skimpyclaw 0.3.14 → 0.4.0

package/dist/setup.d.ts

@@ -3,19 +3,21 @@ interface SetupOptions {
     dryRun?: boolean;
 }
 export declare function renderGatewayPlist(): string;
-type ProviderChoice = 'anthropic-api' | 'anthropic-oauth' | 'openai-api' | 'codex-oauth' | 'minimax-api' | 'kimi-api';
+type ProviderChoice = 'anthropic-api' | 'anthropic-oauth' | 'codex-oauth';
 interface ProviderSecrets {
     anthropicKey?: string;
     oauthToken?: string;
-    openaiKey?: string;
-    minimaxKey?: string;
-    kimiKey?: string;
+}
+/** Map of secret name → config reference string (KEYCHAIN ref or ENV ref). */
+interface SecretRefs {
+    anthropicKey?: string;
+    oauthToken?: string;
+    telegramToken?: string;
+    discordToken?: string;
 }
 interface SetupFeatures {
-    browser: boolean;
     voice: boolean;
     mcp: boolean;
-    sandbox: boolean;
 }
 interface SetupBuildInput {
     workspaceDir: string;
@@ -28,6 +30,8 @@ interface SetupBuildInput {
     agentName: string;
     selectedProviders: Set<ProviderChoice>;
     providerSecrets: ProviderSecrets;
+    /** Resolved secret references (KEYCHAIN or ENV). If not provided, falls back to env var refs. */
+    secretRefs?: SecretRefs;
     features?: SetupFeatures;
     starters?: SetupStarters;
 }

package/dist/setup.js

@@ -8,7 +8,7 @@ import { spawnSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { runDoctor as runDoctorChecks } from './doctor/runner.js';
 import { toErrorMessage } from './utils.js';
-import { detectSandboxRuntime, isSandboxRuntimeRunning, sandboxNetworkExists, defaultSandboxNetwork, } from './sandbox-utils.js';
+import { secureStoreAvailable, setSecureValue } from './secure-store.js';
 import { ensureCoreTemplates, ensureStarterSkills, buildStarterCronJobs, } from './setup-templates.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -59,33 +59,6 @@ function loadExistingSetup() {
     }
     return { config, env };
 }
-function bootstrapSandbox(runtime, image, network) {
-    const sandboxDir = join(__dirname, '..', 'sandbox');
-    const dockerfile = join(sandboxDir, 'Dockerfile');
-    if (!existsSync(dockerfile)) {
-        return { ok: false, message: `Sandbox Dockerfile not found: ${dockerfile}` };
-    }
-    if (!isSandboxRuntimeRunning(runtime)) {
-        const hint = runtime === 'container'
-            ? 'Run `container system start` and rerun onboarding.'
-            : 'Start Docker Desktop and rerun onboarding.';
-        return { ok: false, message: `Runtime "${runtime}" is not running. ${hint}` };
-    }
-    if (!sandboxNetworkExists(runtime, network)) {
-        return { ok: false, message: `Network "${network}" not found for ${runtime}. Update sandbox.network and run \`skimpyclaw sandbox init\`.` };
-    }
-    const build = spawnSync(runtime, ['build', '--build-arg', 'SKIMPY_PROFILE=minimal', '-t', image, sandboxDir], { encoding: 'utf-8' });
-    if (build.status !== 0) {
-        const detail = `${build.stderr || ''}\n${build.stdout || ''}`.trim();
-        return { ok: false, message: `Image build failed: ${detail.slice(-800)}` };
-    }
-    const smoke = spawnSync(runtime, ['run', '--rm', '--network', network, image, 'sh', '-lc', 'hostname && command -v gh >/dev/null && command -v rg >/dev/null && echo sandbox-ok'], { encoding: 'utf-8' });
-    if (smoke.status !== 0) {
-        const detail = `${smoke.stderr || ''}\n${smoke.stdout || ''}`.trim();
-        return { ok: false, message: `Sandbox smoke test failed: ${detail.slice(-800)}` };
-    }
-    return { ok: true, message: (smoke.stdout || '').trim().split('\n').join(' | ') };
-}
 function ask(rl, question) {
     return new Promise((resolve) => {
         rl.question(question, (answer) => {
@@ -124,10 +97,7 @@ export function renderGatewayPlist() {
 const PROVIDER_OPTIONS = [
     { key: 'anthropic-api', label: 'Anthropic API key' },
     { key: 'anthropic-oauth', label: 'Anthropic OAuth (Claude Code)' },
-    { key: 'openai-api', label: 'OpenAI API key' },
