+			if (ids.length === 1) normalized.provider = ids[0];
+		}
+		return Object.keys(normalized).length > 0 ? normalized : void 0;
+	}
+	const legacyProviderConfig = legacyProviderConfigFromTalk(source);
+	if (legacyProviderConfig) {
+		normalized.provider = DEFAULT_TALK_PROVIDER;
+		normalized.providers = { [DEFAULT_TALK_PROVIDER]: legacyProviderConfig };
+	}
+	return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function normalizeTalkConfig(config) {
+	if (!config.talk) return config;
+	const normalizedTalk = normalizeTalkSection(config.talk);
+	if (!normalizedTalk) return config;
+	return {
+		...config,
+		talk: normalizedTalk
+	};
+}
+function resolveActiveTalkProviderConfig(talk) {
+	const normalizedTalk = normalizeTalkSection(talk);
+	if (!normalizedTalk) return {};
+	const provider = activeProviderFromTalk(normalizedTalk);
+	if (!provider) return {};
+	return {
+		provider,
+		config: normalizedTalk.providers?.[provider]
+	};
+}
+function buildTalkConfigResponse(value) {
+	if (!isPlainObject$1(value)) return;
+	const normalized = normalizeTalkSection(value);
+	if (!normalized) return;
+	const payload = {};
+	if (typeof normalized.interruptOnSpeech === "boolean") payload.interruptOnSpeech = normalized.interruptOnSpeech;
+	if (normalized.providers && Object.keys(normalized.providers).length > 0) payload.providers = normalized.providers;
+	if (typeof normalized.provider === "string") payload.provider = normalized.provider;
+	const activeProvider = activeProviderFromTalk(normalized);
+	const providerCompatibilityLegacy = legacyTalkFieldsFromProviderConfig(activeProvider ? normalized.providers?.[activeProvider] : void 0);
+	const compatibilityLegacy = Object.keys(providerCompatibilityLegacy).length > 0 ? providerCompatibilityLegacy : normalizedLegacyTalkFields(normalized);
+	Object.assign(payload, compatibilityLegacy);
+	return Object.keys(payload).length > 0 ? payload : void 0;
+}
+function readTalkApiKeyFromProfile(deps = {}) {
+	const fsImpl = deps.fs ?? fs;
+	const osImpl = deps.os ?? os;
+	const pathImpl = deps.path ?? path;
+	const home = osImpl.homedir();
+	const candidates = [
+		".profile",
+		".zprofile",
+		".zshrc",
+		".bashrc"
+	].map((name) => pathImpl.join(home, name));
+	for (const candidate of candidates) {
+		if (!fsImpl.existsSync(candidate)) continue;
+		try {
+			const value = fsImpl.readFileSync(candidate, "utf-8").match(/(?:^|\n)\s*(?:export\s+)?ELEVENLABS_API_KEY\s*=\s*["']?([^\n"']+)["']?/)?.[1]?.trim();
+			if (value) return value;
+		} catch {}
+	}
+	return null;
+}
+function resolveTalkApiKey(env = process.env, deps = {}) {
+	const envValue = (env.ELEVENLABS_API_KEY ?? "").trim();
+	if (envValue) return envValue;
+	return readTalkApiKeyFromProfile(deps);
+}
+
+//#endregion
+//#region src/config/defaults.ts
+let defaultWarnState = { warned: false };
+const DEFAULT_MODEL_ALIASES = {
+	opus: "anthropic/claude-opus-4-6",
+	sonnet: "anthropic/claude-sonnet-4-6",
+	gpt: "openai/gpt-5.2",
+	"gpt-mini": "openai/gpt-5-mini",
+	gemini: "google/gemini-3-pro-preview",
+	"gemini-flash": "google/gemini-3-flash-preview"
+};
+function resolveAnthropicDefaultAuthMode(cfg) {
+	const profiles = cfg.auth?.profiles ?? {};
+	const anthropicProfiles = Object.entries(profiles).filter(([, profile]) => profile?.provider === "anthropic");
+	const order = cfg.auth?.order?.anthropic ?? [];
+	for (const profileId of order) {
+		const entry = profiles[profileId];
+		if (!entry || entry.provider !== "anthropic") continue;
+		if (entry.mode === "api_key") return "api_key";
+		if (entry.mode === "oauth" || entry.mode === "token") return "oauth";
+	}
+	const hasApiKey = anthropicProfiles.some(([, profile]) => profile?.mode === "api_key");
+	const hasOauth = anthropicProfiles.some(([, profile]) => profile?.mode === "oauth" || profile?.mode === "token");
+	if (hasApiKey && !hasOauth) return "api_key";
+	if (hasOauth && !hasApiKey) return "oauth";
+	if (process.env.ANTHROPIC_OAUTH_TOKEN?.trim()) return "oauth";
+	if (process.env.ANTHROPIC_API_KEY?.trim()) return "api_key";
+	return null;
+}
+function resolvePrimaryModelRef(raw) {
+	if (!raw || typeof raw !== "string") return null;
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	return DEFAULT_MODEL_ALIASES[trimmed.toLowerCase()] ?? trimmed;
+}
+function applyMessageDefaults(cfg) {
+	const messages = cfg.messages;
+	if (messages?.ackReactionScope !== void 0) return cfg;
+	const nextMessages = messages ? { ...messages } : {};
+	nextMessages.ackReactionScope = "group-mentions";
+	return {
+		...cfg,
+		messages: nextMessages
+	};
+}
+function applySessionDefaults(cfg, options = {}) {
+	const session = cfg.session;
+	if (!session || session.mainKey === void 0) return cfg;
+	const trimmed = session.mainKey.trim();
+	const warn = options.warn ?? console.warn;
+	const warnState = options.warnState ?? defaultWarnState;
+	const next = {
+		...cfg,
+		session: {
+			...session,
+			mainKey: "main"
+		}
+	};
+	if (trimmed && trimmed !== "main" && !warnState.warned) {
+		warnState.warned = true;
+		warn("session.mainKey is ignored; main session is always \"main\".");
+	}
+	return next;
+}
+function applyTalkApiKey(config) {
+	const normalized = normalizeTalkConfig(config);
+	const resolved = resolveTalkApiKey();
+	if (!resolved) return normalized;
+	const talk = normalized.talk;
+	const active = resolveActiveTalkProviderConfig(talk);
+	if (active.provider && active.provider !== DEFAULT_TALK_PROVIDER) return normalized;
+	const existingProviderApiKey = typeof active.config?.apiKey === "string" ? active.config.apiKey.trim() : "";
+	const existingLegacyApiKey = typeof talk?.apiKey === "string" ? talk.apiKey.trim() : "";
+	if (existingProviderApiKey || existingLegacyApiKey) return normalized;
+	const providerId = active.provider ?? DEFAULT_TALK_PROVIDER;
+	const providers = { ...talk?.providers };
+	providers[providerId] = {
+		...providers[providerId],
+		apiKey: resolved
+	};
+	const nextTalk = {
+		...talk,
+		provider: talk?.provider ?? providerId,
+		providers,
+		apiKey: resolved
+	};
+	return {
+		...normalized,
+		talk: nextTalk
+	};
+}
+function applyTalkConfigNormalization(config) {
+	return normalizeTalkConfig(config);
+}
+function applyModelDefaults(cfg) {
+	const existingAgent = cfg.agents?.defaults;
+	if (!existingAgent) return cfg;
+	const existingModels = existingAgent.models ?? {};
+	if (Object.keys(existingModels).length === 0) return cfg;
+	const nextModels = { ...existingModels };
+	let mutated = false;
+	for (const [alias, target] of Object.entries(DEFAULT_MODEL_ALIASES)) {
+		const entry = nextModels[target];
+		if (!entry) continue;
+		if (entry.alias !== void 0) continue;
+		nextModels[target] = {
+			...entry,
+			alias
+		};
+		mutated = true;
+	}
+	if (!mutated) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: {
+				...existingAgent,
+				models: nextModels
+			}
+		}
+	};
+}
+function applyAgentDefaults(cfg) {
+	const agents = cfg.agents;
+	const defaults = agents?.defaults;
+	const hasMax = typeof defaults?.maxConcurrent === "number" && Number.isFinite(defaults.maxConcurrent);
+	const hasSubMax = typeof defaults?.subagents?.maxConcurrent === "number" && Number.isFinite(defaults.subagents.maxConcurrent);
+	if (hasMax && hasSubMax) return cfg;
+	let mutated = false;
+	const nextDefaults = defaults ? { ...defaults } : {};
+	if (!hasMax) {
+		nextDefaults.maxConcurrent = DEFAULT_AGENT_MAX_CONCURRENT;
+		mutated = true;
+	}
+	const nextSubagents = defaults?.subagents ? { ...defaults.subagents } : {};
+	if (!hasSubMax) {
+		nextSubagents.maxConcurrent = DEFAULT_SUBAGENT_MAX_CONCURRENT;
+		mutated = true;
+	}
+	if (!mutated) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...agents,
+			defaults: {
+				...nextDefaults,
+				subagents: nextSubagents
+			}
+		}
+	};
+}
+function applyLoggingDefaults(cfg) {
+	const logging = cfg.logging;
+	if (!logging) return cfg;
+	if (logging.redactSensitive) return cfg;
+	return {
+		...cfg,
+		logging: {
+			...logging,
+			redactSensitive: "tools"
+		}
+	};
+}
+function applyContextPruningDefaults(cfg) {
+	const defaults = cfg.agents?.defaults;
+	if (!defaults) return cfg;
+	const authMode = resolveAnthropicDefaultAuthMode(cfg);
+	if (!authMode) return cfg;
+	let mutated = false;
+	const nextDefaults = { ...defaults };
+	const contextPruning = defaults.contextPruning ?? {};
+	const heartbeat = defaults.heartbeat ?? {};
+	if (defaults.contextPruning?.mode === void 0) {
+		nextDefaults.contextPruning = {
+			...contextPruning,
+			mode: "cache-ttl",
+			ttl: defaults.contextPruning?.ttl ?? "1h"
+		};
+		mutated = true;
+	}
+	if (defaults.heartbeat?.every === void 0) {
+		nextDefaults.heartbeat = {
+			...heartbeat,
+			every: authMode === "oauth" ? "1h" : "30m"
+		};
+		mutated = true;
+	}
+	if (authMode === "api_key") {
+		const nextModels = defaults.models ? { ...defaults.models } : {};
+		let modelsMutated = false;
+		const isAnthropicCacheRetentionTarget = (parsed) => Boolean(parsed && (parsed.provider === "anthropic" || parsed.provider === "amazon-bedrock" && parsed.model.toLowerCase().includes("anthropic.claude")));
+		for (const [key, entry] of Object.entries(nextModels)) {
+			if (!isAnthropicCacheRetentionTarget(parseModelRef(key, "anthropic"))) continue;
+			const current = entry ?? {};
+			const params = current.params ?? {};
+			if (typeof params.cacheRetention === "string") continue;
+			nextModels[key] = {
+				...current,
+				params: {
+					...params,
+					cacheRetention: "short"
+				}
+			};
+			modelsMutated = true;
+		}
+		const rawModel = defaults.model;
+		const rawPrimary = typeof rawModel === "string" ? rawModel : rawModel?.primary;
+		const primary = resolvePrimaryModelRef(typeof rawPrimary === "string" ? rawPrimary : void 0);
+		if (primary) {
+			const parsedPrimary = parseModelRef(primary, "anthropic");
+			if (isAnthropicCacheRetentionTarget(parsedPrimary)) {
+				const key = `${parsedPrimary.provider}/${parsedPrimary.model}`;
+				const current = nextModels[key] ?? {};
+				const params = current.params ?? {};
+				if (typeof params.cacheRetention !== "string") {
+					nextModels[key] = {
+						...current,
+						params: {
+							...params,
+							cacheRetention: "short"
+						}
+					};
+					modelsMutated = true;
+				}
+			}
+		}
+		if (modelsMutated) {
+			nextDefaults.models = nextModels;
+			mutated = true;
+		}
+	}
+	if (!mutated) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: nextDefaults
+		}
+	};
+}
+
+//#endregion
+//#region src/config/env-preserve.ts
+/**
+* Preserves `${VAR}` environment variable references during config write-back.
+*
+* When config is read, `${VAR}` references are resolved to their values.
+* When writing back, callers pass the resolved config. This module detects
+* values that match what a `${VAR}` reference would resolve to and restores
+* the original reference, so env var references survive config round-trips.
+*
+* A value is restored only if:
+* 1. The pre-substitution value contained a `${VAR}` pattern
+* 2. Resolving that pattern with current env vars produces the incoming value
+*
+* If a caller intentionally set a new value (different from what the env var
+* resolves to), the new value is kept as-is.
+*/
+const ENV_VAR_PATTERN = /\$\{[A-Z_][A-Z0-9_]*\}/;
+/**
+* Check if a string contains any `${VAR}` env var references.
+*/
+function hasEnvVarRef(value) {
+	return ENV_VAR_PATTERN.test(value);
+}
+/**
+* Resolve `${VAR}` references in a single string using the given env.
+* Returns null if any referenced var is missing (instead of throwing).
+*
+* Mirrors the substitution semantics of `substituteString` in env-substitution.ts:
+* - `${VAR}` → env value (returns null if missing)
+* - `$${VAR}` → literal `${VAR}` (escape sequence)
+*/
+function tryResolveString(template, env) {
+	const ENV_VAR_NAME = /^[A-Z_][A-Z0-9_]*$/;
+	const chunks = [];
+	for (let i = 0; i < template.length; i++) {
+		if (template[i] === "$") {
+			if (template[i + 1] === "$" && template[i + 2] === "{") {
+				const start = i + 3;
+				const end = template.indexOf("}", start);
+				if (end !== -1) {
+					const name = template.slice(start, end);
+					if (ENV_VAR_NAME.test(name)) {
+						chunks.push(`\${${name}}`);
+						i = end;
+						continue;
+					}
+				}
+			}
+			if (template[i + 1] === "{") {
+				const start = i + 2;
+				const end = template.indexOf("}", start);
+				if (end !== -1) {
+					const name = template.slice(start, end);
+					if (ENV_VAR_NAME.test(name)) {
+						const val = env[name];
+						if (val === void 0 || val === "") return null;
+						chunks.push(val);
+						i = end;
+						continue;
+					}
+				}
+			}
+		}
+		chunks.push(template[i]);
+	}
+	return chunks.join("");
+}
+/**
+* Deep-walk the incoming config and restore `${VAR}` references from the
+* pre-substitution parsed config wherever the resolved value matches.
+*
+* @param incoming - The resolved config about to be written
+* @param parsed - The pre-substitution parsed config (from the current file on disk)
+* @param env - Environment variables for verification
+* @returns A new config object with env var references restored where appropriate
+*/
+function restoreEnvVarRefs(incoming, parsed, env = process.env) {
+	if (parsed === null || parsed === void 0) return incoming;
+	if (typeof incoming === "string" && typeof parsed === "string") {
+		if (hasEnvVarRef(parsed)) {
+			if (tryResolveString(parsed, env) === incoming) return parsed;
+		}
+		return incoming;
+	}
+	if (Array.isArray(incoming) && Array.isArray(parsed)) return incoming.map((item, i) => i < parsed.length ? restoreEnvVarRefs(item, parsed[i], env) : item);
+	if (isPlainObject$2(incoming) && isPlainObject$2(parsed)) {
+		const result = {};
+		for (const [key, value] of Object.entries(incoming)) if (key in parsed) result[key] = restoreEnvVarRefs(value, parsed[key], env);
+		else result[key] = value;
+		return result;
+	}
+	return incoming;
+}
+
+//#endregion
+//#region src/config/env-substitution.ts
+/**
+* Environment variable substitution for config values.
+*
+* Supports `${VAR_NAME}` syntax in string values, substituted at config load time.
+* - Only uppercase env vars are matched: `[A-Z_][A-Z0-9_]*`
+* - Escape with `$${}` to output literal `${}`
+* - Missing env vars throw `MissingEnvVarError` with context
+*
+* @example
+* ```json5
+* {
+*   models: {
+*     providers: {
+*       "vercel-gateway": {
+*         apiKey: "${VERCEL_GATEWAY_API_KEY}"
+*       }
+*     }
+*   }
+* }
+* ```
+*/
+const ENV_VAR_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+var MissingEnvVarError = class extends Error {
+	constructor(varName, configPath) {
+		super(`Missing env var "${varName}" referenced at config path: ${configPath}`);
+		this.varName = varName;
+		this.configPath = configPath;
+		this.name = "MissingEnvVarError";
+	}
+};
+function parseEnvTokenAt(value, index) {
+	if (value[index] !== "$") return null;
+	const next = value[index + 1];
+	const afterNext = value[index + 2];
+	if (next === "$" && afterNext === "{") {
+		const start = index + 3;
+		const end = value.indexOf("}", start);
+		if (end !== -1) {
+			const name = value.slice(start, end);
+			if (ENV_VAR_NAME_PATTERN.test(name)) return {
+				kind: "escaped",
+				name,
+				end
+			};
+		}
+	}
+	if (next === "{") {
+		const start = index + 2;
+		const end = value.indexOf("}", start);
+		if (end !== -1) {
+			const name = value.slice(start, end);
+			if (ENV_VAR_NAME_PATTERN.test(name)) return {
+				kind: "substitution",
+				name,
+				end
+			};
+		}
+	}
+	return null;
+}
+function substituteString(value, env, configPath) {
+	if (!value.includes("$")) return value;
+	const chunks = [];
+	for (let i = 0; i < value.length; i += 1) {
+		const char = value[i];
+		if (char !== "$") {
+			chunks.push(char);
+			continue;
+		}
+		const token = parseEnvTokenAt(value, i);
+		if (token?.kind === "escaped") {
+			chunks.push(`\${${token.name}}`);
+			i = token.end;
+			continue;
+		}
+		if (token?.kind === "substitution") {
+			const envValue = env[token.name];
+			if (envValue === void 0 || envValue === "") throw new MissingEnvVarError(token.name, configPath);
+			chunks.push(envValue);
+			i = token.end;
+			continue;
+		}
+		chunks.push(char);
+	}
+	return chunks.join("");
+}
+function containsEnvVarReference(value) {
+	if (!value.includes("$")) return false;
+	for (let i = 0; i < value.length; i += 1) {
+		if (value[i] !== "$") continue;
+		const token = parseEnvTokenAt(value, i);
+		if (token?.kind === "escaped") {
+			i = token.end;
+			continue;
+		}
+		if (token?.kind === "substitution") return true;
+	}
+	return false;
+}
+function substituteAny(value, env, path) {
+	if (typeof value === "string") return substituteString(value, env, path);
+	if (Array.isArray(value)) return value.map((item, index) => substituteAny(item, env, `${path}[${index}]`));
+	if (isPlainObject$2(value)) {
+		const result = {};
+		for (const [key, val] of Object.entries(value)) result[key] = substituteAny(val, env, path ? `${path}.${key}` : key);
+		return result;
+	}
+	return value;
+}
+/**
+* Resolves `${VAR_NAME}` environment variable references in config values.
