Cleanse repository and redeploy Agent-Zero with HF adaptations

.agent/workflows/update_clawdbot.md

@@ -1,366 +0,0 @@
----
-description: Update Clawdbot from upstream when branch has diverged (ahead/behind)
----
-
-# Clawdbot Upstream Sync Workflow
-
-Use this workflow when your fork has diverged from upstream (e.g., "18 commits ahead, 29 commits behind").
-
-## Quick Reference
-
-```bash
-# Check divergence status
-git fetch upstream && git rev-list --left-right --count main...upstream/main
-
-# Full sync (rebase preferred)
-git fetch upstream && git rebase upstream/main && pnpm install && pnpm build && ./scripts/restart-mac.sh
-
-# Check for Swift 6.2 issues after sync
-grep -r "FileManager\.default\|Thread\.isMainThread" src/ apps/ --include="*.swift"
-```
-
----
-
-## Step 1: Assess Divergence
-
-```bash
-git fetch upstream
-git log --oneline --left-right main...upstream/main | head -20
-```
-
-This shows:
-- `<` = your local commits (ahead)
-- `>` = upstream commits you're missing (behind)
-
-**Decision point:**
-- Few local commits, many upstream → **Rebase** (cleaner history)
-- Many local commits or shared branch → **Merge** (preserves history)
-
----
-
-## Step 2A: Rebase Strategy (Preferred)
-
-Replays your commits on top of upstream. Results in linear history.
-
-```bash
-# Ensure working tree is clean
-git status
-
-# Rebase onto upstream
-git rebase upstream/main
-```
-
-### Handling Rebase Conflicts
-
-```bash
-# When conflicts occur:
-# 1. Fix conflicts in the listed files
-# 2. Stage resolved files
-git add <resolved-files>
-
-# 3. Continue rebase
-git rebase --continue
-
-# If a commit is no longer needed (already in upstream):
-git rebase --skip
-
-# To abort and return to original state:
-git rebase --abort
-```
-
-### Common Conflict Patterns
-
-| File | Resolution |
-|------|------------|
-| `package.json` | Take upstream deps, keep local scripts if needed |
-| `pnpm-lock.yaml` | Accept upstream, regenerate with `pnpm install` |
-| `*.patch` files | Usually take upstream version |
-| Source files | Merge logic carefully, prefer upstream structure |
-
----
-
-## Step 2B: Merge Strategy (Alternative)
-
-Preserves all history with a merge commit.
-
-```bash
-git merge upstream/main --no-edit
-```
-
-Resolve conflicts same as rebase, then:
-```bash
-git add <resolved-files>
-git commit
-```
-
----
-
-## Step 3: Rebuild Everything
-
-After sync completes:
-
-```bash
-# Install dependencies (regenerates lock if needed)
-pnpm install
-
-# Build TypeScript
-pnpm build
-
-# Build UI assets
-pnpm ui:build
-
-# Run diagnostics
-pnpm clawdbot doctor
-```
-
----
-
-## Step 4: Rebuild macOS App
-
-```bash
-# Full rebuild, sign, and launch
-./scripts/restart-mac.sh
-
-# Or just package without restart
-pnpm mac:package
-```
-
-### Install to /Applications
-
-```bash
-# Kill running app
-pkill -x "Clawdbot" || true
-
-# Move old version
-mv /Applications/Clawdbot.app /tmp/Clawdbot-backup.app
-
-# Install new build
-cp -R dist/Clawdbot.app /Applications/
-
-# Launch
-open /Applications/Clawdbot.app
-```
-
----
-
-## Step 4A: Verify macOS App & Agent
-
-After rebuilding the macOS app, always verify it works correctly:
-
-```bash
-# Check gateway health
-pnpm clawdbot health
-
-# Verify no zombie processes
-ps aux | grep -E "(clawdbot|gateway)" | grep -v grep
-
-# Test agent functionality by sending a verification message
-pnpm clawdbot agent --message "Verification: macOS app rebuild successful - agent is responding." --session-id YOUR_TELEGRAM_SESSION_ID
-
-# Confirm the message was received on Telegram
-# (Check your Telegram chat with the bot)
-```
-
-**Important:** Always wait for the Telegram verification message before proceeding. If the agent doesn't respond, troubleshoot the gateway or model configuration before pushing.
-
----
-
-## Step 5: Handle Swift/macOS Build Issues (Common After Upstream Sync)
-
-Upstream updates may introduce Swift 6.2 / macOS 26 SDK incompatibilities. Use analyze-mode for systematic debugging:
-
-### Analyze-Mode Investigation
-```bash
-# Gather context with parallel agents
-morph-mcp_warpgrep_codebase_search search_string="Find deprecated FileManager.default and Thread.isMainThread usages in Swift files" repo_path="/Volumes/Main SSD/Developer/clawdis"
-morph-mcp_warpgrep_codebase_search search_string="Locate Peekaboo submodule and macOS app Swift files with concurrency issues" repo_path="/Volumes/Main SSD/Developer/clawdis"
-```
-
-### Common Swift 6.2 Fixes
-
-**FileManager.default Deprecation:**
-```bash
-# Search for deprecated usage
-grep -r "FileManager\.default" src/ apps/ --include="*.swift"
-
-# Replace with proper initialization
-# OLD: FileManager.default
-# NEW: FileManager()
-```
-
-**Thread.isMainThread Deprecation:**
-```bash
-# Search for deprecated usage
-grep -r "Thread\.isMainThread" src/ apps/ --include="*.swift"
-
-# Replace with modern concurrency check
-# OLD: Thread.isMainThread
-# NEW: await MainActor.run { ... } or DispatchQueue.main.sync { ... }
-```
-
-### Peekaboo Submodule Fixes
-```bash
-# Check Peekaboo for concurrency issues
-cd src/canvas-host/a2ui
-grep -r "Thread\.isMainThread\|FileManager\.default" . --include="*.swift"
-
-# Fix and rebuild submodule
-cd /Volumes/Main SSD/Developer/clawdis
-pnpm canvas:a2ui:bundle
-```
-
-### macOS App Concurrency Fixes
-```bash
-# Check macOS app for issues
-grep -r "Thread\.isMainThread\|FileManager\.default" apps/macos/ --include="*.swift"
-
-# Clean and rebuild after fixes
-cd apps/macos && rm -rf .build .swiftpm
-./scripts/restart-mac.sh
-```
-
-### Model Configuration Updates
-If upstream introduced new model configurations:
-```bash
-# Check for OpenRouter API key requirements
-grep -r "openrouter\|OPENROUTER" src/ --include="*.ts" --include="*.js"
-
-# Update clawdbot.json with fallback chains
-# Add model fallback configurations as needed
-```
-
----
-
-## Step 6: Verify & Push
-
-```bash
-# Verify everything works
-pnpm clawdbot health
-pnpm test
-
-# Push (force required after rebase)
-git push origin main --force-with-lease
-
-# Or regular push after merge
-git push origin main
-```
-
----
-
-## Troubleshooting
-
-### Build Fails After Sync
-
-```bash
-# Clean and rebuild
-rm -rf node_modules dist
-pnpm install
-pnpm build
-```
-
-### Type Errors (Bun/Node Incompatibility)
-
-Common issue: `fetch.preconnect` type mismatch. Fix by using `FetchLike` type instead of `typeof fetch`.
-
-### macOS App Crashes on Launch
-
-Usually resource bundle mismatch. Full rebuild required:
-```bash
-cd apps/macos && rm -rf .build .swiftpm
-./scripts/restart-mac.sh
-```
-
-### Patch Failures
-
-```bash
-# Check patch status
-pnpm install 2>&1 | grep -i patch
-
-# If patches fail, they may need updating for new dep versions
-# Check patches/ directory against package.json patchedDependencies
-```
-
-### Swift 6.2 / macOS 26 SDK Build Failures
-
-**Symptoms:** Build fails with deprecation warnings about `FileManager.default` or `Thread.isMainThread`
-
-**Search-Mode Investigation:**
-```bash
-# Exhaustive search for deprecated APIs
-morph-mcp_warpgrep_codebase_search search_string="Find all Swift files using deprecated FileManager.default or Thread.isMainThread" repo_path="/Volumes/Main SSD/Developer/clawdis"
-```
-
-**Quick Fix Commands:**
-```bash
-# Find all affected files
-find . -name "*.swift" -exec grep -l "FileManager\.default\|Thread\.isMainThread" {} \;
-
-# Replace FileManager.default with FileManager()
-find . -name "*.swift" -exec sed -i '' 's/FileManager\.default/FileManager()/g' {} \;
-
-# For Thread.isMainThread, need manual review of each usage
-grep -rn "Thread\.isMainThread" --include="*.swift" .
-```
-
-**Rebuild After Fixes:**
-```bash
-# Clean all build artifacts
-rm -rf apps/macos/.build apps/macos/.swiftpm
-rm -rf src/canvas-host/a2ui/.build
-
-# Rebuild Peekaboo bundle
-pnpm canvas:a2ui:bundle
-
-# Full macOS rebuild
-./scripts/restart-mac.sh
-```
-
----
-
-## Automation Script
-
-Save as `scripts/sync-upstream.sh`:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-echo "==> Fetching upstream..."
-git fetch upstream
-
-echo "==> Current divergence:"
-git rev-list --left-right --count main...upstream/main
-
-echo "==> Rebasing onto upstream/main..."
-git rebase upstream/main
-
-echo "==> Installing dependencies..."
-pnpm install
-
-echo "==> Building..."
-pnpm build
-pnpm ui:build
-
-echo "==> Running doctor..."
-pnpm clawdbot doctor
-
-echo "==> Rebuilding macOS app..."
-./scripts/restart-mac.sh
-
-echo "==> Verifying gateway health..."
-pnpm clawdbot health
-
-echo "==> Checking for Swift 6.2 compatibility issues..."
-if grep -r "FileManager\.default\|Thread\.isMainThread" src/ apps/ --include="*.swift" --quiet; then
-    echo "⚠️  Found potential Swift 6.2 deprecated API usage"
-    echo "   Run manual fixes or use analyze-mode investigation"
-else
-    echo "✅ No obvious Swift deprecation issues found"
-fi
-
-echo "==> Testing agent functionality..."
-# Note: Update YOUR_TELEGRAM_SESSION_ID with actual session ID
-pnpm clawdbot agent --message "Verification: Upstream sync and macOS rebuild completed successfully." --session-id YOUR_TELEGRAM_SESSION_ID || echo "Warning: Agent test failed - check Telegram for verification message"
-
-echo "==> Done! Check Telegram for verification message, then run 'git push --force-with-lease' when ready."
-```