     { key: 'codex-oauth', label: 'OpenAI Codex OAuth' },
-    { key: 'minimax-api', label: 'MiniMax API key' },
-    { key: 'kimi-api', label: 'Kimi (Moonshot) API key' },
 ];
 function detectExistingProviders(config) {
     const existing = new Set();
@@ -138,14 +108,8 @@ function detectExistingProviders(config) {
         existing.add('anthropic-oauth');
     else if (providers.anthropic?.apiKey)
         existing.add('anthropic-api');
-    if (providers.openai?.apiKey)
-        existing.add('openai-api');
     if (providers.codex || providers.openai?.authToken === 'codex')
         existing.add('codex-oauth');
-    if (providers.minimax)
-        existing.add('minimax-api');
-    if (providers.kimi)
-        existing.add('kimi-api');
     return existing;
 }
 async function askProviders(rl, existingProviders) {
@@ -192,6 +156,56 @@ async function askProviders(rl, existingProviders) {
         return choices;
     }
 }
+const KEYCHAIN_SERVICE = 'skimpyclaw';
+/** Secret name → Keychain account name mapping. */
+const SECRET_KEYCHAIN_ACCOUNTS = {
+    anthropicKey: 'anthropic-api-key',
+    oauthToken: 'anthropic-oauth-token',
+    telegramToken: 'telegram-bot-token',
+    discordToken: 'discord-bot-token',
+};
+/** Secret name → env var name mapping (fallback when Keychain unavailable). */
+const SECRET_ENV_VARS = {
+    anthropicKey: 'ANTHROPIC_API_KEY',
+    oauthToken: 'CLAUDE_CODE_OAUTH_TOKEN',
+    telegramToken: 'TELEGRAM_BOT_TOKEN',
+    discordToken: 'DISCORD_BOT_TOKEN',
+};
+/**
+ * Store secrets securely. On macOS, uses Keychain and returns ${KEYCHAIN:...} refs.
+ * On other platforms, returns ${ENV_VAR} refs for .env file fallback.
+ * Returns the reference map and whether Keychain was used.
+ */
+function storeSecretsSecurely(secrets, telegramToken, discordToken) {
+    const keychainOk = secureStoreAvailable().ok;
+    const refs = {};
+    let storedCount = 0;
+    const allSecrets = [
+        { key: 'anthropicKey', value: secrets.anthropicKey },
+        { key: 'oauthToken', value: secrets.oauthToken },
+        { key: 'telegramToken', value: telegramToken },
+        { key: 'discordToken', value: discordToken },
+    ];
+    for (const { key, value } of allSecrets) {
+        if (!value)
+            continue;
+        if (keychainOk) {
+            try {
+                const account = SECRET_KEYCHAIN_ACCOUNTS[key];
+                setSecureValue(KEYCHAIN_SERVICE, account, value);
+                refs[key] = `\${KEYCHAIN:${KEYCHAIN_SERVICE}/${account}}`;
+                storedCount++;
+                continue;
+            }
+            catch {
+                // Fall through to env var ref
+            }
+        }
+        const envVar = SECRET_ENV_VARS[key];
+        refs[key] = `\${${envVar}}`;
+    }
+    return { refs, useKeychain: keychainOk && storedCount > 0, storedCount };
+}
 async function collectProviderSecrets(rl, providers, existingEnv) {
     const secrets = {};
     const env = existingEnv || {};
@@ -232,45 +246,6 @@ async function collectProviderSecrets(rl, providers, existingEnv) {
             console.log(`   ${c.yellow('⚠')} Skipped — run \`claude setup-token\`, then add CLAUDE_CODE_OAUTH_TOKEN to ~/.skimpyclaw/.env`);
         }
     }
-    if (providers.has('openai-api')) {
-        const existing = env.OPENAI_API_KEY || '';
-        console.log('\n   OpenAI API Key');
-        if (existing) {
-            const input = await ask(rl, `   Enter key [${maskInput(existing)}]: `);
-            secrets.openaiKey = input || existing;
-        }
-        else {
-            console.log('   Get one from: https://platform.openai.com/api-keys');
-            secrets.openaiKey = await ask(rl, '   Enter key: ');
-        }
-        console.log(`   ✓ ${maskInput(secrets.openaiKey)}`);
-    }
-    if (providers.has('minimax-api')) {
-        const existing = env.MINIMAX_API_KEY || '';
-        console.log('\n   MiniMax API Key');
-        if (existing) {
