squidclaw 3.0.23 → 3.0.25

package/dist/{audit-DLTgNDFw.js → audit-JLT1FqTt.js}

@@ -1,38 +1,38 @@
 import { g as resolveStateDir, m as resolveOAuthDir, o as resolveConfigPath } from "./paths-CHIu6D1E.js";
-import { A as formatPermissionRemediation, M as safeStat, Qt as normalizeTrustedSafeBinDirs, R as createConfigIO, Rn as INCLUDE_KEY, dt as isDangerousNetworkMode, ft as normalizeNetworkMode, j as inspectPathPermissions, k as formatPermissionDetail, zn as MAX_INCLUDE_DEPTH } from "./auth-profiles-CX4YYu7Z.js";
+import { A as formatPermissionRemediation, M as safeStat, Qt as normalizeTrustedSafeBinDirs, R as createConfigIO, Rn as INCLUDE_KEY, dt as isDangerousNetworkMode, ft as normalizeNetworkMode, j as inspectPathPermissions, k as formatPermissionDetail, zn as MAX_INCLUDE_DEPTH } from "./auth-profiles-9T4j6jMy.js";
 import { t as formatCliCommand } from "./command-format-D8-lYArk.js";
-import { M as resolveAgentModelFallbackValues, N as resolveAgentModelPrimaryValue, d as resolveDefaultAgentId } from "./agent-scope-Cq4vDGrK.js";
+import { M as resolveAgentModelFallbackValues, N as resolveAgentModelPrimaryValue, d as resolveDefaultAgentId } from "./agent-scope-nEVgVklg.js";
 import { c as normalizeAgentId } from "./session-key-k6urs9r-.js";
 import { A as hasConfiguredSecretInput } from "./registry-BXcl3IkC.js";
 import { i as isPathInside, n as MANIFEST_KEY, r as extensionUsesSkippedScannerPath } from "./legacy-names-Q0o_2ITh.js";
-import { d as normalizePluginsConfig } from "./manifest-registry-7kwtbCH-.js";
-import { l as normalizeStringEntries } from "./dock-DJJAj46v.js";
-import { i as loadWorkspaceSkillEntries } from "./skills-C85azDXm.js";
+import { d as normalizePluginsConfig } from "./manifest-registry-1ACGW3OR.js";
+import { l as normalizeStringEntries } from "./dock-W3cGg46W.js";
+import { i as loadWorkspaceSkillEntries } from "./skills-EwyaIyKC.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-DqvtYF2o.js";
-import { n as listChannelPlugins } from "./plugins-BDTkSIi7.js";
-import { t as GatewayClient } from "./client-G9E5HGM2.js";
-import { l as READ_SCOPE, t as buildGatewayConnectionDetails } from "./call-BlWEBz99.js";
+import { n as listChannelPlugins } from "./plugins-Bc7YM9X-.js";
+import { t as GatewayClient } from "./client-COy24r9W.js";
+import { l as READ_SCOPE, t as buildGatewayConnectionDetails } from "./call-D7jOWSFr.js";
 import { t as resolveGatewayCredentialsFromConfig } from "./credentials-CyQeGziJ.js";
-import { C as resolveToolProfilePolicy, f as resolveSandboxConfigForAgent, k as SANDBOX_BROWSER_SECURITY_HASH_EPOCH, l as execDockerRaw, m as resolveSandboxToolPolicyForAgent, u as getBlockedBindReason } from "./sandbox-C3TbYIHd.js";
-import { a as resolveGatewayAuth } from "./auth-CuObxnC4.js";
-import { a as resolveProfile, c as resolveBrowserControlAuth, i as resolveBrowserConfig } from "./server-context-Dw_4lGoI.js";
+import { C as resolveToolProfilePolicy, f as resolveSandboxConfigForAgent, k as SANDBOX_BROWSER_SECURITY_HASH_EPOCH, l as execDockerRaw, m as resolveSandboxToolPolicyForAgent, u as getBlockedBindReason } from "./sandbox-ixDhkfHu.js";
+import { a as resolveGatewayAuth } from "./auth-BlP9BwaD.js";
+import { a as resolveProfile, c as resolveBrowserControlAuth, i as resolveBrowserConfig } from "./server-context-Dd8UynDU.js";
 import { r as formatErrorMessage } from "./errors-BnRmsfe-.js";
-import { r as resolveMergedSafeBinProfileFixtures, t as listInterpreterLikeSafeBins } from "./exec-safe-bin-runtime-policy-CfQeDABF.js";
-import { a as resolveNativeSkillsEnabled, i as resolveNativeCommandsEnabled } from "./commands-CnX9I_l4.js";
-import { i as readChannelAllowFromStore } from "./pairing-store-D0eOXyby.js";
-import { t as listAgentWorkspaceDirs } from "./workspace-dirs-CjMIsQti.js";
-import { l as resolveDmAllowState, n as isToolAllowedByPolicies, o as pickSandboxToolPolicy } from "./pi-tools.policy-BwWnFLLV.js";
+import { r as resolveMergedSafeBinProfileFixtures, t as listInterpreterLikeSafeBins } from "./exec-safe-bin-runtime-policy-DECo77U6.js";
+import { a as resolveNativeSkillsEnabled, i as resolveNativeCommandsEnabled } from "./commands-DDHiW-As.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-BC4mnG9S.js";
+import { t as listAgentWorkspaceDirs } from "./workspace-dirs-D8D-Ghcl.js";
+import { l as resolveDmAllowState, n as isToolAllowedByPolicies, o as pickSandboxToolPolicy } from "./pi-tools.policy-D3RA94WF.js";
 import { n as isDangerousNameMatchingEnabled } from "./dangerous-name-matching-CXdnb6je.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-Dpi4An5r.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-D7MilaX-.js";
-import { t as scanDirectoryWithSummary } from "./skill-scanner-CvS725eQ.js";
-import { r as resolveNodeCommandAllowlist, t as DEFAULT_DANGEROUS_NODE_COMMANDS } from "./node-command-policy-B_D5ucTj.js";
+import { t as scanDirectoryWithSummary } from "./skill-scanner--QKHR8U0.js";
+import { r as resolveNodeCommandAllowlist, t as DEFAULT_DANGEROUS_NODE_COMMANDS } from "./node-command-policy-BeTSnoyk.js";
 import { c as normalizeTelegramAllowFromEntry, s as isNumericTelegramUserId, t as isDiscordMutableAllowEntry } from "./mutable-allowlist-detectors-DHXBcz_e.js";
 import { t as inferParamBFromIdOrName } from "./model-param-b-scvX_s5g.js";
 import path from "node:path";
 import JSON5 from "json5";
-import * as fs$1 from "node:fs/promises";
-import fs from "node:fs/promises";
+import * as fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { isIP } from "node:net";
 
