remoteclaw 0.1.0-next.cd6ddde → 0.1.0-next.cf9ccbe

package/dist/config-DwuBnd6D.js

@@ -0,0 +1,3347 @@
+import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
+import { _ as resolveRequiredHomeDir, a as resolveCanonicalConfigPath, c as resolveDefaultConfigCandidates, d as resolveIsNixMode, f as resolveNewStateDir, i as isNixMode, l as resolveGatewayLockDir, m as resolveStateDir, n as DEFAULT_GATEWAY_PORT, o as resolveConfigPath, p as resolveOAuthDir, r as STATE_DIR, s as resolveConfigPathCandidate, t as CONFIG_PATH, u as resolveGatewayPort } from "./paths-DHuXVC00.js";
+import { _ as resolveUserPath, l as isRecord, m as resolveConfigDir, w as isPlainObject$2 } from "./utils-DPoNpP7D.js";
+import { _ as normalizeChatChannelId, l as CHANNEL_IDS } from "./subsystem-BAW_f3DI.js";
+import { _ as isBlockedObjectKey, s as normalizeAgentId, t as DEFAULT_AGENT_ID } from "./session-key-CgKWfjoZ.js";
+import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDirOrNull } from "./agent-scope-CAQLm3LP.js";
+import { o as parseModelRef } from "./provider-utils-C9kBVF1f.js";
+import { a as shouldEnableShellEnvFallback, i as shouldDeferShellEnvFallback, n as loadShellEnvFallback, r as resolveShellEnvFallbackTimeoutMs } from "./shell-env-c3j5zcU9.js";
+import { t as VERSION } from "./version-CVMnqdzu.js";
+import { t as applyConfigEnvVars } from "./env-vars-a7S70ba7.js";
+import { t as RemoteClawSchema } from "./zod-schema-Y5SQgJLm.js";
+import { n as parseToolsBySenderTypedKey, t as TOOLS_BY_SENDER_KEY_TYPES } from "./types.tools-BDJw1yFx.js";
+import { fileURLToPath } from "node:url";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import JSON5 from "json5";
+import { isDeepStrictEqual } from "node:util";
+import crypto from "node:crypto";
+import dotenv from "dotenv";
+import AjvPkg from "ajv";
+
+//#region src/agents/owner-display.ts
+function trimToUndefined(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/**
+* Resolve owner display settings for prompt rendering.
+* Keep auth secrets decoupled from owner hash secrets.
+*/
+function resolveOwnerDisplaySetting(config) {
+	const ownerDisplay = config?.commands?.ownerDisplay;
+	if (ownerDisplay !== "hash") return {
+		ownerDisplay,
+		ownerDisplaySecret: void 0
+	};
+	return {
+		ownerDisplay: "hash",
+		ownerDisplaySecret: trimToUndefined(config?.commands?.ownerDisplaySecret)
+	};
+}
+/**
+* Ensure hash mode has a dedicated secret.
+* Returns updated config and generated secret when autofill was needed.
+*/
+function ensureOwnerDisplaySecret(config, generateSecret = () => crypto.randomBytes(32).toString("hex")) {
+	const settings = resolveOwnerDisplaySetting(config);
+	if (settings.ownerDisplay !== "hash" || settings.ownerDisplaySecret) return { config };
+	const generatedSecret = generateSecret();
+	return {
+		config: {
+			...config,
+			commands: {
+				...config.commands,
+				ownerDisplay: "hash",
+				ownerDisplaySecret: generatedSecret
+			}
+		},
+		generatedSecret
+	};
+}
+
+//#endregion
+//#region src/infra/dotenv.ts
+function loadDotEnv(opts) {
+	const quiet = opts?.quiet ?? true;
+	dotenv.config({ quiet });
+	const globalEnvPath = path.join(resolveConfigDir(process.env), ".env");
+	if (!fs.existsSync(globalEnvPath)) return;
+	dotenv.config({
+		quiet,
+		path: globalEnvPath,
+		override: false
+	});
+}
+
+//#endregion
+//#region src/config/agent-dirs.ts
+var DuplicateAgentDirError = class extends Error {
+	constructor(duplicates) {
+		super(formatDuplicateAgentDirError(duplicates));
+		this.name = "DuplicateAgentDirError";
+		this.duplicates = duplicates;
+	}
+};
+function canonicalizeAgentDir(agentDir) {
+	const resolved = path.resolve(agentDir);
+	if (process.platform === "darwin" || process.platform === "win32") return resolved.toLowerCase();
+	return resolved;
+}
+function collectReferencedAgentIds(cfg) {
+	const ids = /* @__PURE__ */ new Set();
+	const agents = Array.isArray(cfg.agents?.list) ? cfg.agents?.list : [];
+	const defaultAgentId = agents.find((agent) => agent?.default)?.id ?? agents[0]?.id ?? DEFAULT_AGENT_ID;
+	ids.add(normalizeAgentId(defaultAgentId));
+	for (const entry of agents) if (entry?.id) ids.add(normalizeAgentId(entry.id));
+	const bindings = cfg.bindings;
+	if (Array.isArray(bindings)) for (const binding of bindings) {
+		const id = binding?.agentId;
+		if (typeof id === "string" && id.trim()) ids.add(normalizeAgentId(id));
+	}
+	return [...ids];
+}
+function resolveEffectiveAgentDir(cfg, agentId, deps) {
+	const id = normalizeAgentId(agentId);
+	const trimmed = (Array.isArray(cfg.agents?.list) ? cfg.agents?.list.find((agent) => normalizeAgentId(agent.id) === id)?.agentDir : void 0)?.trim();
+	if (trimmed) return resolveUserPath(trimmed);
+	const env = deps?.env ?? process.env;
+	const root = resolveStateDir(env, deps?.homedir ?? (() => resolveRequiredHomeDir(env, os.homedir)));
+	return path.join(root, "agents", id, "agent");
+}
+function findDuplicateAgentDirs(cfg, deps) {
+	const byDir = /* @__PURE__ */ new Map();
+	for (const agentId of collectReferencedAgentIds(cfg)) {
+		const agentDir = resolveEffectiveAgentDir(cfg, agentId, deps);
+		const key = canonicalizeAgentDir(agentDir);
+		const entry = byDir.get(key);
+		if (entry) entry.agentIds.push(agentId);
+		else byDir.set(key, {
+			agentDir,
+			agentIds: [agentId]
+		});
+	}
+	return [...byDir.values()].filter((v) => v.agentIds.length > 1);
+}
+function formatDuplicateAgentDirError(dups) {
+	return [
+		"Duplicate agentDir detected (multi-agent config).",
+		"Each agent must have a unique agentDir; sharing it causes session state collisions.",
+		"",
+		"Conflicts:",
+		...dups.map((d) => `- ${d.agentDir}: ${d.agentIds.map((id) => `"${id}"`).join(", ")}`),
+		"",
+		"Fix: remove the shared agents.list[].agentDir override (or give each agent its own directory)."
+	].join("\n");
+}
+
+//#endregion
+//#region src/config/backup-rotation.ts
+const CONFIG_BACKUP_COUNT = 5;
+async function rotateConfigBackups(configPath, ioFs) {
+	if (CONFIG_BACKUP_COUNT <= 1) return;
+	const backupBase = `${configPath}.bak`;
+	const maxIndex = CONFIG_BACKUP_COUNT - 1;
+	await ioFs.unlink(`${backupBase}.${maxIndex}`).catch(() => {});
+	for (let index = maxIndex - 1; index >= 1; index -= 1) await ioFs.rename(`${backupBase}.${index}`, `${backupBase}.${index + 1}`).catch(() => {});
+	await ioFs.rename(backupBase, `${backupBase}.1`).catch(() => {});
+}
+
+//#endregion
+//#region src/config/agent-limits.ts
+const DEFAULT_AGENT_MAX_CONCURRENT = 4;
+const DEFAULT_SUBAGENT_MAX_CONCURRENT = 8;
+const DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH = 1;
+function resolveAgentMaxConcurrent(cfg) {
+	const raw = cfg?.agents?.defaults?.maxConcurrent;
+	if (typeof raw === "number" && Number.isFinite(raw)) return Math.max(1, Math.floor(raw));
+	return DEFAULT_AGENT_MAX_CONCURRENT;
+}
+function resolveSubagentMaxConcurrent(cfg) {
+	const raw = cfg?.agents?.defaults?.subagents?.maxConcurrent;
+	if (typeof raw === "number" && Number.isFinite(raw)) return Math.max(1, Math.floor(raw));
+	return DEFAULT_SUBAGENT_MAX_CONCURRENT;
+}
+
+//#endregion
+//#region src/config/talk.ts
+const DEFAULT_TALK_PROVIDER = "elevenlabs";
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeVoiceAliases(value) {
+	if (!isPlainObject$1(value)) return;
+	const aliases = {};
+	for (const [alias, rawId] of Object.entries(value)) {
+		if (typeof rawId !== "string") continue;
+		aliases[alias] = rawId;
+	}
+	return Object.keys(aliases).length > 0 ? aliases : void 0;
+}
+function normalizeTalkProviderConfig(value) {
+	if (!isPlainObject$1(value)) return;
+	const provider = {};
+	for (const [key, raw] of Object.entries(value)) {
+		if (raw === void 0) continue;
+		if (key === "voiceAliases") {
+			const aliases = normalizeVoiceAliases(raw);
+			if (aliases) provider.voiceAliases = aliases;
+			continue;
+		}
+		if (key === "voiceId" || key === "modelId" || key === "outputFormat" || key === "apiKey") {
+			const normalized = normalizeString(raw);
+			if (normalized) provider[key] = normalized;
+			continue;
+		}
+		provider[key] = raw;
+	}
+	return Object.keys(provider).length > 0 ? provider : void 0;
+}
+function normalizeTalkProviders(value) {
+	if (!isPlainObject$1(value)) return;
+	const providers = {};
+	for (const [rawProviderId, providerConfig] of Object.entries(value)) {
+		const providerId = normalizeString(rawProviderId);
+		if (!providerId) continue;
+		const normalizedProvider = normalizeTalkProviderConfig(providerConfig);
+		if (!normalizedProvider) continue;
+		providers[providerId] = normalizedProvider;
+	}
+	return Object.keys(providers).length > 0 ? providers : void 0;
+}
+function normalizedLegacyTalkFields(source) {
+	const legacy = {};
+	const voiceId = normalizeString(source.voiceId);
+	if (voiceId) legacy.voiceId = voiceId;
+	const voiceAliases = normalizeVoiceAliases(source.voiceAliases);
+	if (voiceAliases) legacy.voiceAliases = voiceAliases;
+	const modelId = normalizeString(source.modelId);
+	if (modelId) legacy.modelId = modelId;
+	const outputFormat = normalizeString(source.outputFormat);
+	if (outputFormat) legacy.outputFormat = outputFormat;
+	const apiKey = normalizeString(source.apiKey);
+	if (apiKey) legacy.apiKey = apiKey;
+	return legacy;
+}
+function legacyProviderConfigFromTalk(source) {
+	return normalizeTalkProviderConfig({
+		voiceId: source.voiceId,
+		voiceAliases: source.voiceAliases,
+		modelId: source.modelId,
+		outputFormat: source.outputFormat,
+		apiKey: source.apiKey
+	});
+}
+function activeProviderFromTalk(talk) {
+	const provider = normalizeString(talk.provider);
+	if (provider) return provider;
+	const providerIds = talk.providers ? Object.keys(talk.providers) : [];
+	return providerIds.length === 1 ? providerIds[0] : void 0;
+}
+function legacyTalkFieldsFromProviderConfig(config) {
+	if (!config) return {};
+	const legacy = {};
+	if (typeof config.voiceId === "string") legacy.voiceId = config.voiceId;
+	if (config.voiceAliases && typeof config.voiceAliases === "object" && !Array.isArray(config.voiceAliases)) {
+		const aliases = normalizeVoiceAliases(config.voiceAliases);
+		if (aliases) legacy.voiceAliases = aliases;
+	}
+	if (typeof config.modelId === "string") legacy.modelId = config.modelId;
+	if (typeof config.outputFormat === "string") legacy.outputFormat = config.outputFormat;
+	if (typeof config.apiKey === "string") legacy.apiKey = config.apiKey;
+	return legacy;
+}
+function normalizeTalkSection(value) {
+	if (!isPlainObject$1(value)) return;
+	const source = value;
+	const hasNormalizedShape = typeof source.provider === "string" || isPlainObject$1(source.providers);
+	const normalized = {};
+	const legacy = normalizedLegacyTalkFields(source);
+	if (Object.keys(legacy).length > 0) Object.assign(normalized, legacy);
+	if (typeof source.interruptOnSpeech === "boolean") normalized.interruptOnSpeech = source.interruptOnSpeech;
+	if (hasNormalizedShape) {
+		const providers = normalizeTalkProviders(source.providers);
+		const provider = normalizeString(source.provider);
+		if (providers) normalized.providers = providers;
+		if (provider) normalized.provider = provider;
+		else if (providers) {
+			const ids = Object.keys(providers);
+			if (ids.length === 1) normalized.provider = ids[0];
+		}
+		return Object.keys(normalized).length > 0 ? normalized : void 0;
+	}
+	const legacyProviderConfig = legacyProviderConfigFromTalk(source);
+	if (legacyProviderConfig) {
+		normalized.provider = DEFAULT_TALK_PROVIDER;
+		normalized.providers = { [DEFAULT_TALK_PROVIDER]: legacyProviderConfig };
+	}
+	return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function normalizeTalkConfig(config) {
+	if (!config.talk) return config;
+	const normalizedTalk = normalizeTalkSection(config.talk);
+	if (!normalizedTalk) return config;
+	return {
+		...config,
+		talk: normalizedTalk
+	};
+}
+function resolveActiveTalkProviderConfig(talk) {
+	const normalizedTalk = normalizeTalkSection(talk);
+	if (!normalizedTalk) return {};
+	const provider = activeProviderFromTalk(normalizedTalk);
+	if (!provider) return {};
+	return {
+		provider,
+		config: normalizedTalk.providers?.[provider]
+	};
+}
+function buildTalkConfigResponse(value) {
+	if (!isPlainObject$1(value)) return;
+	const normalized = normalizeTalkSection(value);
+	if (!normalized) return;
+	const payload = {};
+	if (typeof normalized.interruptOnSpeech === "boolean") payload.interruptOnSpeech = normalized.interruptOnSpeech;
+	if (normalized.providers && Object.keys(normalized.providers).length > 0) payload.providers = normalized.providers;
+	if (typeof normalized.provider === "string") payload.provider = normalized.provider;
+	const activeProvider = activeProviderFromTalk(normalized);
+	const providerCompatibilityLegacy = legacyTalkFieldsFromProviderConfig(activeProvider ? normalized.providers?.[activeProvider] : void 0);
+	const compatibilityLegacy = Object.keys(providerCompatibilityLegacy).length > 0 ? providerCompatibilityLegacy : normalizedLegacyTalkFields(normalized);
+	Object.assign(payload, compatibilityLegacy);
+	return Object.keys(payload).length > 0 ? payload : void 0;
+}
+function readTalkApiKeyFromProfile(deps = {}) {
+	const fsImpl = deps.fs ?? fs;
+	const osImpl = deps.os ?? os;
+	const pathImpl = deps.path ?? path;
+	const home = osImpl.homedir();
+	const candidates = [
+		".profile",
+		".zprofile",
+		".zshrc",
+		".bashrc"
+	].map((name) => pathImpl.join(home, name));
+	for (const candidate of candidates) {
+		if (!fsImpl.existsSync(candidate)) continue;
+		try {
+			const value = fsImpl.readFileSync(candidate, "utf-8").match(/(?:^|\n)\s*(?:export\s+)?ELEVENLABS_API_KEY\s*=\s*["']?([^\n"']+)["']?/)?.[1]?.trim();
+			if (value) return value;
+		} catch {}
+	}
+	return null;
+}
+function resolveTalkApiKey(env = process.env, deps = {}) {
+	const envValue = (env.ELEVENLABS_API_KEY ?? "").trim();
+	if (envValue) return envValue;
+	return readTalkApiKeyFromProfile(deps);
+}
+
+//#endregion
+//#region src/config/defaults.ts
+let defaultWarnState = { warned: false };
+const DEFAULT_MODEL_ALIASES = {
+	opus: "anthropic/claude-opus-4-6",
+	sonnet: "anthropic/claude-sonnet-4-6",
+	gpt: "openai/gpt-5.2",