-            const input = await ask(rl, `   Enter key [${maskInput(existing)}]: `);
-            secrets.minimaxKey = input || existing;
-        }
-        else {
-            console.log('   Get one from: https://platform.minimax.io/user-center/basic-information/interface-key');
-            secrets.minimaxKey = await ask(rl, '   Enter key: ');
-        }
-        console.log(`   ✓ ${maskInput(secrets.minimaxKey)}`);
-    }
-    if (providers.has('kimi-api')) {
-        const existing = env.KIMI_API_KEY || '';
-        console.log('\n   Kimi (Moonshot) API Key');
-        if (existing) {
-            const input = await ask(rl, `   Enter key [${maskInput(existing)}]: `);
-            secrets.kimiKey = input || existing;
-        }
-        else {
-            console.log('   Get one from: https://platform.moonshot.cn/console/api-keys');
-            secrets.kimiKey = await ask(rl, '   Enter key: ');
-        }
-        console.log(`   ✓ ${maskInput(secrets.kimiKey)}`);
-    }
     if (providers.has('codex-oauth')) {
         console.log('\n   OpenAI Codex OAuth');
         console.log('   No key needed — uses ~/.codex/auth.json at runtime.');
@@ -279,22 +254,13 @@ async function collectProviderSecrets(rl, providers, existingEnv) {
     console.log('');
     return secrets;
 }
-function buildProviders(providers) {
+function buildProviders(providers, refs) {
     const result = {};
     if (providers.has('anthropic-api')) {
-        result.anthropic = { apiKey: '${ANTHROPIC_API_KEY}' };
+        result.anthropic = { apiKey: refs?.anthropicKey || '${ANTHROPIC_API_KEY}' };
     }
     else if (providers.has('anthropic-oauth')) {
-        result.anthropic = { authToken: '${CLAUDE_CODE_OAUTH_TOKEN}' };
-    }
-    if (providers.has('openai-api')) {
-        result.openai = { apiKey: '${OPENAI_API_KEY}', baseURL: 'https://api.openai.com/v1' };
-    }
-    if (providers.has('minimax-api')) {
-        result.minimax = { apiKey: '${MINIMAX_API_KEY}', baseURL: 'https://api.minimax.io/v1' };
-    }
-    if (providers.has('kimi-api')) {
-        result.kimi = { apiKey: '${KIMI_API_KEY}', baseURL: 'https://api.kimi.com/coding/v1' };
+        result.anthropic = { authToken: refs?.oauthToken || '${CLAUDE_CODE_OAUTH_TOKEN}' };
     }
     if (providers.has('codex-oauth')) {
         result.codex = {
@@ -308,48 +274,31 @@ function buildProviders(providers) {
 function buildDefaultModel(providers) {
     const hasAnthropic = providers.has('anthropic-api') || providers.has('anthropic-oauth');
     if (hasAnthropic)
-        return 'claude-opus';
+        return 'anthropic/claude-opus-4-7';
     if (providers.has('codex-oauth'))
-        return 'codex/gpt-5.3-codex';
-    if (providers.has('kimi-api'))
-        return 'kimi/kimi-for-coding';
-    if (providers.has('minimax-api'))
-        return 'minimax/MiniMax-M2.5';
-    return 'openai/gpt-4o';
+        return 'codex/gpt-5.5';
+    return 'anthropic/claude-opus-4-7';
 }
 function buildAliases(providers) {
-    // Always include well-known aliases so users can switch models easily
     const aliases = {
-        'claude-fast': 'anthropic/claude-haiku-4-5',
-        'claude-think': 'anthropic/claude-sonnet-4-6',
-        'claude-opus': 'anthropic/claude-opus-4-6',
         'codex5.1': 'codex/gpt-5.1-codex',
         'codex5.2': 'codex/gpt-5.2-codex',
         'codex5.3': 'codex/gpt-5.3-codex',
-        'minimax': 'minimax/MiniMax-M2.5',
-        'kimi': 'kimi/kimi-for-coding',
+        'codex5.5': 'codex/gpt-5.5',
     };
-    if (providers.has('openai-api')) {
-        aliases['gpt-fast'] = 'openai/gpt-4o-mini';
-        aliases.gpt = 'openai/gpt-4o';
-    }
     if (providers.has('codex-oauth')) {
-        aliases.codex = 'codex/gpt-5.3-codex';
-    }
-    if (providers.has('minimax-api')) {
-        aliases.minimax = 'minimax/MiniMax-M2.5';
-    }
-    if (providers.has('kimi-api')) {
-        aliases.kimi = 'kimi/kimi-for-coding';
+        aliases.codex = 'codex/gpt-5.5';
     }
     return aliases;
 }
