remoteclaw 0.1.0-next.cd6ddde → 0.1.0-next.cf9ccbe

package/dist/extensionAPI.js

@@ -637,6 +637,8 @@ function createEmptyPluginRegistry() {
 		typedHooks: [],
 		channels: [],
 		providers: [],
+		sttProviders: [],
+		ttsProviders: [],
 		gatewayHandlers: {},
 		httpHandlers: [],
 		httpRoutes: [],
@@ -2631,962 +2633,9 @@ function resolveConfigIncludes(obj, configPath, resolver = defaultResolver) {
 	return new IncludeProcessor(configPath, resolver).process(obj);
 }
 
-//#endregion
-//#region src/config/discord-preview-streaming.ts
-function normalizeStreamingMode(value) {
-	if (typeof value !== "string") return null;
-	return value.trim().toLowerCase() || null;
-}
-function parseStreamingMode(value) {
-	const normalized = normalizeStreamingMode(value);
-	if (normalized === "off" || normalized === "partial" || normalized === "block" || normalized === "progress") return normalized;
-	return null;
-}
-function parseDiscordPreviewStreamMode(value) {
-	const parsed = parseStreamingMode(value);
-	if (!parsed) return null;
-	return parsed === "progress" ? "partial" : parsed;
-}
-function parseSlackLegacyDraftStreamMode(value) {
-	const normalized = normalizeStreamingMode(value);
-	if (normalized === "replace" || normalized === "status_final" || normalized === "append") return normalized;
-	return null;
-}
-function mapSlackLegacyDraftStreamModeToStreaming(mode) {
-	if (mode === "append") return "block";
-	if (mode === "status_final") return "progress";
-	return "partial";
-}
-function resolveTelegramPreviewStreamMode(params = {}) {
-	const parsedStreaming = parseStreamingMode(params.streaming);
-	if (parsedStreaming) {
-		if (parsedStreaming === "progress") return "partial";
-		return parsedStreaming;
-	}
-	const legacy = parseDiscordPreviewStreamMode(params.streamMode);
-	if (legacy) return legacy;
-	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
-	return "off";
-}
-function resolveDiscordPreviewStreamMode(params = {}) {
-	const parsedStreaming = parseDiscordPreviewStreamMode(params.streaming);
-	if (parsedStreaming) return parsedStreaming;
-	const legacy = parseDiscordPreviewStreamMode(params.streamMode);
-	if (legacy) return legacy;
-	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
-	return "off";
-}
-function resolveSlackStreamingMode(params = {}) {
-	const parsedStreaming = parseStreamingMode(params.streaming);
-	if (parsedStreaming) return parsedStreaming;
-	const legacyStreamMode = parseSlackLegacyDraftStreamMode(params.streamMode);
-	if (legacyStreamMode) return mapSlackLegacyDraftStreamModeToStreaming(legacyStreamMode);
-	if (typeof params.streaming === "boolean") return "partial";
-	return "partial";
-}
-function resolveSlackNativeStreaming(params = {}) {
-	if (typeof params.nativeStreaming === "boolean") return params.nativeStreaming;
-	if (typeof params.streaming === "boolean") return params.streaming;
-	return true;
-}
-
-//#endregion
-//#region src/infra/safe-executable-value.ts
-const SHELL_METACHARS = /[;&|`$<>]/;
-const CONTROL_CHARS = /[\r\n]/;
-const QUOTE_CHARS = /["']/;
-const BARE_NAME_PATTERN = /^[A-Za-z0-9._+-]+$/;
-function isLikelyPath(value) {
-	if (value.startsWith(".") || value.startsWith("~")) return true;
-	if (value.includes("/") || value.includes("\\")) return true;
-	return /^[A-Za-z]:[\\/]/.test(value);
-}
-function isSafeExecutableValue(value) {
-	if (!value) return false;
-	const trimmed = value.trim();
-	if (!trimmed) return false;
-	if (trimmed.includes("\0")) return false;
-	if (CONTROL_CHARS.test(trimmed)) return false;
-	if (SHELL_METACHARS.test(trimmed)) return false;
-	if (QUOTE_CHARS.test(trimmed)) return false;
-	if (isLikelyPath(trimmed)) return true;
-	if (trimmed.startsWith("-")) return false;
-	return BARE_NAME_PATTERN.test(trimmed);
-}
-
-//#endregion
-//#region src/config/legacy.shared.ts
-const getRecord = (value) => isRecord(value) ? value : null;
-const ensureRecord = (root, key) => {
-	const existing = root[key];
-	if (isRecord(existing)) return existing;
-	const next = {};
-	root[key] = next;
-	return next;
-};
-const mergeMissing = (target, source) => {
-	for (const [key, value] of Object.entries(source)) {
-		if (value === void 0 || isBlockedObjectKey(key)) continue;
-		const existing = target[key];
-		if (existing === void 0) {
-			target[key] = value;
-			continue;
-		}
-		if (isRecord(existing) && isRecord(value)) mergeMissing(existing, value);
-	}
-};
-const mapLegacyAudioTranscription = (value) => {
-	const transcriber = getRecord(value);
-	const command = Array.isArray(transcriber?.command) ? transcriber?.command : null;
-	if (!command || command.length === 0) return null;
-	if (typeof command[0] !== "string") return null;
-	if (!command.every((part) => typeof part === "string")) return null;
-	const rawExecutable = command[0].trim();
-	if (!rawExecutable) return null;
-	if (!isSafeExecutableValue(rawExecutable)) return null;
-	const args = command.slice(1);
-	const timeoutSeconds = typeof transcriber?.timeoutSeconds === "number" ? transcriber?.timeoutSeconds : void 0;
-	const result = {
-		command: rawExecutable,
-		type: "cli"
-	};
-	if (args.length > 0) result.args = args;
-	if (timeoutSeconds !== void 0) result.timeoutSeconds = timeoutSeconds;
-	return result;
-};
-const getAgentsList = (agents) => {
-	const list = agents?.list;
-	return Array.isArray(list) ? list : [];
-};
-const resolveDefaultAgentIdFromRaw = (raw) => {
-	const list = getAgentsList(getRecord(raw.agents));
-	const defaultEntry = list.find((entry) => isRecord(entry) && entry.default === true && typeof entry.id === "string" && entry.id.trim() !== "");
-	if (defaultEntry) return defaultEntry.id.trim();
-	const routing = getRecord(raw.routing);
-	const routingDefault = typeof routing?.defaultAgentId === "string" ? routing.defaultAgentId.trim() : "";
-	if (routingDefault) return routingDefault;
-	const firstEntry = list.find((entry) => isRecord(entry) && typeof entry.id === "string" && entry.id.trim() !== "");
-	if (firstEntry) return firstEntry.id.trim();
-	return "main";
-};
-const ensureAgentEntry = (list, id) => {
-	const normalized = id.trim();
-	const existing = list.find((entry) => isRecord(entry) && typeof entry.id === "string" && entry.id.trim() === normalized);
-	if (existing) return existing;
-	const created = { id: normalized };
-	list.push(created);
-	return created;
-};
-
-//#endregion
-//#region src/config/legacy.migrations.part-1.ts
-function migrateBindings(raw, changes, changeNote, mutator) {
-	const bindings = Array.isArray(raw.bindings) ? raw.bindings : null;
-	if (!bindings) return;
-	let touched = false;
-	for (const entry of bindings) {
-		if (!isRecord(entry)) continue;
-		const match = getRecord(entry.match);
-		if (!match) continue;
-		if (!mutator(match)) continue;
-		entry.match = match;
-		touched = true;
-	}
-	if (touched) {
-		raw.bindings = bindings;
-		changes.push(changeNote);
-	}
-}
-function ensureDefaultGroupEntry(section) {
-	const groups = isRecord(section.groups) ? section.groups : {};
-	const defaultKey = "*";
-	return {
-		groups,
-		entry: isRecord(groups[defaultKey]) ? groups[defaultKey] : {}
-	};
-}
-const LEGACY_CONFIG_MIGRATIONS_PART_1 = [
-	{
-		id: "bindings.match.provider->bindings.match.channel",
-		describe: "Move bindings[].match.provider to bindings[].match.channel",
-		apply: (raw, changes) => {
-			migrateBindings(raw, changes, "Moved bindings[].match.provider → bindings[].match.channel.", (match) => {
-				if (typeof match.channel === "string" && match.channel.trim()) return false;
-				const provider = typeof match.provider === "string" ? match.provider.trim() : "";
-				if (!provider) return false;
-				match.channel = provider;
-				delete match.provider;
-				return true;
-			});
-		}
-	},
-	{
-		id: "bindings.match.accountID->bindings.match.accountId",
-		describe: "Move bindings[].match.accountID to bindings[].match.accountId",
-		apply: (raw, changes) => {