+*
+* @param obj - The parsed config object (after JSON5 parse and $include resolution)
+* @param env - Environment variables to use for substitution (defaults to process.env)
+* @returns The config object with env vars substituted
+* @throws {MissingEnvVarError} If a referenced env var is not set or empty
+*/
+function resolveConfigEnvVars(obj, env = process.env) {
+	return substituteAny(obj, env, "");
+}
+
+//#endregion
+//#region src/security/scan-paths.ts
+function isPathInside$1(basePath, candidatePath) {
+	const base = path.resolve(basePath);
+	const candidate = path.resolve(candidatePath);
+	const rel = path.relative(base, candidate);
+	return rel === "" || !rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel);
+}
+function safeRealpathSync$1(filePath) {
+	try {
+		return fs.realpathSync(filePath);
+	} catch {
+		return null;
+	}
+}
+function isPathInsideWithRealpath(basePath, candidatePath, opts) {
+	if (!isPathInside$1(basePath, candidatePath)) return false;
+	const baseReal = safeRealpathSync$1(basePath);
+	const candidateReal = safeRealpathSync$1(candidatePath);
+	if (!baseReal || !candidateReal) return opts?.requireRealpath !== true;
+	return isPathInside$1(baseReal, candidateReal);
+}
+function extensionUsesSkippedScannerPath(entry) {
+	return entry.split(/[\\/]+/).filter(Boolean).some((segment) => segment === "node_modules" || segment.startsWith(".") && segment !== "." && segment !== "..");
+}
+
+//#endregion
+//#region src/config/includes.ts
+/**
+* Config includes: $include directive for modular configs
+*
+* @example
+* ```json5
+* {
+*   "$include": "./base.json5",           // single file
+*   "$include": ["./a.json5", "./b.json5"] // merge multiple
+* }
+* ```
+*/
+const INCLUDE_KEY = "$include";
+const MAX_INCLUDE_DEPTH = 10;
+var ConfigIncludeError = class extends Error {
+	constructor(message, includePath, cause) {
+		super(message);
+		this.includePath = includePath;
+		this.cause = cause;
+		this.name = "ConfigIncludeError";
+	}
+};
+var CircularIncludeError = class extends ConfigIncludeError {
+	constructor(chain) {
+		super(`Circular include detected: ${chain.join(" -> ")}`, chain[chain.length - 1]);
+		this.chain = chain;
+		this.name = "CircularIncludeError";
+	}
+};
+/** Deep merge: arrays concatenate, objects merge recursively, primitives: source wins */
+function deepMerge(target, source) {
+	if (Array.isArray(target) && Array.isArray(source)) return [...target, ...source];
+	if (isPlainObject$2(target) && isPlainObject$2(source)) {
+		const result = { ...target };
+		for (const key of Object.keys(source)) {
+			if (isBlockedObjectKey(key)) continue;
+			result[key] = key in result ? deepMerge(result[key], source[key]) : source[key];
+		}
+		return result;
+	}
+	return source;
+}
+var IncludeProcessor = class IncludeProcessor {
+	constructor(basePath, resolver, rootDir) {
+		this.basePath = basePath;
+		this.resolver = resolver;
+		this.visited = /* @__PURE__ */ new Set();
+		this.depth = 0;
+		this.visited.add(path.normalize(basePath));
+		this.rootDir = path.normalize(rootDir ?? path.dirname(basePath));
+		this.rootRealDir = path.normalize(safeRealpath(this.rootDir));
+	}
+	process(obj) {
+		if (Array.isArray(obj)) return obj.map((item) => this.process(item));
+		if (!isPlainObject$2(obj)) return obj;
+		if (!(INCLUDE_KEY in obj)) return this.processObject(obj);
+		return this.processInclude(obj);
+	}
+	processObject(obj) {
+		const result = {};
+		for (const [key, value] of Object.entries(obj)) result[key] = this.process(value);
+		return result;
+	}
+	processInclude(obj) {
+		const includeValue = obj[INCLUDE_KEY];
+		const otherKeys = Object.keys(obj).filter((k) => k !== INCLUDE_KEY);
+		const included = this.resolveInclude(includeValue);
+		if (otherKeys.length === 0) return included;
+		if (!isPlainObject$2(included)) throw new ConfigIncludeError("Sibling keys require included content to be an object", typeof includeValue === "string" ? includeValue : INCLUDE_KEY);
+		const rest = {};
+		for (const key of otherKeys) rest[key] = this.process(obj[key]);
+		return deepMerge(included, rest);
+	}
+	resolveInclude(value) {
+		if (typeof value === "string") return this.loadFile(value);
+		if (Array.isArray(value)) return value.reduce((merged, item) => {
+			if (typeof item !== "string") throw new ConfigIncludeError(`Invalid $include array item: expected string, got ${typeof item}`, String(item));
+			return deepMerge(merged, this.loadFile(item));
+		}, {});
+		throw new ConfigIncludeError(`Invalid $include value: expected string or array of strings, got ${typeof value}`, String(value));
+	}
+	loadFile(includePath) {
+		const resolvedPath = this.resolvePath(includePath);
+		this.checkCircular(resolvedPath);
+		this.checkDepth(includePath);
+		const raw = this.readFile(includePath, resolvedPath);
+		const parsed = this.parseFile(includePath, resolvedPath, raw);
+		return this.processNested(resolvedPath, parsed);
+	}
+	resolvePath(includePath) {
+		const configDir = path.dirname(this.basePath);
+		const resolved = path.isAbsolute(includePath) ? includePath : path.resolve(configDir, includePath);
+		const normalized = path.normalize(resolved);
+		if (!isPathInside$1(this.rootDir, normalized)) throw new ConfigIncludeError(`Include path escapes config directory: ${includePath} (root: ${this.rootDir})`, includePath);
+		try {
+			const real = fs.realpathSync(normalized);
+			if (!isPathInside$1(this.rootRealDir, real)) throw new ConfigIncludeError(`Include path resolves outside config directory (symlink): ${includePath} (root: ${this.rootDir})`, includePath);
+		} catch (err) {
+			if (err instanceof ConfigIncludeError) throw err;
+		}
+		return normalized;
+	}
+	checkCircular(resolvedPath) {
+		if (this.visited.has(resolvedPath)) throw new CircularIncludeError([...this.visited, resolvedPath]);
+	}
+	checkDepth(includePath) {
+		if (this.depth >= MAX_INCLUDE_DEPTH) throw new ConfigIncludeError(`Maximum include depth (${MAX_INCLUDE_DEPTH}) exceeded at: ${includePath}`, includePath);
+	}
+	readFile(includePath, resolvedPath) {
+		try {
+			return this.resolver.readFile(resolvedPath);
+		} catch (err) {
+			throw new ConfigIncludeError(`Failed to read include file: ${includePath} (resolved: ${resolvedPath})`, includePath, err instanceof Error ? err : void 0);
+		}
+	}
+	parseFile(includePath, resolvedPath, raw) {
+		try {
+			return this.resolver.parseJson(raw);
+		} catch (err) {
+			throw new ConfigIncludeError(`Failed to parse include file: ${includePath} (resolved: ${resolvedPath})`, includePath, err instanceof Error ? err : void 0);
+		}
+	}
+	processNested(resolvedPath, parsed) {
+		const nested = new IncludeProcessor(resolvedPath, this.resolver, this.rootDir);
+		nested.visited = new Set([...this.visited, resolvedPath]);
+		nested.depth = this.depth + 1;
+		return nested.process(parsed);
+	}
+};
+function safeRealpath(target) {
+	try {
+		return fs.realpathSync(target);
+	} catch {
+		return target;
+	}
+}
+const defaultResolver = {
+	readFile: (p) => fs.readFileSync(p, "utf-8"),
+	parseJson: (raw) => JSON5.parse(raw)
+};
+/**
+* Resolves all $include directives in a parsed config object.
+*/
+function resolveConfigIncludes(obj, configPath, resolver = defaultResolver) {
+	return new IncludeProcessor(configPath, resolver).process(obj);
+}
+
+//#endregion
+//#region src/config/legacy.shared.ts
+const getRecord = (value) => isRecord(value) ? value : null;
+const ensureRecord = (root, key) => {
+	const existing = root[key];
+	if (isRecord(existing)) return existing;
+	const next = {};
+	root[key] = next;
+	return next;
+};
+const mergeMissing = (target, source) => {
+	for (const [key, value] of Object.entries(source)) {
+		if (value === void 0 || isBlockedObjectKey(key)) continue;
+		const existing = target[key];
+		if (existing === void 0) {
+			target[key] = value;
+			continue;
+		}
+		if (isRecord(existing) && isRecord(value)) mergeMissing(existing, value);
+	}
+};
+const mapLegacyAudioTranscription = (value) => {
+	const transcriber = getRecord(value);
+	const command = Array.isArray(transcriber?.command) ? transcriber?.command : null;
+	if (!command || command.length === 0) return null;
+	if (typeof command[0] !== "string") return null;
+	if (!command.every((part) => typeof part === "string")) return null;
+	const rawExecutable = command[0].trim();
+	if (!rawExecutable) return null;
+	if (!isSafeExecutableValue(rawExecutable)) return null;
+	const args = command.slice(1);
+	const timeoutSeconds = typeof transcriber?.timeoutSeconds === "number" ? transcriber?.timeoutSeconds : void 0;
+	const result = {
+		command: rawExecutable,
+		type: "cli"
+	};
+	if (args.length > 0) result.args = args;
+	if (timeoutSeconds !== void 0) result.timeoutSeconds = timeoutSeconds;
+	return result;
+};
+const getAgentsList = (agents) => {
+	const list = agents?.list;
+	return Array.isArray(list) ? list : [];
+};
+const resolveDefaultAgentIdFromRaw = (raw) => {
+	const list = getAgentsList(getRecord(raw.agents));
+	const defaultEntry = list.find((entry) => isRecord(entry) && entry.default === true && typeof entry.id === "string" && entry.id.trim() !== "");
+	if (defaultEntry) return defaultEntry.id.trim();
+	const routing = getRecord(raw.routing);
+	const routingDefault = typeof routing?.defaultAgentId === "string" ? routing.defaultAgentId.trim() : "";
+	if (routingDefault) return routingDefault;
+	const firstEntry = list.find((entry) => isRecord(entry) && typeof entry.id === "string" && entry.id.trim() !== "");
+	if (firstEntry) return firstEntry.id.trim();
+	return "main";
+};
+const ensureAgentEntry = (list, id) => {
+	const normalized = id.trim();
+	const existing = list.find((entry) => isRecord(entry) && typeof entry.id === "string" && entry.id.trim() === normalized);
+	if (existing) return existing;
+	const created = { id: normalized };
+	list.push(created);
+	return created;
+};
+
+//#endregion
+//#region src/config/legacy.migrations.part-1.ts
+function migrateBindings(raw, changes, changeNote, mutator) {
+	const bindings = Array.isArray(raw.bindings) ? raw.bindings : null;
+	if (!bindings) return;
+	let touched = false;
+	for (const entry of bindings) {
+		if (!isRecord(entry)) continue;
+		const match = getRecord(entry.match);
+		if (!match) continue;
+		if (!mutator(match)) continue;
+		entry.match = match;
+		touched = true;
+	}
+	if (touched) {
+		raw.bindings = bindings;
+		changes.push(changeNote);
+	}
+}
+function ensureDefaultGroupEntry(section) {
+	const groups = isRecord(section.groups) ? section.groups : {};
+	const defaultKey = "*";
+	return {
+		groups,
+		entry: isRecord(groups[defaultKey]) ? groups[defaultKey] : {}
+	};
+}
+const LEGACY_CONFIG_MIGRATIONS_PART_1 = [
+	{
+		id: "bindings.match.provider->bindings.match.channel",
+		describe: "Move bindings[].match.provider to bindings[].match.channel",
+		apply: (raw, changes) => {
+			migrateBindings(raw, changes, "Moved bindings[].match.provider → bindings[].match.channel.", (match) => {
+				if (typeof match.channel === "string" && match.channel.trim()) return false;
+				const provider = typeof match.provider === "string" ? match.provider.trim() : "";
+				if (!provider) return false;
+				match.channel = provider;
+				delete match.provider;
+				return true;
+			});
+		}
+	},
+	{
+		id: "bindings.match.accountID->bindings.match.accountId",
+		describe: "Move bindings[].match.accountID to bindings[].match.accountId",
+		apply: (raw, changes) => {
+			migrateBindings(raw, changes, "Moved bindings[].match.accountID → bindings[].match.accountId.", (match) => {
+				if (match.accountId !== void 0) return false;
+				const accountID = typeof match.accountID === "string" ? match.accountID.trim() : match.accountID;
+				if (!accountID) return false;
+				match.accountId = accountID;
+				delete match.accountID;
+				return true;
+			});
+		}
+	},
+	{
+		id: "session.sendPolicy.rules.match.provider->match.channel",
+		describe: "Move session.sendPolicy.rules[].match.provider to match.channel",
+		apply: (raw, changes) => {
+			const session = getRecord(raw.session);
+			if (!session) return;
+			const sendPolicy = getRecord(session.sendPolicy);
+			if (!sendPolicy) return;
+			const rules = Array.isArray(sendPolicy.rules) ? sendPolicy.rules : null;
+			if (!rules) return;
+			let touched = false;
+			for (const rule of rules) {
+				if (!isRecord(rule)) continue;
+				const match = getRecord(rule.match);
+				if (!match) continue;
+				if (typeof match.channel === "string" && match.channel.trim()) continue;
+				const provider = typeof match.provider === "string" ? match.provider.trim() : "";
+				if (!provider) continue;
+				match.channel = provider;
+				delete match.provider;
+				rule.match = match;
+				touched = true;
+			}
+			if (touched) {
+				sendPolicy.rules = rules;
+				session.sendPolicy = sendPolicy;
+				raw.session = session;
+				changes.push("Moved session.sendPolicy.rules[].match.provider → match.channel.");
+			}
+		}
+	},
+	{
+		id: "messages.queue.byProvider->byChannel",
+		describe: "Move messages.queue.byProvider to messages.queue.byChannel",
+		apply: (raw, changes) => {
+			const messages = getRecord(raw.messages);
+			if (!messages) return;
+			const queue = getRecord(messages.queue);
+			if (!queue) return;
+			if (queue.byProvider === void 0) return;
+			if (queue.byChannel === void 0) {
+				queue.byChannel = queue.byProvider;
+				changes.push("Moved messages.queue.byProvider → messages.queue.byChannel.");
+			} else changes.push("Removed messages.queue.byProvider (messages.queue.byChannel already set).");
+			delete queue.byProvider;
+			messages.queue = queue;
+			raw.messages = messages;
+		}
+	},
+	{
+		id: "providers->channels",
+		describe: "Move provider config sections to channels.*",
+		apply: (raw, changes) => {
+			const legacyEntries = [
+				"whatsapp",
+				"telegram",
+				"discord",
+				"slack",
+				"signal",
+				"imessage",
+				"msteams"
+			].filter((key) => isRecord(raw[key]));
+			if (legacyEntries.length === 0) return;
+			const channels = ensureRecord(raw, "channels");
+			for (const key of legacyEntries) {
+				const legacy = getRecord(raw[key]);
+				if (!legacy) continue;
+				const channelEntry = ensureRecord(channels, key);
+				const hadEntries = Object.keys(channelEntry).length > 0;
+				mergeMissing(channelEntry, legacy);
+				channels[key] = channelEntry;
+				delete raw[key];
+				changes.push(hadEntries ? `Merged ${key} → channels.${key}.` : `Moved ${key} → channels.${key}.`);
+			}
+			raw.channels = channels;
+		}
+	},
+	{
+		id: "channels.streaming-keys->channels.streaming",
+		describe: "Normalize legacy streaming keys to channels.<provider>.streaming (Telegram/Discord/Slack)",
+		apply: (raw, changes) => {
+			const channels = getRecord(raw.channels);
+			if (!channels) return;
+			const migrateProviderEntry = (params) => {
+				const migrateCommonStreamingMode = (resolveMode) => {
+					const hasLegacyStreamMode = params.entry.streamMode !== void 0;
+					const legacyStreaming = params.entry.streaming;
+					if (!hasLegacyStreamMode && typeof legacyStreaming !== "boolean") return false;
+					const resolved = resolveMode(params.entry);
+					params.entry.streaming = resolved;
+					if (hasLegacyStreamMode) {
+						delete params.entry.streamMode;
+						changes.push(`Moved ${params.pathPrefix}.streamMode → ${params.pathPrefix}.streaming (${resolved}).`);
+					}
+					if (typeof legacyStreaming === "boolean") changes.push(`Normalized ${params.pathPrefix}.streaming boolean → enum (${resolved}).`);
+					return true;
+				};
+				const hasLegacyStreamMode = params.entry.streamMode !== void 0;
+				const legacyStreaming = params.entry.streaming;
+				const legacyNativeStreaming = params.entry.nativeStreaming;
+				if (params.provider === "telegram") {
+					migrateCommonStreamingMode(resolveTelegramPreviewStreamMode);
+					return;
+				}
+				if (params.provider === "discord") {
+					migrateCommonStreamingMode(resolveDiscordPreviewStreamMode);
+					return;
+				}
+				if (!hasLegacyStreamMode && typeof legacyStreaming !== "boolean") return;
+				const resolvedStreaming = resolveSlackStreamingMode(params.entry);
+				const resolvedNativeStreaming = resolveSlackNativeStreaming(params.entry);
+				params.entry.streaming = resolvedStreaming;
+				params.entry.nativeStreaming = resolvedNativeStreaming;
+				if (hasLegacyStreamMode) {
+					delete params.entry.streamMode;
+					changes.push(`Moved ${params.pathPrefix}.streamMode → ${params.pathPrefix}.streaming (${resolvedStreaming}).`);
+				}
+				if (typeof legacyStreaming === "boolean") changes.push(`Moved ${params.pathPrefix}.streaming (boolean) → ${params.pathPrefix}.nativeStreaming (${resolvedNativeStreaming}).`);
+				else if (typeof legacyNativeStreaming !== "boolean" && hasLegacyStreamMode) changes.push(`Set ${params.pathPrefix}.nativeStreaming → ${resolvedNativeStreaming}.`);
+			};
+			const migrateProvider = (provider) => {
+				const providerEntry = getRecord(channels[provider]);
+				if (!providerEntry) return;
+				migrateProviderEntry({
+					provider,
+					entry: providerEntry,
+					pathPrefix: `channels.${provider}`
+				});
+				const accounts = getRecord(providerEntry.accounts);
+				if (!accounts) return;
+				for (const [accountId, accountValue] of Object.entries(accounts)) {
+					const account = getRecord(accountValue);
+					if (!account) continue;
+					migrateProviderEntry({
+						provider,
+						entry: account,
+						pathPrefix: `channels.${provider}.accounts.${accountId}`
+					});
+				}
+			};
+			migrateProvider("telegram");
+			migrateProvider("discord");
+			migrateProvider("slack");
+		}
+	},
+	{
+		id: "routing.allowFrom->channels.whatsapp.allowFrom",
+		describe: "Move routing.allowFrom to channels.whatsapp.allowFrom",
+		apply: (raw, changes) => {
+			const routing = raw.routing;
+			if (!routing || typeof routing !== "object") return;
+			const allowFrom = routing.allowFrom;
+			if (allowFrom === void 0) return;
+			const channels = getRecord(raw.channels);
+			const whatsapp = channels ? getRecord(channels.whatsapp) : null;
+			if (!whatsapp) {
+				delete routing.allowFrom;
+				if (Object.keys(routing).length === 0) delete raw.routing;
+				changes.push("Removed routing.allowFrom (channels.whatsapp not configured).");
+				return;
+			}
+			if (whatsapp.allowFrom === void 0) {
+				whatsapp.allowFrom = allowFrom;
+				changes.push("Moved routing.allowFrom → channels.whatsapp.allowFrom.");
+			} else changes.push("Removed routing.allowFrom (channels.whatsapp.allowFrom already set).");
+			delete routing.allowFrom;
+			if (Object.keys(routing).length === 0) delete raw.routing;
+			channels.whatsapp = whatsapp;
+			raw.channels = channels;
+		}
+	},
+	{
+		id: "routing.groupChat.requireMention->groups.*.requireMention",
+		describe: "Move routing.groupChat.requireMention to channels.whatsapp/telegram/imessage groups",
+		apply: (raw, changes) => {
+			const routing = raw.routing;
+			if (!routing || typeof routing !== "object") return;
+			const groupChat = routing.groupChat && typeof routing.groupChat === "object" ? routing.groupChat : null;
+			if (!groupChat) return;
+			const requireMention = groupChat.requireMention;
+			if (requireMention === void 0) return;
+			const channels = ensureRecord(raw, "channels");
+			const applyTo = (key, options) => {
+				if (options?.requireExisting && !isRecord(channels[key])) return;
+				const section = channels[key] && typeof channels[key] === "object" ? channels[key] : {};