-function buildEnvContent(telegramToken, providers, secrets, discordToken) {
+function buildEnvContent(telegramToken, providers, secrets, discordToken, keychainRefs) {
     const lines = ['# SkimpyClaw secrets'];
-    if (providers.has('anthropic-api') && secrets.anthropicKey) {
+    // Helper: only write to .env if NOT stored in Keychain
+    const isInKeychain = (key) => keychainRefs?.[key]?.includes('KEYCHAIN:');
+    if (providers.has('anthropic-api') && secrets.anthropicKey && !isInKeychain('anthropicKey')) {
         lines.push(`ANTHROPIC_API_KEY=${secrets.anthropicKey}`);
     }
-    if (providers.has('anthropic-oauth')) {
+    if (providers.has('anthropic-oauth') && !isInKeychain('oauthToken')) {
         if (secrets.oauthToken) {
             lines.push(`CLAUDE_CODE_OAUTH_TOKEN=${secrets.oauthToken}`);
         }
@@ -358,17 +307,10 @@ function buildEnvContent(telegramToken, providers, secrets, discordToken) {
             lines.push('CLAUDE_CODE_OAUTH_TOKEN=');
         }
     }
-    if (providers.has('openai-api') && secrets.openaiKey) {
-        lines.push(`OPENAI_API_KEY=${secrets.openaiKey}`);
-    }
-    if (providers.has('minimax-api') && secrets.minimaxKey) {
-        lines.push(`MINIMAX_API_KEY=${secrets.minimaxKey}`);
-    }
-    if (providers.has('kimi-api') && secrets.kimiKey) {
-        lines.push(`KIMI_API_KEY=${secrets.kimiKey}`);
+    if (!isInKeychain('telegramToken')) {
+        lines.push(`TELEGRAM_BOT_TOKEN=${telegramToken}`);
     }
-    lines.push(`TELEGRAM_BOT_TOKEN=${telegramToken}`);
-    if (discordToken) {
+    if (discordToken && !isInKeychain('discordToken')) {
         lines.push(`DISCORD_BOT_TOKEN=${discordToken}`);
     }
     lines.push('');
@@ -376,7 +318,7 @@ function buildEnvContent(telegramToken, providers, secrets, discordToken) {
 }
 export function buildSetupConfig(input) {
     const useDiscord = Boolean(input.discordToken);
-    const features = input.features ?? { browser: false, voice: false, mcp: false, sandbox: false };
+    const features = input.features ?? { voice: false, mcp: false };
     const starters = input.starters ?? {
         cronTechNews: false,
         cronWeather: false,
@@ -416,14 +358,14 @@ export function buildSetupConfig(input) {
             },
         },
         models: {
-            providers: buildProviders(input.selectedProviders),
+            providers: buildProviders(input.selectedProviders, input.secretRefs),
             aliases: buildAliases(input.selectedProviders),
         },
         channels: {
             active: useDiscord ? 'discord' : 'telegram',
             telegram: {
                 enabled: true,
-                token: '${TELEGRAM_BOT_TOKEN}',
+                token: input.secretRefs?.telegramToken || '${TELEGRAM_BOT_TOKEN}',
                 allowFrom: [parseInt(input.telegramId, 10) || input.telegramId],
                 dailyNotesDir: '${HOME}/.skimpyclaw/Daily Notes',
                 defaultAllowedPaths: allPaths,
@@ -432,12 +374,11 @@ export function buildSetupConfig(input) {
                     allowedPaths: allPaths,
                     maxIterations: 100,
                     bashTimeout: 15000,
-                    ...(features.browser ? { browser: { type: 'chromium', enabled: true, headless: true } } : {}),
                 },
             },
             discord: {
                 enabled: useDiscord,
-                token: useDiscord ? '${DISCORD_BOT_TOKEN}' : '',
+                token: useDiscord ? (input.secretRefs?.discordToken || '${DISCORD_BOT_TOKEN}') : '',
                 allowFrom: useDiscord ? [input.discordUserId || ''] : [],
                 defaultAllowedPaths: allPaths,
                 ...(input.discordDefaultChannelId ? { defaultChannelId: input.discordDefaultChannelId } : {}),
@@ -446,7 +387,6 @@ export function buildSetupConfig(input) {
                     allowedPaths: allPaths,
                     maxIterations: 100,
                     bashTimeout: 15000,