@@ -1342,7 +1342,7 @@ async function collectIncludePathsRecursive(params) {
 			if (visited.has(resolved)) continue;
 			visited.add(resolved);
 			result.push(resolved);
-			const rawText = await fs$1.readFile(resolved, "utf-8").catch(() => null);
+			const rawText = await fs.readFile(resolved, "utf-8").catch(() => null);
 			if (!rawText) continue;
 			const nestedParsed = (() => {
 				try {
@@ -1377,7 +1377,7 @@ function expandTilde(p, env) {
 }
 async function readPluginManifestExtensions(pluginPath) {
 	const manifestPath = path.join(pluginPath, "package.json");
-	const raw = await fs.readFile(manifestPath, "utf-8").catch(() => "");
+	const raw = await fsPromises.readFile(manifestPath, "utf-8").catch(() => "");
 	if (!raw.trim()) return [];
 	const extensions = JSON.parse(raw)?.[MANIFEST_KEY]?.extensions;
 	if (!Array.isArray(extensions)) return [];
@@ -1399,7 +1399,7 @@ async function listInstalledPluginDirs(params) {
 	};
 	return {
 		extensionsDir,
-		pluginDirs: (await fs.readdir(extensionsDir, { withFileTypes: true }).catch((err) => {
+		pluginDirs: (await fsPromises.readdir(extensionsDir, { withFileTypes: true }).catch((err) => {
 			params.onReadError?.(err);
 			return [];
 		})).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter(Boolean)
@@ -1462,7 +1462,7 @@ function isPinnedRegistrySpec(spec) {
 }
 async function readInstalledPackageVersion(dir) {
 	try {
-		const raw = await fs.readFile(path.join(dir, "package.json"), "utf-8");
+		const raw = await fsPromises.readFile(path.join(dir, "package.json"), "utf-8");
 		const parsed = JSON.parse(raw);
 		return typeof parsed.version === "string" ? parsed.version : void 0;
 	} catch {
@@ -1498,10 +1498,10 @@ async function listWorkspaceSkillMarkdownFiles(workspaceDir) {
 	const visitedDirs = /* @__PURE__ */ new Set();
 	while (queue.length > 0 && skillFiles.length < MAX_WORKSPACE_SKILL_SCAN_FILES_PER_WORKSPACE) {
 		const dir = queue.shift();
-		const dirRealPath = await fs.realpath(dir).catch(() => path.resolve(dir));
+		const dirRealPath = await fsPromises.realpath(dir).catch(() => path.resolve(dir));
 		if (visitedDirs.has(dirRealPath)) continue;
 		visitedDirs.add(dirRealPath);
-		const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+		const entries = await fsPromises.readdir(dir, { withFileTypes: true }).catch(() => []);
 		for (const entry of entries) {
 			if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
 			const fullPath = path.join(dir, entry.name);
@@ -1510,7 +1510,7 @@ async function listWorkspaceSkillMarkdownFiles(workspaceDir) {
 				continue;
 			}
 			if (entry.isSymbolicLink()) {
-				const stat = await fs.stat(fullPath).catch(() => null);
+				const stat = await fsPromises.stat(fullPath).catch(() => null);
 				if (!stat) continue;
 				if (stat.isDirectory()) {
 					queue.push(fullPath);
@@ -1800,13 +1800,13 @@ async function collectWorkspaceSkillSymlinkEscapeFindings(params) {
 	const seenSkillPaths = /* @__PURE__ */ new Set();
 	for (const workspaceDir of workspaceDirs) {
 		const workspacePath = path.resolve(workspaceDir);
-		const workspaceRealPath = await fs.realpath(workspacePath).catch(() => workspacePath);
+		const workspaceRealPath = await fsPromises.realpath(workspacePath).catch(() => workspacePath);
 		const skillFilePaths = await listWorkspaceSkillMarkdownFiles(workspacePath);
 		for (const skillFilePath of skillFilePaths) {
 			const canonicalSkillPath = path.resolve(skillFilePath);
 			if (seenSkillPaths.has(canonicalSkillPath)) continue;
 			seenSkillPaths.add(canonicalSkillPath);
-			const skillRealPath = await fs.realpath(canonicalSkillPath).catch(() => null);
+			const skillRealPath = await fsPromises.realpath(canonicalSkillPath).catch(() => null);
 			if (!skillRealPath) continue;
 			if (isPathInside(workspaceRealPath, skillRealPath)) continue;
 			escapedSkillFiles.push({

package/dist/{auth-CuObxnC4.js → auth-BlP9BwaD.js}

@@ -1,5 +1,5 @@
 import { t as safeEqualSecret } from "./secret-equal-Gla36CGi.js";
-import { a as isTrustedProxyAddress, l as resolveClientIp, n as isLoopbackAddress, t as isLocalishHost } from "./net-CCnbGop3.js";
+import { a as isTrustedProxyAddress, l as resolveClientIp, n as isLoopbackAddress, t as isLocalishHost } from "./net-CIh5ellr.js";
 import { n as resolveGatewayCredentialsFromValues } from "./credentials-CyQeGziJ.js";
 import { c as readTailscaleWhoisIdentity } from "./tailscale-DHGqQR08.js";
 