+				const { groups, entry } = ensureDefaultGroupEntry(section);
+				const defaultKey = "*";
+				if (entry.requireMention === void 0) {
+					entry.requireMention = requireMention;
+					groups[defaultKey] = entry;
+					section.groups = groups;
+					channels[key] = section;
+					changes.push(`Moved routing.groupChat.requireMention → channels.${key}.groups."*".requireMention.`);
+				} else changes.push(`Removed routing.groupChat.requireMention (channels.${key}.groups."*" already set).`);
+			};
+			applyTo("whatsapp", { requireExisting: true });
+			applyTo("telegram");
+			applyTo("imessage");
+			delete groupChat.requireMention;
+			if (Object.keys(groupChat).length === 0) delete routing.groupChat;
+			if (Object.keys(routing).length === 0) delete raw.routing;
+			raw.channels = channels;
+		}
+	},
+	{
+		id: "gateway.token->gateway.auth.token",
+		describe: "Move gateway.token to gateway.auth.token",
+		apply: (raw, changes) => {
+			const gateway = raw.gateway;
+			if (!gateway || typeof gateway !== "object") return;
+			const token = gateway.token;
+			if (token === void 0) return;
+			const gatewayObj = gateway;
+			const auth = gatewayObj.auth && typeof gatewayObj.auth === "object" ? gatewayObj.auth : {};
+			if (auth.token === void 0) {
+				auth.token = token;
+				if (!auth.mode) auth.mode = "token";
+				changes.push("Moved gateway.token → gateway.auth.token.");
+			} else changes.push("Removed gateway.token (gateway.auth.token already set).");
+			delete gatewayObj.token;
+			if (Object.keys(auth).length > 0) gatewayObj.auth = auth;
+			raw.gateway = gatewayObj;
+		}
+	},
+	{
+		id: "telegram.requireMention->channels.telegram.groups.*.requireMention",
+		describe: "Move telegram.requireMention to channels.telegram.groups.*.requireMention",
+		apply: (raw, changes) => {
+			const channels = ensureRecord(raw, "channels");
+			const telegram = channels.telegram;
+			if (!telegram || typeof telegram !== "object") return;
+			const requireMention = telegram.requireMention;
+			if (requireMention === void 0) return;
+			const { groups, entry } = ensureDefaultGroupEntry(telegram);
+			const defaultKey = "*";
+			if (entry.requireMention === void 0) {
+				entry.requireMention = requireMention;
+				groups[defaultKey] = entry;
+				telegram.groups = groups;
+				changes.push("Moved telegram.requireMention → channels.telegram.groups.\"*\".requireMention.");
+			} else changes.push("Removed telegram.requireMention (channels.telegram.groups.\"*\" already set).");
+			delete telegram.requireMention;
+			channels.telegram = telegram;
+			raw.channels = channels;
+		}
+	}
+];
+
+//#endregion
+//#region src/config/legacy.migrations.part-2.ts
+function applyLegacyAudioTranscriptionModel(params) {
+	const mapped = mapLegacyAudioTranscription(params.source);
+	if (!mapped) {
+		params.changes.push(params.invalidMessage);
+		return;
+	}
+	const mediaAudio = ensureRecord(ensureRecord(ensureRecord(params.raw, "tools"), "media"), "audio");
+	if ((Array.isArray(mediaAudio.models) ? mediaAudio.models : []).length === 0) {
+		mediaAudio.enabled = true;
+		mediaAudio.models = [mapped];
+		params.changes.push(params.movedMessage);
+		return;
+	}
+	params.changes.push(params.alreadySetMessage);
+}
+const LEGACY_CONFIG_MIGRATIONS_PART_2 = [
+	{
+		id: "agent.model-config-v2",
+		describe: "Migrate legacy agent.model/allowedModels/modelAliases/modelFallbacks/imageModelFallbacks to agent.models + model lists",
+		apply: (raw, changes) => {
+			const agentRoot = getRecord(raw.agent);
+			const defaults = getRecord(getRecord(raw.agents)?.defaults);
+			const agent = agentRoot ?? defaults;
+			if (!agent) return;
+			const label = agentRoot ? "agent" : "agents.defaults";
+			const legacyModel = typeof agent.model === "string" ? String(agent.model) : void 0;
+			const legacyImageModel = typeof agent.imageModel === "string" ? String(agent.imageModel) : void 0;
+			const legacyAllowed = Array.isArray(agent.allowedModels) ? agent.allowedModels.map(String) : [];
+			const legacyModelFallbacks = Array.isArray(agent.modelFallbacks) ? agent.modelFallbacks.map(String) : [];
+			const legacyImageModelFallbacks = Array.isArray(agent.imageModelFallbacks) ? agent.imageModelFallbacks.map(String) : [];
+			const legacyAliases = agent.modelAliases && typeof agent.modelAliases === "object" ? agent.modelAliases : {};
+			if (!(legacyModel || legacyImageModel || legacyAllowed.length > 0 || legacyModelFallbacks.length > 0 || legacyImageModelFallbacks.length > 0 || Object.keys(legacyAliases).length > 0)) return;
+			const models = agent.models && typeof agent.models === "object" ? agent.models : {};
+			const ensureModel = (rawKey) => {
+				if (typeof rawKey !== "string") return;
+				const key = rawKey.trim();
+				if (!key) return;
+				if (!models[key]) models[key] = {};
+			};
+			ensureModel(legacyModel);
+			ensureModel(legacyImageModel);
+			for (const key of legacyAllowed) ensureModel(key);
+			for (const key of legacyModelFallbacks) ensureModel(key);
+			for (const key of legacyImageModelFallbacks) ensureModel(key);
+			for (const target of Object.values(legacyAliases)) {
+				if (typeof target !== "string") continue;
+				ensureModel(target);
+			}
+			for (const [alias, targetRaw] of Object.entries(legacyAliases)) {
+				if (typeof targetRaw !== "string") continue;
+				const target = targetRaw.trim();
+				if (!target) continue;
+				const entry = models[target] && typeof models[target] === "object" ? models[target] : {};
+				if (!("alias" in entry)) {
+					entry.alias = alias;
+					models[target] = entry;
+				}
+			}
+			const currentModel = agent.model && typeof agent.model === "object" ? agent.model : null;
+			if (currentModel) {
+				if (!currentModel.primary && legacyModel) currentModel.primary = legacyModel;
+				if (legacyModelFallbacks.length > 0 && (!Array.isArray(currentModel.fallbacks) || currentModel.fallbacks.length === 0)) currentModel.fallbacks = legacyModelFallbacks;
+				agent.model = currentModel;
+			} else if (legacyModel || legacyModelFallbacks.length > 0) agent.model = {
+				primary: legacyModel,
+				fallbacks: legacyModelFallbacks.length ? legacyModelFallbacks : []
+			};
+			const currentImageModel = agent.imageModel && typeof agent.imageModel === "object" ? agent.imageModel : null;
+			if (currentImageModel) {
+				if (!currentImageModel.primary && legacyImageModel) currentImageModel.primary = legacyImageModel;
+				if (legacyImageModelFallbacks.length > 0 && (!Array.isArray(currentImageModel.fallbacks) || currentImageModel.fallbacks.length === 0)) currentImageModel.fallbacks = legacyImageModelFallbacks;
+				agent.imageModel = currentImageModel;
+			} else if (legacyImageModel || legacyImageModelFallbacks.length > 0) agent.imageModel = {
+				primary: legacyImageModel,
+				fallbacks: legacyImageModelFallbacks.length ? legacyImageModelFallbacks : []
+			};
+			agent.models = models;
+			if (legacyModel !== void 0) changes.push(`Migrated ${label}.model string → ${label}.model.primary.`);
+			if (legacyModelFallbacks.length > 0) changes.push(`Migrated ${label}.modelFallbacks → ${label}.model.fallbacks.`);
+			if (legacyImageModel !== void 0) changes.push(`Migrated ${label}.imageModel string → ${label}.imageModel.primary.`);
+			if (legacyImageModelFallbacks.length > 0) changes.push(`Migrated ${label}.imageModelFallbacks → ${label}.imageModel.fallbacks.`);
+			if (legacyAllowed.length > 0) changes.push(`Migrated ${label}.allowedModels → ${label}.models.`);
+			if (Object.keys(legacyAliases).length > 0) changes.push(`Migrated ${label}.modelAliases → ${label}.models.*.alias.`);
+			delete agent.allowedModels;
+			delete agent.modelAliases;
+			delete agent.modelFallbacks;
+			delete agent.imageModelFallbacks;
+		}
+	},
+	{
+		id: "routing.agents-v2",
+		describe: "Move routing.agents/defaultAgentId to agents.list",
+		apply: (raw, changes) => {
+			const routing = getRecord(raw.routing);
+			if (!routing) return;
+			const routingAgents = getRecord(routing.agents);
+			const agents = ensureRecord(raw, "agents");
+			const list = getAgentsList(agents);
+			if (routingAgents) {
+				for (const [rawId, entryRaw] of Object.entries(routingAgents)) {
+					const agentId = String(rawId ?? "").trim();
+					const entry = getRecord(entryRaw);
+					if (!agentId || !entry) continue;
+					const target = ensureAgentEntry(list, agentId);
+					const entryCopy = { ...entry };
+					if ("mentionPatterns" in entryCopy) {
+						const mentionPatterns = entryCopy.mentionPatterns;
+						const groupChat = ensureRecord(target, "groupChat");
+						if (groupChat.mentionPatterns === void 0) {
+							groupChat.mentionPatterns = mentionPatterns;
+							changes.push(`Moved routing.agents.${agentId}.mentionPatterns → agents.list (id "${agentId}").groupChat.mentionPatterns.`);
+						} else changes.push(`Removed routing.agents.${agentId}.mentionPatterns (agents.list groupChat mentionPatterns already set).`);
+						delete entryCopy.mentionPatterns;
+					}
+					const legacyGroupChat = getRecord(entryCopy.groupChat);
+					if (legacyGroupChat) {
+						mergeMissing(ensureRecord(target, "groupChat"), legacyGroupChat);
+						delete entryCopy.groupChat;
+					}
+					const legacySandbox = getRecord(entryCopy.sandbox);
+					if (legacySandbox) {
+						const sandboxTools = getRecord(legacySandbox.tools);
+						if (sandboxTools) {
+							mergeMissing(ensureRecord(ensureRecord(ensureRecord(target, "tools"), "sandbox"), "tools"), sandboxTools);
+							delete legacySandbox.tools;
+							changes.push(`Moved routing.agents.${agentId}.sandbox.tools → agents.list (id "${agentId}").tools.sandbox.tools.`);
+						}
+						entryCopy.sandbox = legacySandbox;
+					}
+					mergeMissing(target, entryCopy);
+				}
+				delete routing.agents;
+				changes.push("Moved routing.agents → agents.list.");
+			}
+			const defaultAgentId = typeof routing.defaultAgentId === "string" ? routing.defaultAgentId.trim() : "";
+			if (defaultAgentId) {
+				if (!list.some((entry) => isRecord(entry) && entry.default === true)) {
+					const entry = ensureAgentEntry(list, defaultAgentId);
+					entry.default = true;
+					changes.push(`Moved routing.defaultAgentId → agents.list (id "${defaultAgentId}").default.`);
+				} else changes.push("Removed routing.defaultAgentId (agents.list default already set).");
+				delete routing.defaultAgentId;
+			}
+			if (list.length > 0) agents.list = list;
+			if (Object.keys(routing).length === 0) delete raw.routing;
+		}
+	},
+	{
+		id: "routing.config-v2",
+		describe: "Move routing bindings/groupChat/queue/agentToAgent/transcribeAudio",
+		apply: (raw, changes) => {
+			const routing = getRecord(raw.routing);
+			if (!routing) return;
+			if (routing.bindings !== void 0) {
+				if (raw.bindings === void 0) {
+					raw.bindings = routing.bindings;
+					changes.push("Moved routing.bindings → bindings.");
+				} else changes.push("Removed routing.bindings (bindings already set).");
+				delete routing.bindings;
+			}
+			if (routing.agentToAgent !== void 0) {
+				const tools = ensureRecord(raw, "tools");
+				if (tools.agentToAgent === void 0) {
+					tools.agentToAgent = routing.agentToAgent;
+					changes.push("Moved routing.agentToAgent → tools.agentToAgent.");
+				} else changes.push("Removed routing.agentToAgent (tools.agentToAgent already set).");
+				delete routing.agentToAgent;
+			}
+			if (routing.queue !== void 0) {
+				const messages = ensureRecord(raw, "messages");
+				if (messages.queue === void 0) {
+					messages.queue = routing.queue;
+					changes.push("Moved routing.queue → messages.queue.");
+				} else changes.push("Removed routing.queue (messages.queue already set).");
+				delete routing.queue;
+			}
+			const groupChat = getRecord(routing.groupChat);
+			if (groupChat) {
+				const historyLimit = groupChat.historyLimit;
+				if (historyLimit !== void 0) {
+					const messagesGroup = ensureRecord(ensureRecord(raw, "messages"), "groupChat");
+					if (messagesGroup.historyLimit === void 0) {
+						messagesGroup.historyLimit = historyLimit;
+						changes.push("Moved routing.groupChat.historyLimit → messages.groupChat.historyLimit.");
+					} else changes.push("Removed routing.groupChat.historyLimit (messages.groupChat.historyLimit already set).");
+					delete groupChat.historyLimit;
+				}
+				const mentionPatterns = groupChat.mentionPatterns;
+				if (mentionPatterns !== void 0) {
+					const messagesGroup = ensureRecord(ensureRecord(raw, "messages"), "groupChat");
+					if (messagesGroup.mentionPatterns === void 0) {
+						messagesGroup.mentionPatterns = mentionPatterns;
+						changes.push("Moved routing.groupChat.mentionPatterns → messages.groupChat.mentionPatterns.");
+					} else changes.push("Removed routing.groupChat.mentionPatterns (messages.groupChat.mentionPatterns already set).");
+					delete groupChat.mentionPatterns;
+				}
+				if (Object.keys(groupChat).length === 0) delete routing.groupChat;
+				else routing.groupChat = groupChat;
+			}
+			if (routing.transcribeAudio !== void 0) {
+				applyLegacyAudioTranscriptionModel({
+					raw,
+					source: routing.transcribeAudio,
+					changes,
+					movedMessage: "Moved routing.transcribeAudio → tools.media.audio.models.",
+					alreadySetMessage: "Removed routing.transcribeAudio (tools.media.audio.models already set).",
+					invalidMessage: "Removed routing.transcribeAudio (invalid or empty command)."
+				});
+				delete routing.transcribeAudio;
+			}
+			if (Object.keys(routing).length === 0) delete raw.routing;
+		}
+	},
+	{
+		id: "audio.transcription-v2",
+		describe: "Move audio.transcription to tools.media.audio.models",
+		apply: (raw, changes) => {
+			const audio = getRecord(raw.audio);
+			if (audio?.transcription === void 0) return;
+			applyLegacyAudioTranscriptionModel({
+				raw,
+				source: audio.transcription,
+				changes,
+				movedMessage: "Moved audio.transcription → tools.media.audio.models.",
+				alreadySetMessage: "Removed audio.transcription (tools.media.audio.models already set).",
+				invalidMessage: "Removed audio.transcription (invalid or empty command)."
+			});
+			delete audio.transcription;
+			if (Object.keys(audio).length === 0) delete raw.audio;
+			else raw.audio = audio;
+		}
+	}
+];
+
+//#endregion
+//#region src/config/legacy.migrations.part-3.ts
+const LEGACY_CONFIG_MIGRATIONS_PART_3 = [
+	{
+		id: "auth.anthropic-claude-cli-mode-oauth",
+		describe: "Switch anthropic:claude-cli auth profile mode to oauth",
+		apply: (raw, changes) => {
+			const profiles = getRecord(getRecord(raw.auth)?.profiles);
+			if (!profiles) return;
+			const claudeCli = getRecord(profiles["anthropic:claude-cli"]);
+			if (!claudeCli) return;
+			if (claudeCli.mode !== "token") return;
+			claudeCli.mode = "oauth";
+			changes.push("Updated auth.profiles[\"anthropic:claude-cli\"].mode → \"oauth\".");
+		}
+	},
+	{
+		id: "tools.bash->tools.exec",
+		describe: "Move tools.bash to tools.exec",
+		apply: (raw, changes) => {
+			const tools = ensureRecord(raw, "tools");
+			const bash = getRecord(tools.bash);
+			if (!bash) return;
+			if (tools.exec === void 0) {
+				tools.exec = bash;
+				changes.push("Moved tools.bash → tools.exec.");
+			} else changes.push("Removed tools.bash (tools.exec already set).");
+			delete tools.bash;
+		}
+	},
+	{
+		id: "messages.tts.enabled->auto",
+		describe: "Move messages.tts.enabled to messages.tts.auto",
+		apply: (raw, changes) => {
+			const tts = getRecord(getRecord(raw.messages)?.tts);
+			if (!tts) return;
+			if (tts.auto !== void 0) {
+				if ("enabled" in tts) {
+					delete tts.enabled;
+					changes.push("Removed messages.tts.enabled (messages.tts.auto already set).");
+				}
+				return;
+			}
+			if (typeof tts.enabled !== "boolean") return;
+			tts.auto = tts.enabled ? "always" : "off";
+			delete tts.enabled;
+			changes.push(`Moved messages.tts.enabled → messages.tts.auto (${String(tts.auto)}).`);
+		}
+	},
+	{
+		id: "agent.defaults-v2",
+		describe: "Move agent config to agents.defaults and tools",
+		apply: (raw, changes) => {
+			const agent = getRecord(raw.agent);
+			if (!agent) return;
+			const agents = ensureRecord(raw, "agents");
+			const defaults = getRecord(agents.defaults) ?? {};
+			const tools = ensureRecord(raw, "tools");
+			const agentTools = getRecord(agent.tools);
+			if (agentTools) {
+				if (tools.allow === void 0 && agentTools.allow !== void 0) {
+					tools.allow = agentTools.allow;
+					changes.push("Moved agent.tools.allow → tools.allow.");
+				}
+				if (tools.deny === void 0 && agentTools.deny !== void 0) {
+					tools.deny = agentTools.deny;
+					changes.push("Moved agent.tools.deny → tools.deny.");
+				}
+			}
+			const elevated = getRecord(agent.elevated);
+			if (elevated) if (tools.elevated === void 0) {
+				tools.elevated = elevated;
+				changes.push("Moved agent.elevated → tools.elevated.");
+			} else changes.push("Removed agent.elevated (tools.elevated already set).");
+			const bash = getRecord(agent.bash);
+			if (bash) if (tools.exec === void 0) {
+				tools.exec = bash;
+				changes.push("Moved agent.bash → tools.exec.");
+			} else changes.push("Removed agent.bash (tools.exec already set).");
+			const sandbox = getRecord(agent.sandbox);
+			if (sandbox) {
+				const sandboxTools = getRecord(sandbox.tools);
+				if (sandboxTools) {
+					mergeMissing(ensureRecord(ensureRecord(tools, "sandbox"), "tools"), sandboxTools);
+					delete sandbox.tools;
+					changes.push("Moved agent.sandbox.tools → tools.sandbox.tools.");
+				}
+			}
+			const subagents = getRecord(agent.subagents);
+			if (subagents) {
+				const subagentTools = getRecord(subagents.tools);
+				if (subagentTools) {
+					mergeMissing(ensureRecord(ensureRecord(tools, "subagents"), "tools"), subagentTools);
+					delete subagents.tools;
+					changes.push("Moved agent.subagents.tools → tools.subagents.tools.");
+				}
+			}
+			const agentCopy = structuredClone(agent);
+			delete agentCopy.tools;
+			delete agentCopy.elevated;
+			delete agentCopy.bash;
+			if (isRecord(agentCopy.sandbox)) delete agentCopy.sandbox.tools;
+			if (isRecord(agentCopy.subagents)) delete agentCopy.subagents.tools;
+			mergeMissing(defaults, agentCopy);
+			agents.defaults = defaults;
+			raw.agents = agents;
+			delete raw.agent;
+			changes.push("Moved agent → agents.defaults.");
+		}
+	},
+	{
+		id: "identity->agents.list",
+		describe: "Move identity to agents.list[].identity",
+		apply: (raw, changes) => {
+			const identity = getRecord(raw.identity);
+			if (!identity) return;
+			const agents = ensureRecord(raw, "agents");
+			const list = getAgentsList(agents);
+			const defaultId = resolveDefaultAgentIdFromRaw(raw);
+			const entry = ensureAgentEntry(list, defaultId);
+			if (entry.identity === void 0) {
+				entry.identity = identity;
+				changes.push(`Moved identity → agents.list (id "${defaultId}").identity.`);
+			} else changes.push("Removed identity (agents.list identity already set).");
+			agents.list = list;
+			raw.agents = agents;
+			delete raw.identity;
+		}
+	}
+];
+
+//#endregion
+//#region src/config/legacy.migrations.ts
+const LEGACY_CONFIG_MIGRATIONS = [
+	...LEGACY_CONFIG_MIGRATIONS_PART_1,
+	...LEGACY_CONFIG_MIGRATIONS_PART_2,
+	...LEGACY_CONFIG_MIGRATIONS_PART_3
+];
+
+//#endregion
+//#region src/config/legacy.rules.ts
+const LEGACY_CONFIG_RULES = [
+	{
+		path: ["whatsapp"],
+		message: "whatsapp config moved to channels.whatsapp (auto-migrated on load)."