+	"gpt-mini": "openai/gpt-5-mini",
+	gemini: "google/gemini-3-pro-preview",
+	"gemini-flash": "google/gemini-3-flash-preview"
+};
+function resolveAnthropicDefaultAuthMode(cfg) {
+	const profiles = cfg.auth?.profiles ?? {};
+	const anthropicProfiles = Object.entries(profiles).filter(([, profile]) => profile?.provider === "anthropic");
+	const order = cfg.auth?.order?.anthropic ?? [];
+	for (const profileId of order) {
+		const entry = profiles[profileId];
+		if (!entry || entry.provider !== "anthropic") continue;
+		if (entry.mode === "api_key") return "api_key";
+		if (entry.mode === "oauth" || entry.mode === "token") return "oauth";
+	}
+	const hasApiKey = anthropicProfiles.some(([, profile]) => profile?.mode === "api_key");
+	const hasOauth = anthropicProfiles.some(([, profile]) => profile?.mode === "oauth" || profile?.mode === "token");
+	if (hasApiKey && !hasOauth) return "api_key";
+	if (hasOauth && !hasApiKey) return "oauth";
+	if (process.env.ANTHROPIC_OAUTH_TOKEN?.trim()) return "oauth";
+	if (process.env.ANTHROPIC_API_KEY?.trim()) return "api_key";
+	return null;
+}
+function resolvePrimaryModelRef(raw) {
+	if (!raw || typeof raw !== "string") return null;
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	return DEFAULT_MODEL_ALIASES[trimmed.toLowerCase()] ?? trimmed;
+}
+function applyMessageDefaults(cfg) {
+	const messages = cfg.messages;
+	if (messages?.ackReactionScope !== void 0) return cfg;
+	const nextMessages = messages ? { ...messages } : {};
+	nextMessages.ackReactionScope = "group-mentions";
+	return {
+		...cfg,
+		messages: nextMessages
+	};
+}
+function applySessionDefaults(cfg, options = {}) {
+	const session = cfg.session;
+	if (!session || session.mainKey === void 0) return cfg;
+	const trimmed = session.mainKey.trim();
+	const warn = options.warn ?? console.warn;
+	const warnState = options.warnState ?? defaultWarnState;
+	const next = {
+		...cfg,
+		session: {
+			...session,
+			mainKey: "main"
+		}
+	};
+	if (trimmed && trimmed !== "main" && !warnState.warned) {
+		warnState.warned = true;
+		warn("session.mainKey is ignored; main session is always \"main\".");
+	}
+	return next;
+}
+function applyTalkApiKey(config) {
+	const normalized = normalizeTalkConfig(config);
+	const resolved = resolveTalkApiKey();
+	if (!resolved) return normalized;
+	const talk = normalized.talk;
+	const active = resolveActiveTalkProviderConfig(talk);
+	if (active.provider && active.provider !== DEFAULT_TALK_PROVIDER) return normalized;
+	const existingProviderApiKey = typeof active.config?.apiKey === "string" ? active.config.apiKey.trim() : "";
+	const existingLegacyApiKey = typeof talk?.apiKey === "string" ? talk.apiKey.trim() : "";
+	if (existingProviderApiKey || existingLegacyApiKey) return normalized;
+	const providerId = active.provider ?? DEFAULT_TALK_PROVIDER;
+	const providers = { ...talk?.providers };
+	providers[providerId] = {
+		...providers[providerId],
+		apiKey: resolved
+	};
+	const nextTalk = {
+		...talk,
+		provider: talk?.provider ?? providerId,
+		providers,
+		apiKey: resolved
+	};
+	return {
+		...normalized,
+		talk: nextTalk
+	};
+}
+function applyTalkConfigNormalization(config) {
+	return normalizeTalkConfig(config);
+}
+function applyModelDefaults(cfg) {
+	const existingAgent = cfg.agents?.defaults;
+	if (!existingAgent) return cfg;
+	const existingModels = existingAgent.models ?? {};
+	if (Object.keys(existingModels).length === 0) return cfg;
+	const nextModels = { ...existingModels };
+	let mutated = false;
+	for (const [alias, target] of Object.entries(DEFAULT_MODEL_ALIASES)) {
+		const entry = nextModels[target];
+		if (!entry) continue;
+		if (entry.alias !== void 0) continue;
+		nextModels[target] = {
+			...entry,
+			alias
+		};
+		mutated = true;
+	}
+	if (!mutated) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: {
+				...existingAgent,
+				models: nextModels
+			}
+		}
+	};
+}
+function applyAgentDefaults(cfg) {
+	const agents = cfg.agents;
+	const defaults = agents?.defaults;
+	const hasMax = typeof defaults?.maxConcurrent === "number" && Number.isFinite(defaults.maxConcurrent);
+	const hasSubMax = typeof defaults?.subagents?.maxConcurrent === "number" && Number.isFinite(defaults.subagents.maxConcurrent);
+	if (hasMax && hasSubMax) return cfg;
+	let mutated = false;
+	const nextDefaults = defaults ? { ...defaults } : {};
+	if (!hasMax) {
+		nextDefaults.maxConcurrent = DEFAULT_AGENT_MAX_CONCURRENT;
+		mutated = true;
+	}
+	const nextSubagents = defaults?.subagents ? { ...defaults.subagents } : {};
+	if (!hasSubMax) {
+		nextSubagents.maxConcurrent = DEFAULT_SUBAGENT_MAX_CONCURRENT;
+		mutated = true;
+	}
+	if (!mutated) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...agents,
+			defaults: {
+				...nextDefaults,
+				subagents: nextSubagents
+			}
+		}
+	};
+}
+function applyLoggingDefaults(cfg) {
+	const logging = cfg.logging;
+	if (!logging) return cfg;
+	if (logging.redactSensitive) return cfg;
+	return {
+		...cfg,
+		logging: {
+			...logging,
+			redactSensitive: "tools"
+		}
+	};
+}
+function applyContextPruningDefaults(cfg) {
+	const defaults = cfg.agents?.defaults;
+	if (!defaults) return cfg;
+	const authMode = resolveAnthropicDefaultAuthMode(cfg);
+	if (!authMode) return cfg;
+	let mutated = false;
+	const nextDefaults = { ...defaults };
+	const contextPruning = defaults.contextPruning ?? {};
+	const heartbeat = defaults.heartbeat ?? {};
+	if (defaults.contextPruning?.mode === void 0) {
+		nextDefaults.contextPruning = {
+			...contextPruning,
+			mode: "cache-ttl",
+			ttl: defaults.contextPruning?.ttl ?? "1h"
+		};
+		mutated = true;
+	}
+	if (defaults.heartbeat?.every === void 0) {
+		nextDefaults.heartbeat = {
+			...heartbeat,
+			every: authMode === "oauth" ? "1h" : "30m"
+		};
+		mutated = true;
+	}
+	if (authMode === "api_key") {
+		const nextModels = defaults.models ? { ...defaults.models } : {};
+		let modelsMutated = false;
+		const isAnthropicCacheRetentionTarget = (parsed) => Boolean(parsed && (parsed.provider === "anthropic" || parsed.provider === "amazon-bedrock" && parsed.model.toLowerCase().includes("anthropic.claude")));
+		for (const [key, entry] of Object.entries(nextModels)) {
+			if (!isAnthropicCacheRetentionTarget(parseModelRef(key, "anthropic"))) continue;
+			const current = entry ?? {};
+			const params = current.params ?? {};
+			if (typeof params.cacheRetention === "string") continue;
+			nextModels[key] = {
+				...current,
+				params: {
+					...params,
+					cacheRetention: "short"
+				}
+			};
+			modelsMutated = true;
+		}
+		const rawModel = defaults.model;
+		const rawPrimary = typeof rawModel === "string" ? rawModel : rawModel?.primary;
+		const primary = resolvePrimaryModelRef(typeof rawPrimary === "string" ? rawPrimary : void 0);
+		if (primary) {
+			const parsedPrimary = parseModelRef(primary, "anthropic");
+			if (isAnthropicCacheRetentionTarget(parsedPrimary)) {
+				const key = `${parsedPrimary.provider}/${parsedPrimary.model}`;
+				const current = nextModels[key] ?? {};
+				const params = current.params ?? {};
+				if (typeof params.cacheRetention !== "string") {
+					nextModels[key] = {
+						...current,
+						params: {
+							...params,
+							cacheRetention: "short"
+						}
+					};
+					modelsMutated = true;
+				}
+			}
+		}
+		if (modelsMutated) {
+			nextDefaults.models = nextModels;
+			mutated = true;
+		}
+	}
+	if (!mutated) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: nextDefaults
+		}
+	};
+}
+
+//#endregion
+//#region src/config/env-preserve.ts
+/**
+* Preserves `${VAR}` environment variable references during config write-back.
+*
+* When config is read, `${VAR}` references are resolved to their values.
+* When writing back, callers pass the resolved config. This module detects
+* values that match what a `${VAR}` reference would resolve to and restores
+* the original reference, so env var references survive config round-trips.
+*
+* A value is restored only if:
+* 1. The pre-substitution value contained a `${VAR}` pattern
+* 2. Resolving that pattern with current env vars produces the incoming value
+*
+* If a caller intentionally set a new value (different from what the env var
+* resolves to), the new value is kept as-is.
+*/
+const ENV_VAR_PATTERN = /\$\{[A-Z_][A-Z0-9_]*\}/;
+/**
+* Check if a string contains any `${VAR}` env var references.
+*/
+function hasEnvVarRef(value) {
+	return ENV_VAR_PATTERN.test(value);
+}
+/**
+* Resolve `${VAR}` references in a single string using the given env.
+* Returns null if any referenced var is missing (instead of throwing).
+*
+* Mirrors the substitution semantics of `substituteString` in env-substitution.ts:
+* - `${VAR}` → env value (returns null if missing)
+* - `$${VAR}` → literal `${VAR}` (escape sequence)
+*/
+function tryResolveString(template, env) {
+	const ENV_VAR_NAME = /^[A-Z_][A-Z0-9_]*$/;
+	const chunks = [];
+	for (let i = 0; i < template.length; i++) {
+		if (template[i] === "$") {
+			if (template[i + 1] === "$" && template[i + 2] === "{") {
+				const start = i + 3;
+				const end = template.indexOf("}", start);
+				if (end !== -1) {
+					const name = template.slice(start, end);
+					if (ENV_VAR_NAME.test(name)) {
+						chunks.push(`\${${name}}`);
+						i = end;
+						continue;
+					}
+				}
+			}
+			if (template[i + 1] === "{") {
+				const start = i + 2;
+				const end = template.indexOf("}", start);
+				if (end !== -1) {
+					const name = template.slice(start, end);
+					if (ENV_VAR_NAME.test(name)) {
+						const val = env[name];
+						if (val === void 0 || val === "") return null;
+						chunks.push(val);
+						i = end;
+						continue;
+					}
+				}
+			}
+		}
+		chunks.push(template[i]);
+	}
+	return chunks.join("");
+}
+/**
+* Deep-walk the incoming config and restore `${VAR}` references from the
+* pre-substitution parsed config wherever the resolved value matches.
+*
+* @param incoming - The resolved config about to be written
+* @param parsed - The pre-substitution parsed config (from the current file on disk)
+* @param env - Environment variables for verification
+* @returns A new config object with env var references restored where appropriate
+*/
+function restoreEnvVarRefs(incoming, parsed, env = process.env) {
+	if (parsed === null || parsed === void 0) return incoming;
+	if (typeof incoming === "string" && typeof parsed === "string") {
+		if (hasEnvVarRef(parsed)) {
+			if (tryResolveString(parsed, env) === incoming) return parsed;
+		}
+		return incoming;
+	}
+	if (Array.isArray(incoming) && Array.isArray(parsed)) return incoming.map((item, i) => i < parsed.length ? restoreEnvVarRefs(item, parsed[i], env) : item);
+	if (isPlainObject$2(incoming) && isPlainObject$2(parsed)) {
+		const result = {};
+		for (const [key, value] of Object.entries(incoming)) if (key in parsed) result[key] = restoreEnvVarRefs(value, parsed[key], env);
+		else result[key] = value;
+		return result;
+	}
+	return incoming;
+}
+
+//#endregion
+//#region src/config/env-substitution.ts
+/**
+* Environment variable substitution for config values.
+*
+* Supports `${VAR_NAME}` syntax in string values, substituted at config load time.
+* - Only uppercase env vars are matched: `[A-Z_][A-Z0-9_]*`
+* - Escape with `$${}` to output literal `${}`
+* - Missing env vars throw `MissingEnvVarError` with context
+*
+* @example
+* ```json5
+* {
+*   models: {
+*     providers: {
+*       "vercel-gateway": {
+*         apiKey: "${VERCEL_GATEWAY_API_KEY}"
+*       }
+*     }
+*   }
+* }
+* ```
+*/
+const ENV_VAR_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+var MissingEnvVarError = class extends Error {
+	constructor(varName, configPath) {
+		super(`Missing env var "${varName}" referenced at config path: ${configPath}`);
+		this.varName = varName;
+		this.configPath = configPath;
+		this.name = "MissingEnvVarError";
+	}
+};
+function parseEnvTokenAt(value, index) {
+	if (value[index] !== "$") return null;
+	const next = value[index + 1];
+	const afterNext = value[index + 2];
+	if (next === "$" && afterNext === "{") {
+		const start = index + 3;
+		const end = value.indexOf("}", start);
+		if (end !== -1) {
+			const name = value.slice(start, end);
+			if (ENV_VAR_NAME_PATTERN.test(name)) return {
+				kind: "escaped",
+				name,
+				end
+			};
+		}
+	}
+	if (next === "{") {
+		const start = index + 2;
+		const end = value.indexOf("}", start);
+		if (end !== -1) {
+			const name = value.slice(start, end);
+			if (ENV_VAR_NAME_PATTERN.test(name)) return {
+				kind: "substitution",
+				name,
+				end
+			};
+		}
+	}
+	return null;
+}
+function substituteString(value, env, configPath) {
+	if (!value.includes("$")) return value;
+	const chunks = [];
+	for (let i = 0; i < value.length; i += 1) {
+		const char = value[i];
+		if (char !== "$") {
+			chunks.push(char);
+			continue;
+		}
+		const token = parseEnvTokenAt(value, i);
+		if (token?.kind === "escaped") {
+			chunks.push(`\${${token.name}}`);
+			i = token.end;
+			continue;
+		}
+		if (token?.kind === "substitution") {
+			const envValue = env[token.name];
+			if (envValue === void 0 || envValue === "") throw new MissingEnvVarError(token.name, configPath);
+			chunks.push(envValue);
+			i = token.end;
+			continue;
+		}
+		chunks.push(char);
+	}
+	return chunks.join("");
+}
+function containsEnvVarReference(value) {
+	if (!value.includes("$")) return false;
+	for (let i = 0; i < value.length; i += 1) {
+		if (value[i] !== "$") continue;
+		const token = parseEnvTokenAt(value, i);
+		if (token?.kind === "escaped") {
+			i = token.end;
+			continue;
+		}
+		if (token?.kind === "substitution") return true;
+	}
+	return false;
+}
+function substituteAny(value, env, path) {
+	if (typeof value === "string") return substituteString(value, env, path);
+	if (Array.isArray(value)) return value.map((item, index) => substituteAny(item, env, `${path}[${index}]`));
+	if (isPlainObject$2(value)) {
+		const result = {};
+		for (const [key, val] of Object.entries(value)) result[key] = substituteAny(val, env, path ? `${path}.${key}` : key);
+		return result;
+	}
+	return value;
+}
+/**
+* Resolves `${VAR_NAME}` environment variable references in config values.