.cursor/mcp.json

@@ -1,8 +0,0 @@
-{
-  "mcpServers": {
-    "dev3000": {
-      "type": "http",
-      "url": "http://localhost:3684/mcp"
-    }
-  }
-}

.detect-secrets.cfg

@@ -1,30 +0,0 @@
-# detect-secrets exclusion patterns (regex)
-#
-# Note: detect-secrets does not read this file by default. If you want these
-# applied, wire them into your scan command (e.g. translate to --exclude-files
-# / --exclude-lines) or into a baseline's filters_used.
-
-[exclude-files]
-# pnpm lockfiles contain lots of high-entropy package integrity blobs.
-pattern = (^|/)pnpm-lock\.yaml$
-# Generated output and vendored assets.
-pattern = (^|/)(dist|vendor)/
-# Local config file with allowlist patterns.
-pattern = (^|/)\.detect-secrets\.cfg$
-
-[exclude-lines]
-# Fastlane checks for private key marker; not a real key.
-pattern = key_content\.include\?\("BEGIN PRIVATE KEY"\)
-# UI label string for Anthropic auth mode.
-pattern = case \.apiKeyEnv: "API key \(env var\)"
-# CodingKeys mapping uses apiKey literal.
-pattern = case apikey = "apiKey"
-# Schema labels referencing password fields (not actual secrets).
-pattern = "gateway\.remote\.password"
-pattern = "gateway\.auth\.password"
-# Schema label for talk API key (label text only).
-pattern = "talk\.apiKey"
-# checking for typeof is not something we care about.
-pattern = === "string"
-# specific optional-chaining password check that didn't match the line above.
-pattern = typeof remote\?\.password === "string"

.dockerignore

@@ -1,48 +0,0 @@
-.git
-.worktrees
-.bun-cache
-.bun
-.tmp
-**/.tmp
-.DS_Store
-**/.DS_Store
-*.png
-*.jpg
-*.jpeg
-*.webp
-*.gif
-*.mp4
-*.mov
-*.wav
-*.mp3
-node_modules
-**/node_modules
-.pnpm-store
-**/.pnpm-store
-.turbo
-**/.turbo
-.cache
-**/.cache
-.next
-**/.next
-coverage
-**/coverage
-*.log
-tmp
-**/tmp
-
-# build artifacts
-dist
-**/dist
-apps/macos/.build
-apps/ios/build
-**/*.trace
-
-# large app trees not needed for CLI build
-apps/
-assets/
-Peekaboo/
-Swabble/
-Core/
-Users/
-vendor/

.env.example

@@ -1,5 +0,0 @@
-# Copy to .env and fill with your Twilio credentials
-TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-TWILIO_AUTH_TOKEN=your_auth_token_here
-# Must be a WhatsApp-enabled Twilio number, prefixed with whatsapp:
-TWILIO_WHATSAPP_FROM=whatsapp:+17343367101

.github/FUNDING.yml

@@ -1 +0,0 @@
-custom: ['https://github.com/sponsors/steipete']

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,28 +0,0 @@
----
-name: Bug report
-about: Report a problem or unexpected behavior in Clawdbot.
-title: "[Bug]: "
-labels: bug
----
-
-## Summary
-What went wrong?
-
-## Steps to reproduce
-1.
-2.
-3.
-
-## Expected behavior
-What did you expect to happen?
-
-## Actual behavior
-What actually happened?
-
-## Environment
-- Clawdbot version:
-- OS:
-- Install method (pnpm/npx/docker/etc):
-
-## Logs or screenshots
-Paste relevant logs or add screenshots (redact secrets).

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +0,0 @@
-blank_issues_enabled: true
-contact_links:
-  - name: Onboarding
-    url: https://discord.gg/clawd
-    about: New to Clawdbot? Join Discord for setup guidance from Krill in #help.
-  - name: Support
-    url: https://discord.gg/clawd
-    about: Get help from Krill and the community on Discord in #help.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,18 +0,0 @@
----
-name: Feature request
-about: Suggest an idea or improvement for Clawdbot.
-title: "[Feature]: "
-labels: enhancement
----
-
-## Summary
-Describe the problem you are trying to solve or the opportunity you see.
-
-## Proposed solution
-What would you like Clawdbot to do?
-
-## Alternatives considered
-Any other approaches you have considered?
-
-## Additional context
-Links, screenshots, or related issues.