+	},
+	{
+		path: ["telegram"],
+		message: "telegram config moved to channels.telegram (auto-migrated on load)."
+	},
+	{
+		path: ["discord"],
+		message: "discord config moved to channels.discord (auto-migrated on load)."
+	},
+	{
+		path: ["slack"],
+		message: "slack config moved to channels.slack (auto-migrated on load)."
+	},
+	{
+		path: ["signal"],
+		message: "signal config moved to channels.signal (auto-migrated on load)."
+	},
+	{
+		path: ["imessage"],
+		message: "imessage config moved to channels.imessage (auto-migrated on load)."
+	},
+	{
+		path: ["msteams"],
+		message: "msteams config moved to channels.msteams (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "allowFrom"],
+		message: "routing.allowFrom was removed; use channels.whatsapp.allowFrom instead (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "bindings"],
+		message: "routing.bindings was moved; use top-level bindings instead (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "agents"],
+		message: "routing.agents was moved; use agents.list instead (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "defaultAgentId"],
+		message: "routing.defaultAgentId was moved; use agents.list[].default instead (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "agentToAgent"],
+		message: "routing.agentToAgent was moved; use tools.agentToAgent instead (auto-migrated on load)."
+	},
+	{
+		path: [
+			"routing",
+			"groupChat",
+			"requireMention"
+		],
+		message: "routing.groupChat.requireMention was removed; use channels.whatsapp/telegram/imessage groups defaults (e.g. channels.whatsapp.groups.\"*\".requireMention) instead (auto-migrated on load)."
+	},
+	{
+		path: [
+			"routing",
+			"groupChat",
+			"mentionPatterns"
+		],
+		message: "routing.groupChat.mentionPatterns was moved; use agents.list[].groupChat.mentionPatterns or messages.groupChat.mentionPatterns instead (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "queue"],
+		message: "routing.queue was moved; use messages.queue instead (auto-migrated on load)."
+	},
+	{
+		path: ["routing", "transcribeAudio"],
+		message: "routing.transcribeAudio was moved; use tools.media.audio.models instead (auto-migrated on load)."
+	},
+	{
+		path: ["telegram", "requireMention"],
+		message: "telegram.requireMention was removed; use channels.telegram.groups.\"*\".requireMention instead (auto-migrated on load)."
+	},
+	{
+		path: ["identity"],
+		message: "identity was moved; use agents.list[].identity instead (auto-migrated on load)."
+	},
+	{
+		path: ["agent"],
+		message: "agent.* was moved; use agents.defaults (and tools.* for tool/elevated/exec settings) instead (auto-migrated on load)."
+	},
+	{
+		path: ["tools", "bash"],
+		message: "tools.bash was removed; use tools.exec instead (auto-migrated on load)."
+	},
+	{
+		path: ["agent", "model"],
+		message: "agent.model string was replaced by agents.defaults.model.primary/fallbacks and agents.defaults.models (auto-migrated on load).",
+		match: (value) => typeof value === "string"
+	},
+	{
+		path: ["agent", "imageModel"],
+		message: "agent.imageModel string was replaced by agents.defaults.imageModel.primary/fallbacks (auto-migrated on load).",
+		match: (value) => typeof value === "string"
+	},
+	{
+		path: ["agent", "allowedModels"],
+		message: "agent.allowedModels was replaced by agents.defaults.models (auto-migrated on load)."
+	},
+	{
+		path: ["agent", "modelAliases"],
+		message: "agent.modelAliases was replaced by agents.defaults.models.*.alias (auto-migrated on load)."
+	},
+	{
+		path: ["agent", "modelFallbacks"],
+		message: "agent.modelFallbacks was replaced by agents.defaults.model.fallbacks (auto-migrated on load)."
+	},
+	{
+		path: ["agent", "imageModelFallbacks"],
+		message: "agent.imageModelFallbacks was replaced by agents.defaults.imageModel.fallbacks (auto-migrated on load)."
+	},
+	{
+		path: [
+			"messages",
+			"tts",
+			"enabled"
+		],
+		message: "messages.tts.enabled was replaced by messages.tts.auto (auto-migrated on load)."
+	},
+	{
+		path: ["gateway", "token"],
+		message: "gateway.token is ignored; use gateway.auth.token instead (auto-migrated on load)."
+	}
+];
+
+//#endregion
+//#region src/config/legacy.ts
+function findLegacyConfigIssues(raw) {
+	if (!raw || typeof raw !== "object") return [];
+	const root = raw;
+	const issues = [];
+	for (const rule of LEGACY_CONFIG_RULES) {
+		let cursor = root;
+		for (const key of rule.path) {
+			if (!cursor || typeof cursor !== "object") {
+				cursor = void 0;
+				break;
+			}
+			cursor = cursor[key];
+		}
+		if (cursor !== void 0 && (!rule.match || rule.match(cursor, root))) issues.push({
+			path: rule.path.join("."),
+			message: rule.message
+		});
+	}
+	return issues;
+}
+function applyLegacyMigrations(raw) {
+	if (!raw || typeof raw !== "object") return {
+		next: null,
+		changes: []
+	};
+	const next = structuredClone(raw);
+	const changes = [];
+	for (const migration of LEGACY_CONFIG_MIGRATIONS) migration.apply(next, changes);
+	if (changes.length === 0) return {
+		next: null,
+		changes: []
+	};
+	return {
+		next,
+		changes
+	};
+}
+
+//#endregion
+//#region src/config/merge-patch.ts
+function isObjectWithStringId(value) {
+	if (!isPlainObject$2(value)) return false;
+	return typeof value.id === "string" && value.id.length > 0;
+}
+/**
+* Merge arrays of object-like entries keyed by `id`.
+*
+* Contract:
+* - Base array must be fully id-keyed; otherwise return undefined (caller should replace).
+* - Patch entries with valid id merge by id (or append when the id is new).
+* - Patch entries without valid id append as-is, avoiding destructive full-array replacement.
+*/
+function mergeObjectArraysById(base, patch, options) {
+	if (!base.every(isObjectWithStringId)) return;
+	const merged = [...base];
+	const indexById = /* @__PURE__ */ new Map();
+	for (const [index, entry] of merged.entries()) {
+		if (!isObjectWithStringId(entry)) return;
+		indexById.set(entry.id, index);
+	}
+	for (const patchEntry of patch) {
+		if (!isObjectWithStringId(patchEntry)) {
+			merged.push(structuredClone(patchEntry));
+			continue;
+		}
+		const existingIndex = indexById.get(patchEntry.id);
+		if (existingIndex === void 0) {
+			merged.push(structuredClone(patchEntry));
+			indexById.set(patchEntry.id, merged.length - 1);
+			continue;
+		}
+		merged[existingIndex] = applyMergePatch(merged[existingIndex], patchEntry, options);
+	}
+	return merged;
+}
+function applyMergePatch(base, patch, options = {}) {
+	if (!isPlainObject$2(patch)) return patch;
+	const result = isPlainObject$2(base) ? { ...base } : {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (isBlockedObjectKey(key)) continue;
+		if (value === null) {
+			delete result[key];
+			continue;
+		}
+		if (options.mergeObjectArraysById && Array.isArray(result[key]) && Array.isArray(value)) {
+			const mergedArray = mergeObjectArraysById(result[key], value, options);
+			if (mergedArray) {
+				result[key] = mergedArray;
+				continue;
+			}
+		}
+		if (isPlainObject$2(value)) {
+			const baseValue = result[key];
+			result[key] = applyMergePatch(isPlainObject$2(baseValue) ? baseValue : {}, value, options);
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
+
+//#endregion
+//#region src/config/normalize-paths.ts
+const PATH_VALUE_RE = /^~(?=$|[\\/])/;
+const PATH_KEY_RE = /(dir|path|paths|file|root|workspace)$/i;
+const PATH_LIST_KEYS = new Set(["paths", "pathPrepend"]);
+function normalizeStringValue(key, value) {
+	if (!PATH_VALUE_RE.test(value.trim())) return value;
+	if (!key) return value;
+	if (PATH_KEY_RE.test(key) || PATH_LIST_KEYS.has(key)) return resolveUserPath(value);
+	return value;
+}
+function normalizeAny(key, value) {
+	if (typeof value === "string") return normalizeStringValue(key, value);
+	if (Array.isArray(value)) {
+		const normalizeChildren = Boolean(key && PATH_LIST_KEYS.has(key));
+		return value.map((entry) => {
+			if (typeof entry === "string") return normalizeChildren ? normalizeStringValue(key, entry) : entry;
+			if (Array.isArray(entry)) return normalizeAny(void 0, entry);
+			if (isPlainObject$2(entry)) return normalizeAny(void 0, entry);
+			return entry;
+		});
+	}
+	if (!isPlainObject$2(value)) return value;
+	for (const [childKey, childValue] of Object.entries(value)) {
+		const next = normalizeAny(childKey, childValue);
+		if (next !== childValue) value[childKey] = next;
+	}
+	return value;
+}
+/**
+* Normalize "~" paths in path-ish config fields.
+*
+* Goal: accept `~/...` consistently across config file + env overrides, while
+* keeping the surface area small and predictable.
+*/
+function normalizeConfigPaths(cfg) {
+	if (!cfg || typeof cfg !== "object") return cfg;
+	normalizeAny(void 0, cfg);
+	return cfg;
+}
+
+//#endregion
+//#region src/config/config-paths.ts
+function parseConfigPath(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return {
+		ok: false,
+		error: "Invalid path. Use dot notation (e.g. foo.bar)."
+	};
+	const parts = trimmed.split(".").map((part) => part.trim());
+	if (parts.some((part) => !part)) return {
+		ok: false,
+		error: "Invalid path. Use dot notation (e.g. foo.bar)."
+	};
+	if (parts.some((part) => isBlockedObjectKey(part))) return {
+		ok: false,
+		error: "Invalid path segment."
+	};
+	return {
+		ok: true,
+		path: parts
+	};
+}
+function setConfigValueAtPath(root, path, value) {
+	let cursor = root;
+	for (let idx = 0; idx < path.length - 1; idx += 1) {
+		const key = path[idx];
+		const next = cursor[key];
+		if (!isPlainObject$2(next)) cursor[key] = {};
+		cursor = cursor[key];
+	}
+	cursor[path[path.length - 1]] = value;
+}
+function unsetConfigValueAtPath(root, path) {
+	const stack = [];
+	let cursor = root;
+	for (let idx = 0; idx < path.length - 1; idx += 1) {
+		const key = path[idx];
+		const next = cursor[key];
+		if (!isPlainObject$2(next)) return false;
+		stack.push({
+			node: cursor,
+			key
+		});
+		cursor = next;
+	}
+	const leafKey = path[path.length - 1];
+	if (!(leafKey in cursor)) return false;
+	delete cursor[leafKey];
+	for (let idx = stack.length - 1; idx >= 0; idx -= 1) {
+		const { node, key } = stack[idx];
+		const child = node[key];
+		if (isPlainObject$2(child) && Object.keys(child).length === 0) delete node[key];
+		else break;
+	}
+	return true;
+}
+function getConfigValueAtPath(root, path) {
+	let cursor = root;
+	for (const key of path) {
+		if (!isPlainObject$2(cursor)) return;
+		cursor = cursor[key];
+	}
+	return cursor;
+}
+
+//#endregion
+//#region src/config/runtime-overrides.ts
+let overrides = {};
+function sanitizeOverrideValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (Array.isArray(value)) return value.map((entry) => sanitizeOverrideValue(entry, seen));
+	if (!isPlainObject$2(value)) return value;
+	if (seen.has(value)) return {};
+	seen.add(value);
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (entry === void 0 || isBlockedObjectKey(key)) continue;
+		sanitized[key] = sanitizeOverrideValue(entry, seen);
+	}
+	seen.delete(value);
+	return sanitized;
+}
+function mergeOverrides(base, override) {
+	if (!isPlainObject$2(base) || !isPlainObject$2(override)) return override;
+	const next = { ...base };
+	for (const [key, value] of Object.entries(override)) {
+		if (value === void 0 || isBlockedObjectKey(key)) continue;
+		next[key] = mergeOverrides(base[key], value);
+	}
+	return next;
+}
+function getConfigOverrides() {
+	return overrides;
+}
+function resetConfigOverrides() {
+	overrides = {};
+}
+function setConfigOverride(pathRaw, value) {
+	const parsed = parseConfigPath(pathRaw);
+	if (!parsed.ok || !parsed.path) return {
+		ok: false,
+		error: parsed.error ?? "Invalid path."
+	};
+	setConfigValueAtPath(overrides, parsed.path, sanitizeOverrideValue(value));
+	return { ok: true };
+}
+function unsetConfigOverride(pathRaw) {
+	const parsed = parseConfigPath(pathRaw);
+	if (!parsed.ok || !parsed.path) return {
+		ok: false,
+		removed: false,
+		error: parsed.error ?? "Invalid path."