+*
+* @param obj - The parsed config object (after JSON5 parse and $include resolution)
+* @param env - Environment variables to use for substitution (defaults to process.env)
+* @returns The config object with env vars substituted
+* @throws {MissingEnvVarError} If a referenced env var is not set or empty
+*/
+function resolveConfigEnvVars(obj, env = process.env) {
+	return substituteAny(obj, env, "");
+}
+
+//#endregion
+//#region src/security/scan-paths.ts
+function isPathInside$1(basePath, candidatePath) {
+	const base = path.resolve(basePath);
+	const candidate = path.resolve(candidatePath);
+	const rel = path.relative(base, candidate);
+	return rel === "" || !rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel);
+}
+function safeRealpathSync$1(filePath) {
+	try {
+		return fs.realpathSync(filePath);
+	} catch {
+		return null;
+	}
+}
+function isPathInsideWithRealpath(basePath, candidatePath, opts) {
+	if (!isPathInside$1(basePath, candidatePath)) return false;
+	const baseReal = safeRealpathSync$1(basePath);
+	const candidateReal = safeRealpathSync$1(candidatePath);
+	if (!baseReal || !candidateReal) return opts?.requireRealpath !== true;
+	return isPathInside$1(baseReal, candidateReal);
+}
+function extensionUsesSkippedScannerPath(entry) {
+	return entry.split(/[\\/]+/).filter(Boolean).some((segment) => segment === "node_modules" || segment.startsWith(".") && segment !== "." && segment !== "..");
+}
+
+//#endregion
+//#region src/config/includes.ts
+/**
+* Config includes: $include directive for modular configs
+*
+* @example
+* ```json5
+* {
+*   "$include": "./base.json5",           // single file
+*   "$include": ["./a.json5", "./b.json5"] // merge multiple
+* }
+* ```
+*/
+const INCLUDE_KEY = "$include";
+const MAX_INCLUDE_DEPTH = 10;
+var ConfigIncludeError = class extends Error {
+	constructor(message, includePath, cause) {
+		super(message);
+		this.includePath = includePath;
+		this.cause = cause;
+		this.name = "ConfigIncludeError";
+	}
+};
+var CircularIncludeError = class extends ConfigIncludeError {
+	constructor(chain) {
+		super(`Circular include detected: ${chain.join(" -> ")}`, chain[chain.length - 1]);
+		this.chain = chain;
+		this.name = "CircularIncludeError";
+	}
+};
+/** Deep merge: arrays concatenate, objects merge recursively, primitives: source wins */
+function deepMerge(target, source) {
+	if (Array.isArray(target) && Array.isArray(source)) return [...target, ...source];
+	if (isPlainObject$2(target) && isPlainObject$2(source)) {
+		const result = { ...target };
+		for (const key of Object.keys(source)) {
+			if (isBlockedObjectKey(key)) continue;
+			result[key] = key in result ? deepMerge(result[key], source[key]) : source[key];
+		}
+		return result;
+	}
+	return source;
+}
+var IncludeProcessor = class IncludeProcessor {
+	constructor(basePath, resolver, rootDir) {
+		this.basePath = basePath;
+		this.resolver = resolver;
+		this.visited = /* @__PURE__ */ new Set();
+		this.depth = 0;
+		this.visited.add(path.normalize(basePath));
+		this.rootDir = path.normalize(rootDir ?? path.dirname(basePath));
+		this.rootRealDir = path.normalize(safeRealpath(this.rootDir));
+	}
+	process(obj) {
+		if (Array.isArray(obj)) return obj.map((item) => this.process(item));
+		if (!isPlainObject$2(obj)) return obj;
+		if (!(INCLUDE_KEY in obj)) return this.processObject(obj);
+		return this.processInclude(obj);
+	}
+	processObject(obj) {
+		const result = {};
+		for (const [key, value] of Object.entries(obj)) result[key] = this.process(value);
+		return result;
+	}
+	processInclude(obj) {
+		const includeValue = obj[INCLUDE_KEY];
+		const otherKeys = Object.keys(obj).filter((k) => k !== INCLUDE_KEY);
+		const included = this.resolveInclude(includeValue);
+		if (otherKeys.length === 0) return included;
+		if (!isPlainObject$2(included)) throw new ConfigIncludeError("Sibling keys require included content to be an object", typeof includeValue === "string" ? includeValue : INCLUDE_KEY);
+		const rest = {};
+		for (const key of otherKeys) rest[key] = this.process(obj[key]);
+		return deepMerge(included, rest);
+	}
+	resolveInclude(value) {
+		if (typeof value === "string") return this.loadFile(value);
+		if (Array.isArray(value)) return value.reduce((merged, item) => {
+			if (typeof item !== "string") throw new ConfigIncludeError(`Invalid $include array item: expected string, got ${typeof item}`, String(item));
+			return deepMerge(merged, this.loadFile(item));
+		}, {});
+		throw new ConfigIncludeError(`Invalid $include value: expected string or array of strings, got ${typeof value}`, String(value));
+	}
+	loadFile(includePath) {
+		const resolvedPath = this.resolvePath(includePath);
+		this.checkCircular(resolvedPath);
+		this.checkDepth(includePath);
+		const raw = this.readFile(includePath, resolvedPath);
+		const parsed = this.parseFile(includePath, resolvedPath, raw);
+		return this.processNested(resolvedPath, parsed);
+	}
+	resolvePath(includePath) {
+		const configDir = path.dirname(this.basePath);
+		const resolved = path.isAbsolute(includePath) ? includePath : path.resolve(configDir, includePath);
+		const normalized = path.normalize(resolved);
+		if (!isPathInside$1(this.rootDir, normalized)) throw new ConfigIncludeError(`Include path escapes config directory: ${includePath} (root: ${this.rootDir})`, includePath);
+		try {
+			const real = fs.realpathSync(normalized);
+			if (!isPathInside$1(this.rootRealDir, real)) throw new ConfigIncludeError(`Include path resolves outside config directory (symlink): ${includePath} (root: ${this.rootDir})`, includePath);
+		} catch (err) {
+			if (err instanceof ConfigIncludeError) throw err;
+		}
+		return normalized;
+	}
+	checkCircular(resolvedPath) {
+		if (this.visited.has(resolvedPath)) throw new CircularIncludeError([...this.visited, resolvedPath]);
+	}
+	checkDepth(includePath) {
+		if (this.depth >= MAX_INCLUDE_DEPTH) throw new ConfigIncludeError(`Maximum include depth (${MAX_INCLUDE_DEPTH}) exceeded at: ${includePath}`, includePath);
+	}
+	readFile(includePath, resolvedPath) {
+		try {
+			return this.resolver.readFile(resolvedPath);
+		} catch (err) {
+			throw new ConfigIncludeError(`Failed to read include file: ${includePath} (resolved: ${resolvedPath})`, includePath, err instanceof Error ? err : void 0);
+		}
+	}
+	parseFile(includePath, resolvedPath, raw) {
+		try {
+			return this.resolver.parseJson(raw);
+		} catch (err) {
+			throw new ConfigIncludeError(`Failed to parse include file: ${includePath} (resolved: ${resolvedPath})`, includePath, err instanceof Error ? err : void 0);
+		}
+	}
+	processNested(resolvedPath, parsed) {
+		const nested = new IncludeProcessor(resolvedPath, this.resolver, this.rootDir);
+		nested.visited = new Set([...this.visited, resolvedPath]);
+		nested.depth = this.depth + 1;
+		return nested.process(parsed);
+	}
+};
+function safeRealpath(target) {
+	try {
+		return fs.realpathSync(target);
+	} catch {
+		return target;
+	}
+}
+const defaultResolver = {
+	readFile: (p) => fs.readFileSync(p, "utf-8"),
+	parseJson: (raw) => JSON5.parse(raw)
+};
+/**
+* Resolves all $include directives in a parsed config object.
+*/
+function resolveConfigIncludes(obj, configPath, resolver = defaultResolver) {
+	return new IncludeProcessor(configPath, resolver).process(obj);
+}
+
+//#endregion
+//#region src/config/legacy.migrations.ts
+const LEGACY_CONFIG_MIGRATIONS = [];
+
+//#endregion
+//#region src/config/legacy.rules.ts
+const LEGACY_CONFIG_RULES = [];
+
+//#endregion
+//#region src/config/legacy.ts
+function findLegacyConfigIssues(raw) {
+	if (!raw || typeof raw !== "object") return [];
+	const root = raw;
+	const issues = [];
+	for (const rule of LEGACY_CONFIG_RULES) {
+		let cursor = root;
+		for (const key of rule.path) {
+			if (!cursor || typeof cursor !== "object") {
+				cursor = void 0;
+				break;
+			}
+			cursor = cursor[key];
+		}
+		if (cursor !== void 0 && (!rule.match || rule.match(cursor, root))) issues.push({
+			path: rule.path.join("."),
+			message: rule.message
+		});
+	}
+	return issues;
+}
+function applyLegacyMigrations(raw) {
+	if (!raw || typeof raw !== "object") return {
+		next: null,
+		changes: []
+	};
+	const next = structuredClone(raw);
+	const changes = [];
+	for (const migration of LEGACY_CONFIG_MIGRATIONS) migration.apply(next, changes);
+	if (changes.length === 0) return {
+		next: null,
+		changes: []
+	};
+	return {
+		next,
+		changes
+	};
+}
+
+//#endregion
+//#region src/config/merge-patch.ts
+function isObjectWithStringId(value) {
+	if (!isPlainObject$2(value)) return false;
+	return typeof value.id === "string" && value.id.length > 0;
+}
+/**
+* Merge arrays of object-like entries keyed by `id`.
+*
+* Contract:
+* - Base array must be fully id-keyed; otherwise return undefined (caller should replace).
+* - Patch entries with valid id merge by id (or append when the id is new).
+* - Patch entries without valid id append as-is, avoiding destructive full-array replacement.
+*/
+function mergeObjectArraysById(base, patch, options) {
+	if (!base.every(isObjectWithStringId)) return;
+	const merged = [...base];
+	const indexById = /* @__PURE__ */ new Map();
+	for (const [index, entry] of merged.entries()) {
+		if (!isObjectWithStringId(entry)) return;
+		indexById.set(entry.id, index);
+	}
+	for (const patchEntry of patch) {
+		if (!isObjectWithStringId(patchEntry)) {
+			merged.push(structuredClone(patchEntry));
+			continue;
+		}
+		const existingIndex = indexById.get(patchEntry.id);
+		if (existingIndex === void 0) {
+			merged.push(structuredClone(patchEntry));
+			indexById.set(patchEntry.id, merged.length - 1);
+			continue;
+		}
+		merged[existingIndex] = applyMergePatch(merged[existingIndex], patchEntry, options);
+	}
+	return merged;
+}
+function applyMergePatch(base, patch, options = {}) {
+	if (!isPlainObject$2(patch)) return patch;
+	const result = isPlainObject$2(base) ? { ...base } : {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (isBlockedObjectKey(key)) continue;
+		if (value === null) {
+			delete result[key];
+			continue;
+		}
+		if (options.mergeObjectArraysById && Array.isArray(result[key]) && Array.isArray(value)) {
+			const mergedArray = mergeObjectArraysById(result[key], value, options);
+			if (mergedArray) {
+				result[key] = mergedArray;
+				continue;
+			}
+		}
+		if (isPlainObject$2(value)) {
+			const baseValue = result[key];
+			result[key] = applyMergePatch(isPlainObject$2(baseValue) ? baseValue : {}, value, options);
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
+
+//#endregion
+//#region src/config/normalize-paths.ts
+const PATH_VALUE_RE = /^~(?=$|[\\/])/;
+const PATH_KEY_RE = /(dir|path|paths|file|root|workspace)$/i;
+const PATH_LIST_KEYS = new Set(["paths", "pathPrepend"]);
+function normalizeStringValue(key, value) {
+	if (!PATH_VALUE_RE.test(value.trim())) return value;
+	if (!key) return value;
+	if (PATH_KEY_RE.test(key) || PATH_LIST_KEYS.has(key)) return resolveUserPath(value);
+	return value;
+}
+function normalizeAny(key, value) {
+	if (typeof value === "string") return normalizeStringValue(key, value);
+	if (Array.isArray(value)) {
+		const normalizeChildren = Boolean(key && PATH_LIST_KEYS.has(key));
+		return value.map((entry) => {
+			if (typeof entry === "string") return normalizeChildren ? normalizeStringValue(key, entry) : entry;
+			if (Array.isArray(entry)) return normalizeAny(void 0, entry);
+			if (isPlainObject$2(entry)) return normalizeAny(void 0, entry);
+			return entry;
+		});
+	}
+	if (!isPlainObject$2(value)) return value;
+	for (const [childKey, childValue] of Object.entries(value)) {
+		const next = normalizeAny(childKey, childValue);
+		if (next !== childValue) value[childKey] = next;
+	}
+	return value;
+}
+/**
+* Normalize "~" paths in path-ish config fields.
+*
+* Goal: accept `~/...` consistently across config file + env overrides, while
+* keeping the surface area small and predictable.
+*/
+function normalizeConfigPaths(cfg) {
+	if (!cfg || typeof cfg !== "object") return cfg;
+	normalizeAny(void 0, cfg);
+	return cfg;
+}
+
+//#endregion
+//#region src/config/config-paths.ts
+function parseConfigPath(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return {
+		ok: false,
+		error: "Invalid path. Use dot notation (e.g. foo.bar)."
+	};
+	const parts = trimmed.split(".").map((part) => part.trim());
+	if (parts.some((part) => !part)) return {
+		ok: false,
+		error: "Invalid path. Use dot notation (e.g. foo.bar)."
+	};
+	if (parts.some((part) => isBlockedObjectKey(part))) return {
+		ok: false,
+		error: "Invalid path segment."
+	};
+	return {
+		ok: true,
+		path: parts
+	};
+}
+function setConfigValueAtPath(root, path, value) {
+	let cursor = root;
+	for (let idx = 0; idx < path.length - 1; idx += 1) {
+		const key = path[idx];
+		const next = cursor[key];
+		if (!isPlainObject$2(next)) cursor[key] = {};
+		cursor = cursor[key];
+	}
+	cursor[path[path.length - 1]] = value;
+}
+function unsetConfigValueAtPath(root, path) {
+	const stack = [];
+	let cursor = root;
+	for (let idx = 0; idx < path.length - 1; idx += 1) {
+		const key = path[idx];
+		const next = cursor[key];
+		if (!isPlainObject$2(next)) return false;
+		stack.push({
+			node: cursor,
+			key
+		});
+		cursor = next;
+	}
+	const leafKey = path[path.length - 1];
+	if (!(leafKey in cursor)) return false;
+	delete cursor[leafKey];
+	for (let idx = stack.length - 1; idx >= 0; idx -= 1) {
+		const { node, key } = stack[idx];
+		const child = node[key];
+		if (isPlainObject$2(child) && Object.keys(child).length === 0) delete node[key];
+		else break;
+	}
+	return true;
+}
+function getConfigValueAtPath(root, path) {
+	let cursor = root;
+	for (const key of path) {
+		if (!isPlainObject$2(cursor)) return;
+		cursor = cursor[key];
+	}
+	return cursor;
+}
+
+//#endregion
+//#region src/config/runtime-overrides.ts
+let overrides = {};
+function sanitizeOverrideValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (Array.isArray(value)) return value.map((entry) => sanitizeOverrideValue(entry, seen));
+	if (!isPlainObject$2(value)) return value;
+	if (seen.has(value)) return {};
+	seen.add(value);
+	const sanitized = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (entry === void 0 || isBlockedObjectKey(key)) continue;
+		sanitized[key] = sanitizeOverrideValue(entry, seen);
+	}
+	seen.delete(value);
+	return sanitized;
+}
+function mergeOverrides(base, override) {
+	if (!isPlainObject$2(base) || !isPlainObject$2(override)) return override;
+	const next = { ...base };
+	for (const [key, value] of Object.entries(override)) {
+		if (value === void 0 || isBlockedObjectKey(key)) continue;
+		next[key] = mergeOverrides(base[key], value);
+	}
+	return next;
+}
+function getConfigOverrides() {
+	return overrides;
+}
+function resetConfigOverrides() {
+	overrides = {};
+}
+function setConfigOverride(pathRaw, value) {
+	const parsed = parseConfigPath(pathRaw);
+	if (!parsed.ok || !parsed.path) return {
+		ok: false,
+		error: parsed.error ?? "Invalid path."
+	};
+	setConfigValueAtPath(overrides, parsed.path, sanitizeOverrideValue(value));
+	return { ok: true };
+}
+function unsetConfigOverride(pathRaw) {
+	const parsed = parseConfigPath(pathRaw);
+	if (!parsed.ok || !parsed.path) return {
+		ok: false,
+		removed: false,
+		error: parsed.error ?? "Invalid path."