package/dist/{auth-choice-BVQQneHM.js → auth-choice-Czu7271G.js}

@@ -2,10 +2,10 @@ import "./globals-BrhVUl-N.js";
 import "./paths-CHIu6D1E.js";
 import "./subsystem-Bw5n50gj.js";
 import "./boolean-DtWR5bt3.js";
-import { Ai as normalizeOptionalSecretInput, Sr as normalizeProviderId, Zn as upsertAuthProfile, ct as resolveDefaultSecretProviderAlias, d as resolveApiKeyForProfile, er as ensureAuthProfileStore, gi as resolveEnvApiKey, ji as normalizeSecretInput, pt as parseDurationMs, r as resolveAuthProfileOrder } from "./auth-profiles-CX4YYu7Z.js";
-import "./agent-scope-Cq4vDGrK.js";
+import { Ai as normalizeOptionalSecretInput, Sr as normalizeProviderId, Zn as upsertAuthProfile, ct as resolveDefaultSecretProviderAlias, d as resolveApiKeyForProfile, er as ensureAuthProfileStore, gi as resolveEnvApiKey, ji as normalizeSecretInput, pt as parseDurationMs, r as resolveAuthProfileOrder } from "./auth-profiles-9T4j6jMy.js";
+import "./agent-scope-nEVgVklg.js";
 import "./utils-D6vohX1h.js";
-import "./squidclaw-root-BQfLymzj.js";
+import "./squidclaw-root-JXyRbQLJ.js";
 import "./logger-DL3N22PJ.js";
 import "./exec-TSiqsZw1.js";
 import "./registry-BXcl3IkC.js";
@@ -13,16 +13,16 @@ import "./github-copilot-token-CxitgiZA.js";
 import "./host-env-security-lcjXF83D.js";
 import "./version-3so140Zi.js";
 import "./env-vars-mSSOl7Rv.js";
-import "./manifest-registry-7kwtbCH-.js";
-import "./models-config-poV-4Xlx.js";
-import "./model-catalog-BWuvEv1x.js";
-import { a as normalizeSecretInputModeInput } from "./auth-choice.apply-helpers-p1y_DmDT.js";
-import "./issue-format-DCcINW-9.js";
-import "./shared-BbVxcRzb.js";
-import { A as applyTogetherConfig, B as applyLitellmConfig, E as applyQianfanConfig, H as applyCloudflareAiGatewayConfig, I as applyXiaomiConfig, M as applyVeniceConfig, O as applySyntheticConfig, P as applyXaiConfig, R as applyZaiConfig, St as setZaiApiKey, W as applyVercelAiGatewayConfig, _t as setVeniceApiKey, a as applyMinimaxApiConfig, at as setKilocodeApiKey, b as applyMoonshotConfig, bt as setXaiApiKey, ct as setMinimaxApiKey, d as applyAuthProfileConfig, dt as setOpenaiApiKey, et as setAnthropicApiKey, f as applyHuggingfaceConfig, ft as setOpencodeZenApiKey, g as applyKimiCodeConfig, gt as setTogetherApiKey, ht as setSyntheticApiKey, it as setHuggingfaceApiKey, l as applyMinimaxConfig, lt as setMistralApiKey, m as applyKilocodeConfig, mt as setQianfanApiKey, n as validateAnthropicSetupToken, nt as setCloudflareAiGatewayConfig, o as applyMinimaxApiConfigCn, ot as setKimiCodingApiKey, pt as setOpenrouterApiKey, r as applyOpencodeZenConfig, rt as setGeminiApiKey, st as setLitellmApiKey, t as buildTokenProfileId, tt as setByteplusApiKey, ut as setMoonshotApiKey, v as applyMistralConfig, vt as setVercelAiGatewayApiKey, w as applyOpenrouterConfig, x as applyMoonshotConfigCn, xt as setXiaomiApiKey, yt as setVolcengineApiKey } from "./auth-token-Dlk7MMsC.js";
-import { i as detectZaiEndpoint, n as applyOpenAIConfig, o as applyGoogleGeminiModelDefault } from "./openai-model-default-COzeuAI4.js";
-import { r as applyPrimaryModel } from "./model-picker-CLhaaagi.js";
-import { i as parseNonInteractiveCustomApiFlags, n as applyCustomApiConfig, o as resolveCustomProviderId, t as CustomApiError } from "./onboard-custom-CZtjqrY7.js";
+import "./manifest-registry-1ACGW3OR.js";
+import "./models-config-DAastTau.js";
+import "./model-catalog-Drh9Rois.js";
+import { a as normalizeSecretInputModeInput } from "./auth-choice.apply-helpers-CdoXMtxm.js";
+import "./issue-format-CbTfB8Hy.js";
+import "./shared-BYny1RCF.js";
+import { A as applyTogetherConfig, B as applyLitellmConfig, E as applyQianfanConfig, H as applyCloudflareAiGatewayConfig, I as applyXiaomiConfig, M as applyVeniceConfig, O as applySyntheticConfig, P as applyXaiConfig, R as applyZaiConfig, St as setZaiApiKey, W as applyVercelAiGatewayConfig, _t as setVeniceApiKey, a as applyMinimaxApiConfig, at as setKilocodeApiKey, b as applyMoonshotConfig, bt as setXaiApiKey, ct as setMinimaxApiKey, d as applyAuthProfileConfig, dt as setOpenaiApiKey, et as setAnthropicApiKey, f as applyHuggingfaceConfig, ft as setOpencodeZenApiKey, g as applyKimiCodeConfig, gt as setTogetherApiKey, ht as setSyntheticApiKey, it as setHuggingfaceApiKey, l as applyMinimaxConfig, lt as setMistralApiKey, m as applyKilocodeConfig, mt as setQianfanApiKey, n as validateAnthropicSetupToken, nt as setCloudflareAiGatewayConfig, o as applyMinimaxApiConfigCn, ot as setKimiCodingApiKey, pt as setOpenrouterApiKey, r as applyOpencodeZenConfig, rt as setGeminiApiKey, st as setLitellmApiKey, t as buildTokenProfileId, tt as setByteplusApiKey, ut as setMoonshotApiKey, v as applyMistralConfig, vt as setVercelAiGatewayApiKey, w as applyOpenrouterConfig, x as applyMoonshotConfigCn, xt as setXiaomiApiKey, yt as setVolcengineApiKey } from "./auth-token-BFc70pes.js";
+import { i as detectZaiEndpoint, n as applyOpenAIConfig, o as applyGoogleGeminiModelDefault } from "./openai-model-default-DqE4bNtd.js";
+import { r as applyPrimaryModel } from "./model-picker-DK_vvKCV.js";
+import { i as parseNonInteractiveCustomApiFlags, n as applyCustomApiConfig, o as resolveCustomProviderId, t as CustomApiError } from "./onboard-custom-CRpsaM3g.js";
 
 //#region src/commands/onboard-non-interactive/api-keys.ts
 function parseEnvVarNameFromSourceLabel(source) {