.github/actionlint.yaml

@@ -1,17 +0,0 @@
-# actionlint configuration
-# https://github.com/rhysd/actionlint/blob/main/docs/config.md
-
-self-hosted-runner:
-  labels:
-    # Blacksmith CI runners
-    - blacksmith-4vcpu-ubuntu-2404
-    - blacksmith-4vcpu-windows-2025
-
-# Ignore patterns for known issues
-paths:
-  .github/workflows/**/*.yml:
-    ignore:
-      # Ignore shellcheck warnings (we run shellcheck separately)
-      - 'shellcheck reported issue.+'
-      # Ignore intentional if: false for disabled jobs
-      - 'constant expression "false" in condition'

.github/dependabot.yml

@@ -1,113 +0,0 @@
-# Dependabot configuration
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
-version: 2
-
-registries:
-  npm-npmjs:
-    type: npm-registry
-    url: https://registry.npmjs.org
-    replaces-base: true
-
-updates:
-  # npm dependencies (root)
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    groups:
-      production:
-        dependency-type: production
-        update-types:
-          - minor
-          - patch
-      development:
-        dependency-type: development
-        update-types:
-          - minor
-          - patch
-    open-pull-requests-limit: 10
-    registries:
-      - npm-npmjs
-
-  # GitHub Actions
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    groups:
-      actions:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
-    open-pull-requests-limit: 5
-
-  # Swift Package Manager - macOS app
-  - package-ecosystem: swift
-    directory: /apps/macos
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    groups:
-      swift-deps:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
-    open-pull-requests-limit: 5
-
-  # Swift Package Manager - shared MoltbotKit
-  - package-ecosystem: swift
-    directory: /apps/shared/MoltbotKit
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    groups:
-      swift-deps:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
-    open-pull-requests-limit: 5
-
-  # Swift Package Manager - Swabble
-  - package-ecosystem: swift
-    directory: /Swabble
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    groups:
-      swift-deps:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
-    open-pull-requests-limit: 5
-
-  # Gradle - Android app
-  - package-ecosystem: gradle
-    directory: /apps/android
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-    groups:
-      android-deps:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
-    open-pull-requests-limit: 5

.github/labeler.yml

@@ -1,222 +0,0 @@
-"channel: bluebubbles":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/bluebubbles/**"
-          - "docs/channels/bluebubbles.md"
-"channel: discord":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/discord/**"
-          - "extensions/discord/**"
-          - "docs/channels/discord.md"
-"channel: googlechat":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/googlechat/**"
-          - "docs/channels/googlechat.md"
-"channel: imessage":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/imessage/**"
-          - "extensions/imessage/**"
-          - "docs/channels/imessage.md"
-"channel: line":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/line/**"
-          - "docs/channels/line.md"
-"channel: matrix":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/matrix/**"
-          - "docs/channels/matrix.md"
-"channel: mattermost":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/mattermost/**"
-          - "docs/channels/mattermost.md"
-"channel: msteams":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/msteams/**"
-          - "docs/channels/msteams.md"
-"channel: nextcloud-talk":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/nextcloud-talk/**"
-          - "docs/channels/nextcloud-talk.md"
-"channel: nostr":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/nostr/**"
-          - "docs/channels/nostr.md"
-"channel: signal":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/signal/**"
-          - "extensions/signal/**"
-          - "docs/channels/signal.md"
-"channel: slack":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/slack/**"
-          - "extensions/slack/**"
-          - "docs/channels/slack.md"
-"channel: telegram":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/telegram/**"
-          - "extensions/telegram/**"
-          - "docs/channels/telegram.md"
-"channel: tlon":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/tlon/**"
-          - "docs/channels/tlon.md"
-"channel: voice-call":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/voice-call/**"
-"channel: whatsapp-web":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/web/**"
-          - "extensions/whatsapp/**"
-          - "docs/channels/whatsapp.md"
-"channel: zalo":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/zalo/**"
-          - "docs/channels/zalo.md"
-"channel: zalouser":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/zalouser/**"
-          - "docs/channels/zalouser.md"
-
-"app: android":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "apps/android/**"
-          - "docs/platforms/android.md"
-"app: ios":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "apps/ios/**"
-          - "docs/platforms/ios.md"
-"app: macos":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "apps/macos/**"
-          - "docs/platforms/macos.md"
-          - "docs/platforms/mac/**"
-"app: web-ui":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "ui/**"
-          - "src/gateway/control-ui.ts"
-          - "src/gateway/control-ui-shared.ts"
-          - "src/gateway/protocol/**"
-          - "src/gateway/server-methods/chat.ts"
-          - "src/infra/control-ui-assets.ts"
-
-"gateway":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/gateway/**"
-          - "src/daemon/**"
-          - "docs/gateway/**"
-
-"docs":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "docs/**"
-          - "docs.acp.md"
-
-"cli":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/cli/**"
-
-"commands":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/commands/**"
-
-"scripts":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "scripts/**"
-
-"docker":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "Dockerfile"
-          - "Dockerfile.*"
-          - "docker-compose.yml"
-          - "docker-setup.sh"
-          - ".dockerignore"
-          - "scripts/**/*docker*"
-          - "scripts/**/Dockerfile*"
-          - "scripts/sandbox-*.sh"
-          - "src/agents/sandbox*.ts"
-          - "src/commands/sandbox*.ts"
-          - "src/cli/sandbox-cli.ts"
-          - "src/docker-setup.test.ts"
-          - "src/config/**/*sandbox*"
-          - "docs/cli/sandbox.md"
-          - "docs/gateway/sandbox*.md"
-          - "docs/install/docker.md"
-          - "docs/multi-agent-sandbox-tools.md"
-
-"agents":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "src/agents/**"
-
-"security":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "docs/cli/security.md"
-          - "docs/gateway/security.md"
-
-"extensions: copilot-proxy":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/copilot-proxy/**"
-"extensions: diagnostics-otel":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/diagnostics-otel/**"
-"extensions: google-antigravity-auth":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/google-antigravity-auth/**"
-"extensions: google-gemini-cli-auth":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/google-gemini-cli-auth/**"
-"extensions: llm-task":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/llm-task/**"
-"extensions: lobster":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/lobster/**"
-"extensions: memory-core":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/memory-core/**"
-"extensions: memory-lancedb":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/memory-lancedb/**"
-"extensions: open-prose":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/open-prose/**"
-"extensions: qwen-portal-auth":
-  - changed-files:
-      - any-glob-to-any-file:
-          - "extensions/qwen-portal-auth/**"

.github/workflows/auto-response.yml

@@ -1,78 +0,0 @@
-name: Auto response
-
-on:
-  issues:
-    types: [labeled]
-  pull_request_target:
-    types: [labeled]
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  auto-response:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: "2729701"
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - name: Handle labeled items
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          script: |
-            // Labels prefixed with "r:" are auto-response triggers.
-            const rules = [
-              {
-                label: "r: skill",
-                close: true,
-                message:
-                  "Thanks for the contribution! New skills should be published to Clawdhub for everyone to use. We’re keeping the core lean on skills, so I’m closing this out.",
-              },
-              {
-                label: "r: support",
-                close: true,
-                message:
-                  "Please use our support server https://molt.bot/discord and ask in #help or #users-helping-users to resolve this, or follow the stuck FAQ at https://docs.molt.bot/help/faq#im-stuck-whats-the-fastest-way-to-get-unstuck.",
-              },
-              {
-                label: "r: third-party-extension",
-                close: true,
-                message:
-                  "This would be better made as a third-party extension with our SDK that you maintain yourself. Docs: https://docs.molt.bot/plugin.",
-              },
-            ];
-
-            const labelName = context.payload.label?.name;
-            if (!labelName) {
-              return;
-            }
-
-            const rule = rules.find((item) => item.label === labelName);
-            if (!rule) {
-              return;
-            }
-
-            const issueNumber = context.payload.issue?.number ?? context.payload.pull_request?.number;
-            if (!issueNumber) {
-              return;
-            }
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issueNumber,
-              body: rule.message,
-            });
-
-            if (rule.close) {
-              await github.rest.issues.update({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issueNumber,
-                state: "closed",
-              });
-            }