+	};
+	return {
+		ok: true,
+		removed: unsetConfigValueAtPath(overrides, parsed.path)
+	};
+}
+function applyConfigOverrides(cfg) {
+	if (!overrides || Object.keys(overrides).length === 0) return cfg;
+	return mergeOverrides(cfg, overrides);
+}
+
+//#endregion
+//#region src/plugins/config-state.ts
+const BUNDLED_ENABLED_BY_DEFAULT = new Set([
+	"device-pair",
+	"phone-control",
+	"talk-voice"
+]);
+const normalizeList = (value) => {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+};
+const normalizePluginEntries = (entries) => {
+	if (!entries || typeof entries !== "object" || Array.isArray(entries)) return {};
+	const normalized = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (!key.trim()) continue;
+		if (!value || typeof value !== "object" || Array.isArray(value)) {
+			normalized[key] = {};
+			continue;
+		}
+		const entry = value;
+		normalized[key] = {
+			enabled: typeof entry.enabled === "boolean" ? entry.enabled : void 0,
+			config: "config" in entry ? entry.config : void 0
+		};
+	}
+	return normalized;
+};
+const normalizePluginsConfig = (config) => {
+	return {
+		enabled: config?.enabled !== false,
+		allow: normalizeList(config?.allow),
+		deny: normalizeList(config?.deny),
+		loadPaths: normalizeList(config?.load?.paths),
+		slots: {},
+		entries: normalizePluginEntries(config?.entries)
+	};
+};
+const hasExplicitPluginConfig = (plugins) => {
+	if (!plugins) return false;
+	if (typeof plugins.enabled === "boolean") return true;
+	if (Array.isArray(plugins.allow) && plugins.allow.length > 0) return true;
+	if (Array.isArray(plugins.deny) && plugins.deny.length > 0) return true;
+	if (plugins.load?.paths && Array.isArray(plugins.load.paths) && plugins.load.paths.length > 0) return true;
+	if (plugins.slots && Object.keys(plugins.slots).length > 0) return true;
+	if (plugins.entries && Object.keys(plugins.entries).length > 0) return true;
+	return false;
+};
+function applyTestPluginDefaults(cfg, env = process.env) {
+	if (!env.VITEST) return cfg;
+	const plugins = cfg.plugins;
+	if (hasExplicitPluginConfig(plugins)) return cfg;
+	return {
+		...cfg,
+		plugins: {
+			...plugins,
+			enabled: false
+		}
+	};
+}
+function resolveEnableState(id, origin, config) {
+	if (!config.enabled) return {
+		enabled: false,
+		reason: "plugins disabled"
+	};
+	if (config.deny.includes(id)) return {
+		enabled: false,
+		reason: "blocked by denylist"
+	};
+	if (config.allow.length > 0 && !config.allow.includes(id)) return {
+		enabled: false,
+		reason: "not in allowlist"
+	};
+	const entry = config.entries[id];
+	if (entry?.enabled === true) return { enabled: true };
+	if (entry?.enabled === false) return {
+		enabled: false,
+		reason: "disabled in config"
+	};
+	if (origin === "bundled" && BUNDLED_ENABLED_BY_DEFAULT.has(id)) return { enabled: true };
+	if (origin === "bundled") return {
+		enabled: false,
+		reason: "bundled (disabled by default)"
+	};
+	return { enabled: true };
+}
+function isBundledChannelEnabledByChannelConfig(cfg, pluginId) {
+	if (!cfg) return false;
+	const channelId = normalizeChatChannelId(pluginId);
+	if (!channelId) return false;
+	const entry = cfg.channels?.[channelId];
+	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+	return entry.enabled === true;
+}
+function resolveEffectiveEnableState(params) {
+	const base = resolveEnableState(params.id, params.origin, params.config);
+	if (!base.enabled && base.reason === "bundled (disabled by default)" && isBundledChannelEnabledByChannelConfig(params.rootConfig, params.id)) return { enabled: true };
+	return base;
+}
+
+//#endregion
+//#region src/plugins/bundled-dir.ts
+function resolveBundledPluginsDir() {
+	const override = process.env.REMOTECLAW_BUNDLED_PLUGINS_DIR?.trim();
+	if (override) return override;
+	try {
+		const execDir = path.dirname(process.execPath);
+		const sibling = path.join(execDir, "extensions");
+		if (fs.existsSync(sibling)) return sibling;
+	} catch {}
+	try {
+		let cursor = path.dirname(fileURLToPath(import.meta.url));
+		for (let i = 0; i < 6; i += 1) {
+			const candidate = path.join(cursor, "extensions");
+			if (fs.existsSync(candidate)) return candidate;
+			const parent = path.dirname(cursor);
+			if (parent === cursor) break;
+			cursor = parent;
+		}
+	} catch {}
+}
+
+//#endregion
+//#region src/plugins/manifest.ts
+const MANIFEST_KEY = "remoteclaw";
+const PLUGIN_MANIFEST_FILENAME = "remoteclaw.plugin.json";
+function normalizeStringList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+}
+function resolvePluginManifestPath(rootDir) {
+	return path.join(rootDir, PLUGIN_MANIFEST_FILENAME);
+}
+function loadPluginManifest(rootDir) {
+	const manifestPath = resolvePluginManifestPath(rootDir);
+	if (!fs.existsSync(manifestPath)) return {
+		ok: false,
+		error: `plugin manifest not found: ${manifestPath}`,
+		manifestPath
+	};
+	let raw;
+	try {
+		raw = JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+	} catch (err) {
+		return {
+			ok: false,
+			error: `failed to parse plugin manifest: ${String(err)}`,
+			manifestPath
+		};
+	}
+	if (!isRecord(raw)) return {
+		ok: false,
+		error: "plugin manifest must be an object",
+		manifestPath
+	};
+	const id = typeof raw.id === "string" ? raw.id.trim() : "";
+	if (!id) return {
+		ok: false,
+		error: "plugin manifest requires id",
+		manifestPath
+	};
+	const configSchema = isRecord(raw.configSchema) ? raw.configSchema : null;
+	if (!configSchema) return {
+		ok: false,
+		error: "plugin manifest requires configSchema",
+		manifestPath
+	};
+	const kind = typeof raw.kind === "string" ? raw.kind : void 0;
+	const name = typeof raw.name === "string" ? raw.name.trim() : void 0;
+	const description = typeof raw.description === "string" ? raw.description.trim() : void 0;
+	const version = typeof raw.version === "string" ? raw.version.trim() : void 0;
+	const channels = normalizeStringList(raw.channels);
+	const providers = normalizeStringList(raw.providers);
+	const skills = normalizeStringList(raw.skills);
+	const stt = normalizeStringList(raw.stt);
+	const tts = normalizeStringList(raw.tts);
+	let uiHints;
+	if (isRecord(raw.uiHints)) uiHints = raw.uiHints;
+	return {
+		ok: true,
+		manifest: {
+			id,
+			configSchema,
+			kind,
+			channels,
+			providers,
+			skills,
+			stt,
+			tts,
+			name,
+			description,
+			version,
+			uiHints
+		},
+		manifestPath
+	};
+}
+function getPackageManifestMetadata(manifest) {
+	if (!manifest) return;
+	return manifest[MANIFEST_KEY];
+}
+
+//#endregion
+//#region src/plugins/path-safety.ts
+function isPathInside(baseDir, targetPath) {
+	const rel = path.relative(baseDir, targetPath);
+	if (!rel) return true;
+	return !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function safeRealpathSync(targetPath, cache) {
+	const cached = cache?.get(targetPath);
+	if (cached) return cached;
+	try {
+		const resolved = fs.realpathSync(targetPath);
+		cache?.set(targetPath, resolved);
+		return resolved;
+	} catch {
+		return null;
+	}
+}
+function safeStatSync(targetPath) {
+	try {
+		return fs.statSync(targetPath);
+	} catch {
+		return null;
+	}
+}
+function formatPosixMode(mode) {
+	return (mode & 511).toString(8).padStart(3, "0");
+}
+
+//#endregion
+//#region src/plugins/discovery.ts
+const EXTENSION_EXTS = new Set([
+	".ts",
+	".js",
+	".mts",
+	".cts",
+	".mjs",
+	".cjs"
+]);
+function currentUid(overrideUid) {
+	if (overrideUid !== void 0) return overrideUid;
+	if (process.platform === "win32") return null;
+	if (typeof process.getuid !== "function") return null;
+	return process.getuid();
+}
+function checkSourceEscapesRoot(params) {
+	const sourceRealPath = safeRealpathSync(params.source);
+	const rootRealPath = safeRealpathSync(params.rootDir);
+	if (!sourceRealPath || !rootRealPath) return null;
+	if (isPathInside(rootRealPath, sourceRealPath)) return null;
+	return {
+		reason: "source_escapes_root",
+		sourcePath: params.source,
+		rootPath: params.rootDir,
+		targetPath: params.source,
+		sourceRealPath,
+		rootRealPath
+	};
+}
+function checkPathStatAndPermissions(params) {
+	if (process.platform === "win32") return null;
+	const pathsToCheck = [params.rootDir, params.source];
+	const seen = /* @__PURE__ */ new Set();
+	for (const targetPath of pathsToCheck) {
+		const normalized = path.resolve(targetPath);
+		if (seen.has(normalized)) continue;
+		seen.add(normalized);
+		const stat = safeStatSync(targetPath);
+		if (!stat) return {
+			reason: "path_stat_failed",
+			sourcePath: params.source,
+			rootPath: params.rootDir,
+			targetPath
+		};
+		const modeBits = stat.mode & 511;
+		if ((modeBits & 2) !== 0) return {
+			reason: "path_world_writable",
+			sourcePath: params.source,
+			rootPath: params.rootDir,
+			targetPath,
+			modeBits
+		};
+		if (params.origin !== "bundled" && params.uid !== null && typeof stat.uid === "number" && stat.uid !== params.uid && stat.uid !== 0) return {
+			reason: "path_suspicious_ownership",
+			sourcePath: params.source,
+			rootPath: params.rootDir,
+			targetPath,
+			foundUid: stat.uid,
+			expectedUid: params.uid
+		};
+	}
+	return null;
+}
+function findCandidateBlockIssue(params) {
+	const escaped = checkSourceEscapesRoot({
+		source: params.source,
+		rootDir: params.rootDir
+	});
+	if (escaped) return escaped;
+	return checkPathStatAndPermissions({
+		source: params.source,
+		rootDir: params.rootDir,
+		origin: params.origin,
+		uid: currentUid(params.ownershipUid)
+	});
+}
+function formatCandidateBlockMessage(issue) {
+	if (issue.reason === "source_escapes_root") return `blocked plugin candidate: source escapes plugin root (${issue.sourcePath} -> ${issue.sourceRealPath}; root=${issue.rootRealPath})`;
+	if (issue.reason === "path_stat_failed") return `blocked plugin candidate: cannot stat path (${issue.targetPath})`;
+	if (issue.reason === "path_world_writable") return `blocked plugin candidate: world-writable path (${issue.targetPath}, mode=${formatPosixMode(issue.modeBits ?? 0)})`;
+	return `blocked plugin candidate: suspicious ownership (${issue.targetPath}, uid=${issue.foundUid}, expected uid=${issue.expectedUid} or root)`;
+}
+function isUnsafePluginCandidate(params) {
+	const issue = findCandidateBlockIssue({
+		source: params.source,
+		rootDir: params.rootDir,
+		origin: params.origin,
+		ownershipUid: params.ownershipUid
+	});
+	if (!issue) return false;
+	params.diagnostics.push({
+		level: "warn",
+		source: issue.targetPath,
+		message: formatCandidateBlockMessage(issue)
+	});
+	return true;
+}
+function isExtensionFile(filePath) {
+	const ext = path.extname(filePath);
+	if (!EXTENSION_EXTS.has(ext)) return false;
+	return !filePath.endsWith(".d.ts");
+}
+function shouldIgnoreScannedDirectory(dirName) {
+	const normalized = dirName.trim().toLowerCase();
+	if (!normalized) return true;
+	if (normalized.endsWith(".bak")) return true;
+	if (normalized.includes(".backup-")) return true;
+	if (normalized.includes(".disabled")) return true;
+	return false;
+}
+function readPackageManifest(dir) {
+	const manifestPath = path.join(dir, "package.json");
+	if (!fs.existsSync(manifestPath)) return null;
+	try {
+		const raw = fs.readFileSync(manifestPath, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function resolvePackageExtensions(manifest) {
+	const raw = getPackageManifestMetadata(manifest)?.extensions;
+	if (!Array.isArray(raw)) return [];
+	return raw.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+}
+function deriveIdHint(params) {
+	const base = path.basename(params.filePath, path.extname(params.filePath));
+	const rawPackageName = params.packageName?.trim();
+	if (!rawPackageName) return base;
+	const unscoped = rawPackageName.includes("/") ? rawPackageName.split("/").pop() ?? rawPackageName : rawPackageName;
+	if (!params.hasMultipleExtensions) return unscoped;
+	return `${unscoped}/${base}`;
+}
+function addCandidate(params) {
+	const resolved = path.resolve(params.source);
+	if (params.seen.has(resolved)) return;
+	const resolvedRoot = path.resolve(params.rootDir);
+	if (isUnsafePluginCandidate({
+		source: resolved,
+		rootDir: resolvedRoot,
+		origin: params.origin,
+		diagnostics: params.diagnostics,
+		ownershipUid: params.ownershipUid
+	})) return;
+	params.seen.add(resolved);
+	const manifest = params.manifest ?? null;
+	params.candidates.push({
+		idHint: params.idHint,
+		source: resolved,
+		rootDir: resolvedRoot,
+		origin: params.origin,
+		workspaceDir: params.workspaceDir,
+		packageName: manifest?.name?.trim() || void 0,
+		packageVersion: manifest?.version?.trim() || void 0,
+		packageDescription: manifest?.description?.trim() || void 0,
+		packageDir: params.packageDir,
+		packageManifest: getPackageManifestMetadata(manifest ?? void 0)
+	});
+}
+function resolvePackageEntrySource(params) {
+	const source = path.resolve(params.packageDir, params.entryPath);
+	if (!isPathInsideWithRealpath(params.packageDir, source, { requireRealpath: true })) {
+		params.diagnostics.push({
+			level: "error",
+			message: `extension entry escapes package directory: ${params.entryPath}`,
+			source: params.sourceLabel
+		});
+		return null;
+	}
+	return source;
+}
+function discoverInDirectory(params) {
+	if (!fs.existsSync(params.dir)) return;
+	let entries = [];
+	try {
+		entries = fs.readdirSync(params.dir, { withFileTypes: true });
+	} catch (err) {
+		params.diagnostics.push({
+			level: "warn",
+			message: `failed to read extensions dir: ${params.dir} (${String(err)})`,
+			source: params.dir
+		});
+		return;
+	}
+	for (const entry of entries) {
+		const fullPath = path.join(params.dir, entry.name);
+		if (entry.isFile()) {
+			if (!isExtensionFile(fullPath)) continue;
+			addCandidate({
+				candidates: params.candidates,
+				diagnostics: params.diagnostics,
+				seen: params.seen,
+				idHint: path.basename(entry.name, path.extname(entry.name)),
+				source: fullPath,
+				rootDir: path.dirname(fullPath),
+				origin: params.origin,
+				ownershipUid: params.ownershipUid,
+				workspaceDir: params.workspaceDir
+			});
+		}
+		if (!entry.isDirectory()) continue;
+		if (shouldIgnoreScannedDirectory(entry.name)) continue;
+		const manifest = readPackageManifest(fullPath);
+		const extensions = manifest ? resolvePackageExtensions(manifest) : [];
+		if (extensions.length > 0) {
+			for (const extPath of extensions) {
+				const resolved = resolvePackageEntrySource({
+					packageDir: fullPath,
+					entryPath: extPath,
+					sourceLabel: fullPath,
+					diagnostics: params.diagnostics
+				});
+				if (!resolved) continue;