-			migrateBindings(raw, changes, "Moved bindings[].match.accountID → bindings[].match.accountId.", (match) => {
-				if (match.accountId !== void 0) return false;
-				const accountID = typeof match.accountID === "string" ? match.accountID.trim() : match.accountID;
-				if (!accountID) return false;
-				match.accountId = accountID;
-				delete match.accountID;
-				return true;
-			});
-		}
-	},
-	{
-		id: "session.sendPolicy.rules.match.provider->match.channel",
-		describe: "Move session.sendPolicy.rules[].match.provider to match.channel",
-		apply: (raw, changes) => {
-			const session = getRecord(raw.session);
-			if (!session) return;
-			const sendPolicy = getRecord(session.sendPolicy);
-			if (!sendPolicy) return;
-			const rules = Array.isArray(sendPolicy.rules) ? sendPolicy.rules : null;
-			if (!rules) return;
-			let touched = false;
-			for (const rule of rules) {
-				if (!isRecord(rule)) continue;
-				const match = getRecord(rule.match);
-				if (!match) continue;
-				if (typeof match.channel === "string" && match.channel.trim()) continue;
-				const provider = typeof match.provider === "string" ? match.provider.trim() : "";
-				if (!provider) continue;
-				match.channel = provider;
-				delete match.provider;
-				rule.match = match;
-				touched = true;
-			}
-			if (touched) {
-				sendPolicy.rules = rules;
-				session.sendPolicy = sendPolicy;
-				raw.session = session;
-				changes.push("Moved session.sendPolicy.rules[].match.provider → match.channel.");
-			}
-		}
-	},
-	{
-		id: "messages.queue.byProvider->byChannel",
-		describe: "Move messages.queue.byProvider to messages.queue.byChannel",
-		apply: (raw, changes) => {
-			const messages = getRecord(raw.messages);
-			if (!messages) return;
-			const queue = getRecord(messages.queue);
-			if (!queue) return;
-			if (queue.byProvider === void 0) return;
-			if (queue.byChannel === void 0) {
-				queue.byChannel = queue.byProvider;
-				changes.push("Moved messages.queue.byProvider → messages.queue.byChannel.");
-			} else changes.push("Removed messages.queue.byProvider (messages.queue.byChannel already set).");
-			delete queue.byProvider;
-			messages.queue = queue;
-			raw.messages = messages;
-		}
-	},
-	{
-		id: "providers->channels",
-		describe: "Move provider config sections to channels.*",
-		apply: (raw, changes) => {
-			const legacyEntries = [
-				"whatsapp",
-				"telegram",
-				"discord",
-				"slack",
-				"signal",
-				"imessage",
-				"msteams"
-			].filter((key) => isRecord(raw[key]));
-			if (legacyEntries.length === 0) return;
-			const channels = ensureRecord(raw, "channels");
-			for (const key of legacyEntries) {
-				const legacy = getRecord(raw[key]);
-				if (!legacy) continue;
-				const channelEntry = ensureRecord(channels, key);
-				const hadEntries = Object.keys(channelEntry).length > 0;
-				mergeMissing(channelEntry, legacy);
-				channels[key] = channelEntry;
-				delete raw[key];
-				changes.push(hadEntries ? `Merged ${key} → channels.${key}.` : `Moved ${key} → channels.${key}.`);
-			}
-			raw.channels = channels;
-		}
-	},
-	{
-		id: "channels.streaming-keys->channels.streaming",
-		describe: "Normalize legacy streaming keys to channels.<provider>.streaming (Telegram/Discord/Slack)",
-		apply: (raw, changes) => {
-			const channels = getRecord(raw.channels);
-			if (!channels) return;
-			const migrateProviderEntry = (params) => {
-				const migrateCommonStreamingMode = (resolveMode) => {
-					const hasLegacyStreamMode = params.entry.streamMode !== void 0;
-					const legacyStreaming = params.entry.streaming;
-					if (!hasLegacyStreamMode && typeof legacyStreaming !== "boolean") return false;
-					const resolved = resolveMode(params.entry);
-					params.entry.streaming = resolved;
-					if (hasLegacyStreamMode) {
-						delete params.entry.streamMode;
-						changes.push(`Moved ${params.pathPrefix}.streamMode → ${params.pathPrefix}.streaming (${resolved}).`);
-					}
-					if (typeof legacyStreaming === "boolean") changes.push(`Normalized ${params.pathPrefix}.streaming boolean → enum (${resolved}).`);
-					return true;
-				};
-				const hasLegacyStreamMode = params.entry.streamMode !== void 0;
-				const legacyStreaming = params.entry.streaming;
-				const legacyNativeStreaming = params.entry.nativeStreaming;
-				if (params.provider === "telegram") {
-					migrateCommonStreamingMode(resolveTelegramPreviewStreamMode);
-					return;
-				}
-				if (params.provider === "discord") {
-					migrateCommonStreamingMode(resolveDiscordPreviewStreamMode);
-					return;
-				}
-				if (!hasLegacyStreamMode && typeof legacyStreaming !== "boolean") return;
-				const resolvedStreaming = resolveSlackStreamingMode(params.entry);
-				const resolvedNativeStreaming = resolveSlackNativeStreaming(params.entry);
-				params.entry.streaming = resolvedStreaming;
-				params.entry.nativeStreaming = resolvedNativeStreaming;
-				if (hasLegacyStreamMode) {
-					delete params.entry.streamMode;
-					changes.push(`Moved ${params.pathPrefix}.streamMode → ${params.pathPrefix}.streaming (${resolvedStreaming}).`);
-				}
-				if (typeof legacyStreaming === "boolean") changes.push(`Moved ${params.pathPrefix}.streaming (boolean) → ${params.pathPrefix}.nativeStreaming (${resolvedNativeStreaming}).`);
-				else if (typeof legacyNativeStreaming !== "boolean" && hasLegacyStreamMode) changes.push(`Set ${params.pathPrefix}.nativeStreaming → ${resolvedNativeStreaming}.`);
-			};
-			const migrateProvider = (provider) => {
-				const providerEntry = getRecord(channels[provider]);
-				if (!providerEntry) return;
-				migrateProviderEntry({
-					provider,
-					entry: providerEntry,
-					pathPrefix: `channels.${provider}`
-				});
-				const accounts = getRecord(providerEntry.accounts);
-				if (!accounts) return;
-				for (const [accountId, accountValue] of Object.entries(accounts)) {
-					const account = getRecord(accountValue);
-					if (!account) continue;
-					migrateProviderEntry({
-						provider,
-						entry: account,
-						pathPrefix: `channels.${provider}.accounts.${accountId}`
-					});
-				}
-			};
-			migrateProvider("telegram");
-			migrateProvider("discord");
-			migrateProvider("slack");
-		}
-	},
-	{
-		id: "routing.allowFrom->channels.whatsapp.allowFrom",
-		describe: "Move routing.allowFrom to channels.whatsapp.allowFrom",
-		apply: (raw, changes) => {
-			const routing = raw.routing;
-			if (!routing || typeof routing !== "object") return;
-			const allowFrom = routing.allowFrom;
-			if (allowFrom === void 0) return;
-			const channels = getRecord(raw.channels);
-			const whatsapp = channels ? getRecord(channels.whatsapp) : null;
-			if (!whatsapp) {
-				delete routing.allowFrom;
-				if (Object.keys(routing).length === 0) delete raw.routing;
-				changes.push("Removed routing.allowFrom (channels.whatsapp not configured).");
-				return;
-			}
-			if (whatsapp.allowFrom === void 0) {
-				whatsapp.allowFrom = allowFrom;
-				changes.push("Moved routing.allowFrom → channels.whatsapp.allowFrom.");
-			} else changes.push("Removed routing.allowFrom (channels.whatsapp.allowFrom already set).");
-			delete routing.allowFrom;
-			if (Object.keys(routing).length === 0) delete raw.routing;
-			channels.whatsapp = whatsapp;
-			raw.channels = channels;
-		}
-	},
-	{
-		id: "routing.groupChat.requireMention->groups.*.requireMention",
-		describe: "Move routing.groupChat.requireMention to channels.whatsapp/telegram/imessage groups",
-		apply: (raw, changes) => {
-			const routing = raw.routing;
-			if (!routing || typeof routing !== "object") return;
-			const groupChat = routing.groupChat && typeof routing.groupChat === "object" ? routing.groupChat : null;
-			if (!groupChat) return;
-			const requireMention = groupChat.requireMention;
-			if (requireMention === void 0) return;
-			const channels = ensureRecord(raw, "channels");
-			const applyTo = (key, options) => {