.github/workflows/ci.yml

@@ -1,647 +0,0 @@
-name: CI
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  install-check:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.x
-          check-latest: true
-
-      - name: Setup pnpm (corepack retry)
-        run: |
-          set -euo pipefail
-          corepack enable
-          for attempt in 1 2 3; do
-            if corepack prepare pnpm@10.23.0 --activate; then
-              pnpm -v
-              exit 0
-            fi
-            echo "corepack prepare failed (attempt $attempt/3). Retrying..."
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Runtime versions
-        run: |
-          node -v
-          npm -v
-          pnpm -v
-
-      - name: Capture node path
-        run: echo "NODE_BIN=$(dirname \"$(node -p \"process.execPath\")\")" >> "$GITHUB_ENV"
-
-      - name: Install dependencies (frozen)
-        env:
-          CI: true
-        run: |
-          export PATH="$NODE_BIN:$PATH"
-          which node
-          node -v
-          pnpm -v
-          pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true
-
-  checks:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runtime: node
-            task: lint
-            command: pnpm lint
-          - runtime: node
-            task: test
-            command: pnpm canvas:a2ui:bundle && pnpm test
-          - runtime: node
-            task: build
-            command: pnpm build
-          - runtime: node
-            task: protocol
-            command: pnpm protocol:check
-          - runtime: node
-            task: format
-            command: pnpm format
-          - runtime: bun
-            task: test
-            command: pnpm canvas:a2ui:bundle && bunx vitest run
-          - runtime: bun
-            task: build
-            command: bunx tsc -p tsconfig.json
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.x
-          check-latest: true
-
-      - name: Setup pnpm (corepack retry)
-        run: |
-          set -euo pipefail
-          corepack enable
-          for attempt in 1 2 3; do
-            if corepack prepare pnpm@10.23.0 --activate; then
-              pnpm -v
-              exit 0
-            fi
-            echo "corepack prepare failed (attempt $attempt/3). Retrying..."
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Runtime versions
-        run: |
-          node -v
-          npm -v
-          bun -v
-          pnpm -v
-
-      - name: Capture node path
-        run: echo "NODE_BIN=$(dirname \"$(node -p \"process.execPath\")\")" >> "$GITHUB_ENV"
-
-      - name: Install dependencies
-        env:
-          CI: true
-        run: |
-          export PATH="$NODE_BIN:$PATH"
-          which node
-          node -v
-          pnpm -v
-          pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true || pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true
-
-      - name: Run ${{ matrix.task }} (${{ matrix.runtime }})
-        run: ${{ matrix.command }}
-
-  secrets:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Install detect-secrets
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install detect-secrets==1.5.0
-
-      - name: Detect secrets
-        run: |
-          if ! detect-secrets scan --baseline .secrets.baseline; then
-            echo "::error::Secret scanning failed. See docs/gateway/security.md#secret-scanning-detect-secrets"
-            exit 1
-          fi
-
-  checks-windows:
-    runs-on: blacksmith-4vcpu-windows-2025
-    env:
-      NODE_OPTIONS: --max-old-space-size=4096
-      CLAWDBOT_TEST_WORKERS: 1
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runtime: node
-            task: lint
-            command: pnpm lint
-          - runtime: node
-            task: test
-            command: pnpm canvas:a2ui:bundle && pnpm test
-          - runtime: node
-            task: build
-            command: pnpm build
-          - runtime: node
-            task: protocol
-            command: pnpm protocol:check
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.x
-          check-latest: true
-
-      - name: Setup pnpm (corepack retry)
-        run: |
-          set -euo pipefail
-          corepack enable
-          for attempt in 1 2 3; do
-            if corepack prepare pnpm@10.23.0 --activate; then
-              pnpm -v
-              exit 0
-            fi
-            echo "corepack prepare failed (attempt $attempt/3). Retrying..."
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Runtime versions
-        run: |
-          node -v
-          npm -v
-          bun -v
-          pnpm -v
-
-      - name: Capture node path
-        run: echo "NODE_BIN=$(dirname \"$(node -p \"process.execPath\")\")" >> "$GITHUB_ENV"
-
-      - name: Install dependencies
-        env:
-          CI: true
-        run: |
-          export PATH="$NODE_BIN:$PATH"
-          which node
-          node -v
-          pnpm -v
-          pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true || pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true
-
-      - name: Run ${{ matrix.task }} (${{ matrix.runtime }})
-        run: ${{ matrix.command }}
-
-  checks-macos:
-    if: github.event_name == 'pull_request'
-    runs-on: macos-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - task: test
-            command: pnpm test
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22.x
-          check-latest: true
-
-      - name: Setup pnpm (corepack retry)
-        run: |
-          set -euo pipefail
-          corepack enable
-          for attempt in 1 2 3; do
-            if corepack prepare pnpm@10.23.0 --activate; then
-              pnpm -v
-              exit 0
-            fi
-            echo "corepack prepare failed (attempt $attempt/3). Retrying..."
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Runtime versions
-        run: |
-          node -v
-          npm -v
-          pnpm -v
-
-      - name: Capture node path
-        run: echo "NODE_BIN=$(dirname \"$(node -p \"process.execPath\")\")" >> "$GITHUB_ENV"
-
-      - name: Install dependencies
-        env:
-          CI: true
-        run: |
-          export PATH="$NODE_BIN:$PATH"
-          which node
-          node -v
-          pnpm -v
-          pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true || pnpm install --frozen-lockfile --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true
-
-      - name: Run ${{ matrix.task }}
-        env:
-          NODE_OPTIONS: --max-old-space-size=4096
-        run: ${{ matrix.command }}
-
-  macos-app:
-    if: github.event_name == 'pull_request'
-    runs-on: macos-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - task: lint
-            command: |
-              swiftlint --config .swiftlint.yml
-              swiftformat --lint apps/macos/Sources --config .swiftformat
-          - task: build
-            command: |
-              set -euo pipefail
-              for attempt in 1 2 3; do
-                if swift build --package-path apps/macos --configuration release; then
-                  exit 0
-                fi
-                echo "swift build failed (attempt $attempt/3). Retrying…"
-                sleep $((attempt * 20))
-              done
-              exit 1
-          - task: test
-            command: |
-              set -euo pipefail
-              for attempt in 1 2 3; do
-                if swift test --package-path apps/macos --parallel --enable-code-coverage --show-codecov-path; then
-                  exit 0
-                fi
-                echo "swift test failed (attempt $attempt/3). Retrying…"
-                sleep $((attempt * 20))
-              done
-              exit 1
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Select Xcode 26.1
-        run: |
-          sudo xcode-select -s /Applications/Xcode_26.1.app
-          xcodebuild -version
-
-      - name: Install XcodeGen / SwiftLint / SwiftFormat
-        run: |
-          brew install xcodegen swiftlint swiftformat
-
-      - name: Show toolchain
-        run: |
-          sw_vers
-          xcodebuild -version
-          swift --version
-
-      - name: Run ${{ matrix.task }}
-        run: ${{ matrix.command }}
-  ios:
-    if: false # ignore iOS in CI for now
-    runs-on: macos-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Select Xcode 26.1
-        run: |
-          sudo xcode-select -s /Applications/Xcode_26.1.app
-          xcodebuild -version
-
-      - name: Install XcodeGen
-        run: brew install xcodegen
-
-      - name: Install SwiftLint / SwiftFormat
-        run: brew install swiftlint swiftformat
-
-      - name: Show toolchain
-        run: |
-          sw_vers
-          xcodebuild -version
-          swift --version
-
-      - name: Generate iOS project
-        run: |
-          cd apps/ios
-          xcodegen generate
-
-      - name: iOS tests
-        run: |
-          set -euo pipefail
-          RESULT_BUNDLE_PATH="$RUNNER_TEMP/Clawdis-iOS.xcresult"
-          DEST_ID="$(
-            python3 - <<'PY'
-          import json
-          import subprocess
-          import sys
-          import uuid
-
-          def sh(args: list[str]) -> str:
-            return subprocess.check_output(args, text=True).strip()
-
-          # Prefer an already-created iPhone simulator if it exists.
-          devices = json.loads(sh(["xcrun", "simctl", "list", "devices", "-j"]))
-          candidates: list[tuple[str, str]] = []
-          for runtime, devs in (devices.get("devices") or {}).items():
-            for dev in devs or []:
-              if not dev.get("isAvailable"):
-                continue
-              name = str(dev.get("name") or "")
-              udid = str(dev.get("udid") or "")
-              if not udid or not name.startswith("iPhone"):
-                continue
-              candidates.append((name, udid))
-
-          candidates.sort(key=lambda it: (0 if "iPhone 16" in it[0] else 1, it[0]))
-          if candidates:
-            print(candidates[0][1])
-            sys.exit(0)
-
-          # Otherwise, create one from the newest available iOS runtime.
-          runtimes = json.loads(sh(["xcrun", "simctl", "list", "runtimes", "-j"])).get("runtimes") or []
-          ios = [rt for rt in runtimes if rt.get("platform") == "iOS" and rt.get("isAvailable")]
-          if not ios:
-            print("No available iOS runtimes found.", file=sys.stderr)
-            sys.exit(1)
-
-          def version_key(rt: dict) -> tuple[int, ...]:
-            parts: list[int] = []
-            for p in str(rt.get("version") or "0").split("."):
-              try:
-                parts.append(int(p))
-              except ValueError:
-                parts.append(0)
-            return tuple(parts)
-
-          ios.sort(key=version_key, reverse=True)
-          runtime = ios[0]
-          runtime_id = str(runtime.get("identifier") or "")
-          if not runtime_id:
-            print("Missing iOS runtime identifier.", file=sys.stderr)
-            sys.exit(1)
-
-          supported = runtime.get("supportedDeviceTypes") or []
-          iphones = [dt for dt in supported if dt.get("productFamily") == "iPhone"]
-          if not iphones:
-            print("No iPhone device types for iOS runtime.", file=sys.stderr)
-            sys.exit(1)
-
-          iphones.sort(
-            key=lambda dt: (
-              0 if "iPhone 16" in str(dt.get("name") or "") else 1,
-              str(dt.get("name") or ""),
-            )
-          )
-          device_type_id = str(iphones[0].get("identifier") or "")
-          if not device_type_id:
-            print("Missing iPhone device type identifier.", file=sys.stderr)
-            sys.exit(1)
-
-          sim_name = f"CI iPhone {uuid.uuid4().hex[:8]}"
-          udid = sh(["xcrun", "simctl", "create", sim_name, device_type_id, runtime_id])
-          if not udid:
-            print("Failed to create iPhone simulator.", file=sys.stderr)
-            sys.exit(1)
-          print(udid)
-          PY
-          )"
-          echo "Using iOS Simulator id: $DEST_ID"
-          xcodebuild test \
-            -project apps/ios/Clawdis.xcodeproj \
-            -scheme Clawdis \
-            -destination "platform=iOS Simulator,id=$DEST_ID" \
-            -resultBundlePath "$RESULT_BUNDLE_PATH" \
-            -enableCodeCoverage YES
-
-      - name: iOS coverage summary
-        run: |
-          set -euo pipefail
-          RESULT_BUNDLE_PATH="$RUNNER_TEMP/Clawdis-iOS.xcresult"
-          xcrun xccov view --report --only-targets "$RESULT_BUNDLE_PATH"
-
-      - name: iOS coverage gate (43%)
-        run: |
-          set -euo pipefail
-          RESULT_BUNDLE_PATH="$RUNNER_TEMP/Clawdis-iOS.xcresult"
-          RESULT_BUNDLE_PATH="$RESULT_BUNDLE_PATH" python3 - <<'PY'
-          import json
-          import os
-          import subprocess
-          import sys
-
-          target_name = "Clawdis.app"
-          minimum = 0.43
-
-          report = json.loads(
-            subprocess.check_output(
-              ["xcrun", "xccov", "view", "--report", "--json", os.environ["RESULT_BUNDLE_PATH"]],
-              text=True,
-            )
-          )
-
-          target_coverage = None
-          for target in report.get("targets", []):
-            if target.get("name") == target_name:
-              target_coverage = float(target["lineCoverage"])
-              break
-
-          if target_coverage is None:
-            print(f"Could not find coverage for target: {target_name}")
-            sys.exit(1)
-
-          print(f"{target_name} line coverage: {target_coverage * 100:.2f}% (min {minimum * 100:.2f}%)")
-          if target_coverage + 1e-12 < minimum:
-            sys.exit(1)
-          PY
-
-  android:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - task: test
-            command: ./gradlew --no-daemon :app:testDebugUnitTest
-          - task: build
-            command: ./gradlew --no-daemon :app:assembleDebug
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: false
-
-      - name: Checkout submodules (retry)
-        run: |
-          set -euo pipefail
-          git submodule sync --recursive
-          for attempt in 1 2 3 4 5; do
-            if git -c protocol.version=2 submodule update --init --force --depth=1 --recursive; then
-              exit 0
-            fi
-            echo "Submodule update failed (attempt $attempt/5). Retrying…"
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
-
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          accept-android-sdk-licenses: false
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: 8.11.1
-
-      - name: Install Android SDK packages
-        run: |
-          yes | sdkmanager --licenses >/dev/null
-          sdkmanager --install \
-            "platform-tools" \
-            "platforms;android-36" \
-            "build-tools;36.0.0"
-
-      - name: Run Android ${{ matrix.task }}
-        working-directory: apps/android
-        run: ${{ matrix.command }}