+				addCandidate({
+					candidates: params.candidates,
+					diagnostics: params.diagnostics,
+					seen: params.seen,
+					idHint: deriveIdHint({
+						filePath: resolved,
+						packageName: manifest?.name,
+						hasMultipleExtensions: extensions.length > 1
+					}),
+					source: resolved,
+					rootDir: fullPath,
+					origin: params.origin,
+					ownershipUid: params.ownershipUid,
+					workspaceDir: params.workspaceDir,
+					manifest,
+					packageDir: fullPath
+				});
+			}
+			continue;
+		}
+		const indexFile = [
+			"index.ts",
+			"index.js",
+			"index.mjs",
+			"index.cjs"
+		].map((candidate) => path.join(fullPath, candidate)).find((candidate) => fs.existsSync(candidate));
+		if (indexFile && isExtensionFile(indexFile)) addCandidate({
+			candidates: params.candidates,
+			diagnostics: params.diagnostics,
+			seen: params.seen,
+			idHint: entry.name,
+			source: indexFile,
+			rootDir: fullPath,
+			origin: params.origin,
+			ownershipUid: params.ownershipUid,
+			workspaceDir: params.workspaceDir,
+			manifest,
+			packageDir: fullPath
+		});
+	}
+}
+function discoverFromPath(params) {
+	const resolved = resolveUserPath(params.rawPath);
+	if (!fs.existsSync(resolved)) {
+		params.diagnostics.push({
+			level: "error",
+			message: `plugin path not found: ${resolved}`,
+			source: resolved
+		});
+		return;
+	}
+	const stat = fs.statSync(resolved);
+	if (stat.isFile()) {
+		if (!isExtensionFile(resolved)) {
+			params.diagnostics.push({
+				level: "error",
+				message: `plugin path is not a supported file: ${resolved}`,
+				source: resolved
+			});
+			return;
+		}
+		addCandidate({
+			candidates: params.candidates,
+			diagnostics: params.diagnostics,
+			seen: params.seen,
+			idHint: path.basename(resolved, path.extname(resolved)),
+			source: resolved,
+			rootDir: path.dirname(resolved),
+			origin: params.origin,
+			ownershipUid: params.ownershipUid,
+			workspaceDir: params.workspaceDir
+		});
+		return;
+	}
+	if (stat.isDirectory()) {
+		const manifest = readPackageManifest(resolved);
+		const extensions = manifest ? resolvePackageExtensions(manifest) : [];
+		if (extensions.length > 0) {
+			for (const extPath of extensions) {
+				const source = resolvePackageEntrySource({
+					packageDir: resolved,
+					entryPath: extPath,
+					sourceLabel: resolved,
+					diagnostics: params.diagnostics
+				});
+				if (!source) continue;
+				addCandidate({
+					candidates: params.candidates,
+					diagnostics: params.diagnostics,
+					seen: params.seen,
+					idHint: deriveIdHint({
+						filePath: source,
+						packageName: manifest?.name,
+						hasMultipleExtensions: extensions.length > 1
+					}),
+					source,
+					rootDir: resolved,
+					origin: params.origin,
+					ownershipUid: params.ownershipUid,
+					workspaceDir: params.workspaceDir,
+					manifest,
+					packageDir: resolved
+				});
+			}
+			return;
+		}
+		const indexFile = [
+			"index.ts",
+			"index.js",
+			"index.mjs",
+			"index.cjs"
+		].map((candidate) => path.join(resolved, candidate)).find((candidate) => fs.existsSync(candidate));
+		if (indexFile && isExtensionFile(indexFile)) {
+			addCandidate({
+				candidates: params.candidates,
+				diagnostics: params.diagnostics,
+				seen: params.seen,
+				idHint: path.basename(resolved),
+				source: indexFile,
+				rootDir: resolved,
+				origin: params.origin,
+				ownershipUid: params.ownershipUid,
+				workspaceDir: params.workspaceDir,
+				manifest,
+				packageDir: resolved
+			});
+			return;
+		}
+		discoverInDirectory({
+			dir: resolved,
+			origin: params.origin,
+			ownershipUid: params.ownershipUid,
+			workspaceDir: params.workspaceDir,
+			candidates: params.candidates,
+			diagnostics: params.diagnostics,
+			seen: params.seen
+		});
+		return;
+	}
+}
+function discoverRemoteClawPlugins(params) {
+	const candidates = [];
+	const diagnostics = [];
+	const seen = /* @__PURE__ */ new Set();
+	const workspaceDir = params.workspaceDir?.trim();
+	const extra = params.extraPaths ?? [];
+	for (const extraPath of extra) {
+		if (typeof extraPath !== "string") continue;
+		const trimmed = extraPath.trim();
+		if (!trimmed) continue;
+		discoverFromPath({
+			rawPath: trimmed,
+			origin: "config",
+			ownershipUid: params.ownershipUid,
+			workspaceDir: workspaceDir?.trim() || void 0,
+			candidates,
+			diagnostics,
+			seen
+		});
+	}
+	if (workspaceDir) {
+		const workspaceRoot = resolveUserPath(workspaceDir);
+		const workspaceExtDirs = [path.join(workspaceRoot, ".remoteclaw", "extensions")];
+		for (const dir of workspaceExtDirs) discoverInDirectory({
+			dir,
+			origin: "workspace",
+			ownershipUid: params.ownershipUid,
+			workspaceDir: workspaceRoot,
+			candidates,
+			diagnostics,
+			seen
+		});
+	}
+	discoverInDirectory({
+		dir: path.join(resolveConfigDir(), "extensions"),
+		origin: "global",
+		ownershipUid: params.ownershipUid,
+		candidates,
+		diagnostics,
+		seen
+	});
+	const bundledDir = resolveBundledPluginsDir();
+	if (bundledDir) discoverInDirectory({
+		dir: bundledDir,
+		origin: "bundled",
+		ownershipUid: params.ownershipUid,
+		candidates,
+		diagnostics,
+		seen
+	});
+	return {
+		candidates,
+		diagnostics
+	};
+}
+
+//#endregion
+//#region src/plugins/manifest-registry.ts
+const PLUGIN_ORIGIN_RANK = {
+	config: 0,
+	workspace: 1,
+	global: 2,
+	bundled: 3
+};
+const registryCache = /* @__PURE__ */ new Map();
+const DEFAULT_MANIFEST_CACHE_MS = 200;
+function clearPluginManifestRegistryCache() {
+	registryCache.clear();
+}
+function resolveManifestCacheMs(env) {
+	const raw = env.REMOTECLAW_PLUGIN_MANIFEST_CACHE_MS?.trim();
+	if (raw === "" || raw === "0") return 0;
+	if (!raw) return DEFAULT_MANIFEST_CACHE_MS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return DEFAULT_MANIFEST_CACHE_MS;
+	return Math.max(0, parsed);
+}
+function shouldUseManifestCache(env) {
+	if (env.REMOTECLAW_DISABLE_PLUGIN_MANIFEST_CACHE?.trim()) return false;
+	return resolveManifestCacheMs(env) > 0;
+}
+function buildCacheKey(params) {
+	const workspaceKey = params.workspaceDir ? resolveUserPath(params.workspaceDir) : "";
+	const loadPaths = params.plugins.loadPaths.map((p) => resolveUserPath(p)).map((p) => p.trim()).filter(Boolean).toSorted();
+	return `${workspaceKey}::${JSON.stringify(loadPaths)}`;
+}
+function safeStatMtimeMs(filePath) {
+	try {
+		return fs.statSync(filePath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+function normalizeManifestLabel(raw) {
+	const trimmed = raw?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function buildRecord(params) {
+	return {
+		id: params.manifest.id,
+		name: normalizeManifestLabel(params.manifest.name) ?? params.candidate.packageName,
+		description: normalizeManifestLabel(params.manifest.description) ?? params.candidate.packageDescription,
+		version: normalizeManifestLabel(params.manifest.version) ?? params.candidate.packageVersion,
+		kind: params.manifest.kind,
+		channels: params.manifest.channels ?? [],
+		providers: params.manifest.providers ?? [],
+		skills: params.manifest.skills ?? [],
+		stt: params.manifest.stt ?? [],
+		tts: params.manifest.tts ?? [],
+		origin: params.candidate.origin,
+		workspaceDir: params.candidate.workspaceDir,
+		rootDir: params.candidate.rootDir,
+		source: params.candidate.source,
+		manifestPath: params.manifestPath,
+		schemaCacheKey: params.schemaCacheKey,
+		configSchema: params.configSchema,
+		configUiHints: params.manifest.uiHints
+	};
+}
+function loadPluginManifestRegistry(params) {
+	const normalized = normalizePluginsConfig((params.config ?? {}).plugins);
+	const cacheKey = buildCacheKey({
+		workspaceDir: params.workspaceDir,
+		plugins: normalized
+	});
+	const env = params.env ?? process.env;
+	const cacheEnabled = params.cache !== false && shouldUseManifestCache(env);
+	if (cacheEnabled) {
+		const cached = registryCache.get(cacheKey);
+		if (cached && cached.expiresAt > Date.now()) return cached.registry;
+	}
+	const discovery = params.candidates ? {
+		candidates: params.candidates,
+		diagnostics: params.diagnostics ?? []
+	} : discoverRemoteClawPlugins({
+		workspaceDir: params.workspaceDir,
+		extraPaths: normalized.loadPaths
+	});
+	const diagnostics = [...discovery.diagnostics];
+	const candidates = discovery.candidates;
+	const records = [];
+	const seenIds = /* @__PURE__ */ new Map();
+	const realpathCache = /* @__PURE__ */ new Map();
+	for (const candidate of candidates) {
+		const manifestRes = loadPluginManifest(candidate.rootDir);
+		if (!manifestRes.ok) {
+			diagnostics.push({
+				level: "error",
+				message: manifestRes.error,
+				source: manifestRes.manifestPath
+			});
+			continue;
+		}
+		const manifest = manifestRes.manifest;
+		if (candidate.idHint && candidate.idHint !== manifest.id) diagnostics.push({
+			level: "warn",
+			pluginId: manifest.id,
+			source: candidate.source,
+			message: `plugin id mismatch (manifest uses "${manifest.id}", entry hints "${candidate.idHint}")`
+		});
+		const configSchema = manifest.configSchema;
+		const manifestMtime = safeStatMtimeMs(manifestRes.manifestPath);
+		const schemaCacheKey = manifestMtime ? `${manifestRes.manifestPath}:${manifestMtime}` : manifestRes.manifestPath;
+		const existing = seenIds.get(manifest.id);
+		if (existing) {
+			const existingReal = safeRealpathSync(existing.candidate.rootDir, realpathCache);
+			const candidateReal = safeRealpathSync(candidate.rootDir, realpathCache);
+			if (Boolean(existingReal && candidateReal && existingReal === candidateReal)) {
+				if (PLUGIN_ORIGIN_RANK[candidate.origin] < PLUGIN_ORIGIN_RANK[existing.candidate.origin]) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				continue;
+			}
+			diagnostics.push({
+				level: "warn",
+				pluginId: manifest.id,
+				source: candidate.source,
+				message: `duplicate plugin id detected; later plugin may be overridden (${candidate.source})`
+			});
+		} else seenIds.set(manifest.id, {
+			candidate,
+			recordIndex: records.length
+		});
+		records.push(buildRecord({
+			manifest,
+			candidate,
+			manifestPath: manifestRes.manifestPath,
+			schemaCacheKey,
+			configSchema
+		}));
+	}
+	const registry = {
+		plugins: records,
+		diagnostics
+	};
+	if (cacheEnabled) {
+		const ttl = resolveManifestCacheMs(env);
+		if (ttl > 0) registryCache.set(cacheKey, {
+			expiresAt: Date.now() + ttl,
+			registry
+		});
+	}
+	return registry;
+}
+
+//#endregion
+//#region src/plugins/schema-validator.ts
+const ajv = new AjvPkg({
+	allErrors: true,
+	strict: false,
+	removeAdditional: false
+});
+const schemaCache = /* @__PURE__ */ new Map();
+function formatAjvErrors(errors) {
+	if (!errors || errors.length === 0) return ["invalid config"];
+	return errors.map((error) => {
+		return `${error.instancePath?.replace(/^\//, "").replace(/\//g, ".") || "<root>"}: ${error.message ?? "invalid"}`;
+	});
+}
+function validateJsonSchemaValue(params) {
+	let cached = schemaCache.get(params.cacheKey);
+	if (!cached || cached.schema !== params.schema) {
+		cached = {
+			validate: ajv.compile(params.schema),
+			schema: params.schema
+		};
+		schemaCache.set(params.cacheKey, cached);
+	}
+	if (cached.validate(params.value)) return { ok: true };
+	return {
+		ok: false,
+		errors: formatAjvErrors(cached.validate.errors)
+	};
+}
+
+//#endregion
+//#region src/shared/avatar-policy.ts
+const AVATAR_MAX_BYTES = 2 * 1024 * 1024;
+const LOCAL_AVATAR_EXTENSIONS = new Set([
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".webp",
+	".svg"
+]);
+const AVATAR_MIME_BY_EXT = {
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".webp": "image/webp",
+	".gif": "image/gif",
+	".svg": "image/svg+xml",
+	".bmp": "image/bmp",
+	".tif": "image/tiff",
+	".tiff": "image/tiff"
+};
+const AVATAR_DATA_RE = /^data:/i;
+const AVATAR_IMAGE_DATA_RE = /^data:image\//i;
+const AVATAR_HTTP_RE = /^https?:\/\//i;
+const AVATAR_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
+const WINDOWS_ABS_RE = /^[a-zA-Z]:[\\/]/;
+const AVATAR_PATH_EXT_RE = /\.(png|jpe?g|gif|webp|svg|ico)$/i;
+function resolveAvatarMime(filePath) {
+	return AVATAR_MIME_BY_EXT[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+function isAvatarDataUrl(value) {
+	return AVATAR_DATA_RE.test(value);
+}
+function isAvatarImageDataUrl(value) {
+	return AVATAR_IMAGE_DATA_RE.test(value);
+}
+function isAvatarHttpUrl(value) {
+	return AVATAR_HTTP_RE.test(value);
+}
+function hasAvatarUriScheme(value) {
+	return AVATAR_SCHEME_RE.test(value);
+}
+function isWindowsAbsolutePath(value) {
+	return WINDOWS_ABS_RE.test(value);
+}
+function isWorkspaceRelativeAvatarPath(value) {
+	if (!value) return false;
+	if (value.startsWith("~")) return false;
+	if (hasAvatarUriScheme(value) && !isWindowsAbsolutePath(value)) return false;
+	return true;
+}
+function isPathWithinRoot(rootDir, targetPath) {
+	const relative = path.relative(rootDir, targetPath);
+	if (relative === "") return true;
+	return !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function looksLikeAvatarPath(value) {
+	if (/[\\/]/.test(value)) return true;
+	return AVATAR_PATH_EXT_RE.test(value);
+}
+function isSupportedLocalAvatarExtension(filePath) {
+	const ext = path.extname(filePath).toLowerCase();
+	return LOCAL_AVATAR_EXTENSIONS.has(ext);
+}
+
+//#endregion
+//#region src/config/validation.ts
+const LEGACY_REMOVED_PLUGIN_IDS = new Set(["google-antigravity-auth"]);
+function isWorkspaceAvatarPath(value, workspaceDir) {
+	const workspaceRoot = path.resolve(workspaceDir);
+	return isPathWithinRoot(workspaceRoot, path.resolve(workspaceRoot, value));
+}
+function validateIdentityAvatar(config) {
+	const agents = config.agents?.list;
+	if (!Array.isArray(agents) || agents.length === 0) return [];
+	const issues = [];
+	for (const [index, entry] of agents.entries()) {
+		if (!entry || typeof entry !== "object") continue;
+		const avatarRaw = entry.identity?.avatar;
+		if (typeof avatarRaw !== "string") continue;
+		const avatar = avatarRaw.trim();
+		if (!avatar) continue;
+		if (isAvatarDataUrl(avatar) || isAvatarHttpUrl(avatar)) continue;
+		if (avatar.startsWith("~")) {
+			issues.push({
+				path: `agents.list.${index}.identity.avatar`,
+				message: "identity.avatar must be a workspace-relative path, http(s) URL, or data URI."
+			});
+			continue;
+		}
+		if (hasAvatarUriScheme(avatar) && !isWindowsAbsolutePath(avatar)) {
+			issues.push({
+				path: `agents.list.${index}.identity.avatar`,
+				message: "identity.avatar must be a workspace-relative path, http(s) URL, or data URI."