-                    ...(features.browser ? { browser: { type: 'chromium', enabled: true, headless: false } } : {}),
                 },
             },
         },
@@ -461,7 +401,6 @@ export function buildSetupConfig(input) {
                 allowedPaths: allPaths,
                 maxIterations: 10,
                 bashTimeout: 15000,
-                ...(features.browser ? { browser: { enabled: true } } : { browser: { enabled: false } }),
             },
         },
         ...(features.voice ? {
@@ -470,13 +409,6 @@ export function buildSetupConfig(input) {
                 defaultProvider: 'macos',
                 providers: {
                     macos: { tts: { voice: 'Samantha' } },
-                    ...(input.selectedProviders.has('openai-api') ? {
-                        openai: {
-                            apiKey: '${OPENAI_API_KEY}',
-                            baseURL: 'https://api.openai.com/v1',
-                            stt: { model: 'whisper-1' },
-                        },
-                    } : {}),
                 },
                 channels: {
                     telegram: { enabled: true, acceptVoice: true, sendVoice: true },
@@ -484,16 +416,6 @@ export function buildSetupConfig(input) {
                 },
             },
         } : {}),
-        ...(features.sandbox ? {
-            sandbox: {
-                enabled: true,
-                image: 'skimpyclaw-sandbox',
-                cpus: 2,
-                memory: '2G',
-                network: 'bridge',
-                idleTimeoutMs: 3600000,
-            },
-        } : {}),
         ...(Object.keys(starterSkillEntries).length > 0 ? {
             skills: {
                 enabled: true,
@@ -509,7 +431,7 @@ export function buildSetupArtifacts(input) {
     const config = buildSetupConfig(input);
     return {
         configJson: JSON.stringify(config, null, 2),
-        envContent: buildEnvContent(input.telegramToken, input.selectedProviders, input.providerSecrets, input.discordToken),
+        envContent: buildEnvContent(input.telegramToken, input.selectedProviders, input.providerSecrets, input.discordToken, input.secretRefs),
         config,
     };
 }
@@ -550,34 +472,6 @@ async function validateProviderAuth(providers, secrets) {
             checks.push({ name: 'Anthropic API', ok: false, detail: toErrorMessage(err) });
         }
     }
-    if (providers.has('openai-api') && secrets.openaiKey) {
-        try {
-            const res = await quickFetch('https://api.openai.com/v1/models', {
-                headers: { authorization: `Bearer ${secrets.openaiKey}` },
-            });
-            checks.push({ name: 'OpenAI API', ok: res.ok, detail: res.ok ? 'auth ok' : `HTTP ${res.status}` });
-        }
-        catch (err) {
-            checks.push({ name: 'OpenAI API', ok: false, detail: toErrorMessage(err) });
-        }
-    }
-    if (providers.has('minimax-api') && secrets.minimaxKey) {
-        try {
-            const res = await quickFetch('https://api.minimax.io/anthropic/v1/messages', {
-                method: 'POST',
-                headers: {
-                    authorization: `Bearer ${secrets.minimaxKey}`,
-                    'content-type': 'application/json',
-                    'anthropic-version': '2023-06-01',
-                },
-                body: JSON.stringify({ model: 'MiniMax-M2.5', max_tokens: 8, messages: [{ role: 'user', content: 'ping' }] }),
-            });
-            checks.push({ name: 'MiniMax API', ok: res.ok, detail: res.ok ? 'auth ok' : `HTTP ${res.status}` });
-        }
-        catch (err) {
-            checks.push({ name: 'MiniMax API', ok: false, detail: toErrorMessage(err) });
-        }
-    }
     if (providers.has('codex-oauth')) {
         const authPath = join(homedir(), '.codex', 'auth.json');
         checks.push({ name: 'Codex OAuth', ok: existsSync(authPath), detail: existsSync(authPath) ? authPath : `missing ${authPath}` });
@@ -720,43 +614,9 @@ export async function runSetup(options = {}) {