package/dist/{auth-choice-CXepQc7c.js → auth-choice-ORZHjbsv.js}

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { Di as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, Dr as resolveDefaultModelForAgent, Ei as isHuggingfacePolicyLocked, Jn as listProfilesForProvider, Ni as KILOCODE_DEFAULT_MODEL_REF, Ti as discoverHuggingfaceModels, Zn as upsertAuthProfile, _ as parseOAuthCallbackInput, er as ensureAuthProfileStore, fi as getCustomProviderApiKey, g as generateChutesPkce, gi as resolveEnvApiKey, h as exchangeChutesCodeForTokens, m as CHUTES_AUTHORIZE_ENDPOINT, ni as SYNTHETIC_DEFAULT_MODEL_REF, qr as VENICE_DEFAULT_MODEL_REF, r as resolveAuthProfileOrder, sr as resolveSquidClawAgentDir } from "./auth-profiles-CX4YYu7Z.js";
-import { A as resolveDefaultAgentWorkspaceDir, P as toAgentModelListLike, a as resolveAgentDir, d as resolveDefaultAgentId, u as resolveAgentWorkspaceDir } from "./agent-scope-Cq4vDGrK.js";
-import { r as isLoopbackHost } from "./net-CCnbGop3.js";
-import { n as loadModelCatalog } from "./model-catalog-BWuvEv1x.js";
-import { f as openUrl } from "./onboard-helpers-BP429__H.js";
-import { t as enablePluginInConfig } from "./enable-C8FNY18p.js";
-import { a as normalizeSecretInputModeInput, c as resolveSecretInputModeForEnvSelection, d as normalizeApiKeyInput, f as validateApiKeyInput, i as ensureApiKeyFromOptionEnvOrPrompt, l as applyDefaultModelChoice, n as createAuthChoiceDefaultModelApplierForMutableState, o as normalizeTokenProviderInput, s as promptSecretRefForOnboarding, t as createAuthChoiceAgentModelNoter, u as ensureModelAllowlistEntry } from "./auth-choice.apply-helpers-p1y_DmDT.js";
-import { $ as ZAI_DEFAULT_MODEL_REF, A as applyTogetherConfig, B as applyLitellmConfig, C as applyMoonshotProviderConfigCn, Ct as writeOAuthCredentials, D as applyQianfanProviderConfig, Dt as QIANFAN_DEFAULT_MODEL_REF, E as applyQianfanConfig, Et as MOONSHOT_DEFAULT_MODEL_REF, F as applyXaiProviderConfig, G as applyVercelAiGatewayProviderConfig, H as applyCloudflareAiGatewayConfig, I as applyXiaomiConfig, J as LITELLM_DEFAULT_MODEL_REF, K as applyAgentDefaultModelPrimary, L as applyXiaomiProviderConfig, M as applyVeniceConfig, N as applyVeniceProviderConfig, O as applySyntheticConfig, Ot as XAI_DEFAULT_MODEL_REF, P as applyXaiConfig, Q as XIAOMI_DEFAULT_MODEL_REF, R as applyZaiConfig, S as applyMoonshotProviderConfig, St as setZaiApiKey, T as applyOpenrouterProviderConfig, Tt as MISTRAL_DEFAULT_MODEL_REF, U as applyCloudflareAiGatewayProviderConfig, V as applyLitellmProviderConfig, W as applyVercelAiGatewayConfig, X as TOGETHER_DEFAULT_MODEL_REF, Y as OPENROUTER_DEFAULT_MODEL_REF, Z as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, _ as applyKimiCodeProviderConfig, _t as setVeniceApiKey, a as applyMinimaxApiConfig, at as setKilocodeApiKey, b as applyMoonshotConfig, bt as setXaiApiKey, c as applyMinimaxApiProviderConfigCn, ct as setMinimaxApiKey, d as applyAuthProfileConfig, dt as setOpenaiApiKey, et as setAnthropicApiKey, ft as setOpencodeZenApiKey, g as applyKimiCodeConfig, gt as setTogetherApiKey, h as applyKilocodeProviderConfig, ht as setSyntheticApiKey, i as applyOpencodeZenProviderConfig, it as setHuggingfaceApiKey, j as applyTogetherProviderConfig, k as applySyntheticProviderConfig, l as applyMinimaxConfig, lt as setMistralApiKey, m as applyKilocodeConfig, mt as setQianfanApiKey, n as validateAnthropicSetupToken, nt as setCloudflareAiGatewayConfig, o as applyMinimaxApiConfigCn, ot as setKimiCodingApiKey, p as applyHuggingfaceProviderConfig, pt as setOpenrouterApiKey, q as HUGGINGFACE_DEFAULT_MODEL_REF, r as applyOpencodeZenConfig, rt as setGeminiApiKey, s as applyMinimaxApiProviderConfig, st as setLitellmApiKey, t as buildTokenProfileId, tt as setByteplusApiKey, u as applyMinimaxProviderConfig, ut as setMoonshotApiKey, v as applyMistralConfig, vt as setVercelAiGatewayApiKey, w as applyOpenrouterConfig, wt as KIMI_CODING_MODEL_REF, x as applyMoonshotConfigCn, xt as setXiaomiApiKey, y as applyMistralProviderConfig, yt as setVolcengineApiKey, z as applyZaiProviderConfig } from "./auth-token-Dlk7MMsC.js";
-import { a as createVpsAwareOAuthHandlers, c as githubCopilotLoginCommand, i as resolveProviderMatch, n as mergeConfigPatch, o as isRemoteEnvironment, r as pickAuthMethod, s as resolvePluginProviders, t as applyDefaultModel } from "./provider-auth-helpers-B5kD4Lt6.js";
-import { a as GOOGLE_GEMINI_DEFAULT_MODEL, i as detectZaiEndpoint, n as applyOpenAIConfig, o as applyGoogleGeminiModelDefault, r as applyOpenAIProviderConfig, t as OPENAI_DEFAULT_MODEL } from "./openai-model-default-COzeuAI4.js";
-import { c as OPENAI_CODEX_DEFAULT_MODEL, l as applyOpenAICodexModelDefault, r as applyPrimaryModel, s as promptAndConfigureVllm } from "./model-picker-CLhaaagi.js";
+import { Di as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, Dr as resolveDefaultModelForAgent, Ei as isHuggingfacePolicyLocked, Jn as listProfilesForProvider, Ni as KILOCODE_DEFAULT_MODEL_REF, Ti as discoverHuggingfaceModels, Zn as upsertAuthProfile, _ as parseOAuthCallbackInput, er as ensureAuthProfileStore, fi as getCustomProviderApiKey, g as generateChutesPkce, gi as resolveEnvApiKey, h as exchangeChutesCodeForTokens, m as CHUTES_AUTHORIZE_ENDPOINT, ni as SYNTHETIC_DEFAULT_MODEL_REF, qr as VENICE_DEFAULT_MODEL_REF, r as resolveAuthProfileOrder, sr as resolveSquidClawAgentDir } from "./auth-profiles-9T4j6jMy.js";
+import { A as resolveDefaultAgentWorkspaceDir, P as toAgentModelListLike, a as resolveAgentDir, d as resolveDefaultAgentId, u as resolveAgentWorkspaceDir } from "./agent-scope-nEVgVklg.js";
+import { r as isLoopbackHost } from "./net-CIh5ellr.js";
+import { n as loadModelCatalog } from "./model-catalog-Drh9Rois.js";
+import { f as openUrl } from "./onboard-helpers-DwEZeaoe.js";
+import { t as enablePluginInConfig } from "./enable--Q7yLTZm.js";
+import { a as normalizeSecretInputModeInput, c as resolveSecretInputModeForEnvSelection, d as normalizeApiKeyInput, f as validateApiKeyInput, i as ensureApiKeyFromOptionEnvOrPrompt, l as applyDefaultModelChoice, n as createAuthChoiceDefaultModelApplierForMutableState, o as normalizeTokenProviderInput, s as promptSecretRefForOnboarding, t as createAuthChoiceAgentModelNoter, u as ensureModelAllowlistEntry } from "./auth-choice.apply-helpers-CdoXMtxm.js";
+import { $ as ZAI_DEFAULT_MODEL_REF, A as applyTogetherConfig, B as applyLitellmConfig, C as applyMoonshotProviderConfigCn, Ct as writeOAuthCredentials, D as applyQianfanProviderConfig, Dt as QIANFAN_DEFAULT_MODEL_REF, E as applyQianfanConfig, Et as MOONSHOT_DEFAULT_MODEL_REF, F as applyXaiProviderConfig, G as applyVercelAiGatewayProviderConfig, H as applyCloudflareAiGatewayConfig, I as applyXiaomiConfig, J as LITELLM_DEFAULT_MODEL_REF, K as applyAgentDefaultModelPrimary, L as applyXiaomiProviderConfig, M as applyVeniceConfig, N as applyVeniceProviderConfig, O as applySyntheticConfig, Ot as XAI_DEFAULT_MODEL_REF, P as applyXaiConfig, Q as XIAOMI_DEFAULT_MODEL_REF, R as applyZaiConfig, S as applyMoonshotProviderConfig, St as setZaiApiKey, T as applyOpenrouterProviderConfig, Tt as MISTRAL_DEFAULT_MODEL_REF, U as applyCloudflareAiGatewayProviderConfig, V as applyLitellmProviderConfig, W as applyVercelAiGatewayConfig, X as TOGETHER_DEFAULT_MODEL_REF, Y as OPENROUTER_DEFAULT_MODEL_REF, Z as VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF, _ as applyKimiCodeProviderConfig, _t as setVeniceApiKey, a as applyMinimaxApiConfig, at as setKilocodeApiKey, b as applyMoonshotConfig, bt as setXaiApiKey, c as applyMinimaxApiProviderConfigCn, ct as setMinimaxApiKey, d as applyAuthProfileConfig, dt as setOpenaiApiKey, et as setAnthropicApiKey, ft as setOpencodeZenApiKey, g as applyKimiCodeConfig, gt as setTogetherApiKey, h as applyKilocodeProviderConfig, ht as setSyntheticApiKey, i as applyOpencodeZenProviderConfig, it as setHuggingfaceApiKey, j as applyTogetherProviderConfig, k as applySyntheticProviderConfig, l as applyMinimaxConfig, lt as setMistralApiKey, m as applyKilocodeConfig, mt as setQianfanApiKey, n as validateAnthropicSetupToken, nt as setCloudflareAiGatewayConfig, o as applyMinimaxApiConfigCn, ot as setKimiCodingApiKey, p as applyHuggingfaceProviderConfig, pt as setOpenrouterApiKey, q as HUGGINGFACE_DEFAULT_MODEL_REF, r as applyOpencodeZenConfig, rt as setGeminiApiKey, s as applyMinimaxApiProviderConfig, st as setLitellmApiKey, t as buildTokenProfileId, tt as setByteplusApiKey, u as applyMinimaxProviderConfig, ut as setMoonshotApiKey, v as applyMistralConfig, vt as setVercelAiGatewayApiKey, w as applyOpenrouterConfig, wt as KIMI_CODING_MODEL_REF, x as applyMoonshotConfigCn, xt as setXiaomiApiKey, y as applyMistralProviderConfig, yt as setVolcengineApiKey, z as applyZaiProviderConfig } from "./auth-token-BFc70pes.js";
+import { a as createVpsAwareOAuthHandlers, c as githubCopilotLoginCommand, i as resolveProviderMatch, n as mergeConfigPatch, o as isRemoteEnvironment, r as pickAuthMethod, s as resolvePluginProviders, t as applyDefaultModel } from "./provider-auth-helpers-_77rN3Zc.js";
+import { a as GOOGLE_GEMINI_DEFAULT_MODEL, i as detectZaiEndpoint, n as applyOpenAIConfig, o as applyGoogleGeminiModelDefault, r as applyOpenAIProviderConfig, t as OPENAI_DEFAULT_MODEL } from "./openai-model-default-DqE4bNtd.js";
+import { c as OPENAI_CODEX_DEFAULT_MODEL, l as applyOpenAICodexModelDefault, r as applyPrimaryModel, s as promptAndConfigureVllm } from "./model-picker-DK_vvKCV.js";
 import { r as runOpenAIOAuthTlsPreflight, t as formatOpenAIOAuthTlsPreflightFix } from "./oauth-tls-preflight-6-9iUInB.js";
 import { loginOpenAICodex } from "@mariozechner/pi-ai";
 import { randomBytes } from "node:crypto";