.github/workflows/docker-release.yml

@@ -1,143 +0,0 @@
-name: Docker Release
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
-jobs:
-  # Build amd64 image
-  build-amd64:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: read
-    outputs:
-      image-digest: ${{ steps.build.outputs.digest }}
-      image-metadata: ${{ steps.meta.outputs.json }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
-            type=semver,pattern={{version}},suffix=-amd64
-            type=semver,pattern={{version}},suffix=-arm64
-            type=ref,event=branch,suffix=-amd64
-            type=ref,event=branch,suffix=-arm64
-
-      - name: Build and push amd64 image
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64
-          labels: ${{ steps.meta.outputs.labels }}
-          tags: ${{ steps.meta.outputs.tags }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          provenance: false
-          push: true
-
-  # Build arm64 image
-  build-arm64:
-    runs-on: ubuntu-24.04-arm
-    permissions:
-      packages: write
-      contents: read
-    outputs:
-      image-digest: ${{ steps.build.outputs.digest }}
-      image-metadata: ${{ steps.meta.outputs.json }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
-            type=semver,pattern={{version}},suffix=-amd64
-            type=semver,pattern={{version}},suffix=-arm64
-            type=ref,event=branch,suffix=-amd64
-            type=ref,event=branch,suffix=-arm64
-
-      - name: Build and push arm64 image
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/arm64
-          labels: ${{ steps.meta.outputs.labels }}
-          tags: ${{ steps.meta.outputs.tags }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          provenance: false
-          push: true
-
-  # Create multi-platform manifest
-  create-manifest:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: read
-    needs: [build-amd64, build-arm64]
-    steps:
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata for manifest
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
-
-      - name: Create and push manifest
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            ${{ needs.build-amd64.outputs.image-digest }} \
-            ${{ needs.build-arm64.outputs.image-digest }}
-        env:
-          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}

.github/workflows/install-smoke.yml

@@ -1,41 +0,0 @@
-name: Install Smoke
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  install-smoke:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout CLI
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm (corepack retry)
-        run: |
-          set -euo pipefail
-          corepack enable
-          for attempt in 1 2 3; do
-            if corepack prepare pnpm@10.23.0 --activate; then
-              pnpm -v
-              exit 0
-            fi
-            echo "corepack prepare failed (attempt $attempt/3). Retrying..."
-            sleep $((attempt * 10))
-          done
-          exit 1
-
-      - name: Install pnpm deps (minimal)
-        run: pnpm install --ignore-scripts --frozen-lockfile
-
-      - name: Run installer docker tests
-        env:
-          CLAWDBOT_INSTALL_URL: https://clawd.bot/install.sh
-          CLAWDBOT_INSTALL_CLI_URL: https://clawd.bot/install-cli.sh
-          CLAWDBOT_NO_ONBOARD: "1"
-          CLAWDBOT_INSTALL_SMOKE_SKIP_CLI: "1"
-          CLAWDBOT_INSTALL_SMOKE_SKIP_NONROOT: ${{ github.event_name == 'pull_request' && '1' || '0' }}
-          CLAWDBOT_INSTALL_SMOKE_SKIP_PREVIOUS: "1"
-        run: pnpm test:install:smoke