         }
         statusOk('Acknowledged');
         // 8. Optional Features
-        const existingBrowser = existing.config?.heartbeat?.tools?.browser?.enabled === true
-            || existing.config?.channels?.telegram?.tools?.browser?.enabled === true;
         const existingVoice = existing.config?.voice?.enabled === true;
         sectionHeader('Optional Features');
-        // 6a. Browser tool
-        const browserDefault = existingBrowser ? 'Y' : 'N';
-        const enableBrowser = /^y(es)?$/i.test(await ask(rl, `   Enable browser tool? (requires Chrome) [${existingBrowser ? 'Y/n' : 'y/N'}]: `) || browserDefault);
-        if (enableBrowser) {
-            const macChrome = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome';
-            const which = spawnSync('which', ['google-chrome'], { encoding: 'utf-8' });
-            if (which.status === 0 || existsSync(macChrome)) {
-                statusOk('Chrome detected');
-            }
-            else {
-                statusWarn('Chrome not found — browser tool may not work until Chrome is installed');
-            }
-            // Check for Playwright
-            const pw = spawnSync('npx', ['playwright', '--version'], { encoding: 'utf-8', timeout: 10000 });
-            if (pw.status === 0) {
-                statusOk('Playwright detected');
-            }
-            else {
-                console.log('');
-                console.log('   ┌─────────────────────────────────────────────────────────┐');
-                console.log('   │  Browser tool requires Playwright. Install it:          │');
-                console.log('   │                                                         │');
-                console.log('   │    npx playwright install chromium                      │');
-                console.log('   │                                                         │');
-                console.log('   │  Without this, the browser tool will fail at runtime.   │');
-                console.log('   └─────────────────────────────────────────────────────────┘');
-                console.log('');
-            }
-        }
-        else {
-            statusOk('browser disabled');
-        }
-        // 6b. Voice/TTS
+        // Voice/TTS
         const voiceDefault = existingVoice ? 'Y' : 'N';
         const enableVoice = /^y(es)?$/i.test(await ask(rl, `   Enable voice/TTS? (requires ffmpeg) [${existingVoice ? 'Y/n' : 'y/N'}]: `) || voiceDefault);
         if (enableVoice) {
@@ -779,16 +639,12 @@ export async function runSetup(options = {}) {
             else {
                 console.log('');
                 console.log('   ┌─────────────────────────────────────────────────────────┐');
-                console.log('   │  Voice transcription (STT) requires one of:             │');
+                console.log('   │  Voice transcription (STT) requires local whisper.cpp:  │');
                 console.log('   │                                                         │');
-                console.log('   │  Option A: Local whisper.cpp (free, recommended)        │');
+                console.log('   │  Local whisper.cpp (free, recommended)                  │');
                 console.log('   │    brew install whisper-cpp                             │');
                 console.log('   │    whisper-cpp-download-ggml-model small                │');
                 console.log('   │                                                         │');
-                console.log('   │  Option B: OpenAI Whisper API ($0.006/min)              │');
-                console.log('   │    Add OPENAI_API_KEY to ~/.skimpyclaw/.env             │');
-                console.log('   │    Config auto-includes openai.stt if provider selected │');
-                console.log('   │                                                         │');
                 console.log('   │  Without either, voice messages cannot be transcribed.  │');