+	};
+	return {
+		ok: true,
+		removed: unsetConfigValueAtPath(overrides, parsed.path)
+	};
+}
+function applyConfigOverrides(cfg) {
+	if (!overrides || Object.keys(overrides).length === 0) return cfg;
+	return mergeOverrides(cfg, overrides);
+}
+
+//#endregion
+//#region src/plugins/config-state.ts
+const BUNDLED_ENABLED_BY_DEFAULT = new Set([
+	"device-pair",
+	"phone-control",
+	"talk-voice"
+]);
+const normalizeList = (value) => {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+};
+const normalizePluginEntries = (entries) => {
+	if (!entries || typeof entries !== "object" || Array.isArray(entries)) return {};
+	const normalized = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (!key.trim()) continue;
+		if (!value || typeof value !== "object" || Array.isArray(value)) {
+			normalized[key] = {};
+			continue;
+		}
+		const entry = value;
+		normalized[key] = {
+			enabled: typeof entry.enabled === "boolean" ? entry.enabled : void 0,
+			config: "config" in entry ? entry.config : void 0
+		};
+	}
+	return normalized;
+};
+const normalizePluginsConfig = (config) => {
+	return {
+		enabled: config?.enabled !== false,
+		allow: normalizeList(config?.allow),
+		deny: normalizeList(config?.deny),
+		loadPaths: normalizeList(config?.load?.paths),
+		slots: {},
+		entries: normalizePluginEntries(config?.entries)
+	};
+};
+const hasExplicitPluginConfig = (plugins) => {
+	if (!plugins) return false;
+	if (typeof plugins.enabled === "boolean") return true;
+	if (Array.isArray(plugins.allow) && plugins.allow.length > 0) return true;
+	if (Array.isArray(plugins.deny) && plugins.deny.length > 0) return true;
+	if (plugins.load?.paths && Array.isArray(plugins.load.paths) && plugins.load.paths.length > 0) return true;
+	if (plugins.slots && Object.keys(plugins.slots).length > 0) return true;
+	if (plugins.entries && Object.keys(plugins.entries).length > 0) return true;
+	return false;
+};
+function applyTestPluginDefaults(cfg, env = process.env) {
+	if (!env.VITEST) return cfg;
+	const plugins = cfg.plugins;
+	if (hasExplicitPluginConfig(plugins)) return cfg;
+	return {
+		...cfg,
+		plugins: {
+			...plugins,
+			enabled: false
+		}
+	};
+}
+function resolveEnableState(id, origin, config) {
+	if (!config.enabled) return {
+		enabled: false,
+		reason: "plugins disabled"
+	};
+	if (config.deny.includes(id)) return {
+		enabled: false,
+		reason: "blocked by denylist"
+	};
+	if (config.allow.length > 0 && !config.allow.includes(id)) return {
+		enabled: false,
+		reason: "not in allowlist"
+	};
+	const entry = config.entries[id];
+	if (entry?.enabled === true) return { enabled: true };
+	if (entry?.enabled === false) return {
+		enabled: false,
+		reason: "disabled in config"
+	};
+	if (origin === "bundled" && BUNDLED_ENABLED_BY_DEFAULT.has(id)) return { enabled: true };
+	if (origin === "bundled") return {
+		enabled: false,
+		reason: "bundled (disabled by default)"
+	};
+	return { enabled: true };
+}
+function isBundledChannelEnabledByChannelConfig(cfg, pluginId) {
+	if (!cfg) return false;
+	const channelId = normalizeChatChannelId(pluginId);
+	if (!channelId) return false;
+	const entry = cfg.channels?.[channelId];
+	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+	return entry.enabled === true;
+}
+function resolveEffectiveEnableState(params) {
+	const base = resolveEnableState(params.id, params.origin, params.config);
+	if (!base.enabled && base.reason === "bundled (disabled by default)" && isBundledChannelEnabledByChannelConfig(params.rootConfig, params.id)) return { enabled: true };
+	return base;
+}
+
+//#endregion
+//#region src/plugins/bundled-dir.ts
+function resolveBundledPluginsDir() {
+	const override = process.env.REMOTECLAW_BUNDLED_PLUGINS_DIR?.trim();
+	if (override) return override;
+	try {
+		const execDir = path.dirname(process.execPath);
+		const sibling = path.join(execDir, "extensions");
+		if (fs.existsSync(sibling)) return sibling;
+	} catch {}
+	try {
+		let cursor = path.dirname(fileURLToPath(import.meta.url));
+		for (let i = 0; i < 6; i += 1) {
+			const candidate = path.join(cursor, "extensions");
+			if (fs.existsSync(candidate)) return candidate;
+			const parent = path.dirname(cursor);
+			if (parent === cursor) break;
+			cursor = parent;
+		}
+	} catch {}
+}
+
+//#endregion
+//#region src/compat/legacy-names.ts
+const PROJECT_NAME = "remoteclaw";
+const LEGACY_PROJECT_NAMES = [];
+const MANIFEST_KEY = PROJECT_NAME;
+const LEGACY_MANIFEST_KEYS = LEGACY_PROJECT_NAMES;
+const LEGACY_PLUGIN_MANIFEST_FILENAMES = [];
+
+//#endregion
+//#region src/plugins/manifest.ts
+const PLUGIN_MANIFEST_FILENAME = "remoteclaw.plugin.json";
+const PLUGIN_MANIFEST_FILENAMES = [PLUGIN_MANIFEST_FILENAME, ...LEGACY_PLUGIN_MANIFEST_FILENAMES];
+function normalizeStringList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+}
+function resolvePluginManifestPath(rootDir) {
+	for (const filename of PLUGIN_MANIFEST_FILENAMES) {
+		const candidate = path.join(rootDir, filename);
+		if (fs.existsSync(candidate)) return candidate;
+	}
+	return path.join(rootDir, PLUGIN_MANIFEST_FILENAME);
+}
+function loadPluginManifest(rootDir) {
+	const manifestPath = resolvePluginManifestPath(rootDir);
+	if (!fs.existsSync(manifestPath)) return {
+		ok: false,
+		error: `plugin manifest not found: ${manifestPath}`,
+		manifestPath
+	};
+	let raw;
+	try {
+		raw = JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+	} catch (err) {
+		return {
+			ok: false,
+			error: `failed to parse plugin manifest: ${String(err)}`,
+			manifestPath
+		};
+	}
+	if (!isRecord(raw)) return {
+		ok: false,
+		error: "plugin manifest must be an object",
+		manifestPath
+	};
+	const id = typeof raw.id === "string" ? raw.id.trim() : "";
+	if (!id) return {
+		ok: false,
+		error: "plugin manifest requires id",
+		manifestPath
+	};
+	const configSchema = isRecord(raw.configSchema) ? raw.configSchema : null;
+	if (!configSchema) return {
+		ok: false,
+		error: "plugin manifest requires configSchema",
+		manifestPath
+	};
+	const kind = typeof raw.kind === "string" ? raw.kind : void 0;
+	const name = typeof raw.name === "string" ? raw.name.trim() : void 0;
+	const description = typeof raw.description === "string" ? raw.description.trim() : void 0;
+	const version = typeof raw.version === "string" ? raw.version.trim() : void 0;
+	const channels = normalizeStringList(raw.channels);
+	const providers = normalizeStringList(raw.providers);
+	const skills = normalizeStringList(raw.skills);
+	let uiHints;
+	if (isRecord(raw.uiHints)) uiHints = raw.uiHints;
+	return {
+		ok: true,
+		manifest: {
+			id,
+			configSchema,
+			kind,
+			channels,
+			providers,
+			skills,
+			name,
+			description,
+			version,
+			uiHints
+		},
+		manifestPath
+	};
+}
+function getPackageManifestMetadata(manifest) {
+	if (!manifest) return;
+	const current = manifest[MANIFEST_KEY];
+	if (current) return current;
+	for (const key of LEGACY_MANIFEST_KEYS) {
+		const legacy = manifest[key];
+		if (legacy) return legacy;
+	}
+}
+
+//#endregion
+//#region src/plugins/path-safety.ts
+function isPathInside(baseDir, targetPath) {
+	const rel = path.relative(baseDir, targetPath);
+	if (!rel) return true;
+	return !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function safeRealpathSync(targetPath, cache) {
+	const cached = cache?.get(targetPath);
+	if (cached) return cached;
+	try {
+		const resolved = fs.realpathSync(targetPath);
+		cache?.set(targetPath, resolved);
+		return resolved;
+	} catch {
+		return null;
+	}
+}
+function safeStatSync(targetPath) {
+	try {
+		return fs.statSync(targetPath);
+	} catch {
+		return null;
+	}
+}
+function formatPosixMode(mode) {
+	return (mode & 511).toString(8).padStart(3, "0");
+}
+
+//#endregion
+//#region src/plugins/discovery.ts
+const EXTENSION_EXTS = new Set([
+	".ts",
+	".js",
+	".mts",
+	".cts",
+	".mjs",
+	".cjs"
+]);
+function currentUid(overrideUid) {
+	if (overrideUid !== void 0) return overrideUid;
+	if (process.platform === "win32") return null;
+	if (typeof process.getuid !== "function") return null;
+	return process.getuid();
+}
+function checkSourceEscapesRoot(params) {
+	const sourceRealPath = safeRealpathSync(params.source);
+	const rootRealPath = safeRealpathSync(params.rootDir);
+	if (!sourceRealPath || !rootRealPath) return null;
+	if (isPathInside(rootRealPath, sourceRealPath)) return null;
+	return {
+		reason: "source_escapes_root",
+		sourcePath: params.source,
+		rootPath: params.rootDir,
+		targetPath: params.source,
+		sourceRealPath,
+		rootRealPath
+	};
+}
+function checkPathStatAndPermissions(params) {
+	if (process.platform === "win32") return null;
+	const pathsToCheck = [params.rootDir, params.source];
+	const seen = /* @__PURE__ */ new Set();
+	for (const targetPath of pathsToCheck) {
+		const normalized = path.resolve(targetPath);
+		if (seen.has(normalized)) continue;
+		seen.add(normalized);
+		const stat = safeStatSync(targetPath);
+		if (!stat) return {
+			reason: "path_stat_failed",
+			sourcePath: params.source,
+			rootPath: params.rootDir,
+			targetPath
+		};
+		const modeBits = stat.mode & 511;
+		if ((modeBits & 2) !== 0) return {
+			reason: "path_world_writable",
+			sourcePath: params.source,
+			rootPath: params.rootDir,
+			targetPath,
+			modeBits
+		};
+		if (params.origin !== "bundled" && params.uid !== null && typeof stat.uid === "number" && stat.uid !== params.uid && stat.uid !== 0) return {
+			reason: "path_suspicious_ownership",
+			sourcePath: params.source,
+			rootPath: params.rootDir,
+			targetPath,
+			foundUid: stat.uid,
+			expectedUid: params.uid
+		};
+	}
+	return null;
+}
+function findCandidateBlockIssue(params) {
+	const escaped = checkSourceEscapesRoot({
+		source: params.source,
+		rootDir: params.rootDir
+	});
+	if (escaped) return escaped;
+	return checkPathStatAndPermissions({
+		source: params.source,
+		rootDir: params.rootDir,
+		origin: params.origin,
+		uid: currentUid(params.ownershipUid)
+	});
+}
+function formatCandidateBlockMessage(issue) {
+	if (issue.reason === "source_escapes_root") return `blocked plugin candidate: source escapes plugin root (${issue.sourcePath} -> ${issue.sourceRealPath}; root=${issue.rootRealPath})`;
+	if (issue.reason === "path_stat_failed") return `blocked plugin candidate: cannot stat path (${issue.targetPath})`;
+	if (issue.reason === "path_world_writable") return `blocked plugin candidate: world-writable path (${issue.targetPath}, mode=${formatPosixMode(issue.modeBits ?? 0)})`;
+	return `blocked plugin candidate: suspicious ownership (${issue.targetPath}, uid=${issue.foundUid}, expected uid=${issue.expectedUid} or root)`;
+}
+function isUnsafePluginCandidate(params) {
+	const issue = findCandidateBlockIssue({
+		source: params.source,
+		rootDir: params.rootDir,
+		origin: params.origin,
+		ownershipUid: params.ownershipUid
+	});
+	if (!issue) return false;
+	params.diagnostics.push({
+		level: "warn",
+		source: issue.targetPath,
+		message: formatCandidateBlockMessage(issue)
+	});
+	return true;
+}
+function isExtensionFile(filePath) {
+	const ext = path.extname(filePath);
+	if (!EXTENSION_EXTS.has(ext)) return false;
+	return !filePath.endsWith(".d.ts");
+}
+function shouldIgnoreScannedDirectory(dirName) {
+	const normalized = dirName.trim().toLowerCase();
+	if (!normalized) return true;
+	if (normalized.endsWith(".bak")) return true;
+	if (normalized.includes(".backup-")) return true;
+	if (normalized.includes(".disabled")) return true;
+	return false;
+}
+function readPackageManifest(dir) {
+	const manifestPath = path.join(dir, "package.json");
+	if (!fs.existsSync(manifestPath)) return null;
+	try {
+		const raw = fs.readFileSync(manifestPath, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function resolvePackageExtensions(manifest) {
+	const raw = getPackageManifestMetadata(manifest)?.extensions;
+	if (!Array.isArray(raw)) return [];
+	return raw.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+}
+function deriveIdHint(params) {
+	const base = path.basename(params.filePath, path.extname(params.filePath));
+	const rawPackageName = params.packageName?.trim();
+	if (!rawPackageName) return base;
+	const unscoped = rawPackageName.includes("/") ? rawPackageName.split("/").pop() ?? rawPackageName : rawPackageName;
+	if (!params.hasMultipleExtensions) return unscoped;
+	return `${unscoped}/${base}`;
+}
+function addCandidate(params) {
+	const resolved = path.resolve(params.source);
+	if (params.seen.has(resolved)) return;
+	const resolvedRoot = path.resolve(params.rootDir);
+	if (isUnsafePluginCandidate({
+		source: resolved,
+		rootDir: resolvedRoot,
+		origin: params.origin,
+		diagnostics: params.diagnostics,
+		ownershipUid: params.ownershipUid
+	})) return;
+	params.seen.add(resolved);
+	const manifest = params.manifest ?? null;
+	params.candidates.push({
+		idHint: params.idHint,
+		source: resolved,
+		rootDir: resolvedRoot,
+		origin: params.origin,
+		workspaceDir: params.workspaceDir,
+		packageName: manifest?.name?.trim() || void 0,
+		packageVersion: manifest?.version?.trim() || void 0,
+		packageDescription: manifest?.description?.trim() || void 0,
+		packageDir: params.packageDir,
+		packageManifest: getPackageManifestMetadata(manifest ?? void 0)
+	});
+}
+function resolvePackageEntrySource(params) {
+	const source = path.resolve(params.packageDir, params.entryPath);
+	if (!isPathInsideWithRealpath(params.packageDir, source, { requireRealpath: true })) {
+		params.diagnostics.push({
+			level: "error",
+			message: `extension entry escapes package directory: ${params.entryPath}`,
+			source: params.sourceLabel
+		});
+		return null;
+	}
+	return source;
+}
+function discoverInDirectory(params) {
+	if (!fs.existsSync(params.dir)) return;
+	let entries = [];
+	try {
+		entries = fs.readdirSync(params.dir, { withFileTypes: true });
+	} catch (err) {
+		params.diagnostics.push({
+			level: "warn",
+			message: `failed to read extensions dir: ${params.dir} (${String(err)})`,
+			source: params.dir
+		});
+		return;
+	}
+	for (const entry of entries) {
+		const fullPath = path.join(params.dir, entry.name);
+		if (entry.isFile()) {
+			if (!isExtensionFile(fullPath)) continue;
+			addCandidate({
+				candidates: params.candidates,
+				diagnostics: params.diagnostics,
+				seen: params.seen,
+				idHint: path.basename(entry.name, path.extname(entry.name)),
+				source: fullPath,
+				rootDir: path.dirname(fullPath),
+				origin: params.origin,
+				ownershipUid: params.ownershipUid,
+				workspaceDir: params.workspaceDir
+			});
+		}
+		if (!entry.isDirectory()) continue;
+		if (shouldIgnoreScannedDirectory(entry.name)) continue;
+		const manifest = readPackageManifest(fullPath);
+		const extensions = manifest ? resolvePackageExtensions(manifest) : [];
+		if (extensions.length > 0) {
+			for (const extPath of extensions) {
+				const resolved = resolvePackageEntrySource({
+					packageDir: fullPath,
+					entryPath: extPath,
+					sourceLabel: fullPath,
+					diagnostics: params.diagnostics
+				});
+				if (!resolved) continue;
+				addCandidate({
+					candidates: params.candidates,
+					diagnostics: params.diagnostics,
+					seen: params.seen,
+					idHint: deriveIdHint({
+						filePath: resolved,
+						packageName: manifest?.name,
+						hasMultipleExtensions: extensions.length > 1
+					}),
+					source: resolved,
+					rootDir: fullPath,
+					origin: params.origin,
+					ownershipUid: params.ownershipUid,
+					workspaceDir: params.workspaceDir,
+					manifest,
+					packageDir: fullPath
+				});
+			}
+			continue;
+		}
+		const indexFile = [
+			"index.ts",
+			"index.js",
+			"index.mjs",
+			"index.cjs"
+		].map((candidate) => path.join(fullPath, candidate)).find((candidate) => fs.existsSync(candidate));
+		if (indexFile && isExtensionFile(indexFile)) addCandidate({
+			candidates: params.candidates,
+			diagnostics: params.diagnostics,
+			seen: params.seen,
+			idHint: entry.name,
+			source: indexFile,
+			rootDir: fullPath,
+			origin: params.origin,
+			ownershipUid: params.ownershipUid,
+			workspaceDir: params.workspaceDir,
+			manifest,
+			packageDir: fullPath
+		});
+	}
+}
+function discoverFromPath(params) {
+	const resolved = resolveUserPath(params.rawPath);
+	if (!fs.existsSync(resolved)) {
+		params.diagnostics.push({
+			level: "error",
+			message: `plugin path not found: ${resolved}`,
+			source: resolved
+		});
+		return;
+	}
+	const stat = fs.statSync(resolved);
+	if (stat.isFile()) {
+		if (!isExtensionFile(resolved)) {
+			params.diagnostics.push({
+				level: "error",
+				message: `plugin path is not a supported file: ${resolved}`,
+				source: resolved
+			});
+			return;
+		}
+		addCandidate({
+			candidates: params.candidates,
+			diagnostics: params.diagnostics,
+			seen: params.seen,
+			idHint: path.basename(resolved, path.extname(resolved)),
+			source: resolved,
+			rootDir: path.dirname(resolved),
+			origin: params.origin,
+			ownershipUid: params.ownershipUid,
+			workspaceDir: params.workspaceDir
+		});
+		return;
+	}
+	if (stat.isDirectory()) {
+		const manifest = readPackageManifest(resolved);
+		const extensions = manifest ? resolvePackageExtensions(manifest) : [];
+		if (extensions.length > 0) {
+			for (const extPath of extensions) {
+				const source = resolvePackageEntrySource({
+					packageDir: resolved,
+					entryPath: extPath,
+					sourceLabel: resolved,
+					diagnostics: params.diagnostics
+				});
+				if (!source) continue;
+				addCandidate({
+					candidates: params.candidates,
+					diagnostics: params.diagnostics,
+					seen: params.seen,
+					idHint: deriveIdHint({
+						filePath: source,
+						packageName: manifest?.name,
+						hasMultipleExtensions: extensions.length > 1
+					}),
+					source,
+					rootDir: resolved,
+					origin: params.origin,
+					ownershipUid: params.ownershipUid,
+					workspaceDir: params.workspaceDir,
+					manifest,
+					packageDir: resolved
+				});
+			}
+			return;
+		}
+		const indexFile = [
+			"index.ts",
+			"index.js",
+			"index.mjs",
+			"index.cjs"