package/dist/{auth-choice.apply-helpers-p1y_DmDT.js → auth-choice.apply-helpers-CdoXMtxm.js}

@@ -1,4 +1,4 @@
-import { Li as DEFAULT_PROVIDER, O as encodeJsonPointerToken, Tr as resolveAllowlistModelKey, ct as resolveDefaultSecretProviderAlias, gi as resolveEnvApiKey, ot as isValidFileSecretRefId, y as resolveSecretRefString } from "./auth-profiles-CX4YYu7Z.js";
+import { Li as DEFAULT_PROVIDER, O as encodeJsonPointerToken, Tr as resolveAllowlistModelKey, ct as resolveDefaultSecretProviderAlias, gi as resolveEnvApiKey, ot as isValidFileSecretRefId, y as resolveSecretRefString } from "./auth-profiles-9T4j6jMy.js";
 import { t as PROVIDER_ENV_VARS } from "./provider-env-vars-CDLIEZFR.js";
 
 //#region src/commands/auth-choice.api-key.ts

package/dist/{auth-profiles-CX4YYu7Z.js → auth-profiles-9T4j6jMy.js}

@@ -3,10 +3,10 @@ import { _ as expandHomePrefix, a as resolveCanonicalConfigPath, c as resolveDef
 import { c as stripAnsi, t as createSubsystemLogger } from "./subsystem-Bw5n50gj.js";
 import { r as isTruthyEnvValue } from "./entry.js";
 import { t as formatCliCommand } from "./command-format-D8-lYArk.js";
-import { N as resolveAgentModelPrimaryValue, P as toAgentModelListLike, d as resolveDefaultAgentId, i as resolveAgentConfig, o as resolveAgentEffectiveModelPrimary, u as resolveAgentWorkspaceDir } from "./agent-scope-Cq4vDGrK.js";
+import { N as resolveAgentModelPrimaryValue, P as toAgentModelListLike, d as resolveDefaultAgentId, i as resolveAgentConfig, o as resolveAgentEffectiveModelPrimary, u as resolveAgentWorkspaceDir } from "./agent-scope-nEVgVklg.js";
 import { c as normalizeAgentId, t as DEFAULT_AGENT_ID, y as isBlockedObjectKey } from "./session-key-k6urs9r-.js";
 import { E as isPlainObject$2, S as sleep, h as resolveConfigDir, u as isRecord$2, v as resolveUserPath } from "./utils-D6vohX1h.js";
-import { a as openBoundaryFileSync, r as canUseBoundaryFileOpen } from "./squidclaw-root-BQfLymzj.js";
+import { a as openBoundaryFileSync, r as canUseBoundaryFileOpen } from "./squidclaw-root-JXyRbQLJ.js";
 import { n as runExec } from "./exec-TSiqsZw1.js";
 import { A as hasConfiguredSecretInput, D as DEFAULT_SECRET_PROVIDER_ALIAS, F as resolveSecretInputRef, M as normalizeResolvedSecretInputString, N as normalizeSecretInputString, O as assertSecretInputResolved, P as parseEnvTemplateSecretRef, j as isSecretRef, k as coerceSecretRef, l as normalizeChatChannelId, t as CHANNEL_IDS } from "./registry-BXcl3IkC.js";
 import { a as saveJsonFile, i as loadJsonFile, r as resolveCopilotApiToken, t as DEFAULT_COPILOT_API_BASE_URL } from "./github-copilot-token-CxitgiZA.js";
@@ -14,8 +14,8 @@ import { i as sanitizeHostExecEnv } from "./host-env-security-lcjXF83D.js";
 import { t as VERSION } from "./version-3so140Zi.js";
 import { t as applyConfigEnvVars } from "./env-vars-mSSOl7Rv.js";
 import { i as isPathInside } from "./legacy-names-Q0o_2ITh.js";
-import { d as normalizePluginsConfig, f as resolveEffectiveEnableState, n as loadPluginManifestRegistry, p as resolveMemorySlotDecision } from "./manifest-registry-7kwtbCH-.js";
-import { d as TOOLS_BY_SENDER_KEY_TYPES, f as parseToolsBySenderTypedKey } from "./dock-DJJAj46v.js";
+import { d as normalizePluginsConfig, f as resolveEffectiveEnableState, n as loadPluginManifestRegistry, p as resolveMemorySlotDecision } from "./manifest-registry-1ACGW3OR.js";
+import { d as TOOLS_BY_SENDER_KEY_TYPES, f as parseToolsBySenderTypedKey } from "./dock-W3cGg46W.js";
 import { t as runTasksWithConcurrency } from "./run-with-concurrency-kzSMVKJz.js";
 import { createRequire } from "node:module";
 import { execFileSync, spawn } from "node:child_process";
@@ -24,7 +24,7 @@ import path from "node:path";
 import fs from "node:fs";
 import JSON5 from "json5";
 import { isDeepStrictEqual } from "node:util";
-import fs$1 from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import { BedrockClient, ListFoundationModelsCommand } from "@aws-sdk/client-bedrock";
 import { createAssistantMessageEventStream, getEnvApiKey, getOAuthApiKey, getOAuthProviders } from "@mariozechner/pi-ai";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -3559,7 +3559,7 @@ function computeDelayMs(retries, attempt) {
 }
 async function readLockPayload(lockPath) {
 	try {
-		const raw = await fs$1.readFile(lockPath, "utf8");
+		const raw = await fsPromises.readFile(lockPath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (typeof parsed.pid !== "number" || typeof parsed.createdAt !== "string") return null;
 		return {
@@ -3573,9 +3573,9 @@ async function readLockPayload(lockPath) {
 async function resolveNormalizedFilePath(filePath) {
 	const resolved = path.resolve(filePath);
 	const dir = path.dirname(resolved);
-	await fs$1.mkdir(dir, { recursive: true });
+	await fsPromises.mkdir(dir, { recursive: true });
 	try {
-		const realDir = await fs$1.realpath(dir);
+		const realDir = await fsPromises.realpath(dir);
 		return path.join(realDir, path.basename(resolved));
 	} catch {
 		return resolved;
@@ -3589,7 +3589,7 @@ async function isStaleLock(lockPath, staleMs) {
 		if (!Number.isFinite(createdAt) || Date.now() - createdAt > staleMs) return true;
 	}
 	try {
-		const stat = await fs$1.stat(lockPath);
+		const stat = await fsPromises.stat(lockPath);
 		return Date.now() - stat.mtimeMs > staleMs;
 	} catch {
 		return true;
@@ -3602,7 +3602,7 @@ async function releaseHeldLock(normalizedFile) {
 	if (current.count > 0) return;
 	HELD_LOCKS.delete(normalizedFile);
 	await current.handle.close().catch(() => void 0);
-	await fs$1.rm(current.lockPath, { force: true }).catch(() => void 0);
+	await fsPromises.rm(current.lockPath, { force: true }).catch(() => void 0);
 }
 async function acquireFileLock(filePath, options) {
 	const normalizedFile = await resolveNormalizedFilePath(filePath);
@@ -3617,7 +3617,7 @@ async function acquireFileLock(filePath, options) {
 	}
 	const attempts = Math.max(1, options.retries.retries + 1);
 	for (let attempt = 0; attempt < attempts; attempt += 1) try {
-		const handle = await fs$1.open(lockPath, "wx");
+		const handle = await fsPromises.open(lockPath, "wx");
 		await handle.writeFile(JSON.stringify({
 			pid: process.pid,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -3634,7 +3634,7 @@ async function acquireFileLock(filePath, options) {
 	} catch (err) {
 		if (err.code !== "EEXIST") throw err;
 		if (await isStaleLock(lockPath, options.stale)) {
-			await fs$1.rm(lockPath, { force: true }).catch(() => void 0);
+			await fsPromises.rm(lockPath, { force: true }).catch(() => void 0);
 			continue;
 		}
 		if (attempt >= attempts - 1) break;
@@ -14786,7 +14786,7 @@ function createIcaclsResetCommand(targetPath, opts) {
 //#region src/security/audit-fs.ts
 async function safeStat(targetPath) {
 	try {
-		const lst = await fs$1.lstat(targetPath);
+		const lst = await fsPromises.lstat(targetPath);
 		return {
 			ok: true,
 			isSymlink: lst.isSymbolicLink(),
@@ -14825,7 +14825,7 @@ async function inspectPathPermissions(targetPath, opts) {
 	let effectiveMode = st.mode;
 	let effectiveIsDir = st.isDir;
 	if (st.isSymlink) try {
-		const target = await fs$1.stat(targetPath);
+		const target = await fsPromises.stat(targetPath);
 		effectiveMode = typeof target.mode === "number" ? target.mode : st.mode;
 		effectiveIsDir = target.isDirectory();
 	} catch {}
@@ -15079,7 +15079,7 @@ async function assertSecurePath(params) {
 	if (stat.isSymlink) {
 		if (!params.allowSymlinkPath) throw new Error(`${params.label} must not be a symlink: ${effectivePath}`);
 		try {
-			effectivePath = await fs$1.realpath(effectivePath);
+			effectivePath = await fsPromises.realpath(effectivePath);
 		} catch {
 			throw new Error(`${params.label} symlink target is not readable: ${params.targetPath}`);
 		}
@@ -15127,7 +15127,7 @@ async function readFileProviderPayload(params) {
 			}, timeoutMs);
 		});
 		try {
-			const payload = await Promise.race([fs$1.readFile(secureFilePath, { signal: abortController.signal }), timeoutPromise]);
+			const payload = await Promise.race([fsPromises.readFile(secureFilePath, { signal: abortController.signal }), timeoutPromise]);
 			if (payload.byteLength > maxBytes) throw new Error(`File provider "${params.providerName}" exceeded maxBytes (${maxBytes}).`);
 			const text = payload.toString("utf8");
 			if (params.providerConfig.mode === "singleValue") return text.replace(/\r?\n$/, "");