+			});
+			continue;
+		}
+		const workspaceDir = resolveAgentWorkspaceDirOrNull(config, entry.id ?? resolveDefaultAgentId(config));
+		if (workspaceDir != null && !isWorkspaceAvatarPath(avatar, workspaceDir)) issues.push({
+			path: `agents.list.${index}.identity.avatar`,
+			message: "identity.avatar must stay within the agent workspace."
+		});
+	}
+	return issues;
+}
+/**
+* Validates config without applying runtime defaults.
+* Use this when you need the raw validated config (e.g., for writing back to file).
+*/
+function validateConfigObjectRaw(raw) {
+	const legacyIssues = findLegacyConfigIssues(raw);
+	if (legacyIssues.length > 0) return {
+		ok: false,
+		issues: legacyIssues.map((iss) => ({
+			path: iss.path,
+			message: iss.message
+		}))
+	};
+	const validated = RemoteClawSchema.safeParse(raw);
+	if (!validated.success) return {
+		ok: false,
+		issues: validated.error.issues.map((iss) => ({
+			path: iss.path.join("."),
+			message: iss.message
+		}))
+	};
+	const duplicates = findDuplicateAgentDirs(validated.data);
+	if (duplicates.length > 0) return {
+		ok: false,
+		issues: [{
+			path: "agents.list",
+			message: formatDuplicateAgentDirError(duplicates)
+		}]
+	};
+	const avatarIssues = validateIdentityAvatar(validated.data);
+	if (avatarIssues.length > 0) return {
+		ok: false,
+		issues: avatarIssues
+	};
+	return {
+		ok: true,
+		config: validated.data
+	};
+}
+function validateConfigObject(raw) {
+	const result = validateConfigObjectRaw(raw);
+	if (!result.ok) return result;
+	return {
+		ok: true,
+		config: applyModelDefaults(applyAgentDefaults(applySessionDefaults(result.config)))
+	};
+}
+function validateConfigObjectWithPlugins(raw) {
+	return validateConfigObjectWithPluginsBase(raw, { applyDefaults: true });
+}
+function validateConfigObjectRawWithPlugins(raw) {
+	return validateConfigObjectWithPluginsBase(raw, { applyDefaults: false });
+}
+function validateConfigObjectWithPluginsBase(raw, opts) {
+	const base = opts.applyDefaults ? validateConfigObject(raw) : validateConfigObjectRaw(raw);
+	if (!base.ok) return {
+		ok: false,
+		issues: base.issues,
+		warnings: []
+	};
+	const config = base.config;
+	const issues = [];
+	const warnings = [];
+	const hasExplicitPluginsConfig = isRecord(raw) && Object.prototype.hasOwnProperty.call(raw, "plugins");
+	let registryInfo = null;
+	const ensureRegistry = () => {
+		if (registryInfo) return registryInfo;
+		const registry = loadPluginManifestRegistry({
+			config,
+			workspaceDir: resolveAgentWorkspaceDirOrNull(config, resolveDefaultAgentId(config)) ?? void 0
+		});
+		const knownIds = new Set(registry.plugins.map((record) => record.id));
+		const normalizedPlugins = normalizePluginsConfig(config.plugins);
+		for (const diag of registry.diagnostics) {
+			let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
+			if (!diag.pluginId && diag.message.includes("plugin path not found")) path = "plugins.load.paths";
+			const message = `${diag.pluginId ? `plugin ${diag.pluginId}` : "plugin"}: ${diag.message}`;
+			if (diag.level === "error") issues.push({
+				path,
+				message
+			});
+			else warnings.push({
+				path,
+				message
+			});
+		}
+		registryInfo = {
+			registry,
+			knownIds,
+			normalizedPlugins
+		};
+		return registryInfo;
+	};
+	const allowedChannels = new Set([
+		"defaults",
+		"modelByChannel",
+		...CHANNEL_IDS
+	]);
+	if (config.channels && isRecord(config.channels)) for (const key of Object.keys(config.channels)) {
+		const trimmed = key.trim();
+		if (!trimmed) continue;
+		if (!allowedChannels.has(trimmed)) {
+			const { registry } = ensureRegistry();
+			for (const record of registry.plugins) for (const channelId of record.channels) allowedChannels.add(channelId);
+		}
+		if (!allowedChannels.has(trimmed)) issues.push({
+			path: `channels.${trimmed}`,
+			message: `unknown channel id: ${trimmed}`
+		});
+	}
+	const heartbeatChannelIds = /* @__PURE__ */ new Set();
+	for (const channelId of CHANNEL_IDS) heartbeatChannelIds.add(channelId.toLowerCase());
+	const validateHeartbeatTarget = (target, path) => {
+		if (typeof target !== "string") return;
+		const trimmed = target.trim();
+		if (!trimmed) {
+			issues.push({
+				path,
+				message: "heartbeat target must not be empty"
+			});
+			return;
+		}
+		const normalized = trimmed.toLowerCase();
+		if (normalized === "last" || normalized === "none") return;
+		if (normalizeChatChannelId(trimmed)) return;
+		if (!heartbeatChannelIds.has(normalized)) {
+			const { registry } = ensureRegistry();
+			for (const record of registry.plugins) for (const channelId of record.channels) {
+				const pluginChannel = channelId.trim();
+				if (pluginChannel) heartbeatChannelIds.add(pluginChannel.toLowerCase());
+			}
+		}
+		if (heartbeatChannelIds.has(normalized)) return;
+		issues.push({
+			path,
+			message: `unknown heartbeat target: ${target}`
+		});
+	};
+	validateHeartbeatTarget(config.agents?.defaults?.heartbeat?.target, "agents.defaults.heartbeat.target");
+	if (Array.isArray(config.agents?.list)) for (const [index, entry] of config.agents.list.entries()) validateHeartbeatTarget(entry?.heartbeat?.target, `agents.list.${index}.heartbeat.target`);
+	if (!hasExplicitPluginsConfig) {
+		if (issues.length > 0) return {
+			ok: false,
+			issues,
+			warnings
+		};
+		return {
+			ok: true,
+			config,
+			warnings
+		};
+	}
+	const { registry, knownIds, normalizedPlugins } = ensureRegistry();
+	const pushMissingPluginIssue = (path, pluginId) => {
+		if (LEGACY_REMOVED_PLUGIN_IDS.has(pluginId)) {
+			warnings.push({
+				path,
+				message: `plugin removed: ${pluginId} (stale config entry ignored; remove it from plugins config)`
+			});
+			return;
+		}
+		issues.push({
+			path,
+			message: `plugin not found: ${pluginId}`
+		});
+	};
+	const pluginsConfig = config.plugins;
+	const entries = pluginsConfig?.entries;
+	if (entries && isRecord(entries)) {
+		for (const pluginId of Object.keys(entries)) if (!knownIds.has(pluginId)) pushMissingPluginIssue(`plugins.entries.${pluginId}`, pluginId);
+	}
+	const allow = pluginsConfig?.allow ?? [];
+	for (const pluginId of allow) {
+		if (typeof pluginId !== "string" || !pluginId.trim()) continue;
+		if (!knownIds.has(pluginId)) pushMissingPluginIssue("plugins.allow", pluginId);
+	}
+	const deny = pluginsConfig?.deny ?? [];
+	for (const pluginId of deny) {
+		if (typeof pluginId !== "string" || !pluginId.trim()) continue;
+		if (!knownIds.has(pluginId)) pushMissingPluginIssue("plugins.deny", pluginId);
+	}
+	const seenPlugins = /* @__PURE__ */ new Set();
+	for (const record of registry.plugins) {
+		const pluginId = record.id;
+		if (seenPlugins.has(pluginId)) continue;
+		seenPlugins.add(pluginId);
+		const entry = normalizedPlugins.entries[pluginId];
+		const entryHasConfig = Boolean(entry?.config);
+		const enableState = resolveEffectiveEnableState({
+			id: pluginId,
+			origin: record.origin,
+			config: normalizedPlugins,
+			rootConfig: config
+		});
+		let enabled = enableState.enabled;
+		let reason = enableState.reason;
+		if (enabled || entryHasConfig) if (record.configSchema) {
+			const res = validateJsonSchemaValue({
+				schema: record.configSchema,
+				cacheKey: record.schemaCacheKey ?? record.manifestPath ?? pluginId,
+				value: entry?.config ?? {}
+			});
+			if (!res.ok) for (const error of res.errors) issues.push({
+				path: `plugins.entries.${pluginId}.config`,
+				message: `invalid config: ${error}`
+			});
+		} else issues.push({
+			path: `plugins.entries.${pluginId}`,
+			message: `plugin schema missing for ${pluginId}`
+		});
+		if (!enabled && entryHasConfig) warnings.push({
+			path: `plugins.entries.${pluginId}`,
+			message: `plugin disabled (${reason ?? "disabled"}) but config is present`
+		});
+	}
+	if (issues.length > 0) return {
+		ok: false,
+		issues,
+		warnings
+	};
+	return {
+		ok: true,
+		config,
+		warnings
+	};
+}
+
+//#endregion
+//#region src/config/version.ts
+const VERSION_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-(\d+))?/;
+function parseRemoteClawVersion(raw) {
+	if (!raw) return null;
+	const match = raw.trim().match(VERSION_RE);
+	if (!match) return null;
+	const [, major, minor, patch, revision] = match;
+	return {
+		major: Number.parseInt(major, 10),
+		minor: Number.parseInt(minor, 10),
+		patch: Number.parseInt(patch, 10),
+		revision: revision ? Number.parseInt(revision, 10) : 0
+	};
+}
+function compareRemoteClawVersions(a, b) {
+	const parsedA = parseRemoteClawVersion(a);
+	const parsedB = parseRemoteClawVersion(b);
+	if (!parsedA || !parsedB) return null;
+	if (parsedA.major !== parsedB.major) return parsedA.major < parsedB.major ? -1 : 1;
+	if (parsedA.minor !== parsedB.minor) return parsedA.minor < parsedB.minor ? -1 : 1;
+	if (parsedA.patch !== parsedB.patch) return parsedA.patch < parsedB.patch ? -1 : 1;
+	if (parsedA.revision !== parsedB.revision) return parsedA.revision < parsedB.revision ? -1 : 1;
+	return 0;
+}
+
+//#endregion
+//#region src/config/io.ts
+const SHELL_ENV_EXPECTED_KEYS = [
+	"OPENAI_API_KEY",
+	"ANTHROPIC_API_KEY",
+	"ANTHROPIC_OAUTH_TOKEN",
+	"GEMINI_API_KEY",
+	"ZAI_API_KEY",
+	"OPENROUTER_API_KEY",
+	"AI_GATEWAY_API_KEY",
+	"MINIMAX_API_KEY",
+	"SYNTHETIC_API_KEY",
+	"KILOCODE_API_KEY",
+	"ELEVENLABS_API_KEY",
+	"TELEGRAM_BOT_TOKEN",
+	"DISCORD_BOT_TOKEN",
+	"SLACK_BOT_TOKEN",
+	"SLACK_APP_TOKEN",
+	"REMOTECLAW_GATEWAY_TOKEN",
+	"REMOTECLAW_GATEWAY_PASSWORD"
+];
+const OPEN_DM_POLICY_ALLOW_FROM_RE = /^(?<policyPath>[a-z0-9_.-]+)\s*=\s*"open"\s+requires\s+(?<allowPath>[a-z0-9_.-]+)(?:\s+\(or\s+[a-z0-9_.-]+\))?\s+to include "\*"$/i;
+const CONFIG_AUDIT_LOG_FILENAME = "config-audit.jsonl";
+const loggedInvalidConfigs = /* @__PURE__ */ new Set();
+function hashConfigRaw(raw) {
+	return crypto.createHash("sha256").update(raw ?? "").digest("hex");
+}
+function formatConfigValidationFailure(pathLabel, issueMessage) {
+	const match = issueMessage.match(OPEN_DM_POLICY_ALLOW_FROM_RE);
+	const policyPath = match?.groups?.policyPath?.trim();
+	const allowPath = match?.groups?.allowPath?.trim();
+	if (!policyPath || !allowPath) return `Config validation failed: ${pathLabel}: ${issueMessage}`;
+	return [
+		`Config validation failed: ${pathLabel}`,
+		"",
+		`Configuration mismatch: ${policyPath} is "open", but ${allowPath} does not include "*".`,
+		"",
+		"Fix with:",
+		`  remoteclaw config set ${allowPath} '["*"]'`,
+		"",
+		"Or switch policy:",
+		`  remoteclaw config set ${policyPath} "pairing"`
+	].join("\n");
+}
+function isNumericPathSegment(raw) {
+	return /^[0-9]+$/.test(raw);
+}
+function isWritePlainObject(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasOwnObjectKey(value, key) {
+	return Object.prototype.hasOwnProperty.call(value, key);
+}
+const WRITE_PRUNED_OBJECT = Symbol("write-pruned-object");
+function unsetPathForWriteAt(value, pathSegments, depth) {
+	if (depth >= pathSegments.length) return {
+		changed: false,
+		value
+	};
+	const segment = pathSegments[depth];
+	const isLeaf = depth === pathSegments.length - 1;
+	if (Array.isArray(value)) {
+		if (!isNumericPathSegment(segment)) return {
+			changed: false,
+			value
+		};
+		const index = Number.parseInt(segment, 10);
+		if (!Number.isFinite(index) || index < 0 || index >= value.length) return {
+			changed: false,
+			value
+		};
+		if (isLeaf) {
+			const next = value.slice();
+			next.splice(index, 1);
+			return {
+				changed: true,
+				value: next
+			};
+		}
+		const child = unsetPathForWriteAt(value[index], pathSegments, depth + 1);
+		if (!child.changed) return {
+			changed: false,
+			value
+		};
+		const next = value.slice();
+		if (child.value === WRITE_PRUNED_OBJECT) next.splice(index, 1);
+		else next[index] = child.value;
+		return {
+			changed: true,
+			value: next
+		};
+	}
+	if (isBlockedObjectKey(segment) || !isWritePlainObject(value) || !hasOwnObjectKey(value, segment)) return {
+		changed: false,
+		value
+	};
+	if (isLeaf) {
+		const next = { ...value };
+		delete next[segment];
+		return {
+			changed: true,
+			value: Object.keys(next).length === 0 ? WRITE_PRUNED_OBJECT : next
+		};
+	}
+	const child = unsetPathForWriteAt(value[segment], pathSegments, depth + 1);
+	if (!child.changed) return {
+		changed: false,
+		value
+	};
+	const next = { ...value };
+	if (child.value === WRITE_PRUNED_OBJECT) delete next[segment];
+	else next[segment] = child.value;
+	return {
+		changed: true,
+		value: Object.keys(next).length === 0 ? WRITE_PRUNED_OBJECT : next
+	};
+}
+function unsetPathForWrite(root, pathSegments) {
+	if (pathSegments.length === 0) return {
+		changed: false,
+		next: root
+	};
+	const result = unsetPathForWriteAt(root, pathSegments, 0);
+	if (!result.changed) return {
+		changed: false,
+		next: root
+	};
+	if (result.value === WRITE_PRUNED_OBJECT) return {
+		changed: true,
+		next: {}
+	};
+	if (isWritePlainObject(result.value)) return {
+		changed: true,
+		next: coerceConfig(result.value)
+	};
+	return {
+		changed: false,
+		next: root
+	};
+}
+function resolveConfigSnapshotHash(snapshot) {
+	if (typeof snapshot.hash === "string") {
+		const trimmed = snapshot.hash.trim();
+		if (trimmed) return trimmed;
+	}
+	if (typeof snapshot.raw !== "string") return null;
+	return hashConfigRaw(snapshot.raw);
+}
+function coerceConfig(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+	return value;
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasConfigMeta(value) {
+	if (!isPlainObject(value)) return false;
+	const meta = value.meta;
+	return isPlainObject(meta);
+}
+function resolveGatewayMode(value) {
+	if (!isPlainObject(value)) return null;
+	const gateway = value.gateway;
+	if (!isPlainObject(gateway) || typeof gateway.mode !== "string") return null;
+	const trimmed = gateway.mode.trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+function cloneUnknown(value) {
+	return structuredClone(value);
+}
+function createMergePatch(base, target) {
+	if (!isPlainObject(base) || !isPlainObject(target)) return cloneUnknown(target);
+	const patch = {};
+	const keys = new Set([...Object.keys(base), ...Object.keys(target)]);
+	for (const key of keys) {
+		const hasBase = key in base;
+		if (!(key in target)) {
+			patch[key] = null;