+		].map((candidate) => path.join(resolved, candidate)).find((candidate) => fs.existsSync(candidate));
+		if (indexFile && isExtensionFile(indexFile)) {
+			addCandidate({
+				candidates: params.candidates,
+				diagnostics: params.diagnostics,
+				seen: params.seen,
+				idHint: path.basename(resolved),
+				source: indexFile,
+				rootDir: resolved,
+				origin: params.origin,
+				ownershipUid: params.ownershipUid,
+				workspaceDir: params.workspaceDir,
+				manifest,
+				packageDir: resolved
+			});
+			return;
+		}
+		discoverInDirectory({
+			dir: resolved,
+			origin: params.origin,
+			ownershipUid: params.ownershipUid,
+			workspaceDir: params.workspaceDir,
+			candidates: params.candidates,
+			diagnostics: params.diagnostics,
+			seen: params.seen
+		});
+		return;
+	}
+}
+function discoverRemoteClawPlugins(params) {
+	const candidates = [];
+	const diagnostics = [];
+	const seen = /* @__PURE__ */ new Set();
+	const workspaceDir = params.workspaceDir?.trim();
+	const extra = params.extraPaths ?? [];
+	for (const extraPath of extra) {
+		if (typeof extraPath !== "string") continue;
+		const trimmed = extraPath.trim();
+		if (!trimmed) continue;
+		discoverFromPath({
+			rawPath: trimmed,
+			origin: "config",
+			ownershipUid: params.ownershipUid,
+			workspaceDir: workspaceDir?.trim() || void 0,
+			candidates,
+			diagnostics,
+			seen
+		});
+	}
+	if (workspaceDir) {
+		const workspaceRoot = resolveUserPath(workspaceDir);
+		const workspaceExtDirs = [path.join(workspaceRoot, ".remoteclaw", "extensions")];
+		for (const dir of workspaceExtDirs) discoverInDirectory({
+			dir,
+			origin: "workspace",
+			ownershipUid: params.ownershipUid,
+			workspaceDir: workspaceRoot,
+			candidates,
+			diagnostics,
+			seen
+		});
+	}
+	discoverInDirectory({
+		dir: path.join(resolveConfigDir(), "extensions"),
+		origin: "global",
+		ownershipUid: params.ownershipUid,
+		candidates,
+		diagnostics,
+		seen
+	});
+	const bundledDir = resolveBundledPluginsDir();
+	if (bundledDir) discoverInDirectory({
+		dir: bundledDir,
+		origin: "bundled",
+		ownershipUid: params.ownershipUid,
+		candidates,
+		diagnostics,
+		seen
+	});
+	return {
+		candidates,
+		diagnostics
+	};
+}
+
+//#endregion
+//#region src/plugins/manifest-registry.ts
+const PLUGIN_ORIGIN_RANK = {
+	config: 0,
+	workspace: 1,
+	global: 2,
+	bundled: 3
+};
+const registryCache = /* @__PURE__ */ new Map();
+const DEFAULT_MANIFEST_CACHE_MS = 200;
+function clearPluginManifestRegistryCache() {
+	registryCache.clear();
+}
+function resolveManifestCacheMs(env) {
+	const raw = env.REMOTECLAW_PLUGIN_MANIFEST_CACHE_MS?.trim();
+	if (raw === "" || raw === "0") return 0;
+	if (!raw) return DEFAULT_MANIFEST_CACHE_MS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return DEFAULT_MANIFEST_CACHE_MS;
+	return Math.max(0, parsed);
+}
+function shouldUseManifestCache(env) {
+	if (env.REMOTECLAW_DISABLE_PLUGIN_MANIFEST_CACHE?.trim()) return false;
+	return resolveManifestCacheMs(env) > 0;
+}
+function buildCacheKey(params) {
+	const workspaceKey = params.workspaceDir ? resolveUserPath(params.workspaceDir) : "";
+	const loadPaths = params.plugins.loadPaths.map((p) => resolveUserPath(p)).map((p) => p.trim()).filter(Boolean).toSorted();
+	return `${workspaceKey}::${JSON.stringify(loadPaths)}`;
+}
+function safeStatMtimeMs(filePath) {
+	try {
+		return fs.statSync(filePath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+function normalizeManifestLabel(raw) {
+	const trimmed = raw?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function buildRecord(params) {
+	return {
+		id: params.manifest.id,
+		name: normalizeManifestLabel(params.manifest.name) ?? params.candidate.packageName,
+		description: normalizeManifestLabel(params.manifest.description) ?? params.candidate.packageDescription,
+		version: normalizeManifestLabel(params.manifest.version) ?? params.candidate.packageVersion,
+		kind: params.manifest.kind,
+		channels: params.manifest.channels ?? [],
+		providers: params.manifest.providers ?? [],
+		skills: params.manifest.skills ?? [],
+		origin: params.candidate.origin,
+		workspaceDir: params.candidate.workspaceDir,
+		rootDir: params.candidate.rootDir,
+		source: params.candidate.source,
+		manifestPath: params.manifestPath,
+		schemaCacheKey: params.schemaCacheKey,
+		configSchema: params.configSchema,
+		configUiHints: params.manifest.uiHints
+	};
+}
+function loadPluginManifestRegistry(params) {
+	const normalized = normalizePluginsConfig((params.config ?? {}).plugins);
+	const cacheKey = buildCacheKey({
+		workspaceDir: params.workspaceDir,
+		plugins: normalized
+	});
+	const env = params.env ?? process.env;
+	const cacheEnabled = params.cache !== false && shouldUseManifestCache(env);
+	if (cacheEnabled) {
+		const cached = registryCache.get(cacheKey);
+		if (cached && cached.expiresAt > Date.now()) return cached.registry;
+	}
+	const discovery = params.candidates ? {
+		candidates: params.candidates,
+		diagnostics: params.diagnostics ?? []
+	} : discoverRemoteClawPlugins({
+		workspaceDir: params.workspaceDir,
+		extraPaths: normalized.loadPaths
+	});
+	const diagnostics = [...discovery.diagnostics];
+	const candidates = discovery.candidates;
+	const records = [];
+	const seenIds = /* @__PURE__ */ new Map();
+	const realpathCache = /* @__PURE__ */ new Map();
+	for (const candidate of candidates) {
+		const manifestRes = loadPluginManifest(candidate.rootDir);
+		if (!manifestRes.ok) {
+			diagnostics.push({
+				level: "error",
+				message: manifestRes.error,
+				source: manifestRes.manifestPath
+			});
+			continue;
+		}
+		const manifest = manifestRes.manifest;
+		if (candidate.idHint && candidate.idHint !== manifest.id) diagnostics.push({
+			level: "warn",
+			pluginId: manifest.id,
+			source: candidate.source,
+			message: `plugin id mismatch (manifest uses "${manifest.id}", entry hints "${candidate.idHint}")`
+		});
+		const configSchema = manifest.configSchema;
+		const manifestMtime = safeStatMtimeMs(manifestRes.manifestPath);
+		const schemaCacheKey = manifestMtime ? `${manifestRes.manifestPath}:${manifestMtime}` : manifestRes.manifestPath;
+		const existing = seenIds.get(manifest.id);
+		if (existing) {
+			const existingReal = safeRealpathSync(existing.candidate.rootDir, realpathCache);
+			const candidateReal = safeRealpathSync(candidate.rootDir, realpathCache);
+			if (Boolean(existingReal && candidateReal && existingReal === candidateReal)) {
+				if (PLUGIN_ORIGIN_RANK[candidate.origin] < PLUGIN_ORIGIN_RANK[existing.candidate.origin]) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				continue;
+			}
+			diagnostics.push({
+				level: "warn",
+				pluginId: manifest.id,
+				source: candidate.source,
+				message: `duplicate plugin id detected; later plugin may be overridden (${candidate.source})`
+			});
+		} else seenIds.set(manifest.id, {
+			candidate,
+			recordIndex: records.length
+		});
+		records.push(buildRecord({
+			manifest,
+			candidate,
+			manifestPath: manifestRes.manifestPath,
+			schemaCacheKey,
+			configSchema
+		}));
+	}
+	const registry = {
+		plugins: records,
+		diagnostics
+	};
+	if (cacheEnabled) {
+		const ttl = resolveManifestCacheMs(env);
+		if (ttl > 0) registryCache.set(cacheKey, {
+			expiresAt: Date.now() + ttl,
+			registry
+		});
+	}
+	return registry;
+}
+
+//#endregion
+//#region src/plugins/schema-validator.ts
+const ajv = new AjvPkg({
+	allErrors: true,
+	strict: false,
+	removeAdditional: false
+});
+const schemaCache = /* @__PURE__ */ new Map();
+function formatAjvErrors(errors) {
+	if (!errors || errors.length === 0) return ["invalid config"];
+	return errors.map((error) => {
+		return `${error.instancePath?.replace(/^\//, "").replace(/\//g, ".") || "<root>"}: ${error.message ?? "invalid"}`;
+	});
+}
+function validateJsonSchemaValue(params) {
+	let cached = schemaCache.get(params.cacheKey);
+	if (!cached || cached.schema !== params.schema) {
+		cached = {
+			validate: ajv.compile(params.schema),
+			schema: params.schema
+		};
+		schemaCache.set(params.cacheKey, cached);
+	}
+	if (cached.validate(params.value)) return { ok: true };
+	return {
+		ok: false,
+		errors: formatAjvErrors(cached.validate.errors)
+	};
+}
+
+//#endregion
+//#region src/shared/avatar-policy.ts
+const AVATAR_MAX_BYTES = 2 * 1024 * 1024;
+const LOCAL_AVATAR_EXTENSIONS = new Set([
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".webp",
+	".svg"
+]);
+const AVATAR_MIME_BY_EXT = {
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".webp": "image/webp",
+	".gif": "image/gif",
+	".svg": "image/svg+xml",
+	".bmp": "image/bmp",
+	".tif": "image/tiff",
+	".tiff": "image/tiff"
+};
+const AVATAR_DATA_RE = /^data:/i;
+const AVATAR_IMAGE_DATA_RE = /^data:image\//i;
+const AVATAR_HTTP_RE = /^https?:\/\//i;
+const AVATAR_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
+const WINDOWS_ABS_RE = /^[a-zA-Z]:[\\/]/;
+const AVATAR_PATH_EXT_RE = /\.(png|jpe?g|gif|webp|svg|ico)$/i;
+function resolveAvatarMime(filePath) {
+	return AVATAR_MIME_BY_EXT[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+function isAvatarDataUrl(value) {
+	return AVATAR_DATA_RE.test(value);
+}
+function isAvatarImageDataUrl(value) {
+	return AVATAR_IMAGE_DATA_RE.test(value);
+}
+function isAvatarHttpUrl(value) {
+	return AVATAR_HTTP_RE.test(value);
+}
+function hasAvatarUriScheme(value) {
+	return AVATAR_SCHEME_RE.test(value);
+}
+function isWindowsAbsolutePath(value) {
+	return WINDOWS_ABS_RE.test(value);
+}
+function isWorkspaceRelativeAvatarPath(value) {
+	if (!value) return false;
+	if (value.startsWith("~")) return false;
+	if (hasAvatarUriScheme(value) && !isWindowsAbsolutePath(value)) return false;
+	return true;
+}
+function isPathWithinRoot(rootDir, targetPath) {
+	const relative = path.relative(rootDir, targetPath);
+	if (relative === "") return true;
+	return !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function looksLikeAvatarPath(value) {
+	if (/[\\/]/.test(value)) return true;
+	return AVATAR_PATH_EXT_RE.test(value);
+}
+function isSupportedLocalAvatarExtension(filePath) {
+	const ext = path.extname(filePath).toLowerCase();
+	return LOCAL_AVATAR_EXTENSIONS.has(ext);
+}
+
+//#endregion
+//#region src/config/validation.ts
+const LEGACY_REMOVED_PLUGIN_IDS = new Set(["google-antigravity-auth"]);
+function isWorkspaceAvatarPath(value, workspaceDir) {
+	const workspaceRoot = path.resolve(workspaceDir);
+	return isPathWithinRoot(workspaceRoot, path.resolve(workspaceRoot, value));
+}
+function validateIdentityAvatar(config) {
+	const agents = config.agents?.list;
+	if (!Array.isArray(agents) || agents.length === 0) return [];
+	const issues = [];
+	for (const [index, entry] of agents.entries()) {
+		if (!entry || typeof entry !== "object") continue;
+		const avatarRaw = entry.identity?.avatar;
+		if (typeof avatarRaw !== "string") continue;
+		const avatar = avatarRaw.trim();
+		if (!avatar) continue;
+		if (isAvatarDataUrl(avatar) || isAvatarHttpUrl(avatar)) continue;
+		if (avatar.startsWith("~")) {
+			issues.push({
+				path: `agents.list.${index}.identity.avatar`,
+				message: "identity.avatar must be a workspace-relative path, http(s) URL, or data URI."
+			});
+			continue;
+		}
+		if (hasAvatarUriScheme(avatar) && !isWindowsAbsolutePath(avatar)) {
+			issues.push({
+				path: `agents.list.${index}.identity.avatar`,
+				message: "identity.avatar must be a workspace-relative path, http(s) URL, or data URI."
+			});
+			continue;
+		}
+		const workspaceDir = resolveAgentWorkspaceDirOrNull(config, entry.id ?? resolveDefaultAgentId(config));
+		if (workspaceDir != null && !isWorkspaceAvatarPath(avatar, workspaceDir)) issues.push({
+			path: `agents.list.${index}.identity.avatar`,
+			message: "identity.avatar must stay within the agent workspace."
+		});
+	}
+	return issues;
+}
+/**
+* Validates config without applying runtime defaults.
+* Use this when you need the raw validated config (e.g., for writing back to file).
+*/
+function validateConfigObjectRaw(raw) {
+	const legacyIssues = findLegacyConfigIssues(raw);
+	if (legacyIssues.length > 0) return {
+		ok: false,
+		issues: legacyIssues.map((iss) => ({
+			path: iss.path,
+			message: iss.message
+		}))
+	};
+	const validated = RemoteClawSchema.safeParse(raw);
+	if (!validated.success) return {
+		ok: false,
+		issues: validated.error.issues.map((iss) => ({
+			path: iss.path.join("."),
+			message: iss.message
+		}))
+	};
+	const duplicates = findDuplicateAgentDirs(validated.data);
+	if (duplicates.length > 0) return {
+		ok: false,
+		issues: [{
+			path: "agents.list",
+			message: formatDuplicateAgentDirError(duplicates)
+		}]
+	};
+	const avatarIssues = validateIdentityAvatar(validated.data);
+	if (avatarIssues.length > 0) return {
+		ok: false,
+		issues: avatarIssues
+	};
+	return {
+		ok: true,
+		config: validated.data
+	};
+}
+function validateConfigObject(raw) {
+	const result = validateConfigObjectRaw(raw);
+	if (!result.ok) return result;
+	return {
+		ok: true,
+		config: applyModelDefaults(applyAgentDefaults(applySessionDefaults(result.config)))
+	};
+}
+function validateConfigObjectWithPlugins(raw) {
+	return validateConfigObjectWithPluginsBase(raw, { applyDefaults: true });
+}
+function validateConfigObjectRawWithPlugins(raw) {
+	return validateConfigObjectWithPluginsBase(raw, { applyDefaults: false });
+}
+function validateConfigObjectWithPluginsBase(raw, opts) {
+	const base = opts.applyDefaults ? validateConfigObject(raw) : validateConfigObjectRaw(raw);
+	if (!base.ok) return {
+		ok: false,
+		issues: base.issues,
+		warnings: []
+	};
+	const config = base.config;
+	const issues = [];
+	const warnings = [];
+	const hasExplicitPluginsConfig = isRecord(raw) && Object.prototype.hasOwnProperty.call(raw, "plugins");
+	let registryInfo = null;
+	const ensureRegistry = () => {
+		if (registryInfo) return registryInfo;
+		const registry = loadPluginManifestRegistry({
+			config,
+			workspaceDir: resolveAgentWorkspaceDirOrNull(config, resolveDefaultAgentId(config)) ?? void 0
+		});
+		const knownIds = new Set(registry.plugins.map((record) => record.id));
+		const normalizedPlugins = normalizePluginsConfig(config.plugins);
+		for (const diag of registry.diagnostics) {
+			let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
+			if (!diag.pluginId && diag.message.includes("plugin path not found")) path = "plugins.load.paths";
+			const message = `${diag.pluginId ? `plugin ${diag.pluginId}` : "plugin"}: ${diag.message}`;
+			if (diag.level === "error") issues.push({
+				path,
+				message
+			});
+			else warnings.push({
+				path,
+				message
+			});
+		}
+		registryInfo = {
+			registry,
+			knownIds,
+			normalizedPlugins
+		};
+		return registryInfo;
+	};
+	const allowedChannels = new Set([
+		"defaults",
+		"modelByChannel",
+		...CHANNEL_IDS
+	]);
+	if (config.channels && isRecord(config.channels)) for (const key of Object.keys(config.channels)) {
+		const trimmed = key.trim();
+		if (!trimmed) continue;
+		if (!allowedChannels.has(trimmed)) {
+			const { registry } = ensureRegistry();
+			for (const record of registry.plugins) for (const channelId of record.channels) allowedChannels.add(channelId);
+		}
+		if (!allowedChannels.has(trimmed)) issues.push({
+			path: `channels.${trimmed}`,
+			message: `unknown channel id: ${trimmed}`
+		});
+	}
+	const heartbeatChannelIds = /* @__PURE__ */ new Set();
+	for (const channelId of CHANNEL_IDS) heartbeatChannelIds.add(channelId.toLowerCase());
+	const validateHeartbeatTarget = (target, path) => {
+		if (typeof target !== "string") return;
+		const trimmed = target.trim();
+		if (!trimmed) {
+			issues.push({
+				path,
+				message: "heartbeat target must not be empty"
+			});
+			return;
+		}
+		const normalized = trimmed.toLowerCase();
+		if (normalized === "last" || normalized === "none") return;
+		if (normalizeChatChannelId(trimmed)) return;
+		if (!heartbeatChannelIds.has(normalized)) {
+			const { registry } = ensureRegistry();
+			for (const record of registry.plugins) for (const channelId of record.channels) {
+				const pluginChannel = channelId.trim();
+				if (pluginChannel) heartbeatChannelIds.add(pluginChannel.toLowerCase());
+			}
+		}
+		if (heartbeatChannelIds.has(normalized)) return;
+		issues.push({
+			path,
+			message: `unknown heartbeat target: ${target}`
+		});
+	};
+	validateHeartbeatTarget(config.agents?.defaults?.heartbeat?.target, "agents.defaults.heartbeat.target");
+	if (Array.isArray(config.agents?.list)) for (const [index, entry] of config.agents.list.entries()) validateHeartbeatTarget(entry?.heartbeat?.target, `agents.list.${index}.heartbeat.target`);
+	if (!hasExplicitPluginsConfig) {
+		if (issues.length > 0) return {
+			ok: false,
+			issues,
+			warnings
+		};
+		return {
+			ok: true,
+			config,
+			warnings
+		};
+	}
+	const { registry, knownIds, normalizedPlugins } = ensureRegistry();
+	const pushMissingPluginIssue = (path, pluginId) => {
+		if (LEGACY_REMOVED_PLUGIN_IDS.has(pluginId)) {
+			warnings.push({
+				path,
+				message: `plugin removed: ${pluginId} (stale config entry ignored; remove it from plugins config)`
+			});
+			return;
+		}
+		issues.push({
+			path,
+			message: `plugin not found: ${pluginId}`
+		});
+	};
+	const pluginsConfig = config.plugins;
+	const entries = pluginsConfig?.entries;
+	if (entries && isRecord(entries)) {
+		for (const pluginId of Object.keys(entries)) if (!knownIds.has(pluginId)) pushMissingPluginIssue(`plugins.entries.${pluginId}`, pluginId);
+	}
+	const allow = pluginsConfig?.allow ?? [];
+	for (const pluginId of allow) {
+		if (typeof pluginId !== "string" || !pluginId.trim()) continue;
+		if (!knownIds.has(pluginId)) pushMissingPluginIssue("plugins.allow", pluginId);
+	}
+	const deny = pluginsConfig?.deny ?? [];
+	for (const pluginId of deny) {
+		if (typeof pluginId !== "string" || !pluginId.trim()) continue;
+		if (!knownIds.has(pluginId)) pushMissingPluginIssue("plugins.deny", pluginId);
+	}
+	const seenPlugins = /* @__PURE__ */ new Set();
+	for (const record of registry.plugins) {
+		const pluginId = record.id;