                 console.log('   └─────────────────────────────────────────────────────────┘');
                 console.log('');
@@ -797,7 +653,7 @@ export async function runSetup(options = {}) {
         else {
             statusOk('voice disabled');
         }
-        // 6c. MCP tools
+        // MCP tools
         console.log('   Install mcporter: https://github.com/steipete/mcporter');
         const enableMcp = /^y(es)?$/i.test(await ask(rl, '   Enable MCP tools? (requires mcporter at ~/.mcporter/) [y/N]: '));
         if (enableMcp) {
@@ -812,34 +668,9 @@ export async function runSetup(options = {}) {
         else {
             statusOk('MCP tools disabled');
         }
-        // 6d. Sandbox (container isolation)
-        const existingSandbox = existing.config?.sandbox?.enabled === true;
-        const sandboxDefault = existingSandbox ? 'Y' : 'N';
-        const enableSandbox = /^y(es)?$/i.test(await ask(rl, `   Enable sandbox? (requires Docker or Apple Containers) [${existingSandbox ? 'Y/n' : 'y/N'}]: `) || sandboxDefault);
-        let detectedSandboxRuntime = null;
-        if (enableSandbox) {
-            const containerCli = spawnSync('which', ['container'], { encoding: 'utf-8' });
-            const docker = spawnSync('which', ['docker'], { encoding: 'utf-8' });
-            if (containerCli.status === 0) {
-                detectedSandboxRuntime = 'container';
-                statusOk('Apple Containers detected');
-            }
-            else if (docker.status === 0) {
-                detectedSandboxRuntime = 'docker';
-                statusOk('Docker detected');
-            }
-            else {
-                statusWarn('No container runtime found — sandbox features won\'t work until Docker or Apple Containers is installed');
-            }
-        }
-        else {
-            statusOk('sandbox disabled');
-        }
         const features = {
-            browser: enableBrowser,
             voice: enableVoice,
             mcp: enableMcp,
-            sandbox: enableSandbox,
         };
         sectionHeader('Starter Packs (optional)');
         const localTz = Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
@@ -866,6 +697,11 @@ export async function runSetup(options = {}) {
             skillWeather: false,
             skillWebSearch: false,
         };
+        // Store secrets in macOS Keychain when available (default on macOS)
+        const { refs: secretRefs, useKeychain, storedCount } = storeSecretsSecurely(providerSecrets, telegramToken, useDiscord ? discordToken : undefined);
+        if (useKeychain) {
+            statusOk(`${storedCount} secret(s) stored in macOS Keychain`);
+        }
         const { envContent, config: generatedConfig } = buildSetupArtifacts({
             workspaceDir: extraAllowedPaths[0] || join(homedir(), '.skimpyclaw'),
             extraAllowedPaths,
@@ -877,6 +713,7 @@ export async function runSetup(options = {}) {
             agentName,
             selectedProviders,
             providerSecrets,
+            secretRefs,
             features,
             starters,
         });
@@ -908,9 +745,6 @@ export async function runSetup(options = {}) {
             if (existing.config.langfuse) {
                 generatedConfig.langfuse = existing.config.langfuse;
             }
-            if (existing.config.sandbox) {
-                generatedConfig.sandbox = existing.config.sandbox;
-            }
             // Preserve voice provider config if voice was already configured
             if (existing.config.voice?.providers && Object.keys(existing.config.voice.providers).length > 0) {
                 generatedConfig.voice = existing.config.voice;
@@ -927,16 +761,6 @@ export async function runSetup(options = {}) {
                 };
             }
         }
-        if (enableSandbox && generatedConfig.sandbox) {
-            const runtime = detectSandboxRuntime(detectedSandboxRuntime) || detectSandboxRuntime();
-            if (runtime) {