+			continue;
+		}
+		const targetValue = target[key];
+		if (!hasBase) {
+			patch[key] = cloneUnknown(targetValue);
+			continue;
+		}
+		const baseValue = base[key];
+		if (isPlainObject(baseValue) && isPlainObject(targetValue)) {
+			const childPatch = createMergePatch(baseValue, targetValue);
+			if (isPlainObject(childPatch) && Object.keys(childPatch).length === 0) continue;
+			patch[key] = childPatch;
+			continue;
+		}
+		if (!isDeepStrictEqual(baseValue, targetValue)) patch[key] = cloneUnknown(targetValue);
+	}
+	return patch;
+}
+function collectEnvRefPaths(value, path, output) {
+	if (typeof value === "string") {
+		if (containsEnvVarReference(value)) output.set(path, value);
+		return;
+	}
+	if (Array.isArray(value)) {
+		value.forEach((item, index) => {
+			collectEnvRefPaths(item, `${path}[${index}]`, output);
+		});
+		return;
+	}
+	if (isPlainObject(value)) for (const [key, child] of Object.entries(value)) collectEnvRefPaths(child, path ? `${path}.${key}` : key, output);
+}
+function collectChangedPaths(base, target, path, output) {
+	if (Array.isArray(base) && Array.isArray(target)) {
+		const max = Math.max(base.length, target.length);
+		for (let index = 0; index < max; index += 1) {
+			const childPath = path ? `${path}[${index}]` : `[${index}]`;
+			if (index >= base.length || index >= target.length) {
+				output.add(childPath);
+				continue;
+			}
+			collectChangedPaths(base[index], target[index], childPath, output);
+		}
+		return;
+	}
+	if (isPlainObject(base) && isPlainObject(target)) {
+		const keys = new Set([...Object.keys(base), ...Object.keys(target)]);
+		for (const key of keys) {
+			const childPath = path ? `${path}.${key}` : key;
+			const hasBase = key in base;
+			if (!(key in target) || !hasBase) {
+				output.add(childPath);
+				continue;
+			}
+			collectChangedPaths(base[key], target[key], childPath, output);
+		}
+		return;
+	}
+	if (!isDeepStrictEqual(base, target)) output.add(path);
+}
+function parentPath(value) {
+	if (!value) return "";
+	if (value.endsWith("]")) {
+		const index = value.lastIndexOf("[");
+		return index > 0 ? value.slice(0, index) : "";
+	}
+	const index = value.lastIndexOf(".");
+	return index >= 0 ? value.slice(0, index) : "";
+}
+function isPathChanged(path, changedPaths) {
+	if (changedPaths.has(path)) return true;
+	let current = parentPath(path);
+	while (current) {
+		if (changedPaths.has(current)) return true;
+		current = parentPath(current);
+	}
+	return changedPaths.has("");
+}
+function restoreEnvRefsFromMap(value, path, envRefMap, changedPaths) {
+	if (typeof value === "string") {
+		if (!isPathChanged(path, changedPaths)) {
+			const original = envRefMap.get(path);
+			if (original !== void 0) return original;
+		}
+		return value;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const next = value.map((item, index) => {
+			const updated = restoreEnvRefsFromMap(item, `${path}[${index}]`, envRefMap, changedPaths);
+			if (updated !== item) changed = true;
+			return updated;
+		});
+		return changed ? next : value;
+	}
+	if (isPlainObject(value)) {
+		let changed = false;
+		const next = {};
+		for (const [key, child] of Object.entries(value)) {
+			const updated = restoreEnvRefsFromMap(child, path ? `${path}.${key}` : key, envRefMap, changedPaths);
+			if (updated !== child) changed = true;
+			next[key] = updated;
+		}
+		return changed ? next : value;
+	}
+	return value;
+}
+function resolveConfigAuditLogPath(env, homedir) {
+	return path.join(resolveStateDir(env, homedir), "logs", CONFIG_AUDIT_LOG_FILENAME);
+}
+function resolveConfigWriteSuspiciousReasons(params) {
+	const reasons = [];
+	if (!params.existsBefore) return reasons;
+	if (typeof params.previousBytes === "number" && typeof params.nextBytes === "number" && params.previousBytes >= 512 && params.nextBytes < Math.floor(params.previousBytes * .5)) reasons.push(`size-drop:${params.previousBytes}->${params.nextBytes}`);
+	if (!params.hasMetaBefore) reasons.push("missing-meta-before-write");
+	if (params.gatewayModeBefore && !params.gatewayModeAfter) reasons.push("gateway-mode-removed");
+	return reasons;
+}
+async function appendConfigWriteAuditRecord(deps, record) {
+	try {
+		const auditPath = resolveConfigAuditLogPath(deps.env, deps.homedir);
+		await deps.fs.promises.mkdir(path.dirname(auditPath), {
+			recursive: true,
+			mode: 448
+		});
+		await deps.fs.promises.appendFile(auditPath, `${JSON.stringify(record)}\n`, {
+			encoding: "utf-8",
+			mode: 384
+		});
+	} catch {}
+}
+function warnOnConfigMiskeys(raw, logger) {
+	if (!raw || typeof raw !== "object") return;
+	const gateway = raw.gateway;
+	if (!gateway || typeof gateway !== "object") return;
+	if ("token" in gateway) logger.warn("Config uses \"gateway.token\". This key is ignored; use \"gateway.auth.token\" instead.");
+}
+function stampConfigVersion(cfg) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		...cfg,
+		meta: {
+			...cfg.meta,
+			lastTouchedVersion: VERSION,
+			lastTouchedAt: now
+		}
+	};
+}
+function warnIfConfigFromFuture(cfg, logger) {
+	const touched = cfg.meta?.lastTouchedVersion;
+	if (!touched) return;
+	const cmp = compareRemoteClawVersions(VERSION, touched);
+	if (cmp === null) return;
+	if (cmp < 0) logger.warn(`Config was last written by a newer RemoteClaw (${touched}); current version is ${VERSION}.`);
+}
+function resolveConfigPathForDeps(deps) {
+	if (deps.configPath) return deps.configPath;
+	return resolveConfigPath(deps.env, resolveStateDir(deps.env, deps.homedir));
+}
+function normalizeDeps(overrides = {}) {
+	return {
+		fs: overrides.fs ?? fs,
+		json5: overrides.json5 ?? JSON5,
+		env: overrides.env ?? process.env,
+		homedir: overrides.homedir ?? (() => resolveRequiredHomeDir(overrides.env ?? process.env, os.homedir)),
+		configPath: overrides.configPath ?? "",
+		logger: overrides.logger ?? console
+	};
+}
+function maybeLoadDotEnvForConfig(env) {
+	if (env !== process.env) return;
+	loadDotEnv({ quiet: true });
+}
+function parseConfigJson5(raw, json5 = JSON5) {
+	try {
+		return {
+			ok: true,
+			parsed: json5.parse(raw)
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: String(err)
+		};
+	}
+}
+function resolveConfigIncludesForRead(parsed, configPath, deps) {
+	return resolveConfigIncludes(parsed, configPath, {
+		readFile: (candidate) => deps.fs.readFileSync(candidate, "utf-8"),
+		parseJson: (raw) => deps.json5.parse(raw)
+	});
+}
+function resolveConfigForRead(resolvedIncludes, env) {
+	if (resolvedIncludes && typeof resolvedIncludes === "object" && "env" in resolvedIncludes) applyConfigEnvVars(resolvedIncludes, env);
+	return {
+		resolvedConfigRaw: resolveConfigEnvVars(resolvedIncludes, env),
+		envSnapshotForRestore: { ...env }
+	};
+}
+function createConfigIO(overrides = {}) {
+	const deps = normalizeDeps(overrides);
+	const requestedConfigPath = resolveConfigPathForDeps(deps);
+	const configPath = (deps.configPath ? [requestedConfigPath] : resolveDefaultConfigCandidates(deps.env, deps.homedir)).find((candidate) => deps.fs.existsSync(candidate)) ?? requestedConfigPath;
+	function loadConfig() {
+		try {
+			maybeLoadDotEnvForConfig(deps.env);
+			if (!deps.fs.existsSync(configPath)) {
+				if (shouldEnableShellEnvFallback(deps.env) && !shouldDeferShellEnvFallback(deps.env)) loadShellEnvFallback({
+					enabled: true,
+					env: deps.env,
+					expectedKeys: SHELL_ENV_EXPECTED_KEYS,
+					logger: deps.logger,
+					timeoutMs: resolveShellEnvFallbackTimeoutMs(deps.env)
+				});
+				return {};
+			}
+			const raw = deps.fs.readFileSync(configPath, "utf-8");
+			const { resolvedConfigRaw: resolvedConfig } = resolveConfigForRead(resolveConfigIncludesForRead(deps.json5.parse(raw), configPath, deps), deps.env);
+			warnOnConfigMiskeys(resolvedConfig, deps.logger);
+			if (typeof resolvedConfig !== "object" || resolvedConfig === null) return {};
+			const preValidationDuplicates = findDuplicateAgentDirs(resolvedConfig, {
+				env: deps.env,
+				homedir: deps.homedir
+			});
+			if (preValidationDuplicates.length > 0) throw new DuplicateAgentDirError(preValidationDuplicates);
+			const validated = validateConfigObjectWithPlugins(resolvedConfig);
+			if (!validated.ok) {
+				const details = validated.issues.map((iss) => `- ${iss.path || "<root>"}: ${iss.message}`).join("\n");
+				if (!loggedInvalidConfigs.has(configPath)) {
+					loggedInvalidConfigs.add(configPath);
+					deps.logger.error(`Invalid config at ${configPath}:\\n${details}`);
+				}
+				const error = /* @__PURE__ */ new Error("Invalid config");
+				error.code = "INVALID_CONFIG";
+				error.details = details;
+				throw error;
+			}
+			if (validated.warnings.length > 0) {
+				const details = validated.warnings.map((iss) => `- ${iss.path || "<root>"}: ${iss.message}`).join("\n");
+				deps.logger.warn(`Config warnings:\\n${details}`);
+			}
+			warnIfConfigFromFuture(validated.config, deps.logger);
+			const cfg = applyTalkConfigNormalization(applyModelDefaults(applyContextPruningDefaults(applyAgentDefaults(applySessionDefaults(applyLoggingDefaults(applyMessageDefaults(validated.config)))))));
+			normalizeConfigPaths(cfg);
+			const duplicates = findDuplicateAgentDirs(cfg, {
+				env: deps.env,
+				homedir: deps.homedir
+			});
+			if (duplicates.length > 0) throw new DuplicateAgentDirError(duplicates);
+			applyConfigEnvVars(cfg, deps.env);
+			if ((shouldEnableShellEnvFallback(deps.env) || cfg.env?.shellEnv?.enabled === true) && !shouldDeferShellEnvFallback(deps.env)) loadShellEnvFallback({
+				enabled: true,
+				env: deps.env,
+				expectedKeys: SHELL_ENV_EXPECTED_KEYS,
+				logger: deps.logger,
+				timeoutMs: cfg.env?.shellEnv?.timeoutMs ?? resolveShellEnvFallbackTimeoutMs(deps.env)
+			});
+			const pendingSecret = AUTO_OWNER_DISPLAY_SECRET_BY_PATH.get(configPath);
+			const ownerDisplaySecretResolution = ensureOwnerDisplaySecret(cfg, () => pendingSecret ?? crypto.randomBytes(32).toString("hex"));
+			const cfgWithOwnerDisplaySecret = ownerDisplaySecretResolution.config;
+			if (ownerDisplaySecretResolution.generatedSecret) {
+				AUTO_OWNER_DISPLAY_SECRET_BY_PATH.set(configPath, ownerDisplaySecretResolution.generatedSecret);
+				if (!AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT.has(configPath)) {
+					AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT.add(configPath);
+					writeConfigFile(cfgWithOwnerDisplaySecret, { expectedConfigPath: configPath }).then(() => {
+						AUTO_OWNER_DISPLAY_SECRET_BY_PATH.delete(configPath);
+						AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.delete(configPath);
+					}).catch((err) => {
+						if (!AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.has(configPath)) {
+							AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.add(configPath);
+							deps.logger.warn(`Failed to persist auto-generated commands.ownerDisplaySecret at ${configPath}: ${String(err)}`);
+						}
+					}).finally(() => {
+						AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT.delete(configPath);
+					});
+				}
+			} else {
+				AUTO_OWNER_DISPLAY_SECRET_BY_PATH.delete(configPath);
+				AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED.delete(configPath);
+			}
+			return applyConfigOverrides(cfgWithOwnerDisplaySecret);
+		} catch (err) {
+			if (err instanceof DuplicateAgentDirError) {
+				deps.logger.error(err.message);
+				throw err;
+			}
+			if (err?.code === "INVALID_CONFIG") return {};
+			deps.logger.error(`Failed to read config at ${configPath}`, err);
+			return {};
+		}
+	}
+	async function readConfigFileSnapshotInternal() {
+		maybeLoadDotEnvForConfig(deps.env);
+		if (!deps.fs.existsSync(configPath)) {
+			const hash = hashConfigRaw(null);
+			return { snapshot: {
+				path: configPath,
+				exists: false,
+				raw: null,
+				parsed: {},
+				resolved: {},
+				valid: true,
+				config: applyTalkApiKey(applyTalkConfigNormalization(applyModelDefaults(applyContextPruningDefaults(applyAgentDefaults(applySessionDefaults(applyMessageDefaults({}))))))),
+				hash,
+				issues: [],
+				warnings: [],
+				legacyIssues: []
+			} };
+		}
+		try {
+			const raw = deps.fs.readFileSync(configPath, "utf-8");
+			const hash = hashConfigRaw(raw);
+			const parsedRes = parseConfigJson5(raw, deps.json5);
+			if (!parsedRes.ok) return { snapshot: {
+				path: configPath,
+				exists: true,
+				raw,
+				parsed: {},
+				resolved: {},
+				valid: false,
+				config: {},
+				hash,
+				issues: [{
+					path: "",
+					message: `JSON5 parse failed: ${parsedRes.error}`
+				}],
+				warnings: [],
+				legacyIssues: []
+			} };
+			let resolved;
+			try {
+				resolved = resolveConfigIncludesForRead(parsedRes.parsed, configPath, deps);
+			} catch (err) {
+				const message = err instanceof ConfigIncludeError ? err.message : `Include resolution failed: ${String(err)}`;
+				return { snapshot: {
+					path: configPath,
+					exists: true,
+					raw,
+					parsed: parsedRes.parsed,
+					resolved: coerceConfig(parsedRes.parsed),
+					valid: false,
+					config: coerceConfig(parsedRes.parsed),
+					hash,
+					issues: [{
+						path: "",
+						message
+					}],
+					warnings: [],
+					legacyIssues: []
+				} };
+			}
+			let readResolution;
+			try {
+				readResolution = resolveConfigForRead(resolved, deps.env);
+			} catch (err) {
+				const message = err instanceof MissingEnvVarError ? err.message : `Env var substitution failed: ${String(err)}`;
+				return { snapshot: {
+					path: configPath,
+					exists: true,
+					raw,
+					parsed: parsedRes.parsed,
+					resolved: coerceConfig(resolved),
+					valid: false,
+					config: coerceConfig(resolved),
+					hash,
+					issues: [{
+						path: "",
+						message
+					}],
+					warnings: [],
+					legacyIssues: []
+				} };
+			}
+			const resolvedConfigRaw = readResolution.resolvedConfigRaw;
+			const legacyIssues = findLegacyConfigIssues(resolvedConfigRaw);
+			const validated = validateConfigObjectWithPlugins(resolvedConfigRaw);
+			if (!validated.ok) return { snapshot: {
+				path: configPath,
+				exists: true,
+				raw,
+				parsed: parsedRes.parsed,
+				resolved: coerceConfig(resolvedConfigRaw),
+				valid: false,
+				config: coerceConfig(resolvedConfigRaw),
+				hash,