+		if (seenPlugins.has(pluginId)) continue;
+		seenPlugins.add(pluginId);
+		const entry = normalizedPlugins.entries[pluginId];
+		const entryHasConfig = Boolean(entry?.config);
+		const enableState = resolveEffectiveEnableState({
+			id: pluginId,
+			origin: record.origin,
+			config: normalizedPlugins,
+			rootConfig: config
+		});
+		let enabled = enableState.enabled;
+		let reason = enableState.reason;
+		if (enabled || entryHasConfig) if (record.configSchema) {
+			const res = validateJsonSchemaValue({
+				schema: record.configSchema,
+				cacheKey: record.schemaCacheKey ?? record.manifestPath ?? pluginId,
+				value: entry?.config ?? {}
+			});
+			if (!res.ok) for (const error of res.errors) issues.push({
+				path: `plugins.entries.${pluginId}.config`,
+				message: `invalid config: ${error}`
+			});
+		} else issues.push({
+			path: `plugins.entries.${pluginId}`,
+			message: `plugin schema missing for ${pluginId}`
+		});
+		if (!enabled && entryHasConfig) warnings.push({
+			path: `plugins.entries.${pluginId}`,
+			message: `plugin disabled (${reason ?? "disabled"}) but config is present`
+		});
+	}
+	if (issues.length > 0) return {
+		ok: false,
+		issues,
+		warnings
+	};
+	return {
+		ok: true,
+		config,
+		warnings
+	};
+}
+
+//#endregion
+//#region src/config/version.ts
+const VERSION_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-(\d+))?/;
+function parseRemoteClawVersion(raw) {
+	if (!raw) return null;
+	const match = raw.trim().match(VERSION_RE);
+	if (!match) return null;
+	const [, major, minor, patch, revision] = match;
+	return {
+		major: Number.parseInt(major, 10),
+		minor: Number.parseInt(minor, 10),
+		patch: Number.parseInt(patch, 10),
+		revision: revision ? Number.parseInt(revision, 10) : 0
+	};
+}
+function compareRemoteClawVersions(a, b) {
+	const parsedA = parseRemoteClawVersion(a);
+	const parsedB = parseRemoteClawVersion(b);
+	if (!parsedA || !parsedB) return null;
+	if (parsedA.major !== parsedB.major) return parsedA.major < parsedB.major ? -1 : 1;
+	if (parsedA.minor !== parsedB.minor) return parsedA.minor < parsedB.minor ? -1 : 1;
+	if (parsedA.patch !== parsedB.patch) return parsedA.patch < parsedB.patch ? -1 : 1;
+	if (parsedA.revision !== parsedB.revision) return parsedA.revision < parsedB.revision ? -1 : 1;
+	return 0;
+}
+
+//#endregion
+//#region src/config/io.ts
+const SHELL_ENV_EXPECTED_KEYS = [
+	"OPENAI_API_KEY",
+	"ANTHROPIC_API_KEY",
+	"ANTHROPIC_OAUTH_TOKEN",
+	"GEMINI_API_KEY",
+	"ZAI_API_KEY",
+	"OPENROUTER_API_KEY",
+	"AI_GATEWAY_API_KEY",
+	"MINIMAX_API_KEY",
+	"SYNTHETIC_API_KEY",
+	"KILOCODE_API_KEY",
+	"ELEVENLABS_API_KEY",
+	"TELEGRAM_BOT_TOKEN",
+	"DISCORD_BOT_TOKEN",
+	"SLACK_BOT_TOKEN",
+	"SLACK_APP_TOKEN",
+	"REMOTECLAW_GATEWAY_TOKEN",
+	"REMOTECLAW_GATEWAY_PASSWORD"
+];
+const OPEN_DM_POLICY_ALLOW_FROM_RE = /^(?<policyPath>[a-z0-9_.-]+)\s*=\s*"open"\s+requires\s+(?<allowPath>[a-z0-9_.-]+)(?:\s+\(or\s+[a-z0-9_.-]+\))?\s+to include "\*"$/i;
+const CONFIG_AUDIT_LOG_FILENAME = "config-audit.jsonl";
+const loggedInvalidConfigs = /* @__PURE__ */ new Set();
+function hashConfigRaw(raw) {
+	return crypto.createHash("sha256").update(raw ?? "").digest("hex");
+}
+function formatConfigValidationFailure(pathLabel, issueMessage) {
+	const match = issueMessage.match(OPEN_DM_POLICY_ALLOW_FROM_RE);
+	const policyPath = match?.groups?.policyPath?.trim();
+	const allowPath = match?.groups?.allowPath?.trim();
+	if (!policyPath || !allowPath) return `Config validation failed: ${pathLabel}: ${issueMessage}`;
+	return [
+		`Config validation failed: ${pathLabel}`,
+		"",
+		`Configuration mismatch: ${policyPath} is "open", but ${allowPath} does not include "*".`,
+		"",
+		"Fix with:",
+		`  remoteclaw config set ${allowPath} '["*"]'`,
+		"",
+		"Or switch policy:",
+		`  remoteclaw config set ${policyPath} "pairing"`
+	].join("\n");
+}
+function isNumericPathSegment(raw) {
+	return /^[0-9]+$/.test(raw);
+}
+function isWritePlainObject(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasOwnObjectKey(value, key) {
+	return Object.prototype.hasOwnProperty.call(value, key);
+}
+const WRITE_PRUNED_OBJECT = Symbol("write-pruned-object");
+function unsetPathForWriteAt(value, pathSegments, depth) {
+	if (depth >= pathSegments.length) return {
+		changed: false,
+		value
+	};
+	const segment = pathSegments[depth];
+	const isLeaf = depth === pathSegments.length - 1;
+	if (Array.isArray(value)) {
+		if (!isNumericPathSegment(segment)) return {
+			changed: false,
+			value
+		};
+		const index = Number.parseInt(segment, 10);
+		if (!Number.isFinite(index) || index < 0 || index >= value.length) return {
+			changed: false,
+			value
+		};
+		if (isLeaf) {
+			const next = value.slice();
+			next.splice(index, 1);
+			return {
+				changed: true,
+				value: next
+			};
+		}
+		const child = unsetPathForWriteAt(value[index], pathSegments, depth + 1);
+		if (!child.changed) return {
+			changed: false,
+			value
+		};
+		const next = value.slice();
+		if (child.value === WRITE_PRUNED_OBJECT) next.splice(index, 1);
+		else next[index] = child.value;
+		return {
+			changed: true,
+			value: next
+		};
+	}
+	if (isBlockedObjectKey(segment) || !isWritePlainObject(value) || !hasOwnObjectKey(value, segment)) return {
+		changed: false,
+		value
+	};
+	if (isLeaf) {
+		const next = { ...value };
+		delete next[segment];
+		return {
+			changed: true,
+			value: Object.keys(next).length === 0 ? WRITE_PRUNED_OBJECT : next
+		};
+	}
+	const child = unsetPathForWriteAt(value[segment], pathSegments, depth + 1);
+	if (!child.changed) return {
+		changed: false,
+		value
+	};
+	const next = { ...value };
+	if (child.value === WRITE_PRUNED_OBJECT) delete next[segment];
+	else next[segment] = child.value;
+	return {
+		changed: true,
+		value: Object.keys(next).length === 0 ? WRITE_PRUNED_OBJECT : next
+	};
+}
+function unsetPathForWrite(root, pathSegments) {
+	if (pathSegments.length === 0) return {
+		changed: false,
+		next: root
+	};
+	const result = unsetPathForWriteAt(root, pathSegments, 0);
+	if (!result.changed) return {
+		changed: false,
+		next: root
+	};
+	if (result.value === WRITE_PRUNED_OBJECT) return {
+		changed: true,
+		next: {}
+	};
+	if (isWritePlainObject(result.value)) return {
+		changed: true,
+		next: coerceConfig(result.value)
+	};
+	return {
+		changed: false,
+		next: root
+	};
+}
+function resolveConfigSnapshotHash(snapshot) {
+	if (typeof snapshot.hash === "string") {
+		const trimmed = snapshot.hash.trim();
+		if (trimmed) return trimmed;
+	}
+	if (typeof snapshot.raw !== "string") return null;
+	return hashConfigRaw(snapshot.raw);
+}
+function coerceConfig(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+	return value;
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasConfigMeta(value) {
+	if (!isPlainObject(value)) return false;
+	const meta = value.meta;
+	return isPlainObject(meta);
+}
+function resolveGatewayMode(value) {
+	if (!isPlainObject(value)) return null;
+	const gateway = value.gateway;
+	if (!isPlainObject(gateway) || typeof gateway.mode !== "string") return null;
+	const trimmed = gateway.mode.trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+function cloneUnknown(value) {
+	return structuredClone(value);
+}
+function createMergePatch(base, target) {
+	if (!isPlainObject(base) || !isPlainObject(target)) return cloneUnknown(target);
+	const patch = {};
+	const keys = new Set([...Object.keys(base), ...Object.keys(target)]);
+	for (const key of keys) {
+		const hasBase = key in base;
+		if (!(key in target)) {
+			patch[key] = null;
+			continue;
+		}
+		const targetValue = target[key];
+		if (!hasBase) {
+			patch[key] = cloneUnknown(targetValue);
+			continue;
+		}
+		const baseValue = base[key];
+		if (isPlainObject(baseValue) && isPlainObject(targetValue)) {
+			const childPatch = createMergePatch(baseValue, targetValue);
+			if (isPlainObject(childPatch) && Object.keys(childPatch).length === 0) continue;
+			patch[key] = childPatch;
+			continue;
+		}
+		if (!isDeepStrictEqual(baseValue, targetValue)) patch[key] = cloneUnknown(targetValue);
+	}
+	return patch;
+}
+function collectEnvRefPaths(value, path, output) {
+	if (typeof value === "string") {
+		if (containsEnvVarReference(value)) output.set(path, value);
+		return;
+	}
+	if (Array.isArray(value)) {
+		value.forEach((item, index) => {
+			collectEnvRefPaths(item, `${path}[${index}]`, output);
+		});
+		return;
+	}
+	if (isPlainObject(value)) for (const [key, child] of Object.entries(value)) collectEnvRefPaths(child, path ? `${path}.${key}` : key, output);
+}
+function collectChangedPaths(base, target, path, output) {
+	if (Array.isArray(base) && Array.isArray(target)) {
+		const max = Math.max(base.length, target.length);
+		for (let index = 0; index < max; index += 1) {
+			const childPath = path ? `${path}[${index}]` : `[${index}]`;
+			if (index >= base.length || index >= target.length) {
+				output.add(childPath);
+				continue;
+			}
+			collectChangedPaths(base[index], target[index], childPath, output);
+		}
+		return;
+	}
+	if (isPlainObject(base) && isPlainObject(target)) {
+		const keys = new Set([...Object.keys(base), ...Object.keys(target)]);
+		for (const key of keys) {
+			const childPath = path ? `${path}.${key}` : key;
+			const hasBase = key in base;
+			if (!(key in target) || !hasBase) {
+				output.add(childPath);
+				continue;
+			}
+			collectChangedPaths(base[key], target[key], childPath, output);
+		}
+		return;
+	}
+	if (!isDeepStrictEqual(base, target)) output.add(path);
+}
+function parentPath(value) {
+	if (!value) return "";
+	if (value.endsWith("]")) {
+		const index = value.lastIndexOf("[");
+		return index > 0 ? value.slice(0, index) : "";
+	}
+	const index = value.lastIndexOf(".");
+	return index >= 0 ? value.slice(0, index) : "";
+}
+function isPathChanged(path, changedPaths) {
+	if (changedPaths.has(path)) return true;
+	let current = parentPath(path);
+	while (current) {
+		if (changedPaths.has(current)) return true;
+		current = parentPath(current);
+	}
+	return changedPaths.has("");
+}
+function restoreEnvRefsFromMap(value, path, envRefMap, changedPaths) {
+	if (typeof value === "string") {
+		if (!isPathChanged(path, changedPaths)) {
+			const original = envRefMap.get(path);
+			if (original !== void 0) return original;
+		}
+		return value;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const next = value.map((item, index) => {
+			const updated = restoreEnvRefsFromMap(item, `${path}[${index}]`, envRefMap, changedPaths);
+			if (updated !== item) changed = true;
+			return updated;
+		});
+		return changed ? next : value;
+	}
+	if (isPlainObject(value)) {
+		let changed = false;
+		const next = {};
+		for (const [key, child] of Object.entries(value)) {
+			const updated = restoreEnvRefsFromMap(child, path ? `${path}.${key}` : key, envRefMap, changedPaths);
+			if (updated !== child) changed = true;
+			next[key] = updated;
+		}
+		return changed ? next : value;
+	}
+	return value;
+}
+function resolveConfigAuditLogPath(env, homedir) {
+	return path.join(resolveStateDir(env, homedir), "logs", CONFIG_AUDIT_LOG_FILENAME);
+}
+function resolveConfigWriteSuspiciousReasons(params) {
+	const reasons = [];
+	if (!params.existsBefore) return reasons;
+	if (typeof params.previousBytes === "number" && typeof params.nextBytes === "number" && params.previousBytes >= 512 && params.nextBytes < Math.floor(params.previousBytes * .5)) reasons.push(`size-drop:${params.previousBytes}->${params.nextBytes}`);
+	if (!params.hasMetaBefore) reasons.push("missing-meta-before-write");
+	if (params.gatewayModeBefore && !params.gatewayModeAfter) reasons.push("gateway-mode-removed");
+	return reasons;
+}
+async function appendConfigWriteAuditRecord(deps, record) {
+	try {
+		const auditPath = resolveConfigAuditLogPath(deps.env, deps.homedir);
+		await deps.fs.promises.mkdir(path.dirname(auditPath), {
+			recursive: true,
+			mode: 448
+		});
+		await deps.fs.promises.appendFile(auditPath, `${JSON.stringify(record)}\n`, {
+			encoding: "utf-8",
+			mode: 384
+		});
+	} catch {}
+}
+function warnOnConfigMiskeys(raw, logger) {
+	if (!raw || typeof raw !== "object") return;
+	const gateway = raw.gateway;
+	if (!gateway || typeof gateway !== "object") return;
+	if ("token" in gateway) logger.warn("Config uses \"gateway.token\". This key is ignored; use \"gateway.auth.token\" instead.");
+}
+function stampConfigVersion(cfg) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		...cfg,
+		meta: {
+			...cfg.meta,
+			lastTouchedVersion: VERSION,
+			lastTouchedAt: now
+		}
+	};
+}
+function warnIfConfigFromFuture(cfg, logger) {
+	const touched = cfg.meta?.lastTouchedVersion;
+	if (!touched) return;
+	const cmp = compareRemoteClawVersions(VERSION, touched);
+	if (cmp === null) return;
+	if (cmp < 0) logger.warn(`Config was last written by a newer RemoteClaw (${touched}); current version is ${VERSION}.`);
+}
+function resolveConfigPathForDeps(deps) {
+	if (deps.configPath) return deps.configPath;
+	return resolveConfigPath(deps.env, resolveStateDir(deps.env, deps.homedir));
+}
+function normalizeDeps(overrides = {}) {
+	return {
+		fs: overrides.fs ?? fs,
+		json5: overrides.json5 ?? JSON5,
+		env: overrides.env ?? process.env,
+		homedir: overrides.homedir ?? (() => resolveRequiredHomeDir(overrides.env ?? process.env, os.homedir)),
+		configPath: overrides.configPath ?? "",
+		logger: overrides.logger ?? console
+	};
+}
+function maybeLoadDotEnvForConfig(env) {
+	if (env !== process.env) return;
+	loadDotEnv({ quiet: true });
+}
+function parseConfigJson5(raw, json5 = JSON5) {
+	try {
+		return {
+			ok: true,
+			parsed: json5.parse(raw)
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: String(err)
+		};
+	}
+}
+function resolveConfigIncludesForRead(parsed, configPath, deps) {
+	return resolveConfigIncludes(parsed, configPath, {
+		readFile: (candidate) => deps.fs.readFileSync(candidate, "utf-8"),
+		parseJson: (raw) => deps.json5.parse(raw)
+	});
+}
+function resolveConfigForRead(resolvedIncludes, env) {
+	if (resolvedIncludes && typeof resolvedIncludes === "object" && "env" in resolvedIncludes) applyConfigEnvVars(resolvedIncludes, env);
+	return {
+		resolvedConfigRaw: resolveConfigEnvVars(resolvedIncludes, env),
+		envSnapshotForRestore: { ...env }
+	};
+}
+function createConfigIO(overrides = {}) {
+	const deps = normalizeDeps(overrides);
+	const requestedConfigPath = resolveConfigPathForDeps(deps);
+	const configPath = (deps.configPath ? [requestedConfigPath] : resolveDefaultConfigCandidates(deps.env, deps.homedir)).find((candidate) => deps.fs.existsSync(candidate)) ?? requestedConfigPath;
+	function loadConfig() {
+		try {
+			maybeLoadDotEnvForConfig(deps.env);
+			if (!deps.fs.existsSync(configPath)) {
+				if (shouldEnableShellEnvFallback(deps.env) && !shouldDeferShellEnvFallback(deps.env)) loadShellEnvFallback({
+					enabled: true,
+					env: deps.env,
+					expectedKeys: SHELL_ENV_EXPECTED_KEYS,
+					logger: deps.logger,
+					timeoutMs: resolveShellEnvFallbackTimeoutMs(deps.env)
+				});
+				return {};
+			}
+			const raw = deps.fs.readFileSync(configPath, "utf-8");
+			const { resolvedConfigRaw: resolvedConfig } = resolveConfigForRead(resolveConfigIncludesForRead(deps.json5.parse(raw), configPath, deps), deps.env);
+			warnOnConfigMiskeys(resolvedConfig, deps.logger);
+			if (typeof resolvedConfig !== "object" || resolvedConfig === null) return {};
+			const preValidationDuplicates = findDuplicateAgentDirs(resolvedConfig, {
+				env: deps.env,
+				homedir: deps.homedir
+			});
+			if (preValidationDuplicates.length > 0) throw new DuplicateAgentDirError(preValidationDuplicates);
+			const validated = validateConfigObjectWithPlugins(resolvedConfig);
+			if (!validated.ok) {
+				const details = validated.issues.map((iss) => `- ${iss.path || "<root>"}: ${iss.message}`).join("\n");
+				if (!loggedInvalidConfigs.has(configPath)) {
+					loggedInvalidConfigs.add(configPath);
+					deps.logger.error(`Invalid config at ${configPath}:\\n${details}`);
+				}
+				const error = /* @__PURE__ */ new Error("Invalid config");
+				error.code = "INVALID_CONFIG";
+				error.details = details;
+				throw error;
+			}
+			if (validated.warnings.length > 0) {
+				const details = validated.warnings.map((iss) => `- ${iss.path || "<root>"}: ${iss.message}`).join("\n");
+				deps.logger.warn(`Config warnings:\\n${details}`);
+			}
+			warnIfConfigFromFuture(validated.config, deps.logger);
+			const cfg = applyTalkConfigNormalization(applyModelDefaults(applyContextPruningDefaults(applyAgentDefaults(applySessionDefaults(applyLoggingDefaults(applyMessageDefaults(validated.config)))))));
+			normalizeConfigPaths(cfg);
+			const duplicates = findDuplicateAgentDirs(cfg, {
+				env: deps.env,
+				homedir: deps.homedir
+			});
+			if (duplicates.length > 0) throw new DuplicateAgentDirError(duplicates);
+			applyConfigEnvVars(cfg, deps.env);
+			if ((shouldEnableShellEnvFallback(deps.env) || cfg.env?.shellEnv?.enabled === true) && !shouldDeferShellEnvFallback(deps.env)) loadShellEnvFallback({
+				enabled: true,
+				env: deps.env,
+				expectedKeys: SHELL_ENV_EXPECTED_KEYS,
+				logger: deps.logger,
+				timeoutMs: cfg.env?.shellEnv?.timeoutMs ?? resolveShellEnvFallbackTimeoutMs(deps.env)
+			});
+			const pendingSecret = AUTO_OWNER_DISPLAY_SECRET_BY_PATH.get(configPath);
+			const ownerDisplaySecretResolution = ensureOwnerDisplaySecret(cfg, () => pendingSecret ?? crypto.randomBytes(32).toString("hex"));
+			const cfgWithOwnerDisplaySecret = ownerDisplaySecretResolution.config;
+			if (ownerDisplaySecretResolution.generatedSecret) {
+				AUTO_OWNER_DISPLAY_SECRET_BY_PATH.set(configPath, ownerDisplaySecretResolution.generatedSecret);
+				if (!AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT.has(configPath)) {
+					AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT.add(configPath);
+					writeConfigFile(cfgWithOwnerDisplaySecret, { expectedConfigPath: configPath }).then(() => {
+						AUTO_OWNER_DISPLAY_SECRET_BY_PATH.delete(configPath);