-				if (options?.requireExisting && !isRecord(channels[key])) return;
-				const section = channels[key] && typeof channels[key] === "object" ? channels[key] : {};
-				const { groups, entry } = ensureDefaultGroupEntry(section);
-				const defaultKey = "*";
-				if (entry.requireMention === void 0) {
-					entry.requireMention = requireMention;
-					groups[defaultKey] = entry;
-					section.groups = groups;
-					channels[key] = section;
-					changes.push(`Moved routing.groupChat.requireMention → channels.${key}.groups."*".requireMention.`);
-				} else changes.push(`Removed routing.groupChat.requireMention (channels.${key}.groups."*" already set).`);
-			};
-			applyTo("whatsapp", { requireExisting: true });
-			applyTo("telegram");
-			applyTo("imessage");
-			delete groupChat.requireMention;
-			if (Object.keys(groupChat).length === 0) delete routing.groupChat;
-			if (Object.keys(routing).length === 0) delete raw.routing;
-			raw.channels = channels;
-		}
-	},
-	{
-		id: "gateway.token->gateway.auth.token",
-		describe: "Move gateway.token to gateway.auth.token",
-		apply: (raw, changes) => {
-			const gateway = raw.gateway;
-			if (!gateway || typeof gateway !== "object") return;
-			const token = gateway.token;
-			if (token === void 0) return;
-			const gatewayObj = gateway;
-			const auth = gatewayObj.auth && typeof gatewayObj.auth === "object" ? gatewayObj.auth : {};
-			if (auth.token === void 0) {
-				auth.token = token;
-				if (!auth.mode) auth.mode = "token";
-				changes.push("Moved gateway.token → gateway.auth.token.");
-			} else changes.push("Removed gateway.token (gateway.auth.token already set).");
-			delete gatewayObj.token;
-			if (Object.keys(auth).length > 0) gatewayObj.auth = auth;
-			raw.gateway = gatewayObj;
-		}
-	},
-	{
-		id: "telegram.requireMention->channels.telegram.groups.*.requireMention",
-		describe: "Move telegram.requireMention to channels.telegram.groups.*.requireMention",
-		apply: (raw, changes) => {
-			const channels = ensureRecord(raw, "channels");
-			const telegram = channels.telegram;
-			if (!telegram || typeof telegram !== "object") return;
-			const requireMention = telegram.requireMention;
-			if (requireMention === void 0) return;
-			const { groups, entry } = ensureDefaultGroupEntry(telegram);
-			const defaultKey = "*";
-			if (entry.requireMention === void 0) {
-				entry.requireMention = requireMention;
-				groups[defaultKey] = entry;
-				telegram.groups = groups;
-				changes.push("Moved telegram.requireMention → channels.telegram.groups.\"*\".requireMention.");
-			} else changes.push("Removed telegram.requireMention (channels.telegram.groups.\"*\" already set).");
-			delete telegram.requireMention;
-			channels.telegram = telegram;
-			raw.channels = channels;
-		}
-	}
-];
-
-//#endregion
-//#region src/config/legacy.migrations.part-2.ts
-function applyLegacyAudioTranscriptionModel(params) {
-	const mapped = mapLegacyAudioTranscription(params.source);
-	if (!mapped) {
-		params.changes.push(params.invalidMessage);
-		return;
-	}
-	const mediaAudio = ensureRecord(ensureRecord(ensureRecord(params.raw, "tools"), "media"), "audio");
-	if ((Array.isArray(mediaAudio.models) ? mediaAudio.models : []).length === 0) {
-		mediaAudio.enabled = true;
-		mediaAudio.models = [mapped];
-		params.changes.push(params.movedMessage);
-		return;
-	}
-	params.changes.push(params.alreadySetMessage);
-}
-const LEGACY_CONFIG_MIGRATIONS_PART_2 = [
-	{
-		id: "agent.model-config-v2",
-		describe: "Migrate legacy agent.model/allowedModels/modelAliases/modelFallbacks/imageModelFallbacks to agent.models + model lists",
-		apply: (raw, changes) => {
-			const agentRoot = getRecord(raw.agent);
-			const defaults = getRecord(getRecord(raw.agents)?.defaults);
-			const agent = agentRoot ?? defaults;
-			if (!agent) return;
-			const label = agentRoot ? "agent" : "agents.defaults";
-			const legacyModel = typeof agent.model === "string" ? String(agent.model) : void 0;
-			const legacyImageModel = typeof agent.imageModel === "string" ? String(agent.imageModel) : void 0;
-			const legacyAllowed = Array.isArray(agent.allowedModels) ? agent.allowedModels.map(String) : [];
-			const legacyModelFallbacks = Array.isArray(agent.modelFallbacks) ? agent.modelFallbacks.map(String) : [];
-			const legacyImageModelFallbacks = Array.isArray(agent.imageModelFallbacks) ? agent.imageModelFallbacks.map(String) : [];
-			const legacyAliases = agent.modelAliases && typeof agent.modelAliases === "object" ? agent.modelAliases : {};
-			if (!(legacyModel || legacyImageModel || legacyAllowed.length > 0 || legacyModelFallbacks.length > 0 || legacyImageModelFallbacks.length > 0 || Object.keys(legacyAliases).length > 0)) return;
-			const models = agent.models && typeof agent.models === "object" ? agent.models : {};
-			const ensureModel = (rawKey) => {
-				if (typeof rawKey !== "string") return;
-				const key = rawKey.trim();
-				if (!key) return;
-				if (!models[key]) models[key] = {};
-			};
-			ensureModel(legacyModel);
-			ensureModel(legacyImageModel);
-			for (const key of legacyAllowed) ensureModel(key);
-			for (const key of legacyModelFallbacks) ensureModel(key);
-			for (const key of legacyImageModelFallbacks) ensureModel(key);
-			for (const target of Object.values(legacyAliases)) {
-				if (typeof target !== "string") continue;
-				ensureModel(target);
-			}
-			for (const [alias, targetRaw] of Object.entries(legacyAliases)) {
-				if (typeof targetRaw !== "string") continue;
-				const target = targetRaw.trim();
-				if (!target) continue;
-				const entry = models[target] && typeof models[target] === "object" ? models[target] : {};
-				if (!("alias" in entry)) {
-					entry.alias = alias;
-					models[target] = entry;
-				}
-			}
-			const currentModel = agent.model && typeof agent.model === "object" ? agent.model : null;
-			if (currentModel) {
-				if (!currentModel.primary && legacyModel) currentModel.primary = legacyModel;
-				if (legacyModelFallbacks.length > 0 && (!Array.isArray(currentModel.fallbacks) || currentModel.fallbacks.length === 0)) currentModel.fallbacks = legacyModelFallbacks;
-				agent.model = currentModel;
-			} else if (legacyModel || legacyModelFallbacks.length > 0) agent.model = {
-				primary: legacyModel,
-				fallbacks: legacyModelFallbacks.length ? legacyModelFallbacks : []
-			};
-			const currentImageModel = agent.imageModel && typeof agent.imageModel === "object" ? agent.imageModel : null;
-			if (currentImageModel) {
-				if (!currentImageModel.primary && legacyImageModel) currentImageModel.primary = legacyImageModel;
-				if (legacyImageModelFallbacks.length > 0 && (!Array.isArray(currentImageModel.fallbacks) || currentImageModel.fallbacks.length === 0)) currentImageModel.fallbacks = legacyImageModelFallbacks;
-				agent.imageModel = currentImageModel;
-			} else if (legacyImageModel || legacyImageModelFallbacks.length > 0) agent.imageModel = {
-				primary: legacyImageModel,
-				fallbacks: legacyImageModelFallbacks.length ? legacyImageModelFallbacks : []
-			};
-			agent.models = models;
-			if (legacyModel !== void 0) changes.push(`Migrated ${label}.model string → ${label}.model.primary.`);
-			if (legacyModelFallbacks.length > 0) changes.push(`Migrated ${label}.modelFallbacks → ${label}.model.fallbacks.`);
-			if (legacyImageModel !== void 0) changes.push(`Migrated ${label}.imageModel string → ${label}.imageModel.primary.`);
-			if (legacyImageModelFallbacks.length > 0) changes.push(`Migrated ${label}.imageModelFallbacks → ${label}.imageModel.fallbacks.`);
-			if (legacyAllowed.length > 0) changes.push(`Migrated ${label}.allowedModels → ${label}.models.`);
-			if (Object.keys(legacyAliases).length > 0) changes.push(`Migrated ${label}.modelAliases → ${label}.models.*.alias.`);
-			delete agent.allowedModels;
-			delete agent.modelAliases;
-			delete agent.modelFallbacks;
-			delete agent.imageModelFallbacks;
-		}
-	},
-	{
-		id: "routing.agents-v2",