-                generatedConfig.sandbox.runtime = runtime;
-                generatedConfig.sandbox.network = defaultSandboxNetwork(runtime);
-            }
-            if (!generatedConfig.sandbox.image) {
-                generatedConfig.sandbox.image = 'skimpyclaw-sandbox:latest';
-            }
-        }
         // Create directories
         console.log('Creating directories...');
         mkdirSync(CONFIG_DIR, { recursive: true });
@@ -995,27 +819,6 @@ export async function runSetup(options = {}) {
             writeFileSync(envPath, envContent);
             console.log(`✓ Secrets written to ${envPath}`);
         }
-        if (enableSandbox) {
-            sectionHeader('Sandbox Bootstrap');
-            const sandboxCfg = generatedConfig.sandbox || {};
-            const runtime = detectSandboxRuntime(sandboxCfg.runtime);
-            const image = String(sandboxCfg.image || 'skimpyclaw-sandbox:latest');
-            const network = String(sandboxCfg.network || (runtime ? defaultSandboxNetwork(runtime) : 'bridge'));
-            if (!runtime) {
-                statusWarn('Sandbox enabled, but no runtime detected. Run `skimpyclaw sandbox init` later.');
-            }
-            else {
-                console.log(`   Building sandbox image (${runtime}, network=${network})...`);
-                const bootstrap = bootstrapSandbox(runtime, image, network);
-                if (bootstrap.ok) {
-                    statusOk(`sandbox ready (${bootstrap.message})`);
-                }
-                else {
-                    statusWarn(bootstrap.message);
-                    console.log(`   ${c.dim('You can retry later with: skimpyclaw sandbox init')}`);
-                }
-            }
-        }
         // Update USER.md with name
         writeFileSync(join(AGENTS_DIR, 'USER.md'), `# USER.md - About ${userName}\n\nName: ${userName}\n\n## Preferences\n\n- Direct communication, no fluff\n\n## Routines\n\n- Morning: Review tasks and messages\n- EOD: Review completed work, plan tomorrow\n`);
         // Create launchd plist from template
@@ -1054,17 +857,6 @@ export async function runSetup(options = {}) {
         console.log('\nNext steps:');
         let step = 1;
         console.log(`${step++}. Review templates in ~/.skimpyclaw/agents/main/`);
-        if (enableSandbox) {
-            const runtimeHint = detectedSandboxRuntime === 'docker'
-                ? 'open -a Docker    # or start Docker Desktop'
-                : 'container system start';
-            console.log(`${step++}. Start the container runtime (if not already running):`);
-            console.log(`   ${runtimeHint}`);
-            console.log(`${step++}. Initialize the sandbox:`);
-            console.log('   skimpyclaw sandbox init');
-            console.log(`${step++}. Verify sandbox is working:`);
-            console.log('   skimpyclaw sandbox doctor');
-        }
         console.log(`${step++}. Start the daemon:`);
         console.log('   skimpyclaw start --daemon');
         console.log(`${step++}. Check health:`);
@@ -1072,10 +864,10 @@ export async function runSetup(options = {}) {
         console.log(`${step++}. Optional daemon controls: skimpyclaw stop | skimpyclaw restart`);
         console.log(`${step++}. Send /help in your ${useDiscord ? 'Discord bot DM/server' : 'Telegram bot'}`);
         console.log('');
-        console.log(`${c.yellow('Note:')} The /team and /code tools require an external coding CLI on your PATH:`);
+        console.log(`${c.yellow('Note:')} The /code tool requires an external coding CLI on your PATH:`);
         console.log('   • Claude Code CLI  →  https://docs.anthropic.com/en/docs/claude-code');
         console.log('   • Codex CLI        →  https://github.com/openai/codex');
-        console.log('   Install at least one to use code_with_agent / code_with_team.');
+        console.log('   Install at least one to use code_with_agent.');
         console.log('\n👙🦞 Enjoy!');
     }
     finally {