package/dist/{auth-token-Dlk7MMsC.js → auth-token-BFc70pes.js}

@@ -1,6 +1,6 @@
 import { g as resolveStateDir } from "./paths-CHIu6D1E.js";
 import { t as createSubsystemLogger } from "./subsystem-Bw5n50gj.js";
-import { $r as TOGETHER_MODEL_CATALOG, Br as buildXiaomiProvider, Ci as HUGGINGFACE_MODEL_CATALOG, Di as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, Fr as QIANFAN_DEFAULT_MODEL_ID, Ir as XIAOMI_DEFAULT_MODEL_ID, Jr as VENICE_MODEL_CATALOG, Kr as VENICE_BASE_URL, Lr as buildKilocodeProvider, Mi as KILOCODE_BASE_URL, Ni as KILOCODE_DEFAULT_MODEL_REF, Oi as buildCloudflareAiGatewayModelDefinition, Pr as QIANFAN_BASE_URL, Qr as TOGETHER_BASE_URL, Rr as buildKimiCodingProvider, Si as HUGGINGFACE_BASE_URL, Sr as normalizeProviderId, Yr as buildVeniceModelDefinition, Zn as upsertAuthProfile, ei as buildTogetherModelDefinition, ii as buildSyntheticModelDefinition, ji as normalizeSecretInput, ki as resolveCloudflareAiGatewayBaseUrl, ni as SYNTHETIC_DEFAULT_MODEL_REF, qr as VENICE_DEFAULT_MODEL_REF, ri as SYNTHETIC_MODEL_CATALOG, sr as resolveSquidClawAgentDir, ti as SYNTHETIC_BASE_URL, wi as buildHuggingfaceModelDefinition, zr as buildQianfanProvider } from "./auth-profiles-CX4YYu7Z.js";
+import { $r as TOGETHER_MODEL_CATALOG, Br as buildXiaomiProvider, Ci as HUGGINGFACE_MODEL_CATALOG, Di as CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF, Fr as QIANFAN_DEFAULT_MODEL_ID, Ir as XIAOMI_DEFAULT_MODEL_ID, Jr as VENICE_MODEL_CATALOG, Kr as VENICE_BASE_URL, Lr as buildKilocodeProvider, Mi as KILOCODE_BASE_URL, Ni as KILOCODE_DEFAULT_MODEL_REF, Oi as buildCloudflareAiGatewayModelDefinition, Pr as QIANFAN_BASE_URL, Qr as TOGETHER_BASE_URL, Rr as buildKimiCodingProvider, Si as HUGGINGFACE_BASE_URL, Sr as normalizeProviderId, Yr as buildVeniceModelDefinition, Zn as upsertAuthProfile, ei as buildTogetherModelDefinition, ii as buildSyntheticModelDefinition, ji as normalizeSecretInput, ki as resolveCloudflareAiGatewayBaseUrl, ni as SYNTHETIC_DEFAULT_MODEL_REF, qr as VENICE_DEFAULT_MODEL_REF, ri as SYNTHETIC_MODEL_CATALOG, sr as resolveSquidClawAgentDir, ti as SYNTHETIC_BASE_URL, wi as buildHuggingfaceModelDefinition, zr as buildQianfanProvider } from "./auth-profiles-9T4j6jMy.js";
 import { D as DEFAULT_SECRET_PROVIDER_ALIAS, k as coerceSecretRef } from "./registry-BXcl3IkC.js";
 import { t as PROVIDER_ENV_VARS } from "./provider-env-vars-CDLIEZFR.js";
 import path from "node:path";

package/dist/{banner-DMfuBV69.js → banner-CwNmI5G-.js}

@@ -1,7 +1,7 @@
 import { f as isRich, p as theme, z as hasRootVersionAlias } from "./globals-BrhVUl-N.js";
 import { l as visibleWidth } from "./subsystem-Bw5n50gj.js";
-import { z as loadConfig } from "./auth-profiles-CX4YYu7Z.js";
-import { Hn as resolveCommitHash } from "./subagent-registry-CIgFD2oi.js";
+import { z as loadConfig } from "./auth-profiles-9T4j6jMy.js";
+import { Hn as resolveCommitHash } from "./subagent-registry-CQA6P2FO.js";
 