+						AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.delete(configPath);
+					}).catch((err) => {
+						if (!AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.has(configPath)) {
+							AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.add(configPath);
+							deps.logger.warn(`Failed to persist auto-generated commands.ownerDisplaySecret at ${configPath}: ${String(err)}`);
+						}
+					}).finally(() => {
+						AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT.delete(configPath);
+					});
+				}
+			} else {
+				AUTO_OWNER_DISPLAY_SECRET_BY_PATH.delete(configPath);
+				AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.delete(configPath);
+			}
+			return applyConfigOverrides(cfgWithOwnerDisplaySecret);
+		} catch (err) {
+			if (err instanceof DuplicateAgentDirError) {
+				deps.logger.error(err.message);
+				throw err;
+			}
+			if (err?.code === "INVALID_CONFIG") return {};
+			deps.logger.error(`Failed to read config at ${configPath}`, err);
+			return {};
+		}
+	}
+	async function readConfigFileSnapshotInternal() {
+		maybeLoadDotEnvForConfig(deps.env);
+		if (!deps.fs.existsSync(configPath)) {
+			const hash = hashConfigRaw(null);
+			return { snapshot: {
+				path: configPath,
+				exists: false,
+				raw: null,
+				parsed: {},
+				resolved: {},
+				valid: true,
+				config: applyTalkApiKey(applyTalkConfigNormalization(applyModelDefaults(applyContextPruningDefaults(applyAgentDefaults(applySessionDefaults(applyMessageDefaults({}))))))),
+				hash,
+				issues: [],
+				warnings: [],
+				legacyIssues: []
+			} };
+		}
+		try {
+			const raw = deps.fs.readFileSync(configPath, "utf-8");
+			const hash = hashConfigRaw(raw);
+			const parsedRes = parseConfigJson5(raw, deps.json5);
+			if (!parsedRes.ok) return { snapshot: {
+				path: configPath,
+				exists: true,
+				raw,
+				parsed: {},
+				resolved: {},
+				valid: false,
+				config: {},
+				hash,
+				issues: [{
+					path: "",
+					message: `JSON5 parse failed: ${parsedRes.error}`
+				}],
+				warnings: [],
+				legacyIssues: []
+			} };
+			let resolved;
+			try {
+				resolved = resolveConfigIncludesForRead(parsedRes.parsed, configPath, deps);
+			} catch (err) {
+				const message = err instanceof ConfigIncludeError ? err.message : `Include resolution failed: ${String(err)}`;
+				return { snapshot: {
+					path: configPath,
+					exists: true,
+					raw,
+					parsed: parsedRes.parsed,
+					resolved: coerceConfig(parsedRes.parsed),
+					valid: false,
+					config: coerceConfig(parsedRes.parsed),
+					hash,
+					issues: [{
+						path: "",
+						message
+					}],
+					warnings: [],
+					legacyIssues: []
+				} };
+			}
+			let readResolution;
+			try {
+				readResolution = resolveConfigForRead(resolved, deps.env);
+			} catch (err) {
+				const message = err instanceof MissingEnvVarError ? err.message : `Env var substitution failed: ${String(err)}`;
+				return { snapshot: {
+					path: configPath,
+					exists: true,
+					raw,
+					parsed: parsedRes.parsed,
+					resolved: coerceConfig(resolved),
+					valid: false,
+					config: coerceConfig(resolved),
+					hash,
+					issues: [{
+						path: "",
+						message
+					}],
+					warnings: [],
+					legacyIssues: []
+				} };
+			}
+			const resolvedConfigRaw = readResolution.resolvedConfigRaw;
+			const legacyIssues = findLegacyConfigIssues(resolvedConfigRaw);
+			const validated = validateConfigObjectWithPlugins(resolvedConfigRaw);
+			if (!validated.ok) return { snapshot: {
+				path: configPath,
+				exists: true,
+				raw,
+				parsed: parsedRes.parsed,
+				resolved: coerceConfig(resolvedConfigRaw),
+				valid: false,
+				config: coerceConfig(resolvedConfigRaw),
+				hash,
+				issues: validated.issues,
+				warnings: validated.warnings,
+				legacyIssues
+			} };
+			warnIfConfigFromFuture(validated.config, deps.logger);
+			const snapshotConfig = normalizeConfigPaths(applyTalkApiKey(applyTalkConfigNormalization(applyModelDefaults(applyAgentDefaults(applySessionDefaults(applyLoggingDefaults(applyMessageDefaults(validated.config))))))));
+			return {
+				snapshot: {
+					path: configPath,
+					exists: true,
+					raw,
+					parsed: parsedRes.parsed,
+					resolved: coerceConfig(resolvedConfigRaw),
+					valid: true,
+					config: snapshotConfig,
+					hash,
+					issues: [],
+					warnings: validated.warnings,
+					legacyIssues
+				},
+				envSnapshotForRestore: readResolution.envSnapshotForRestore
+			};
+		} catch (err) {
+			const nodeErr = err;
+			let message;
+			if (nodeErr?.code === "EACCES") {
+				const uid = process.getuid?.();
+				const uidHint = typeof uid === "number" ? String(uid) : "$(id -u)";
+				message = [
+					`read failed: ${String(err)}`,
+					``,
+					`Config file is not readable by the current process. If running in a container`,
+					`or 1-click deployment, fix ownership with:`,
+					`  chown ${uidHint} "${configPath}"`,
+					`Then restart the gateway.`
+				].join("\n");
+				deps.logger.error(message);
+			} else message = `read failed: ${String(err)}`;
+			return { snapshot: {
+				path: configPath,
+				exists: true,
+				raw: null,
+				parsed: {},
+				resolved: {},
+				valid: false,
+				config: {},
+				hash: hashConfigRaw(null),
+				issues: [{
+					path: "",
+					message
+				}],
+				warnings: [],
+				legacyIssues: []
+			} };
+		}
+	}
+	async function readConfigFileSnapshot() {
+		return (await readConfigFileSnapshotInternal()).snapshot;
+	}
+	async function readConfigFileSnapshotForWrite() {
+		const result = await readConfigFileSnapshotInternal();
+		return {
+			snapshot: result.snapshot,
+			writeOptions: {
+				envSnapshotForRestore: result.envSnapshotForRestore,
+				expectedConfigPath: configPath
+			}
+		};
+	}
+	async function writeConfigFile(cfg, options = {}) {
+		clearConfigCache();
+		let persistCandidate = cfg;
+		const { snapshot } = await readConfigFileSnapshotInternal();
+		let envRefMap = null;
+		let changedPaths = null;
+		if (snapshot.valid && snapshot.exists) {
+			const patch = createMergePatch(snapshot.config, cfg);
+			persistCandidate = applyMergePatch(snapshot.resolved, patch);
+			try {
+				const resolvedIncludes = resolveConfigIncludes(snapshot.parsed, configPath, {
+					readFile: (candidate) => deps.fs.readFileSync(candidate, "utf-8"),
+					parseJson: (raw) => deps.json5.parse(raw)
+				});
+				const collected = /* @__PURE__ */ new Map();
+				collectEnvRefPaths(resolvedIncludes, "", collected);
+				if (collected.size > 0) {
+					envRefMap = collected;
+					changedPaths = /* @__PURE__ */ new Set();
+					collectChangedPaths(snapshot.config, cfg, "", changedPaths);
+				}
+			} catch {
+				envRefMap = null;
+			}
+		}
+		const validated = validateConfigObjectRawWithPlugins(persistCandidate);
+		if (!validated.ok) {
+			const issue = validated.issues[0];
+			const pathLabel = issue?.path ? issue.path : "<root>";
+			const issueMessage = issue?.message ?? "invalid";
+			throw new Error(formatConfigValidationFailure(pathLabel, issueMessage));
+		}
+		if (validated.warnings.length > 0) {
+			const details = validated.warnings.map((warning) => `- ${warning.path}: ${warning.message}`).join("\n");
+			deps.logger.warn(`Config warnings:\n${details}`);
+		}
+		let cfgToWrite = validated.config;
+		try {
+			if (deps.fs.existsSync(configPath)) {
+				const parsedRes = parseConfigJson5(await deps.fs.promises.readFile(configPath, "utf-8"), deps.json5);
+				if (parsedRes.ok) {
+					const envForRestore = options.envSnapshotForRestore ?? deps.env;
+					cfgToWrite = restoreEnvVarRefs(cfgToWrite, parsedRes.parsed, envForRestore);
+				}
+			}
+		} catch {}
+		const dir = path.dirname(configPath);
+		await deps.fs.promises.mkdir(dir, {
+			recursive: true,
+			mode: 448
+		});
+		let outputConfig = envRefMap && changedPaths ? restoreEnvRefsFromMap(cfgToWrite, "", envRefMap, changedPaths) : cfgToWrite;
+		if (options.unsetPaths?.length) for (const unsetPath of options.unsetPaths) {
+			if (!Array.isArray(unsetPath) || unsetPath.length === 0) continue;
+			const unsetResult = unsetPathForWrite(outputConfig, unsetPath);
+			if (unsetResult.changed) outputConfig = unsetResult.next;
+		}
+		const stampedOutputConfig = stampConfigVersion(outputConfig);
+		const json = JSON.stringify(stampedOutputConfig, null, 2).trimEnd().concat("\n");
+		const nextHash = hashConfigRaw(json);
+		const previousHash = resolveConfigSnapshotHash(snapshot);
+		const changedPathCount = changedPaths?.size;
+		const previousBytes = typeof snapshot.raw === "string" ? Buffer.byteLength(snapshot.raw, "utf-8") : null;
+		const nextBytes = Buffer.byteLength(json, "utf-8");
+		const hasMetaBefore = hasConfigMeta(snapshot.parsed);
+		const hasMetaAfter = hasConfigMeta(stampedOutputConfig);
+		const gatewayModeBefore = resolveGatewayMode(snapshot.resolved);
+		const gatewayModeAfter = resolveGatewayMode(stampedOutputConfig);
+		const suspiciousReasons = resolveConfigWriteSuspiciousReasons({
+			existsBefore: snapshot.exists,
+			previousBytes,
+			nextBytes,
+			hasMetaBefore,
+			gatewayModeBefore,
+			gatewayModeAfter
+		});
+		const logConfigOverwrite = () => {
+			if (!snapshot.exists) return;
+			const isVitest = deps.env.VITEST === "true";
+			const shouldLogInVitest = deps.env.REMOTECLAW_TEST_CONFIG_OVERWRITE_LOG === "1";
+			if (isVitest && !shouldLogInVitest) return;
+			const changeSummary = typeof changedPathCount === "number" ? `, changedPaths=${changedPathCount}` : "";
+			deps.logger.warn(`Config overwrite: ${configPath} (sha256 ${previousHash ?? "unknown"} -> ${nextHash}, backup=${configPath}.bak${changeSummary})`);
+		};
+		const logConfigWriteAnomalies = () => {
+			if (suspiciousReasons.length === 0) return;
+			const isVitest = deps.env.VITEST === "true";
+			const shouldLogInVitest = deps.env.REMOTECLAW_TEST_CONFIG_WRITE_ANOMALY_LOG === "1";
+			if (isVitest && !shouldLogInVitest) return;
+			deps.logger.warn(`Config write anomaly: ${configPath} (${suspiciousReasons.join(", ")})`);
+		};
+		const auditRecordBase = {
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			source: "config-io",
+			event: "config.write",
+			configPath,
+			pid: process.pid,
+			ppid: process.ppid,
+			cwd: process.cwd(),
+			argv: process.argv.slice(0, 8),
+			execArgv: process.execArgv.slice(0, 8),
+			watchMode: deps.env.REMOTECLAW_WATCH_MODE === "1",
+			watchSession: typeof deps.env.REMOTECLAW_WATCH_SESSION === "string" && deps.env.REMOTECLAW_WATCH_SESSION.trim().length > 0 ? deps.env.REMOTECLAW_WATCH_SESSION.trim() : null,
+			watchCommand: typeof deps.env.REMOTECLAW_WATCH_COMMAND === "string" && deps.env.REMOTECLAW_WATCH_COMMAND.trim().length > 0 ? deps.env.REMOTECLAW_WATCH_COMMAND.trim() : null,
+			existsBefore: snapshot.exists,
+			previousHash: previousHash ?? null,
+			nextHash,
+			previousBytes,
+			nextBytes,
+			changedPathCount: typeof changedPathCount === "number" ? changedPathCount : null,
+			hasMetaBefore,
+			hasMetaAfter,
+			gatewayModeBefore,
+			gatewayModeAfter,
+			suspicious: suspiciousReasons
+		};
+		const appendWriteAudit = async (result, err) => {
+			const errorCode = err && typeof err === "object" && "code" in err && typeof err.code === "string" ? err.code : void 0;
+			const errorMessage = err && typeof err === "object" && "message" in err && typeof err.message === "string" ? err.message : void 0;
+			await appendConfigWriteAuditRecord(deps, {
+				...auditRecordBase,
+				result,
+				nextHash: result === "failed" ? null : auditRecordBase.nextHash,
+				nextBytes: result === "failed" ? null : auditRecordBase.nextBytes,
+				errorCode,
+				errorMessage
+			});
+		};
+		const tmp = path.join(dir, `${path.basename(configPath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+		try {
+			await deps.fs.promises.writeFile(tmp, json, {
+				encoding: "utf-8",
+				mode: 384
+			});
+			if (deps.fs.existsSync(configPath)) {
+				await rotateConfigBackups(configPath, deps.fs.promises);
+				await deps.fs.promises.copyFile(configPath, `${configPath}.bak`).catch(() => {});
+			}
+			try {
+				await deps.fs.promises.rename(tmp, configPath);
+			} catch (err) {
+				const code = err.code;
+				if (code === "EPERM" || code === "EEXIST") {
+					await deps.fs.promises.copyFile(tmp, configPath);
+					await deps.fs.promises.chmod(configPath, 384).catch(() => {});
+					await deps.fs.promises.unlink(tmp).catch(() => {});
+					logConfigOverwrite();
+					logConfigWriteAnomalies();
+					await appendWriteAudit("copy-fallback");
+					return;
+				}
+				await deps.fs.promises.unlink(tmp).catch(() => {});
+				throw err;
+			}
+			logConfigOverwrite();
+			logConfigWriteAnomalies();
+			await appendWriteAudit("rename");
+		} catch (err) {
+			await appendWriteAudit("failed", err);
+			throw err;
+		}
+	}
+	return {
+		configPath,
+		loadConfig,
+		readConfigFileSnapshot,
+		readConfigFileSnapshotForWrite,
+		writeConfigFile
+	};
+}
+const DEFAULT_CONFIG_CACHE_MS = 200;
+const AUTO_OWNER_DISPLAY_SECRET_BY_PATH = /* @__PURE__ */ new Map();
+const AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT = /* @__PURE__ */ new Set();
+const AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED = /* @__PURE__ */ new Set();
+let configCache = null;
+function resolveConfigCacheMs(env) {
+	const raw = env.REMOTECLAW_CONFIG_CACHE_MS?.trim();
+	if (raw === "" || raw === "0") return 0;
+	if (!raw) return DEFAULT_CONFIG_CACHE_MS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return DEFAULT_CONFIG_CACHE_MS;
+	return Math.max(0, parsed);
+}
+function shouldUseConfigCache(env) {
+	if (env.REMOTECLAW_DISABLE_CONFIG_CACHE?.trim()) return false;
+	return resolveConfigCacheMs(env) > 0;
+}
+function clearConfigCache() {
+	configCache = null;
+}
+function loadConfig() {
+	const io = createConfigIO();
+	const configPath = io.configPath;
+	const now = Date.now();
+	if (shouldUseConfigCache(process.env)) {
+		const cached = configCache;
+		if (cached && cached.configPath === configPath && cached.expiresAt > now) return cached.config;
+	}
+	const config = io.loadConfig();
+	if (shouldUseConfigCache(process.env)) {
+		const cacheMs = resolveConfigCacheMs(process.env);
+		if (cacheMs > 0) configCache = {
+			configPath,
+			expiresAt: now + cacheMs,
+			config
+		};
+	}
+	return config;
+}
+async function readConfigFileSnapshot() {
+	return await createConfigIO().readConfigFileSnapshot();
+}
+async function readConfigFileSnapshotForWrite() {
+	return await createConfigIO().readConfigFileSnapshotForWrite();
+}
+async function writeConfigFile(cfg, options = {}) {
+	const io = createConfigIO();
+	const sameConfigPath = options.expectedConfigPath === void 0 || options.expectedConfigPath === io.configPath;
+	await io.writeConfigFile(cfg, {
+		envSnapshotForRestore: sameConfigPath ? options.envSnapshotForRestore : void 0,
+		unsetPaths: options.unsetPaths
+	});
+}
+
+//#endregion
+//#region src/config/legacy-migrate.ts
+function migrateLegacyConfig(raw) {
+	const { next, changes } = applyLegacyMigrations(raw);
+	if (!next) return {
+		config: null,
+		changes: []
+	};
+	const validated = validateConfigObjectWithPlugins(next);
+	if (!validated.ok) {
+		changes.push("Migration applied, but config still invalid; fix remaining issues manually.");
+		return {
+			config: null,
+			changes
+		};
+	}
+	return {
+		config: validated.config,
+		changes
+	};
+}
+
+//#endregion
+//#region src/config/config.ts
+var config_exports = /* @__PURE__ */ __exportAll({
+	CONFIG_PATH: () => CONFIG_PATH,
+	DEFAULT_GATEWAY_PORT: () => DEFAULT_GATEWAY_PORT,
+	STATE_DIR: () => STATE_DIR,
+	TOOLS_BY_SENDER_KEY_TYPES: () => TOOLS_BY_SENDER_KEY_TYPES,
+	applyConfigOverrides: () => applyConfigOverrides,
+	getConfigOverrides: () => getConfigOverrides,
+	isNixMode: () => isNixMode,
+	loadConfig: () => loadConfig,
+	parseToolsBySenderTypedKey: () => parseToolsBySenderTypedKey,
+	resetConfigOverrides: () => resetConfigOverrides,
+	resolveCanonicalConfigPath: () => resolveCanonicalConfigPath,
+	resolveConfigPath: () => resolveConfigPath,
+	resolveConfigPathCandidate: () => resolveConfigPathCandidate,
+	resolveDefaultConfigCandidates: () => resolveDefaultConfigCandidates,
+	resolveGatewayLockDir: () => resolveGatewayLockDir,
+	resolveGatewayPort: () => resolveGatewayPort,
+	resolveIsNixMode: () => resolveIsNixMode,
+	resolveLegacyStateDirs: () => resolveLegacyStateDirs,
+	resolveNewStateDir: () => resolveNewStateDir,
+	resolveOAuthDir: () => resolveOAuthDir,
+	resolveStateDir: () => resolveStateDir,
+	setConfigOverride: () => setConfigOverride,
+	unsetConfigOverride: () => unsetConfigOverride
+});
+
+//#endregion
+export { applyTestPluginDefaults as A, unsetConfigValueAtPath as B, discoverRemoteClawPlugins as C, LEGACY_MANIFEST_KEYS as D, loadPluginManifest as E, setConfigOverride as F, extensionUsesSkippedScannerPath as G, applyLegacyMigrations as H, unsetConfigOverride as I, buildTalkConfigResponse as J, isPathInside$1 as K, getConfigValueAtPath as L, resolveEffectiveEnableState as M, getConfigOverrides as N, MANIFEST_KEY as O, resetConfigOverrides as P, loadDotEnv as Q, parseConfigPath as R, loadPluginManifestRegistry as S, safeStatSync as T, INCLUDE_KEY as U, applyMergePatch as V, MAX_INCLUDE_DEPTH as W, resolveAgentMaxConcurrent as X, DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH as Y, resolveSubagentMaxConcurrent as Z, isWorkspaceRelativeAvatarPath as _, parseConfigJson5 as a, validateJsonSchemaValue as b, resolveConfigSnapshotHash as c, AVATAR_MAX_BYTES as d, isAvatarDataUrl as f, isSupportedLocalAvatarExtension as g, isPathWithinRoot as h, loadConfig as i, normalizePluginsConfig as j, resolveBundledPluginsDir as k, writeConfigFile as l, isAvatarImageDataUrl as m, migrateLegacyConfig as n, readConfigFileSnapshot as o, isAvatarHttpUrl as p, isPathInsideWithRealpath as q, createConfigIO as r, readConfigFileSnapshotForWrite as s, config_exports as t, validateConfigObjectWithPlugins as u, looksLikeAvatarPath as v, isPathInside as w, clearPluginManifestRegistryCache as x, resolveAvatarMime as y, setConfigValueAtPath as z };