-		describe: "Move routing.agents/defaultAgentId to agents.list",
-		apply: (raw, changes) => {
-			const routing = getRecord(raw.routing);
-			if (!routing) return;
-			const routingAgents = getRecord(routing.agents);
-			const agents = ensureRecord(raw, "agents");
-			const list = getAgentsList(agents);
-			if (routingAgents) {
-				for (const [rawId, entryRaw] of Object.entries(routingAgents)) {
-					const agentId = String(rawId ?? "").trim();
-					const entry = getRecord(entryRaw);
-					if (!agentId || !entry) continue;
-					const target = ensureAgentEntry(list, agentId);
-					const entryCopy = { ...entry };
-					if ("mentionPatterns" in entryCopy) {
-						const mentionPatterns = entryCopy.mentionPatterns;
-						const groupChat = ensureRecord(target, "groupChat");
-						if (groupChat.mentionPatterns === void 0) {
-							groupChat.mentionPatterns = mentionPatterns;
-							changes.push(`Moved routing.agents.${agentId}.mentionPatterns → agents.list (id "${agentId}").groupChat.mentionPatterns.`);
-						} else changes.push(`Removed routing.agents.${agentId}.mentionPatterns (agents.list groupChat mentionPatterns already set).`);
-						delete entryCopy.mentionPatterns;
-					}
-					const legacyGroupChat = getRecord(entryCopy.groupChat);
-					if (legacyGroupChat) {
-						mergeMissing(ensureRecord(target, "groupChat"), legacyGroupChat);
-						delete entryCopy.groupChat;
-					}
-					const legacySandbox = getRecord(entryCopy.sandbox);
-					if (legacySandbox) {
-						const sandboxTools = getRecord(legacySandbox.tools);
-						if (sandboxTools) {
-							mergeMissing(ensureRecord(ensureRecord(ensureRecord(target, "tools"), "sandbox"), "tools"), sandboxTools);
-							delete legacySandbox.tools;
-							changes.push(`Moved routing.agents.${agentId}.sandbox.tools → agents.list (id "${agentId}").tools.sandbox.tools.`);
-						}
-						entryCopy.sandbox = legacySandbox;
-					}
-					mergeMissing(target, entryCopy);
-				}
-				delete routing.agents;
-				changes.push("Moved routing.agents → agents.list.");
-			}
-			const defaultAgentId = typeof routing.defaultAgentId === "string" ? routing.defaultAgentId.trim() : "";
-			if (defaultAgentId) {
-				if (!list.some((entry) => isRecord(entry) && entry.default === true)) {
-					const entry = ensureAgentEntry(list, defaultAgentId);
-					entry.default = true;
-					changes.push(`Moved routing.defaultAgentId → agents.list (id "${defaultAgentId}").default.`);
-				} else changes.push("Removed routing.defaultAgentId (agents.list default already set).");
-				delete routing.defaultAgentId;
-			}
-			if (list.length > 0) agents.list = list;
-			if (Object.keys(routing).length === 0) delete raw.routing;
-		}
-	},
-	{
-		id: "routing.config-v2",
-		describe: "Move routing bindings/groupChat/queue/agentToAgent/transcribeAudio",
-		apply: (raw, changes) => {
-			const routing = getRecord(raw.routing);
-			if (!routing) return;
-			if (routing.bindings !== void 0) {
-				if (raw.bindings === void 0) {
-					raw.bindings = routing.bindings;
-					changes.push("Moved routing.bindings → bindings.");
-				} else changes.push("Removed routing.bindings (bindings already set).");
-				delete routing.bindings;
-			}
-			if (routing.agentToAgent !== void 0) {
-				const tools = ensureRecord(raw, "tools");
-				if (tools.agentToAgent === void 0) {
-					tools.agentToAgent = routing.agentToAgent;
-					changes.push("Moved routing.agentToAgent → tools.agentToAgent.");
-				} else changes.push("Removed routing.agentToAgent (tools.agentToAgent already set).");
-				delete routing.agentToAgent;
-			}
-			if (routing.queue !== void 0) {
-				const messages = ensureRecord(raw, "messages");
-				if (messages.queue === void 0) {
-					messages.queue = routing.queue;
-					changes.push("Moved routing.queue → messages.queue.");
-				} else changes.push("Removed routing.queue (messages.queue already set).");
-				delete routing.queue;
-			}
-			const groupChat = getRecord(routing.groupChat);
-			if (groupChat) {
-				const historyLimit = groupChat.historyLimit;
-				if (historyLimit !== void 0) {
-					const messagesGroup = ensureRecord(ensureRecord(raw, "messages"), "groupChat");
-					if (messagesGroup.historyLimit === void 0) {
-						messagesGroup.historyLimit = historyLimit;
-						changes.push("Moved routing.groupChat.historyLimit → messages.groupChat.historyLimit.");
-					} else changes.push("Removed routing.groupChat.historyLimit (messages.groupChat.historyLimit already set).");
-					delete groupChat.historyLimit;
-				}
-				const mentionPatterns = groupChat.mentionPatterns;
-				if (mentionPatterns !== void 0) {
-					const messagesGroup = ensureRecord(ensureRecord(raw, "messages"), "groupChat");
-					if (messagesGroup.mentionPatterns === void 0) {
-						messagesGroup.mentionPatterns = mentionPatterns;
-						changes.push("Moved routing.groupChat.mentionPatterns → messages.groupChat.mentionPatterns.");
-					} else changes.push("Removed routing.groupChat.mentionPatterns (messages.groupChat.mentionPatterns already set).");
-					delete groupChat.mentionPatterns;
-				}
-				if (Object.keys(groupChat).length === 0) delete routing.groupChat;
-				else routing.groupChat = groupChat;
-			}
-			if (routing.transcribeAudio !== void 0) {
-				applyLegacyAudioTranscriptionModel({
-					raw,
-					source: routing.transcribeAudio,
-					changes,
-					movedMessage: "Moved routing.transcribeAudio → tools.media.audio.models.",
-					alreadySetMessage: "Removed routing.transcribeAudio (tools.media.audio.models already set).",
-					invalidMessage: "Removed routing.transcribeAudio (invalid or empty command)."
-				});
-				delete routing.transcribeAudio;
-			}
-			if (Object.keys(routing).length === 0) delete raw.routing;
-		}
-	},
-	{
-		id: "audio.transcription-v2",
-		describe: "Move audio.transcription to tools.media.audio.models",
-		apply: (raw, changes) => {
-			const audio = getRecord(raw.audio);
-			if (audio?.transcription === void 0) return;
-			applyLegacyAudioTranscriptionModel({
-				raw,
-				source: audio.transcription,
-				changes,
-				movedMessage: "Moved audio.transcription → tools.media.audio.models.",
-				alreadySetMessage: "Removed audio.transcription (tools.media.audio.models already set).",
-				invalidMessage: "Removed audio.transcription (invalid or empty command)."
-			});
-			delete audio.transcription;
-			if (Object.keys(audio).length === 0) delete raw.audio;
-			else raw.audio = audio;
-		}
-	}
-];
-
-//#endregion
-//#region src/config/legacy.migrations.part-3.ts
-const LEGACY_CONFIG_MIGRATIONS_PART_3 = [
-	{
-		id: "auth.anthropic-claude-cli-mode-oauth",
-		describe: "Switch anthropic:claude-cli auth profile mode to oauth",
-		apply: (raw, changes) => {
-			const profiles = getRecord(getRecord(raw.auth)?.profiles);
-			if (!profiles) return;
-			const claudeCli = getRecord(profiles["anthropic:claude-cli"]);
-			if (!claudeCli) return;
-			if (claudeCli.mode !== "token") return;
-			claudeCli.mode = "oauth";
-			changes.push("Updated auth.profiles[\"anthropic:claude-cli\"].mode → \"oauth\".");
-		}
-	},
-	{
-		id: "tools.bash->tools.exec",
-		describe: "Move tools.bash to tools.exec",
-		apply: (raw, changes) => {
-			const tools = ensureRecord(raw, "tools");
-			const bash = getRecord(tools.bash);
-			if (!bash) return;
-			if (tools.exec === void 0) {
-				tools.exec = bash;
-				changes.push("Moved tools.bash → tools.exec.");
-			} else changes.push("Removed tools.bash (tools.exec already set).");
-			delete tools.bash;
-		}
-	},
-	{
-		id: "messages.tts.enabled->auto",
-		describe: "Move messages.tts.enabled to messages.tts.auto",
-		apply: (raw, changes) => {
-			const tts = getRecord(getRecord(raw.messages)?.tts);
-			if (!tts) return;
-			if (tts.auto !== void 0) {
-				if ("enabled" in tts) {
-					delete tts.enabled;
-					changes.push("Removed messages.tts.enabled (messages.tts.auto already set).");
-				}
-				return;