 //#region src/cli/tagline.ts
 const DEFAULT_TAGLINE = "All your chats, one SquidClaw.";

package/dist/{bonjour-discovery-BHz2I6_W.js → bonjour-discovery-eqJcK09r.js}

@@ -1,5 +1,5 @@
 import { t as runCommandWithTimeout } from "./exec-TSiqsZw1.js";
-import { t as isTailnetIPv4 } from "./tailnet-CZANZjq6.js";
+import { t as isTailnetIPv4 } from "./tailnet-DJq7Mi1o.js";
 import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-BCMIEFUS.js";
 
 //#region src/infra/bonjour-discovery.ts

package/dist/{browser-cli-Dvwk4zAD.js → browser-cli-DCDPC5sg.js}

@@ -2,11 +2,11 @@ import { n as info, p as theme, t as danger } from "./globals-BrhVUl-N.js";
 import { g as resolveStateDir } from "./paths-CHIu6D1E.js";
 import { d as defaultRuntime } from "./subsystem-Bw5n50gj.js";
 import { t as parseBooleanValue } from "./boolean-DtWR5bt3.js";
-import { z as loadConfig } from "./auth-profiles-CX4YYu7Z.js";
+import { z as loadConfig } from "./auth-profiles-9T4j6jMy.js";
 import { t as formatCliCommand } from "./command-format-D8-lYArk.js";
-import "./agent-scope-Cq4vDGrK.js";
+import "./agent-scope-nEVgVklg.js";
 import { x as shortenHomePath } from "./utils-D6vohX1h.js";
-import "./squidclaw-root-BQfLymzj.js";
+import "./squidclaw-root-JXyRbQLJ.js";
 import "./logger-DL3N22PJ.js";
 import "./exec-TSiqsZw1.js";
 import "./registry-BXcl3IkC.js";
@@ -14,25 +14,25 @@ import "./github-copilot-token-CxitgiZA.js";
 import "./host-env-security-lcjXF83D.js";
 import "./version-3so140Zi.js";
 import "./env-vars-mSSOl7Rv.js";
-import "./manifest-registry-7kwtbCH-.js";
-import "./path-alias-guards-vfYYQFIg.js";
+import "./manifest-registry-1ACGW3OR.js";
+import "./path-alias-guards-DeOVetT7.js";
 import "./message-channel-DqvtYF2o.js";
-import "./client-G9E5HGM2.js";
-import "./call-BlWEBz99.js";
+import "./client-COy24r9W.js";
+import "./call-D7jOWSFr.js";
 import "./pairing-token-B_ig96RO.js";
-import "./net-CCnbGop3.js";
-import "./tailnet-CZANZjq6.js";
-import { c as normalizeBrowserFormField, i as resolveExistingPathsWithinRoot, l as normalizeBrowserFormFieldValue, r as DEFAULT_UPLOAD_DIR } from "./paths-DfuVHiHu.js";
+import "./net-CIh5ellr.js";
+import "./tailnet-DJq7Mi1o.js";
+import { c as normalizeBrowserFormField, i as resolveExistingPathsWithinRoot, l as normalizeBrowserFormFieldValue, r as DEFAULT_UPLOAD_DIR } from "./paths-D6mnO6Ni.js";
 import "./redact-DknVdX-O.js";
 import "./errors-BnRmsfe-.js";
-import "./fs-safe-DPYj7h8A.js";
+import "./fs-safe-BPQ-per2.js";
 import { t as movePathToTrash } from "./trash-DUuU677G.js";
 import { t as formatDocsLink } from "./links-Dye6HsRG.js";
 import { n as runCommandWithRuntime } from "./cli-utils-BKqG4ZT-.js";
 import { t as formatHelpExamples } from "./help-format-CpR5cEGe.js";
 import "./progress-DuhDspl6.js";
 import { n as inheritOptionFromParent } from "./command-options-DVCpMofi.js";
-import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-D0AmaBzR.js";
+import { n as callGatewayFromCli, t as addGatewayClientOptions } from "./gateway-rpc-BBBN9ZJk.js";
 import { t as copyToClipboard } from "./clipboard-DFi9X9K_.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.23",
-  "commit": "d9d6c6ad69f04fa19798578e43fb44ba66c1baaf",
-  "builtAt": "2026-03-19T21:59:27.517Z"
+  "version": "3.0.25",
+  "commit": "be956a9acfb597e32c0defaf61cbf6604466008d",
+  "builtAt": "2026-03-20T20:21:25.658Z"
 }

package/dist/bundled/session-memory/handler.js

@@ -277,6 +277,15 @@ var MemoryManager = class {
 	clearWorkingMemory(sessionId) {
 		this.db.prepare(`DELETE FROM working_memory WHERE session_id = ? AND agent_id = ? AND user_id = ?`).run(sessionId, this.agentId, this.userId);
 	}
+	/** Replace all working memory for this agent (working memory = current state, not history) */
+	clearAllWorkingMemory() {
+		this.db.prepare(`DELETE FROM working_memory WHERE agent_id = ? AND user_id = ?`).run(this.agentId, this.userId);
+	}
+	/** Get the most recent working memory items across all sessions */
+	getLatestWorkingMemory(limit = 5) {
+		return this.db.prepare(`SELECT * FROM working_memory WHERE agent_id = ? AND user_id = ?
+         ORDER BY created_at DESC LIMIT ?`).all(this.agentId, this.userId, limit);
+	}
 	addEpisodic(mem) {
 		const sortedEntities = [...mem.entities ?? []].toSorted();
 		const sortedTags = [...mem.tags ?? []].toSorted();
@@ -468,6 +477,9 @@ Return ONLY valid JSON in this exact format (no markdown, no explanation):
   ],
   "procedural": [
     {"name": "procedure_name", "description": "when to use", "steps": ["Step 1", "Step 2"], "tags": ["tag"]}
+  ],
+  "working_memory": [
+    {"task": "what was being actively worked on", "project": "ProjectName", "next_step": "the very next action to take"}
   ]
 }
 