.github/workflows/labeler.yml

@@ -1,24 +0,0 @@
-name: Labeler
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: "2729701"
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - uses: actions/labeler@v5
-        with:
-          configuration-path: .github/labeler.yml
-          repo-token: ${{ steps.app-token.outputs.token }}
-          sync-labels: true

.github/workflows/workflow-sanity.yml

@@ -1,37 +0,0 @@
-name: Workflow Sanity
-
-on:
-  pull_request:
-  push:
-
-jobs:
-  no-tabs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Fail on tabs in workflow files
-        run: |
-          python - <<'PY'
-          from __future__ import annotations
-
-          import pathlib
-          import sys
-
-          root = pathlib.Path(".github/workflows")
-          bad: list[str] = []
-          for path in sorted(root.rglob("*.yml")):
-            if b"\t" in path.read_bytes():
-              bad.append(str(path))
-
-          for path in sorted(root.rglob("*.yaml")):
-            if b"\t" in path.read_bytes():
-              bad.append(str(path))
-
-          if bad:
-            print("Tabs found in workflow file(s):")
-            for path in bad:
-              print(f"- {path}")
-            sys.exit(1)
-          PY

.gitignore

@@ -1,73 +0,0 @@
-node_modules
-**/node_modules/
-.env
-docker-compose.extra.yml
-dist
-*.bun-build
-pnpm-lock.yaml
-bun.lock
-bun.lockb
-coverage
-.pnpm-store
-.worktrees/
-.DS_Store
-**/.DS_Store
-ui/src/ui/__screenshots__/
-ui/playwright-report/
-ui/test-results/
-
-# Bun build artifacts
-*.bun-build
-apps/macos/.build/
-apps/shared/MoltbotKit/.build/
-**/ModuleCache/
-bin/
-bin/clawdbot-mac
-bin/docs-list
-apps/macos/.build-local/
-apps/macos/.swiftpm/
-apps/shared/MoltbotKit/.swiftpm/
-Core/
-apps/ios/*.xcodeproj/
-apps/ios/*.xcworkspace/
-apps/ios/.swiftpm/
-vendor/
-apps/ios/Clawdbot.xcodeproj/
-apps/ios/Clawdbot.xcodeproj/**
-apps/macos/.build/**
-**/*.bun-build
-apps/ios/*.xcfilelist
-
-# Vendor build artifacts
-vendor/a2ui/renderers/lit/dist/
-src/canvas-host/a2ui/*.bundle.js
-src/canvas-host/a2ui/*.map
-.bundle.hash
-
-# fastlane (iOS)
-apps/ios/fastlane/README.md
-apps/ios/fastlane/report.xml
-apps/ios/fastlane/Preview.html
-apps/ios/fastlane/screenshots/
-apps/ios/fastlane/test_output/
-apps/ios/fastlane/logs/
-apps/ios/fastlane/.env
-apps/ios/fastlane/report.xml
-
-# fastlane build artifacts (local)
-apps/ios/*.ipa
-apps/ios/*.dSYM.zip
-
-# provisioning profiles (local)
-apps/ios/*.mobileprovision
-.env
-
-# Local untracked files
-.local/
-.vscode/
-IDENTITY.md
-USER.md
-.tgz
-
-# local tooling
-.serena/

.hfignore

@@ -1,4 +0,0 @@
-node_modules/
-.git/
-venv/
-ui/node_modules/

.npmrc

@@ -1 +0,0 @@
-allow-build-scripts=@whiskeysockets/baileys,sharp,esbuild,protobufjs,fs-ext,node-pty,@lydell/node-pty,@matrix-org/matrix-sdk-crypto-nodejs

.oxfmtrc.jsonc

@@ -1,5 +0,0 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "indentWidth": 2,
-  "printWidth": 100
-}

.oxlintrc.json

@@ -1,12 +0,0 @@
-{
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": [
-    "unicorn",
-    "typescript",
-    "oxc"
-  ],
-  "categories": {
-    "correctness": "error"
-  },
-  "ignorePatterns": ["src/canvas-host/a2ui/a2ui.bundle.js"]
-}

.pre-commit-config.yaml

@@ -1,105 +0,0 @@
-# Pre-commit hooks for clawdbot
-# Install: prek install
-# Run manually: prek run --all-files
-#
-# See https://pre-commit.com for more information
-
-repos:
-  # Basic file hygiene
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
-    hooks:
-      - id: trailing-whitespace
-        exclude: '^(docs/|dist/|vendor/|.*\.snap$)'
-      - id: end-of-file-fixer
-        exclude: '^(docs/|dist/|vendor/|.*\.snap$)'
-      - id: check-yaml
-        args: [--allow-multiple-documents]
-      - id: check-added-large-files
-        args: [--maxkb=500]
-      - id: check-merge-conflict
-
-  # Secret detection (same as CI)
-  - repo: https://github.com/Yelp/detect-secrets
-    rev: v1.5.0
-    hooks:
-      - id: detect-secrets
-        args:
-          - --baseline
-          - .secrets.baseline
-          - --exclude-files
-          - '(^|/)(dist/|vendor/|pnpm-lock\.yaml$|\.detect-secrets\.cfg$)'
-          - --exclude-lines
-          - 'key_content\.include\?\("BEGIN PRIVATE KEY"\)'
-          - --exclude-lines
-          - 'case \.apiKeyEnv: "API key \(env var\)"'
-          - --exclude-lines
-          - 'case apikey = "apiKey"'
-          - --exclude-lines
-          - '"gateway\.remote\.password"'
-          - --exclude-lines
-          - '"gateway\.auth\.password"'
-          - --exclude-lines
-          - '"talk\.apiKey"'
-          - --exclude-lines
-          - '=== "string"'
-          - --exclude-lines
-          - 'typeof remote\?\.password === "string"'
-
-  # Shell script linting
-  - repo: https://github.com/koalaman/shellcheck-precommit
-    rev: v0.11.0
-    hooks:
-      - id: shellcheck
-        args: [--severity=error]  # Only fail on errors, not warnings/info
-        # Exclude vendor and scripts with embedded code or known issues
-        exclude: '^(vendor/|scripts/e2e/)'
-
-  # GitHub Actions linting
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.10
-    hooks:
-      - id: actionlint
-
-  # GitHub Actions security audit
-  - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.22.0
-    hooks:
-      - id: zizmor
-        args: [--persona=regular, --min-severity=medium, --min-confidence=medium]
-        exclude: '^(vendor/|Swabble/)'
-
-  # Project checks (same commands as CI)
-  - repo: local
-    hooks:
-      # oxlint --type-aware src test
-      - id: oxlint
-        name: oxlint
-        entry: scripts/pre-commit/run-node-tool.sh oxlint --type-aware src test
-        language: system
-        pass_filenames: false
-        types_or: [javascript, jsx, ts, tsx]
-
-      # oxfmt --check src test
-      - id: oxfmt
-        name: oxfmt
-        entry: scripts/pre-commit/run-node-tool.sh oxfmt --check src test
-        language: system
-        pass_filenames: false
-        types_or: [javascript, jsx, ts, tsx]
-
-      # swiftlint (same as CI)
-      - id: swiftlint
-        name: swiftlint
-        entry: swiftlint --config .swiftlint.yml
-        language: system
-        pass_filenames: false
-        types: [swift]
-
-      # swiftformat --lint (same as CI)
-      - id: swiftformat
-        name: swiftformat
-        entry: swiftformat --lint apps/macos/Sources --config .swiftformat
-        language: system
-        pass_filenames: false
-        types: [swift]