-			}
-			if (typeof tts.enabled !== "boolean") return;
-			tts.auto = tts.enabled ? "always" : "off";
-			delete tts.enabled;
-			changes.push(`Moved messages.tts.enabled → messages.tts.auto (${String(tts.auto)}).`);
-		}
-	},
-	{
-		id: "agent.defaults-v2",
-		describe: "Move agent config to agents.defaults and tools",
-		apply: (raw, changes) => {
-			const agent = getRecord(raw.agent);
-			if (!agent) return;
-			const agents = ensureRecord(raw, "agents");
-			const defaults = getRecord(agents.defaults) ?? {};
-			const tools = ensureRecord(raw, "tools");
-			const agentTools = getRecord(agent.tools);
-			if (agentTools) {
-				if (tools.allow === void 0 && agentTools.allow !== void 0) {
-					tools.allow = agentTools.allow;
-					changes.push("Moved agent.tools.allow → tools.allow.");
-				}
-				if (tools.deny === void 0 && agentTools.deny !== void 0) {
-					tools.deny = agentTools.deny;
-					changes.push("Moved agent.tools.deny → tools.deny.");
-				}
-			}
-			const elevated = getRecord(agent.elevated);
-			if (elevated) if (tools.elevated === void 0) {
-				tools.elevated = elevated;
-				changes.push("Moved agent.elevated → tools.elevated.");
-			} else changes.push("Removed agent.elevated (tools.elevated already set).");
-			const bash = getRecord(agent.bash);
-			if (bash) if (tools.exec === void 0) {
-				tools.exec = bash;
-				changes.push("Moved agent.bash → tools.exec.");
-			} else changes.push("Removed agent.bash (tools.exec already set).");
-			const sandbox = getRecord(agent.sandbox);
-			if (sandbox) {
-				const sandboxTools = getRecord(sandbox.tools);
-				if (sandboxTools) {
-					mergeMissing(ensureRecord(ensureRecord(tools, "sandbox"), "tools"), sandboxTools);
-					delete sandbox.tools;
-					changes.push("Moved agent.sandbox.tools → tools.sandbox.tools.");
-				}
-			}
-			const subagents = getRecord(agent.subagents);
-			if (subagents) {
-				const subagentTools = getRecord(subagents.tools);
-				if (subagentTools) {
-					mergeMissing(ensureRecord(ensureRecord(tools, "subagents"), "tools"), subagentTools);
-					delete subagents.tools;
-					changes.push("Moved agent.subagents.tools → tools.subagents.tools.");
-				}
-			}
-			const agentCopy = structuredClone(agent);
-			delete agentCopy.tools;
-			delete agentCopy.elevated;
-			delete agentCopy.bash;
-			if (isRecord(agentCopy.sandbox)) delete agentCopy.sandbox.tools;
-			if (isRecord(agentCopy.subagents)) delete agentCopy.subagents.tools;
-			mergeMissing(defaults, agentCopy);
-			agents.defaults = defaults;
-			raw.agents = agents;
-			delete raw.agent;
-			changes.push("Moved agent → agents.defaults.");
-		}
-	},
-	{
-		id: "identity->agents.list",
-		describe: "Move identity to agents.list[].identity",
-		apply: (raw, changes) => {
-			const identity = getRecord(raw.identity);
-			if (!identity) return;
-			const agents = ensureRecord(raw, "agents");
-			const list = getAgentsList(agents);
-			const defaultId = resolveDefaultAgentIdFromRaw(raw);
-			const entry = ensureAgentEntry(list, defaultId);
-			if (entry.identity === void 0) {
-				entry.identity = identity;
-				changes.push(`Moved identity → agents.list (id "${defaultId}").identity.`);
-			} else changes.push("Removed identity (agents.list identity already set).");
-			agents.list = list;
-			raw.agents = agents;
-			delete raw.identity;
-		}
-	}
-];
-
-//#endregion
-//#region src/config/legacy.migrations.ts
-const LEGACY_CONFIG_MIGRATIONS = [
-	...LEGACY_CONFIG_MIGRATIONS_PART_1,
-	...LEGACY_CONFIG_MIGRATIONS_PART_2,
-	...LEGACY_CONFIG_MIGRATIONS_PART_3
-];
-
 //#endregion
 //#region src/config/legacy.rules.ts
-const LEGACY_CONFIG_RULES = [
-	{
-		path: ["whatsapp"],
-		message: "whatsapp config moved to channels.whatsapp (auto-migrated on load)."
-	},
-	{
-		path: ["telegram"],
-		message: "telegram config moved to channels.telegram (auto-migrated on load)."
-	},
-	{
-		path: ["discord"],
-		message: "discord config moved to channels.discord (auto-migrated on load)."
-	},
-	{
-		path: ["slack"],
-		message: "slack config moved to channels.slack (auto-migrated on load)."
-	},
-	{
-		path: ["signal"],
-		message: "signal config moved to channels.signal (auto-migrated on load)."
-	},
-	{
-		path: ["imessage"],
-		message: "imessage config moved to channels.imessage (auto-migrated on load)."
-	},
-	{
-		path: ["msteams"],
-		message: "msteams config moved to channels.msteams (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "allowFrom"],
-		message: "routing.allowFrom was removed; use channels.whatsapp.allowFrom instead (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "bindings"],
-		message: "routing.bindings was moved; use top-level bindings instead (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "agents"],
-		message: "routing.agents was moved; use agents.list instead (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "defaultAgentId"],
-		message: "routing.defaultAgentId was moved; use agents.list[].default instead (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "agentToAgent"],
-		message: "routing.agentToAgent was moved; use tools.agentToAgent instead (auto-migrated on load)."
-	},
-	{
-		path: [
-			"routing",
-			"groupChat",
-			"requireMention"
-		],
-		message: "routing.groupChat.requireMention was removed; use channels.whatsapp/telegram/imessage groups defaults (e.g. channels.whatsapp.groups.\"*\".requireMention) instead (auto-migrated on load)."
-	},
-	{
-		path: [
-			"routing",
-			"groupChat",
-			"mentionPatterns"
-		],
-		message: "routing.groupChat.mentionPatterns was moved; use agents.list[].groupChat.mentionPatterns or messages.groupChat.mentionPatterns instead (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "queue"],
-		message: "routing.queue was moved; use messages.queue instead (auto-migrated on load)."
-	},
-	{
-		path: ["routing", "transcribeAudio"],
-		message: "routing.transcribeAudio was moved; use tools.media.audio.models instead (auto-migrated on load)."
-	},
-	{
-		path: ["telegram", "requireMention"],
-		message: "telegram.requireMention was removed; use channels.telegram.groups.\"*\".requireMention instead (auto-migrated on load)."
-	},
-	{
-		path: ["identity"],
-		message: "identity was moved; use agents.list[].identity instead (auto-migrated on load)."
-	},
-	{
-		path: ["agent"],
-		message: "agent.* was moved; use agents.defaults (and tools.* for tool/elevated/exec settings) instead (auto-migrated on load)."
-	},
-	{
-		path: ["tools", "bash"],
-		message: "tools.bash was removed; use tools.exec instead (auto-migrated on load)."
-	},
-	{
-		path: ["agent", "model"],
-		message: "agent.model string was replaced by agents.defaults.model.primary/fallbacks and agents.defaults.models (auto-migrated on load).",
-		match: (value) => typeof value === "string"
-	},
-	{
-		path: ["agent", "imageModel"],
-		message: "agent.imageModel string was replaced by agents.defaults.imageModel.primary/fallbacks (auto-migrated on load).",
-		match: (value) => typeof value === "string"
-	},
-	{
-		path: ["agent", "allowedModels"],
-		message: "agent.allowedModels was replaced by agents.defaults.models (auto-migrated on load)."
-	},
-	{
-		path: ["agent", "modelAliases"],
-		message: "agent.modelAliases was replaced by agents.defaults.models.*.alias (auto-migrated on load)."
-	},
-	{
-		path: ["agent", "modelFallbacks"],
-		message: "agent.modelFallbacks was replaced by agents.defaults.model.fallbacks (auto-migrated on load)."
-	},
-	{
-		path: ["agent", "imageModelFallbacks"],
-		message: "agent.imageModelFallbacks was replaced by agents.defaults.imageModel.fallbacks (auto-migrated on load)."
-	},
-	{
-		path: [
-			"messages",
-			"tts",
-			"enabled"
-		],
-		message: "messages.tts.enabled was replaced by messages.tts.auto (auto-migrated on load)."
-	},
-	{
-		path: ["gateway", "token"],
-		message: "gateway.token is ignored; use gateway.auth.token instead (auto-migrated on load)."