@@ -476,7 +488,8 @@ Rules:
 - Importance: 1=trivial 5=normal 8=important 10=critical
 - Confidence: 0.0=uncertain 0.5=probable 1.0=certain
 - Entities: proper nouns only (people, projects, companies, products, servers)
-- If nothing worth remembering: {"episodic":[],"semantic":[],"procedural":[]}`;
+- working_memory: capture ONLY tasks that were actively in progress at session end — things the user would want to continue next time. Max 3 items. If nothing was actively being worked on, return [].
+- If nothing worth remembering: {"episodic":[],"semantic":[],"procedural":[],"working_memory":[]}`;
 /**
 * Run long-term memory extraction on session content.
 * Follows the same pattern as generateSlugViaLLM.
@@ -503,9 +516,9 @@ ${params.sessionContent.slice(-6e3)}`;
 		const parsed = modelRef ? parseModelRef(modelRef, DEFAULT_PROVIDER) : null;
 		const provider = parsed?.provider ?? DEFAULT_PROVIDER;
 		const model = parsed?.model ?? DEFAULT_MODEL;
-		let rawResponse = "";
-		await runEmbeddedPiAgent({
-			sessionId: `ltm-extract-${Date.now()}`,
+		const runId = `ltm-extract-${Date.now()}`;
+		const rawResponse = (await runEmbeddedPiAgent({
+			sessionId: runId,
 			sessionKey: "temp:ltm-extractor",
 			agentId: cfgAgentId,
 			sessionFile: tempSessionFile,
@@ -514,13 +527,11 @@ ${params.sessionContent.slice(-6e3)}`;
 			config: params.cfg,
 			provider,
 			model,
-			trigger: "api",
 			prompt,
 			extraSystemPrompt: EXTRACTION_PROMPT_SYSTEM,
-			onAgentEvent: (evt) => {
-				if (evt.stream === "assistant" && typeof evt.data?.text === "string") rawResponse += evt.data.text;
-			}
-		});
+			timeoutMs: 3e4,
+			runId
+		})).payloads?.[0]?.text ?? "";
 		if (!rawResponse.trim()) {
 			log$1.warn("LTM extraction returned empty response");
 			return {
@@ -605,6 +616,24 @@ ${params.sessionContent.slice(-6e3)}`;
 				skipped++;
 			}
 		}
+		const workingItems = (extracted.working_memory ?? []).filter((w) => typeof w?.task === "string" && w.task.trim().length > 0);
+		if (workingItems.length > 0) {
+			manager.clearAllWorkingMemory();
+			for (const wm of workingItems.slice(0, 3)) try {
+				manager.addWorking({
+					sessionId: params.sessionId,
+					content: JSON.stringify({
+						task: wm.task,
+						project: wm.project,
+						next_step: wm.next_step
+					}),
+					layerHint: "working"
+				});
+				created++;
+			} catch {
+				skipped++;
+			}
+		}
 		manager.logExtraction({
 			sessionId: params.sessionId,
 			trigger: "session_end",
@@ -645,6 +674,19 @@ async function syncLongTermContextFile(params) {
 		"*Auto-generated from conversation history. Updated at session end.*",
 		""
 	];
+	const working = params.manager.getLatestWorkingMemory(3);
+	if (working.length > 0) {
+		lines.push("### 🔄 Active Work (Resume Here)");
+		for (const w of working) try {
+			const parsed = JSON.parse(w.content);
+			const proj = parsed.project ? `**[${parsed.project}]** ` : "";
+			const next = parsed.next_step ? ` → Next: ${parsed.next_step}` : "";
+			lines.push(`- ${proj}${parsed.task}${next}`);
+		} catch {
+			lines.push(`- ${w.content}`);
+		}
+		lines.push("");
+	}
 	const semantic = params.manager.getActiveSemantic(40);
 	if (semantic.length > 0) {
 		lines.push("### Facts & Preferences");
@@ -670,7 +712,7 @@ async function syncLongTermContextFile(params) {
 		lines.push("");
 	}
 	const stats = params.manager.getStats();
-	lines.push(`*${stats.episodic} events · ${stats.semantic} facts · ${stats.procedural} workflows*`);
+	lines.push(`*${stats.episodic} events · ${stats.semantic} facts · ${stats.procedural} workflows · ${stats.working} active tasks*`);
 	const memDir = path.join(params.workspaceDir, "memory");
 	await fs.mkdir(memDir, { recursive: true });
 	await fs.writeFile(path.join(memDir, "long-term-context.md"), lines.join("\n"), "utf-8");

package/dist/{call-BlWEBz99.js → call-D7jOWSFr.js}

@@ -1,22 +1,22 @@
 import { g as resolveStateDir, o as resolveConfigPath, u as resolveGatewayPort } from "./paths-CHIu6D1E.js";
-import { lt as secretRefKey, x as resolveSecretRefValues, z as loadConfig } from "./auth-profiles-CX4YYu7Z.js";
+import { lt as secretRefKey, x as resolveSecretRefValues, z as loadConfig } from "./auth-profiles-9T4j6jMy.js";
 import { b as shortenHomeInString, s as ensureDir, t as CONFIG_DIR, v as resolveUserPath } from "./utils-D6vohX1h.js";
 import { A as hasConfiguredSecretInput, F as resolveSecretInputRef } from "./registry-BXcl3IkC.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-DqvtYF2o.js";
-import { Mt as PROTOCOL_VERSION, en as normalizeFingerprint, nn as loadOrCreateDeviceIdentity, t as GatewayClient } from "./client-G9E5HGM2.js";
-import { i as isSecureWebSocketUrl } from "./net-CCnbGop3.js";
+import { Mt as PROTOCOL_VERSION, en as normalizeFingerprint, nn as loadOrCreateDeviceIdentity, t as GatewayClient } from "./client-COy24r9W.js";
+import { i as isSecureWebSocketUrl } from "./net-CIh5ellr.js";
 import { t as resolveGatewayCredentialsFromConfig } from "./credentials-CyQeGziJ.js";
 import { execFile } from "node:child_process";
 import path from "node:path";
 import { promisify } from "node:util";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import { X509Certificate, randomUUID } from "node:crypto";
 
 //#region src/infra/tls/gateway.ts
 const execFileAsync = promisify(execFile);
 async function fileExists(filePath) {
 	try {
-		await fs.access(filePath);
+		await fsPromises.access(filePath);
 		return true;
 	} catch {
 		return false;
@@ -43,8 +43,8 @@ async function generateSelfSignedCert(params) {
 		"-subj",
 		"/CN=squidclaw-gateway"
 	]);
-	await fs.chmod(params.keyPath, 384).catch(() => {});
-	await fs.chmod(params.certPath, 384).catch(() => {});
+	await fsPromises.chmod(params.keyPath, 384).catch(() => {});
+	await fsPromises.chmod(params.certPath, 384).catch(() => {});
 	params.log?.info?.(`gateway tls: generated self-signed cert at ${shortenHomeInString(params.certPath)}`);
 }
 async function loadGatewayTlsRuntime(cfg, log) {
@@ -82,9 +82,9 @@ async function loadGatewayTlsRuntime(cfg, log) {
 		error: "gateway tls: cert/key missing"
 	};
 	try {
-		const cert = await fs.readFile(certPath, "utf8");
-		const key = await fs.readFile(keyPath, "utf8");
-		const ca = caPath ? await fs.readFile(caPath, "utf8") : void 0;
+		const cert = await fsPromises.readFile(certPath, "utf8");
+		const key = await fsPromises.readFile(keyPath, "utf8");
+		const ca = caPath ? await fsPromises.readFile(caPath, "utf8") : void 0;
 		const fingerprintSha256 = normalizeFingerprint(new X509Certificate(cert).fingerprint256 ?? "");
 		if (!fingerprintSha256) return {
 			enabled: false,