.prettierignore

@@ -1 +0,0 @@
-src/canvas-host/a2ui/a2ui.bundle.js

.secrets.baseline

@@ -1,2191 +0,0 @@
-{
-  "version": "1.5.0",
-  "plugins_used": [
-    {
-      "name": "ArtifactoryDetector"
-    },
-    {
-      "name": "AWSKeyDetector"
-    },
-    {
-      "name": "AzureStorageKeyDetector"
-    },
-    {
-      "name": "Base64HighEntropyString",
-      "limit": 4.5
-    },
-    {
-      "name": "BasicAuthDetector"
-    },
-    {
-      "name": "CloudantDetector"
-    },
-    {
-      "name": "DiscordBotTokenDetector"
-    },
-    {
-      "name": "GitHubTokenDetector"
-    },
-    {
-      "name": "GitLabTokenDetector"
-    },
-    {
-      "name": "HexHighEntropyString",
-      "limit": 3.0
-    },
-    {
-      "name": "IbmCloudIamDetector"
-    },
-    {
-      "name": "IbmCosHmacDetector"
-    },
-    {
-      "name": "IPPublicDetector"
-    },
-    {
-      "name": "JwtTokenDetector"
-    },
-    {
-      "name": "KeywordDetector",
-      "keyword_exclude": ""
-    },
-    {
-      "name": "MailchimpDetector"
-    },
-    {
-      "name": "NpmDetector"
-    },
-    {
-      "name": "OpenAIDetector"
-    },
-    {
-      "name": "PrivateKeyDetector"
-    },
-    {
-      "name": "PypiTokenDetector"
-    },
-    {
-      "name": "SendGridDetector"
-    },
-    {
-      "name": "SlackDetector"
-    },
-    {
-      "name": "SoftlayerDetector"
-    },
-    {
-      "name": "SquareOAuthDetector"
-    },
-    {
-      "name": "StripeDetector"
-    },
-    {
-      "name": "TelegramBotTokenDetector"
-    },
-    {
-      "name": "TwilioKeyDetector"
-    }
-  ],
-  "filters_used": [
-    {
-      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
-    },
-    {
-      "path": "detect_secrets.filters.common.is_baseline_file",
-      "filename": ".secrets.baseline"
-    },
-    {
-      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
-      "min_level": 2
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_lock_file"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_sequential_string"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_swagger_file"
-    },
-    {
-      "path": "detect_secrets.filters.heuristic.is_templated_secret"
-    },
-    {
-      "path": "detect_secrets.filters.regex.should_exclude_file",
-      "pattern": [
-        "(^|/)pnpm-lock\\.yaml$"
-      ]
-    },
-    {
-      "path": "detect_secrets.filters.regex.should_exclude_line",
-      "pattern": [
-        "key_content\\.include\\?\\(\"BEGIN PRIVATE KEY\"\\)",
-        "case \\.apiKeyEnv: \"API key \\(env var\\)\"",
-        "case apikey = \"apiKey\"",
-        "\"gateway\\.remote\\.password\"",
-        "\"gateway\\.auth\\.password\"",
-        "\"talk\\.apiKey\"",
-        "=== \"string\"",
-        "typeof remote\\?\\.password === \"string\""
-      ]
-    }
-  ],
-  "results": {
-    ".env.example": [
-      {
-        "type": "Twilio API Key",
-        "filename": ".env.example",
-        "hashed_secret": "3c7206eff845bc69cf12d904d0f95f9aec15535e",
-        "is_verified": false,
-        "line_number": 2
-      }
-    ],
-    "appcast.xml": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "appcast.xml",
-        "hashed_secret": "4e5f0a148d9ef42afeb73b1c77643e2ef2dee0b9",
-        "is_verified": false,
-        "line_number": 90
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "appcast.xml",
-        "hashed_secret": "f1ccdaf78c308ec2cf608818da13f5f1e4809ed1",
-        "is_verified": false,
-        "line_number": 138
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "appcast.xml",
-        "hashed_secret": "2691dc9c9ded92ba62a2d8ee589e2d78e2aa0479",
-        "is_verified": false,
-        "line_number": 212
-      }
-    ],
-    "apps/macos/Tests/ClawdbotIPCTests/AnthropicAuthResolverTests.swift": [
-      {
-        "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/AnthropicAuthResolverTests.swift",
-        "hashed_secret": "e761624445731fcb8b15da94343c6b92e507d190",
-        "is_verified": false,
-        "line_number": 26
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/AnthropicAuthResolverTests.swift",
-        "hashed_secret": "a23c8630c8a5fbaa21f095e0269c135c20d21689",
-        "is_verified": false,
-        "line_number": 42
-      }
-    ],
-    "apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift": [
-      {
-        "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift",
-        "hashed_secret": "19dad5cecb110281417d1db56b60e1b006d55bb4",
-        "is_verified": false,
-        "line_number": 61
-      }
-    ],
-    "apps/macos/Tests/ClawdbotIPCTests/GatewayLaunchAgentManagerTests.swift": [
-      {
-        "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/GatewayLaunchAgentManagerTests.swift",
-        "hashed_secret": "1a91d62f7ca67399625a4368a6ab5d4a3baa6073",
-        "is_verified": false,
-        "line_number": 13
-      }
-    ],
-    "apps/macos/Tests/ClawdbotIPCTests/TailscaleIntegrationSectionTests.swift": [
-      {
-        "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/TailscaleIntegrationSectionTests.swift",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 27
-      }
-    ],
-    "apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift": [
-      {
-        "type": "Secret Keyword",
-        "filename": "apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift",
-        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
-        "is_verified": false,
-        "line_number": 100
-      }
-    ],
-    "docs/brave-search.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/brave-search.md",
-        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
-        "is_verified": false,
-        "line_number": 26
-      }
-    ],
-    "docs/channels/bluebubbles.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/channels/bluebubbles.md",
-        "hashed_secret": "555da20df20d4172e00f1b73d7c3943802055270",
-        "is_verified": false,
-        "line_number": 32
-      }
-    ],
-    "docs/channels/matrix.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/channels/matrix.md",
-        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
-        "is_verified": false,
-        "line_number": 58
-      }
-    ],
-    "docs/channels/nextcloud-talk.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/channels/nextcloud-talk.md",
-        "hashed_secret": "76ed0a056aa77060de25754586440cff390791d0",
-        "is_verified": false,
-        "line_number": 47
-      }
-    ],
-    "docs/channels/nostr.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/channels/nostr.md",
-        "hashed_secret": "edeb23e25a619c434d22bb7f1c3ca4841166b4e8",
-        "is_verified": false,
-        "line_number": 65
-      }
-    ],
-    "docs/channels/slack.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/channels/slack.md",
-        "hashed_secret": "3f4800fb7c1fb79a9a48bfd562d90bc6b2e2b718",
-        "is_verified": false,
-        "line_number": 141
-      }
-    ],
-    "docs/concepts/memory.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/concepts/memory.md",
-        "hashed_secret": "39d711243bfcee9fec8299b204e1aa9c3430fa12",
-        "is_verified": false,
-        "line_number": 108
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/concepts/memory.md",
-        "hashed_secret": "1a8abbf465c52363ab4c9c6ad945b8e857cbea55",
-        "is_verified": false,
-        "line_number": 131
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/concepts/memory.md",
-        "hashed_secret": "b9f640d6095b9f6b5a65983f7b76dbbb254e0044",
-        "is_verified": false,
-        "line_number": 373
-      }
-    ],
-    "docs/concepts/model-providers.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/concepts/model-providers.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 168
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/concepts/model-providers.md",
-        "hashed_secret": "ef83ad68b9b66e008727b7c417c6a8f618b5177e",
-        "is_verified": false,
-        "line_number": 255
-      }
-    ],
-    "docs/environment.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/environment.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
-        "is_verified": false,
-        "line_number": 29
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/environment.md",
-        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
-        "is_verified": false,
-        "line_number": 31
-      }
-    ],
-    "docs/gateway/configuration-examples.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration-examples.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
-        "is_verified": false,
-        "line_number": 53
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration-examples.md",
-        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
-        "is_verified": false,
-        "line_number": 55
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration-examples.md",
-        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
-        "is_verified": false,
-        "line_number": 319
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration-examples.md",
-        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
-        "is_verified": false,
-        "line_number": 414
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration-examples.md",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
-        "is_verified": false,
-        "line_number": 548
-      }
-    ],
-    "docs/gateway/configuration.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
-        "is_verified": false,
-        "line_number": 272
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
-        "is_verified": false,
-        "line_number": 274
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 1029
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
-        "is_verified": false,
-        "line_number": 1470
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "bde4db9b4c3be4049adc3b9a69851d7c35119770",
-        "is_verified": false,
-        "line_number": 1486
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
-        "is_verified": false,
-        "line_number": 2268
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 2344
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