-	}
-];
+const LEGACY_CONFIG_RULES = [];
 
 //#endregion
 //#region src/config/legacy.ts
@@ -3832,27 +2881,15 @@ function resolveBundledPluginsDir() {
 	} catch {}
 }
 
-//#endregion
-//#region src/compat/legacy-names.ts
-const PROJECT_NAME = "remoteclaw";
-const LEGACY_PROJECT_NAMES = [];
-const MANIFEST_KEY = PROJECT_NAME;
-const LEGACY_MANIFEST_KEYS = LEGACY_PROJECT_NAMES;
-const LEGACY_PLUGIN_MANIFEST_FILENAMES = [];
-
 //#endregion
 //#region src/plugins/manifest.ts
+const MANIFEST_KEY = "remoteclaw";
 const PLUGIN_MANIFEST_FILENAME = "remoteclaw.plugin.json";
-const PLUGIN_MANIFEST_FILENAMES = [PLUGIN_MANIFEST_FILENAME, ...LEGACY_PLUGIN_MANIFEST_FILENAMES];
 function normalizeStringList(value) {
 	if (!Array.isArray(value)) return [];
 	return value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
 }
 function resolvePluginManifestPath(rootDir) {
-	for (const filename of PLUGIN_MANIFEST_FILENAMES) {
-		const candidate = path.join(rootDir, filename);
-		if (fs.existsSync(candidate)) return candidate;
-	}
 	return path.join(rootDir, PLUGIN_MANIFEST_FILENAME);
 }
 function loadPluginManifest(rootDir) {
@@ -3896,6 +2933,8 @@ function loadPluginManifest(rootDir) {
 	const channels = normalizeStringList(raw.channels);
 	const providers = normalizeStringList(raw.providers);
 	const skills = normalizeStringList(raw.skills);
+	const stt = normalizeStringList(raw.stt);
+	const tts = normalizeStringList(raw.tts);
 	let uiHints;
 	if (isRecord(raw.uiHints)) uiHints = raw.uiHints;
 	return {
@@ -3907,6 +2946,8 @@ function loadPluginManifest(rootDir) {
 			channels,
 			providers,
 			skills,
+			stt,
+			tts,
 			name,
 			description,
 			version,
@@ -3917,12 +2958,7 @@ function loadPluginManifest(rootDir) {
 }
 function getPackageManifestMetadata(manifest) {
 	if (!manifest) return;
-	const current = manifest[MANIFEST_KEY];
-	if (current) return current;
-	for (const key of LEGACY_MANIFEST_KEYS) {
-		const legacy = manifest[key];
-		if (legacy) return legacy;
-	}
+	return manifest[MANIFEST_KEY];
 }
 
 //#endregion
@@ -4412,6 +3448,8 @@ function buildRecord(params) {
 		channels: params.manifest.channels ?? [],
 		providers: params.manifest.providers ?? [],
 		skills: params.manifest.skills ?? [],
+		stt: params.manifest.stt ?? [],
+		tts: params.manifest.tts ?? [],
 		origin: params.candidate.origin,
 		workspaceDir: params.candidate.workspaceDir,
 		rootDir: params.candidate.rootDir,
@@ -4642,27 +3680,27 @@ function parseDurationMs(raw, opts) {
 }
 
 //#endregion
-//#region src/config/zod-schema.allowdeny.ts
-const AllowDenyActionSchema = z.union([z.literal("allow"), z.literal("deny")]);
-const AllowDenyChatTypeSchema = z.union([
-	z.literal("direct"),
-	z.literal("group"),
-	z.literal("channel"),
-	z.literal("dm")
-]).optional();
-function createAllowDenyChannelRulesSchema() {
-	return z.object({
-		default: AllowDenyActionSchema.optional(),
-		rules: z.array(z.object({
-			action: AllowDenyActionSchema,
-			match: z.object({
-				channel: z.string().optional(),
-				chatType: AllowDenyChatTypeSchema,
-				keyPrefix: z.string().optional(),
-				rawKeyPrefix: z.string().optional()
-			}).strict().optional()
-		}).strict()).optional()
-	}).strict().optional();
+//#region src/infra/safe-executable-value.ts
+const SHELL_METACHARS = /[;&|`$<>]/;
+const CONTROL_CHARS = /[\r\n]/;
+const QUOTE_CHARS = /["']/;
+const BARE_NAME_PATTERN = /^[A-Za-z0-9._+-]+$/;
+function isLikelyPath(value) {
+	if (value.startsWith(".") || value.startsWith("~")) return true;
+	if (value.includes("/") || value.includes("\\")) return true;
+	return /^[A-Za-z]:[\\/]/.test(value);
+}
+function isSafeExecutableValue(value) {
+	if (!value) return false;
+	const trimmed = value.trim();
+	if (!trimmed) return false;
+	if (trimmed.includes("\0")) return false;
+	if (CONTROL_CHARS.test(trimmed)) return false;
+	if (SHELL_METACHARS.test(trimmed)) return false;
+	if (QUOTE_CHARS.test(trimmed)) return false;
+	if (isLikelyPath(trimmed)) return true;
+	if (trimmed.startsWith("-")) return false;
+	return BARE_NAME_PATTERN.test(trimmed);
 }
 
 //#endregion
@@ -4749,11 +3787,7 @@ const MarkdownTableModeSchema = z.enum([
 	"code"
 ]);
 const MarkdownConfigSchema = z.object({ tables: MarkdownTableModeSchema.optional() }).strict().optional();
-const TtsProviderSchema = z.enum([
-	"elevenlabs",
-	"openai",
-	"edge"
-]);
+const TtsProviderSchema = z.string().min(1);
 const TtsModeSchema = z.enum(["final", "all"]);
 const TtsAutoSchema = z.enum([
 	"off",
@@ -4931,22 +3965,6 @@ const TranscribeAudioSchema = z.object({
 }).strict().optional();
 const HexColorSchema = z.string().regex(/^#?[0-9a-fA-F]{6}$/, "expected hex color (RRGGBB)");
 const ExecutableTokenSchema = z.string().refine(isSafeExecutableValue, "expected safe executable name or path");
-const MediaUnderstandingScopeSchema = createAllowDenyChannelRulesSchema();
-const MediaUnderstandingCapabilitiesSchema = z.array(z.union([
-	z.literal("image"),
-	z.literal("audio"),
-	z.literal("video")
-])).optional();
-const MediaUnderstandingAttachmentsSchema = z.object({
-	mode: z.union([z.literal("first"), z.literal("all")]).optional(),
-	maxAttachments: z.number().int().positive().optional(),
-	prefer: z.union([
-		z.literal("first"),
-		z.literal("last"),
-		z.literal("path"),
-		z.literal("url")
-	]).optional()
-}).strict().optional();
 const DeepgramAudioSchema = z.object({
 	detectLanguage: z.boolean().optional(),
 	punctuate: z.boolean().optional(),
@@ -4970,7 +3988,6 @@ const MediaUnderstandingRuntimeFields = {
 const MediaUnderstandingModelSchema = z.object({
 	provider: z.string().optional(),
 	model: z.string().optional(),
-	capabilities: MediaUnderstandingCapabilitiesSchema,
 	type: z.union([z.literal("provider"), z.literal("cli")]).optional(),
 	command: z.string().optional(),
 	args: z.array(z.string()).optional(),
@@ -4982,33 +3999,12 @@ const MediaUnderstandingModelSchema = z.object({
 }).strict().optional();
 const ToolsMediaUnderstandingSchema = z.object({
 	enabled: z.boolean().optional(),
-	scope: MediaUnderstandingScopeSchema,
 	maxBytes: z.number().int().positive().optional(),
 	maxChars: z.number().int().positive().optional(),
 	...MediaUnderstandingRuntimeFields,
-	attachments: MediaUnderstandingAttachmentsSchema,
 	models: z.array(MediaUnderstandingModelSchema).optional()
 }).strict().optional();
-const ToolsMediaSchema = z.object({
-	models: z.array(MediaUnderstandingModelSchema).optional(),
-	concurrency: z.number().int().positive().optional(),
-	image: ToolsMediaUnderstandingSchema.optional(),
-	audio: ToolsMediaUnderstandingSchema.optional(),
-	video: ToolsMediaUnderstandingSchema.optional()
-}).strict().optional();
-const LinkModelSchema = z.object({
-	type: z.literal("cli").optional(),
-	command: z.string().min(1),
-	args: z.array(z.string()).optional(),
-	timeoutSeconds: z.number().int().positive().optional()
-}).strict();
-const ToolsLinksSchema = z.object({
-	enabled: z.boolean().optional(),
-	scope: MediaUnderstandingScopeSchema,
-	maxLinks: z.number().int().positive().optional(),
-	timeoutSeconds: z.number().int().positive().optional(),
-	models: z.array(LinkModelSchema).optional()
-}).strict().optional();
+const ToolsMediaSchema = z.object({ audio: ToolsMediaUnderstandingSchema.optional() }).strict().optional();
 const NativeCommandsSettingSchema = z.union([z.boolean(), z.literal("auto")]);
 const ProviderCommandsSchema = z.object({ native: NativeCommandsSettingSchema.optional() }).strict().optional();
 
@@ -5113,7 +4109,6 @@ const ToolPolicyWithProfileSchema = z.object({
 }).strict().superRefine((value, ctx) => {
 	addAllowAlsoAllowConflictIssue(value, ctx, "tools.byProvider policy cannot set both allow and alsoAllow in the same scope (merge alsoAllow into allow, or remove allow and use profile + alsoAllow)");
 });
-const ElevatedAllowFromSchema = z.record(z.string(), z.array(z.union([z.string(), z.number()]))).optional();
 const ToolExecSafeBinProfileSchema = z.object({
 	minPositional: z.number().int().nonnegative().optional(),
 	maxPositional: z.number().int().nonnegative().optional(),
@@ -5162,10 +4157,6 @@ const CommonToolPolicyFields = {
 };
 const AgentToolsSchema = z.object({
 	...CommonToolPolicyFields,
-	elevated: z.object({
-		enabled: z.boolean().optional(),
-		allowFrom: ElevatedAllowFromSchema