+				issues: validated.issues,
+				warnings: validated.warnings,
+				legacyIssues
+			} };
+			warnIfConfigFromFuture(validated.config, deps.logger);
+			const snapshotConfig = normalizeConfigPaths(applyTalkApiKey(applyTalkConfigNormalization(applyModelDefaults(applyAgentDefaults(applySessionDefaults(applyLoggingDefaults(applyMessageDefaults(validated.config))))))));
+			return {
+				snapshot: {
+					path: configPath,
+					exists: true,
+					raw,
+					parsed: parsedRes.parsed,
+					resolved: coerceConfig(resolvedConfigRaw),
+					valid: true,
+					config: snapshotConfig,
+					hash,
+					issues: [],
+					warnings: validated.warnings,
+					legacyIssues
+				},
+				envSnapshotForRestore: readResolution.envSnapshotForRestore
+			};
+		} catch (err) {
+			const nodeErr = err;
+			let message;
+			if (nodeErr?.code === "EACCES") {
+				const uid = process.getuid?.();
+				const uidHint = typeof uid === "number" ? String(uid) : "$(id -u)";
+				message = [
+					`read failed: ${String(err)}`,
+					``,
+					`Config file is not readable by the current process. If running in a container`,
+					`or 1-click deployment, fix ownership with:`,
+					`  chown ${uidHint} "${configPath}"`,
+					`Then restart the gateway.`
+				].join("\n");
+				deps.logger.error(message);
+			} else message = `read failed: ${String(err)}`;
+			return { snapshot: {
+				path: configPath,
+				exists: true,
+				raw: null,
+				parsed: {},
+				resolved: {},
+				valid: false,
+				config: {},
+				hash: hashConfigRaw(null),
+				issues: [{
+					path: "",
+					message
+				}],
+				warnings: [],
+				legacyIssues: []
+			} };
+		}
+	}
+	async function readConfigFileSnapshot() {
+		return (await readConfigFileSnapshotInternal()).snapshot;
+	}
+	async function readConfigFileSnapshotForWrite() {
+		const result = await readConfigFileSnapshotInternal();
+		return {
+			snapshot: result.snapshot,
+			writeOptions: {
+				envSnapshotForRestore: result.envSnapshotForRestore,
+				expectedConfigPath: configPath
+			}
+		};
+	}
+	async function writeConfigFile(cfg, options = {}) {
+		clearConfigCache();
+		let persistCandidate = cfg;
+		const { snapshot } = await readConfigFileSnapshotInternal();
+		let envRefMap = null;
+		let changedPaths = null;
+		if (snapshot.valid && snapshot.exists) {
+			const patch = createMergePatch(snapshot.config, cfg);
+			persistCandidate = applyMergePatch(snapshot.resolved, patch);
+			try {
+				const resolvedIncludes = resolveConfigIncludes(snapshot.parsed, configPath, {
+					readFile: (candidate) => deps.fs.readFileSync(candidate, "utf-8"),
+					parseJson: (raw) => deps.json5.parse(raw)
+				});
+				const collected = /* @__PURE__ */ new Map();
+				collectEnvRefPaths(resolvedIncludes, "", collected);
+				if (collected.size > 0) {
+					envRefMap = collected;
+					changedPaths = /* @__PURE__ */ new Set();
+					collectChangedPaths(snapshot.config, cfg, "", changedPaths);
+				}
+			} catch {
+				envRefMap = null;
+			}
+		}
+		const validated = validateConfigObjectRawWithPlugins(persistCandidate);
+		if (!validated.ok) {
+			const issue = validated.issues[0];
+			const pathLabel = issue?.path ? issue.path : "<root>";
+			const issueMessage = issue?.message ?? "invalid";
+			throw new Error(formatConfigValidationFailure(pathLabel, issueMessage));
+		}
+		if (validated.warnings.length > 0) {
+			const details = validated.warnings.map((warning) => `- ${warning.path}: ${warning.message}`).join("\n");
+			deps.logger.warn(`Config warnings:\n${details}`);
+		}
+		let cfgToWrite = validated.config;
+		try {
+			if (deps.fs.existsSync(configPath)) {
+				const parsedRes = parseConfigJson5(await deps.fs.promises.readFile(configPath, "utf-8"), deps.json5);
+				if (parsedRes.ok) {
+					const envForRestore = options.envSnapshotForRestore ?? deps.env;
+					cfgToWrite = restoreEnvVarRefs(cfgToWrite, parsedRes.parsed, envForRestore);
+				}
+			}
+		} catch {}
+		const dir = path.dirname(configPath);
+		await deps.fs.promises.mkdir(dir, {
+			recursive: true,
+			mode: 448
+		});
+		let outputConfig = envRefMap && changedPaths ? restoreEnvRefsFromMap(cfgToWrite, "", envRefMap, changedPaths) : cfgToWrite;
+		if (options.unsetPaths?.length) for (const unsetPath of options.unsetPaths) {
+			if (!Array.isArray(unsetPath) || unsetPath.length === 0) continue;
+			const unsetResult = unsetPathForWrite(outputConfig, unsetPath);
+			if (unsetResult.changed) outputConfig = unsetResult.next;
+		}
+		const stampedOutputConfig = stampConfigVersion(outputConfig);
+		const json = JSON.stringify(stampedOutputConfig, null, 2).trimEnd().concat("\n");
+		const nextHash = hashConfigRaw(json);
+		const previousHash = resolveConfigSnapshotHash(snapshot);
+		const changedPathCount = changedPaths?.size;
+		const previousBytes = typeof snapshot.raw === "string" ? Buffer.byteLength(snapshot.raw, "utf-8") : null;
+		const nextBytes = Buffer.byteLength(json, "utf-8");
+		const hasMetaBefore = hasConfigMeta(snapshot.parsed);
+		const hasMetaAfter = hasConfigMeta(stampedOutputConfig);
+		const gatewayModeBefore = resolveGatewayMode(snapshot.resolved);
+		const gatewayModeAfter = resolveGatewayMode(stampedOutputConfig);
+		const suspiciousReasons = resolveConfigWriteSuspiciousReasons({
+			existsBefore: snapshot.exists,
+			previousBytes,
+			nextBytes,
+			hasMetaBefore,
+			gatewayModeBefore,
+			gatewayModeAfter
+		});
+		const logConfigOverwrite = () => {
+			if (!snapshot.exists) return;
+			const isVitest = deps.env.VITEST === "true";
+			const shouldLogInVitest = deps.env.REMOTECLAW_TEST_CONFIG_OVERWRITE_LOG === "1";
+			if (isVitest && !shouldLogInVitest) return;
+			const changeSummary = typeof changedPathCount === "number" ? `, changedPaths=${changedPathCount}` : "";
+			deps.logger.warn(`Config overwrite: ${configPath} (sha256 ${previousHash ?? "unknown"} -> ${nextHash}, backup=${configPath}.bak${changeSummary})`);
+		};
+		const logConfigWriteAnomalies = () => {
+			if (suspiciousReasons.length === 0) return;
+			const isVitest = deps.env.VITEST === "true";
+			const shouldLogInVitest = deps.env.REMOTECLAW_TEST_CONFIG_WRITE_ANOMALY_LOG === "1";
+			if (isVitest && !shouldLogInVitest) return;
+			deps.logger.warn(`Config write anomaly: ${configPath} (${suspiciousReasons.join(", ")})`);
+		};
+		const auditRecordBase = {
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			source: "config-io",
+			event: "config.write",
+			configPath,
+			pid: process.pid,
+			ppid: process.ppid,
+			cwd: process.cwd(),
+			argv: process.argv.slice(0, 8),
+			execArgv: process.execArgv.slice(0, 8),
+			watchMode: deps.env.REMOTECLAW_WATCH_MODE === "1",
+			watchSession: typeof deps.env.REMOTECLAW_WATCH_SESSION === "string" && deps.env.REMOTECLAW_WATCH_SESSION.trim().length > 0 ? deps.env.REMOTECLAW_WATCH_SESSION.trim() : null,
+			watchCommand: typeof deps.env.REMOTECLAW_WATCH_COMMAND === "string" && deps.env.REMOTECLAW_WATCH_COMMAND.trim().length > 0 ? deps.env.REMOTECLAW_WATCH_COMMAND.trim() : null,
+			existsBefore: snapshot.exists,
+			previousHash: previousHash ?? null,
+			nextHash,
+			previousBytes,
+			nextBytes,
+			changedPathCount: typeof changedPathCount === "number" ? changedPathCount : null,
+			hasMetaBefore,
+			hasMetaAfter,
+			gatewayModeBefore,
+			gatewayModeAfter,
+			suspicious: suspiciousReasons
+		};
+		const appendWriteAudit = async (result, err) => {
+			const errorCode = err && typeof err === "object" && "code" in err && typeof err.code === "string" ? err.code : void 0;
+			const errorMessage = err && typeof err === "object" && "message" in err && typeof err.message === "string" ? err.message : void 0;
+			await appendConfigWriteAuditRecord(deps, {
+				...auditRecordBase,
+				result,
+				nextHash: result === "failed" ? null : auditRecordBase.nextHash,
+				nextBytes: result === "failed" ? null : auditRecordBase.nextBytes,
+				errorCode,
+				errorMessage
+			});
+		};
+		const tmp = path.join(dir, `${path.basename(configPath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+		try {
+			await deps.fs.promises.writeFile(tmp, json, {
+				encoding: "utf-8",
+				mode: 384
+			});
+			if (deps.fs.existsSync(configPath)) {
+				await rotateConfigBackups(configPath, deps.fs.promises);
+				await deps.fs.promises.copyFile(configPath, `${configPath}.bak`).catch(() => {});
+			}
+			try {
+				await deps.fs.promises.rename(tmp, configPath);
+			} catch (err) {
+				const code = err.code;
+				if (code === "EPERM" || code === "EEXIST") {
+					await deps.fs.promises.copyFile(tmp, configPath);
+					await deps.fs.promises.chmod(configPath, 384).catch(() => {});
+					await deps.fs.promises.unlink(tmp).catch(() => {});
+					logConfigOverwrite();
+					logConfigWriteAnomalies();
+					await appendWriteAudit("copy-fallback");
+					return;
+				}
+				await deps.fs.promises.unlink(tmp).catch(() => {});
+				throw err;
+			}
+			logConfigOverwrite();
+			logConfigWriteAnomalies();
+			await appendWriteAudit("rename");
+		} catch (err) {
+			await appendWriteAudit("failed", err);
+			throw err;
+		}
+	}
+	return {
+		configPath,
+		loadConfig,
+		readConfigFileSnapshot,
+		readConfigFileSnapshotForWrite,
+		writeConfigFile
+	};
+}
+const DEFAULT_CONFIG_CACHE_MS = 200;
+const AUTO_OWNER_DISPLAY_SECRET_BY_PATH = /* @__PURE__ */ new Map();
+const AUTO_OWNER_DISPLAY_SECRET_PERSIST_IN_FLIGHT = /* @__PURE__ */ new Set();
+const AUTO_OWNER_DISPLAY_SECRET_PERSIST_WARNED = /* @__PURE__ */ new Set();
+let configCache = null;
+function resolveConfigCacheMs(env) {
+	const raw = env.REMOTECLAW_CONFIG_CACHE_MS?.trim();
+	if (raw === "" || raw === "0") return 0;
+	if (!raw) return DEFAULT_CONFIG_CACHE_MS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return DEFAULT_CONFIG_CACHE_MS;
+	return Math.max(0, parsed);
+}
+function shouldUseConfigCache(env) {
+	if (env.REMOTECLAW_DISABLE_CONFIG_CACHE?.trim()) return false;
+	return resolveConfigCacheMs(env) > 0;
+}
+function clearConfigCache() {
+	configCache = null;
+}
+function loadConfig() {
+	const io = createConfigIO();
+	const configPath = io.configPath;
+	const now = Date.now();
+	if (shouldUseConfigCache(process.env)) {
+		const cached = configCache;
+		if (cached && cached.configPath === configPath && cached.expiresAt > now) return cached.config;
+	}
+	const config = io.loadConfig();
+	if (shouldUseConfigCache(process.env)) {
+		const cacheMs = resolveConfigCacheMs(process.env);
+		if (cacheMs > 0) configCache = {
+			configPath,
+			expiresAt: now + cacheMs,
+			config
+		};
+	}
+	return config;
+}
+async function readConfigFileSnapshot() {
+	return await createConfigIO().readConfigFileSnapshot();
+}
+async function readConfigFileSnapshotForWrite() {
+	return await createConfigIO().readConfigFileSnapshotForWrite();
+}
+async function writeConfigFile(cfg, options = {}) {
+	const io = createConfigIO();
+	const sameConfigPath = options.expectedConfigPath === void 0 || options.expectedConfigPath === io.configPath;
+	await io.writeConfigFile(cfg, {
+		envSnapshotForRestore: sameConfigPath ? options.envSnapshotForRestore : void 0,
+		unsetPaths: options.unsetPaths
+	});
+}
+
+//#endregion
+//#region src/config/legacy-migrate.ts
+function migrateLegacyConfig(raw) {
+	const { next, changes } = applyLegacyMigrations(raw);
+	if (!next) return {
+		config: null,
+		changes: []
+	};
+	const validated = validateConfigObjectWithPlugins(next);
+	if (!validated.ok) {
+		changes.push("Migration applied, but config still invalid; fix remaining issues manually.");
+		return {
+			config: null,
+			changes
+		};
+	}
+	return {
+		config: validated.config,
+		changes
+	};
+}
+
+//#endregion
+//#region src/config/config.ts
+var config_exports = /* @__PURE__ */ __exportAll({
+	CONFIG_PATH: () => CONFIG_PATH,
+	DEFAULT_GATEWAY_PORT: () => DEFAULT_GATEWAY_PORT,
+	STATE_DIR: () => STATE_DIR,
+	TOOLS_BY_SENDER_KEY_TYPES: () => TOOLS_BY_SENDER_KEY_TYPES,
+	applyConfigOverrides: () => applyConfigOverrides,
+	getConfigOverrides: () => getConfigOverrides,
+	isNixMode: () => isNixMode,
+	loadConfig: () => loadConfig,
+	parseToolsBySenderTypedKey: () => parseToolsBySenderTypedKey,
+	resetConfigOverrides: () => resetConfigOverrides,
+	resolveCanonicalConfigPath: () => resolveCanonicalConfigPath,
+	resolveConfigPath: () => resolveConfigPath,
+	resolveConfigPathCandidate: () => resolveConfigPathCandidate,
+	resolveDefaultConfigCandidates: () => resolveDefaultConfigCandidates,
+	resolveGatewayLockDir: () => resolveGatewayLockDir,
+	resolveGatewayPort: () => resolveGatewayPort,
+	resolveIsNixMode: () => resolveIsNixMode,
+	resolveNewStateDir: () => resolveNewStateDir,
+	resolveOAuthDir: () => resolveOAuthDir,
+	resolveStateDir: () => resolveStateDir,
+	setConfigOverride: () => setConfigOverride,
+	unsetConfigOverride: () => unsetConfigOverride
+});
+
+//#endregion
+export { resolveEffectiveEnableState as A, applyLegacyMigrations as B, discoverRemoteClawPlugins as C, resolveBundledPluginsDir as D, loadPluginManifest as E, getConfigValueAtPath as F, isPathInsideWithRealpath as G, MAX_INCLUDE_DEPTH as H, parseConfigPath as I, resolveAgentMaxConcurrent as J, buildTalkConfigResponse as K, setConfigValueAtPath as L, resetConfigOverrides as M, setConfigOverride as N, applyTestPluginDefaults as O, unsetConfigOverride as P, unsetConfigValueAtPath as R, loadPluginManifestRegistry as S, safeStatSync as T, extensionUsesSkippedScannerPath as U, INCLUDE_KEY as V, isPathInside$1 as W, loadDotEnv as X, resolveSubagentMaxConcurrent as Y, isWorkspaceRelativeAvatarPath as _, parseConfigJson5 as a, validateJsonSchemaValue as b, resolveConfigSnapshotHash as c, AVATAR_MAX_BYTES as d, isAvatarDataUrl as f, isSupportedLocalAvatarExtension as g, isPathWithinRoot as h, loadConfig as i, getConfigOverrides as j, normalizePluginsConfig as k, writeConfigFile as l, isAvatarImageDataUrl as m, migrateLegacyConfig as n, readConfigFileSnapshot as o, isAvatarHttpUrl as p, DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH as q, createConfigIO as r, readConfigFileSnapshotForWrite as s, config_exports as t, validateConfigObjectWithPlugins as u, looksLikeAvatarPath as v, isPathInside as w, clearPluginManifestRegistryCache as x, resolveAvatarMime as y, applyMergePatch as z };