-	}).strict().optional(),
 	exec: AgentToolExecSchema,
 	fs: ToolFsSchema
 }).strict().superRefine((value, ctx) => {
@@ -5195,7 +4186,6 @@ const AgentEntrySchema = z.object({
 const ToolsSchema = z.object({
 	...CommonToolPolicyFields,
 	media: ToolsMediaSchema,
-	links: ToolsLinksSchema,
 	sessions: z.object({ visibility: z.enum([
 		"self",
 		"tree",
@@ -5219,10 +4209,6 @@ const ToolsSchema = z.object({
 		enabled: z.boolean().optional(),
 		allow: z.array(z.string()).optional()
 	}).strict().optional(),
-	elevated: z.object({
-		enabled: z.boolean().optional(),
-		allowFrom: ElevatedAllowFromSchema
-	}).strict().optional(),
 	exec: ToolExecSchema,
 	fs: ToolFsSchema,
 	subagents: z.object({ tools: ToolPolicySchema }).strict().optional()
@@ -5238,9 +4224,6 @@ const AgentDefaultsSchema = z.object({
 	models: z.unknown().optional(),
 	workspace: z.string().optional(),
 	repoRoot: z.string().optional(),
-	skipBootstrap: z.boolean().optional(),
-	bootstrapMaxChars: z.number().int().positive().optional(),
-	bootstrapTotalMaxChars: z.number().int().positive().optional(),
 	userTimezone: z.string().optional(),
 	timeFormat: z.union([
 		z.literal("auto"),
@@ -5278,12 +4261,6 @@ const AgentDefaultsSchema = z.object({
 		z.literal("on"),
 		z.literal("full")
 	]).optional(),
-	elevatedDefault: z.union([
-		z.literal("off"),
-		z.literal("on"),
-		z.literal("ask"),
-		z.literal("full")
-	]).optional(),
 	blockStreamingDefault: z.union([z.literal("off"), z.literal("on")]).optional(),
 	blockStreamingBreak: z.union([z.literal("text_end"), z.literal("message_end")]).optional(),
 	blockStreamingChunk: BlockStreamingChunkSchema.optional(),
@@ -5564,6 +4541,65 @@ function isValidInboundPathRootPattern(value) {
 	return segments.every((segment) => segment === WILDCARD_SEGMENT || !segment.includes("*"));
 }
 
+//#endregion
+//#region src/config/discord-preview-streaming.ts
+function normalizeStreamingMode(value) {
+	if (typeof value !== "string") return null;
+	return value.trim().toLowerCase() || null;
+}
+function parseStreamingMode(value) {
+	const normalized = normalizeStreamingMode(value);
+	if (normalized === "off" || normalized === "partial" || normalized === "block" || normalized === "progress") return normalized;
+	return null;
+}
+function parseDiscordPreviewStreamMode(value) {
+	const parsed = parseStreamingMode(value);
+	if (!parsed) return null;
+	return parsed === "progress" ? "partial" : parsed;
+}
+function parseSlackLegacyDraftStreamMode(value) {
+	const normalized = normalizeStreamingMode(value);
+	if (normalized === "replace" || normalized === "status_final" || normalized === "append") return normalized;
+	return null;
+}
+function mapSlackLegacyDraftStreamModeToStreaming(mode) {
+	if (mode === "append") return "block";
+	if (mode === "status_final") return "progress";
+	return "partial";
+}
+function resolveTelegramPreviewStreamMode(params = {}) {
+	const parsedStreaming = parseStreamingMode(params.streaming);
+	if (parsedStreaming) {
+		if (parsedStreaming === "progress") return "partial";
+		return parsedStreaming;
+	}
+	const legacy = parseDiscordPreviewStreamMode(params.streamMode);
+	if (legacy) return legacy;
+	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
+	return "off";
+}
+function resolveDiscordPreviewStreamMode(params = {}) {
+	const parsedStreaming = parseDiscordPreviewStreamMode(params.streaming);
+	if (parsedStreaming) return parsedStreaming;
+	const legacy = parseDiscordPreviewStreamMode(params.streamMode);
+	if (legacy) return legacy;
+	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
+	return "off";
+}
+function resolveSlackStreamingMode(params = {}) {
+	const parsedStreaming = parseStreamingMode(params.streaming);
+	if (parsedStreaming) return parsedStreaming;
+	const legacyStreamMode = parseSlackLegacyDraftStreamMode(params.streamMode);
+	if (legacyStreamMode) return mapSlackLegacyDraftStreamModeToStreaming(legacyStreamMode);
+	if (typeof params.streaming === "boolean") return "partial";
+	return "partial";
+}
+function resolveSlackNativeStreaming(params = {}) {
+	if (typeof params.nativeStreaming === "boolean") return params.nativeStreaming;
+	if (typeof params.streaming === "boolean") return params.streaming;
+	return true;
+}
+
 //#endregion
 //#region src/config/telegram-custom-commands.ts
 const TELEGRAM_COMMAND_NAME_PATTERN = /^[a-z0-9_]{1,32}$/;
@@ -6632,6 +5668,30 @@ const ChannelsSchema = z.object({
 	msteams: MSTeamsConfigSchema.optional()
 }).passthrough().optional();
 
+//#endregion
+//#region src/config/zod-schema.allowdeny.ts
+const AllowDenyActionSchema = z.union([z.literal("allow"), z.literal("deny")]);
+const AllowDenyChatTypeSchema = z.union([
+	z.literal("direct"),
+	z.literal("group"),
+	z.literal("channel"),
+	z.literal("dm")
+]).optional();
+function createAllowDenyChannelRulesSchema() {
+	return z.object({
+		default: AllowDenyActionSchema.optional(),
+		rules: z.array(z.object({
+			action: AllowDenyActionSchema,
+			match: z.object({
+				channel: z.string().optional(),
+				chatType: AllowDenyChatTypeSchema,
+				keyPrefix: z.string().optional(),
+				rawKeyPrefix: z.string().optional()
+			}).strict().optional()
+		}).strict()).optional()
+	}).strict().optional();
+}
+
 //#endregion
 //#region src/config/zod-schema.session.ts
 const SessionResetConfigSchema = z.object({
@@ -6770,8 +5830,6 @@ const MessagesSchema = z.object({
 const CommandsSchema = z.object({
 	native: NativeCommandsSettingSchema.optional().default("auto"),
 	text: z.boolean().optional(),
-	bash: z.boolean().optional(),
-	bashForegroundMs: z.number().int().min(0).max(3e4).optional(),
 	config: z.boolean().optional(),
 	debug: z.boolean().optional(),
 	restart: z.boolean().optional().default(true),
@@ -6779,7 +5837,7 @@ const CommandsSchema = z.object({
 	ownerAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
 	ownerDisplay: z.enum(["raw", "hash"]).optional().default("raw"),
 	ownerDisplaySecret: z.string().optional().register(sensitive),
-	allowFrom: ElevatedAllowFromSchema.optional()
+	allowFrom: z.record(z.string(), z.array(z.union([z.string(), z.number()]))).optional()
 }).strict().optional().default(() => ({
 	native: "auto",
 	restart: true,
@@ -9327,22 +8385,6 @@ function loadSessionStore(storePath, opts = {}) {
 			continue;
 		}
 	}
-	for (const entry of Object.values(store)) {
-		if (!entry || typeof entry !== "object") continue;
-		const rec = entry;
-		if (typeof rec.channel !== "string" && typeof rec.provider === "string") {
-			rec.channel = rec.provider;
-			delete rec.provider;
-		}
-		if (typeof rec.lastChannel !== "string" && typeof rec.lastProvider === "string") {
-			rec.lastChannel = rec.lastProvider;
-			delete rec.lastProvider;
-		}
-		if (typeof rec.groupChannel !== "string" && typeof rec.room === "string") {
-			rec.groupChannel = rec.room;
-			delete rec.room;
-		} else if ("room" in rec) delete rec.room;
-	}
 	if (!opts.skipCache && isSessionStoreCacheEnabled()) SESSION_STORE_CACHE.set(storePath, {
 		store: structuredClone(store),
 		loadedAt: Date.now(),
@@ -10702,7 +9744,7 @@ async function detectMimeImpl(opts) {
 	if (sniffed) return sniffed;
 	if (headerMime) return headerMime;
 }
-function extensionForMime(mime) {
+function extensionForMime$1(mime) {
 	const normalized = normalizeMimeType(mime);
 	if (!normalized) return;
 	return EXT_BY_MIME[normalized];
@@ -10842,7 +9884,7 @@ async function fetchRemoteMedia(options) {
 			filePath: filePathForMime
 		});
 		if (fileName && !path.extname(fileName) && contentType) {
-			const ext = extensionForMime(contentType);
+			const ext = extensionForMime$1(contentType);
 			if (ext) fileName = `${fileName}${ext}`;
 		}
 		return {
@@ -10892,7 +9934,7 @@ async function downloadRemote(url, tempDir, index) {
 		maxBytes: MAX_INBOUND_MEDIA_BYTES
 	});
 	const mimeType = fetched.contentType ?? "application/octet-stream";
-	const fileName = `inbound-media-${index}${extensionForMime(mimeType) ?? ""}`;
+	const fileName = `inbound-media-${index}${extensionForMime$1(mimeType) ?? ""}`;
 	const filePath = join(tempDir, fileName);
 	await writeFile(filePath, fetched.buffer);
 	return {
@@ -10925,6 +9967,12 @@ var CLIRuntimeBase = class CLIRuntimeBase {
 		this.command = command;
 		this.timeoutMs = timeoutMs;
 	}
+	/**
+	* Construct a custom stdin payload for the subprocess.
+	* When this returns a string, it is written to stdin instead of
+	* the default large-prompt fallback.  Subclasses may override.
+	*/
+	buildStdinPayload(_params) {}
 	/** Whether this CLI accepts prompts via stdin. Subclasses may override. */
 	get supportsStdinPrompt() {
 		return true;
@@ -11026,7 +10074,11 @@ var CLIRuntimeBase = class CLIRuntimeBase {
 				});
 			});
 		});
-		if (this.supportsStdinPrompt && params.prompt.length > CLIRuntimeBase.STDIN_PROMPT_THRESHOLD && child.stdin) {
+		const customStdin = this.buildStdinPayload(params);
+		if (customStdin !== void 0 && child.stdin) {
+			logDebug(`[agent-runtime] pid=${child.pid}: delivering custom stdin payload (${customStdin.length} chars)`);
+			child.stdin.write(customStdin);
+		} else if (this.supportsStdinPrompt && params.prompt.length > CLIRuntimeBase.STDIN_PROMPT_THRESHOLD && child.stdin) {
 			logDebug(`[agent-runtime] pid=${child.pid}: delivering prompt via stdin (${params.prompt.length} chars)`);
 			child.stdin.write(params.prompt);
 		}
@@ -11108,7 +10160,8 @@ var ClaudeCliRuntime = class extends CLIRuntimeBase {
 	}
 	async *execute(params) {
 		this.resetState();
-		for await (const event of super.execute(params)) {
+		const prepared = await this.prepareMedia(params);
+		for await (const event of super.execute(prepared)) {
 			if (event.type === "done") this.enrichDoneEvent(event);
 			yield event;
 		}
@@ -11122,9 +10175,34 @@ var ClaudeCliRuntime = class extends CLIRuntimeBase {
 		];
 		if (params.sessionId) args.push("--resume", params.sessionId);
 		if (params.mcpServers && Object.keys(params.mcpServers).length > 0) args.push("--mcp-config", JSON.stringify({ mcpServers: params.mcpServers }));
-		args.push("--print", params.prompt);
+		if (params.media?.some((m) => m.mimeType.startsWith("image/") && m.base64)) args.push("-p", "--input-format", "stream-json");
+		else args.push("--print", params.prompt);
 		return args;
 	}
+	buildStdinPayload(params) {
+		const images = params.media?.filter((m) => m.mimeType.startsWith("image/") && m.base64);
+		if (!images?.length) return;
+		const content = images.map((img) => ({
+			type: "image",
+			source: {
+				type: "base64",
+				media_type: img.mimeType,
+				data: img.base64
+			}
+		}));
+		content.push({
+			type: "text",
+			text: params.prompt
+		});
+		const envelope = {
+			type: "user",
+			message: {
+				role: "user",
+				content
+			}
+		};
+		return JSON.stringify(envelope) + "\n";
+	}
 	extractEvent(line) {
 		const parsed = JSON.parse(line);
 		if (!isObject$3(parsed)) return null;
@@ -11236,6 +10314,37 @@ var ClaudeCliRuntime = class extends CLIRuntimeBase {
 		if (this.resultData?.durationApiMs !== void 0) result.apiDurationMs = this.resultData.durationApiMs;
 		if (this.resultData?.numTurns !== void 0) result.numTurns = this.resultData.numTurns;
 	}
+	/**
+	* Read image files referenced by media attachments and populate their base64 field.
+	* Non-image media types are filtered out (audio/video are not supported natively).
+	*/
+	async prepareMedia(params) {
+		if (!params.media?.length) return params;
+		const prepared = [];
+		for (const attachment of params.media) {
+			if (!attachment.mimeType.startsWith("image/")) continue;
+			if (attachment.base64) {
+				prepared.push(attachment);
+				continue;
+			}
+			if (attachment.filePath) {
+				try {
+					const buffer = await readFile(attachment.filePath);
+					prepared.push({
+						...attachment,
+						base64: buffer.toString("base64")
+					});
+				} catch {
+					logDebug(`[claude-runtime] failed to read media file: ${attachment.filePath}`);
+				}
+				continue;
+			}
+		}
+		return {
+			...params,
+			media: prepared.length > 0 ? prepared : void 0
+		};
+	}
 	resetState() {
 		this.currentSessionId = void 0;
 		this.accumulatedText = "";
@@ -11273,7 +10382,7 @@ var CodexCliRuntime = class extends CLIRuntimeBase {
 	constructor() {
 		super("codex");
 		this.mediaCapabilities = {
-			acceptsInbound: [],
+			acceptsInbound: ["image/"],
 			emitsOutbound: false
 		};
 		this.accumulatedText = "";
@@ -11304,13 +10413,17 @@ var CodexCliRuntime = class extends CLIRuntimeBase {
 			params.sessionId,
 			params.prompt
 		];
-		return [
+		const args = [
 			"exec",
 			"--json",
 			"--color",
-			"never",
-			params.prompt
+			"never"
 		];
+		if (params.media) {
+			for (const attachment of params.media) if (attachment.mimeType.startsWith("image/") && attachment.filePath) args.push("--image", attachment.filePath);
+		}
+		args.push(params.prompt);
+		return args;
 	}
 	extractEvent(line) {
 		const parsed = JSON.parse(line);
@@ -11630,7 +10743,8 @@ var GeminiCliRuntime = class extends CLIRuntimeBase {
 			acceptsInbound: [
 				"image/",
 				"audio/",
-				"video/"
+				"video/",
+				"application/pdf"
 			],
 			emitsOutbound: false
 		};
@@ -11644,12 +10758,14 @@ var GeminiCliRuntime = class extends CLIRuntimeBase {
 		const mcpConfigManager = params.mcpServers && Object.keys(params.mcpServers).length > 0 ? new GeminiMcpConfigManager(params.workingDirectory, params.mcpServers) : null;
 		try {
 			await mcpConfigManager?.setup();
-			for await (const event of super.execute(params)) {
+			const prepared = await this.prepareMedia(params);
+			for await (const event of super.execute(prepared)) {
 				if (event.type === "done") this.enrichDoneEvent(event);
 				yield event;
 			}
 		} finally {
 			await mcpConfigManager?.teardown();
+			await this.cleanupMediaTempDir();
 		}
 	}
 	buildArgs(params) {
@@ -11739,10 +10855,52 @@ var GeminiCliRuntime = class extends CLIRuntimeBase {
 			if (this.resultStats.toolCalls !== void 0) result.numTurns = this.resultStats.toolCalls;
 		}
 	}
+	/**
+	* Save media attachments to temp files and inject `@path` references into
+	* the prompt.  Gemini CLI resolves `@path` inline references natively.
+	*/
+	async prepareMedia(params) {
+		if (!params.media?.length) return params;
+		const tempDir = join(tmpdir(), `remoteclaw-gemini-media-${randomUUID()}`);
+		await mkdir(tempDir, { recursive: true });
+		this.mediaTempDir = tempDir;
+		const mediaRefs = [];
+		for (const attachment of params.media) {
+			const ext = extensionForMime(attachment.mimeType);
+			const filePath = join(tempDir, `media-${mediaRefs.length}${ext}`);
+			if (attachment.base64) {
+				await writeFile(filePath, Buffer.from(attachment.base64, "base64"));
+				mediaRefs.push(filePath);
+			} else if (attachment.filePath) try {
+				await writeFile(filePath, await readFile(attachment.filePath));
+				mediaRefs.push(filePath);
+			} catch {
+				logDebug(`[gemini-runtime] failed to read media file: ${attachment.filePath}`);
+			}
+		}
+		if (mediaRefs.length === 0) return params;
+		const mediaPrefix = mediaRefs.map((ref) => `@${ref}`).join(" ");
+		return {
+			...params,
+			prompt: `${mediaPrefix} ${params.prompt}`
+		};
+	}
+	async cleanupMediaTempDir() {
+		if (this.mediaTempDir) {
+			try {
+				await rm(this.mediaTempDir, {
+					recursive: true,
+					force: true
+				});
+			} catch {}
+			this.mediaTempDir = void 0;
+		}
+	}
 	resetState() {
 		this.currentSessionId = void 0;
 		this.accumulatedText = "";
 		this.resultStats = void 0;
+		this.mediaTempDir = void 0;
 	}
 };
 /**
@@ -11804,6 +10962,23 @@ var GeminiMcpConfigManager = class {
 function isObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Map common MIME types to file extensions for Gemini CLI `@path` references. */
+function extensionForMime(mimeType) {
+	return {
+		"image/jpeg": ".jpg",
+		"image/png": ".png",
+		"image/gif": ".gif",
+		"image/webp": ".webp",
+		"audio/ogg": ".ogg",
+		"audio/mpeg": ".mp3",
+		"audio/wav": ".wav",
+		"audio/webm": ".weba",
+		"video/mp4": ".mp4",
+		"video/webm": ".webm",
+		"video/quicktime": ".mov",
+		"application/pdf": ".pdf"
+	}[mimeType] ?? "";
+}
 
 //#endregion
 //#region src/middleware/runtimes/opencode.ts