-        "is_verified": false,
-        "line_number": 2658
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/configuration.md",
-        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
-        "is_verified": false,
-        "line_number": 2844
-      }
-    ],
-    "docs/gateway/local-models.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/local-models.md",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
-        "is_verified": false,
-        "line_number": 32
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/local-models.md",
-        "hashed_secret": "49fd535e63175a827aab3eff9ac58a9e82460ac9",
-        "is_verified": false,
-        "line_number": 121
-      }
-    ],
-    "docs/gateway/tailscale.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/gateway/tailscale.md",
-        "hashed_secret": "9cb0dc5383312aa15b9dc6745645bde18ff5ade9",
-        "is_verified": false,
-        "line_number": 75
-      }
-    ],
-    "docs/help/faq.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/help/faq.md",
-        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
-        "is_verified": false,
-        "line_number": 925
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/help/faq.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
-        "is_verified": false,
-        "line_number": 1113
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/help/faq.md",
-        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
-        "is_verified": false,
-        "line_number": 1114
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/help/faq.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 1439
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/help/faq.md",
-        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
-        "is_verified": false,
-        "line_number": 1715
-      }
-    ],
-    "docs/nodes/talk.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/nodes/talk.md",
-        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
-        "is_verified": false,
-        "line_number": 50
-      }
-    ],
-    "docs/perplexity.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/perplexity.md",
-        "hashed_secret": "6b26c117c66a0c030e239eef595c1e18865132a8",
-        "is_verified": false,
-        "line_number": 35
-      }
-    ],
-    "docs/providers/anthropic.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/anthropic.md",
-        "hashed_secret": "c7a8c334eef5d1749fface7d42c66f9ae5e8cf36",
-        "is_verified": false,
-        "line_number": 32
-      }
-    ],
-    "docs/providers/glm.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/glm.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 22
-      }
-    ],
-    "docs/providers/minimax.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/minimax.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 49
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/minimax.md",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
-        "is_verified": false,
-        "line_number": 118
-      }
-    ],
-    "docs/providers/moonshot.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/moonshot.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 39
-      }
-    ],
-    "docs/providers/openai.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/openai.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 31
-      }
-    ],
-    "docs/providers/opencode.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/opencode.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 25
-      }
-    ],
-    "docs/providers/openrouter.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/openrouter.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
-        "is_verified": false,
-        "line_number": 22
-      }
-    ],
-    "docs/providers/synthetic.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/synthetic.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 31
-      }
-    ],
-    "docs/providers/zai.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/providers/zai.md",
-        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
-        "is_verified": false,
-        "line_number": 25
-      }
-    ],
-    "docs/tools/browser.md": [
-      {
-        "type": "Basic Auth Credentials",
-        "filename": "docs/tools/browser.md",
-        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
-        "is_verified": false,
-        "line_number": 163
-      }
-    ],
-    "docs/tools/firecrawl.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/firecrawl.md",
-        "hashed_secret": "674397e2c0c2faaa85961c708d2a96a7cc7af217",
-        "is_verified": false,
-        "line_number": 28
-      }
-    ],
-    "docs/tools/skills-config.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/skills-config.md",
-        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
-        "is_verified": false,
-        "line_number": 30
-      }
-    ],
-    "docs/tools/skills.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/skills.md",
-        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
-        "is_verified": false,
-        "line_number": 160
-      }
-    ],
-    "docs/tools/web.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/web.md",
-        "hashed_secret": "6b26c117c66a0c030e239eef595c1e18865132a8",
-        "is_verified": false,
-        "line_number": 61
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/web.md",
-        "hashed_secret": "96c682c88ed551f22fe76d206c2dfb7df9221ad9",
-        "is_verified": false,
-        "line_number": 112
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/web.md",
-        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
-        "is_verified": false,
-        "line_number": 160
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tools/web.md",
-        "hashed_secret": "674397e2c0c2faaa85961c708d2a96a7cc7af217",
-        "is_verified": false,
-        "line_number": 223
-      }
-    ],
-    "docs/tts.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tts.md",
-        "hashed_secret": "bde4db9b4c3be4049adc3b9a69851d7c35119770",
-        "is_verified": false,
-        "line_number": 72
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/tts.md",
-        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
-        "is_verified": false,
-        "line_number": 77
-      }
-    ],
-    "extensions/bluebubbles/src/actions.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/actions.test.ts",
-        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
-        "is_verified": false,
-        "line_number": 73
-      }
-    ],
-    "extensions/bluebubbles/src/attachments.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/attachments.test.ts",
-        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
-        "is_verified": false,
-        "line_number": 35
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/attachments.test.ts",
-        "hashed_secret": "db1530e1ea43af094d3d75b8dbaf19a4a182a318",
-        "is_verified": false,
-        "line_number": 99
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/attachments.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 117
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/attachments.test.ts",
-        "hashed_secret": "052f076c732648ab32d2fcde9fe255319bfa0c7b",
-        "is_verified": false,
-        "line_number": 229
-      }
-    ],
-    "extensions/bluebubbles/src/chat.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/chat.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 33
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/chat.test.ts",
-        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
-        "is_verified": false,
-        "line_number": 68
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/chat.test.ts",
-        "hashed_secret": "5c5a15a8b0b3e154d77746945e563ba40100681b",
-        "is_verified": false,
-        "line_number": 85
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/chat.test.ts",
-        "hashed_secret": "faacad0ce4ea1c19b46e128fd79679d37d3d331d",
-        "is_verified": false,
-        "line_number": 134
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/chat.test.ts",
-        "hashed_secret": "4dcc26a1d99532846fedf1265df4f40f4e0005b8",
-        "is_verified": false,
-        "line_number": 219
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/chat.test.ts",
-        "hashed_secret": "fd2a721f7be1ee3d691a011affcdb11d0ca365a8",
-        "is_verified": false,
-        "line_number": 282
-      }
-    ],
-    "extensions/bluebubbles/src/monitor.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/monitor.test.ts",
-        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
-        "is_verified": false,
-        "line_number": 187
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/monitor.test.ts",
-        "hashed_secret": "1ae0af3fe72b3ba394f9fa95a6cffc090d726c23",
-        "is_verified": false,
-        "line_number": 394
-      }
-    ],
-    "extensions/bluebubbles/src/reactions.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/reactions.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 38
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/reactions.test.ts",
-        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
-        "is_verified": false,
-        "line_number": 179
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/reactions.test.ts",
-        "hashed_secret": "a4a05c9a6449eb9d6cdac81dd7edc49230e327e6",
-        "is_verified": false,
-        "line_number": 210
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/reactions.test.ts",
-        "hashed_secret": "a2833da9f0a16f09994754d0a31749cecf8c8c77",
-        "is_verified": false,
-        "line_number": 316
-      }
-    ],
-    "extensions/bluebubbles/src/send.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/send.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 38
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/bluebubbles/src/send.test.ts",
-        "hashed_secret": "faacad0ce4ea1c19b46e128fd79679d37d3d331d",
-        "is_verified": false,
-        "line_number": 675
-      }
-    ],
-    "extensions/bluebubbles/src/targets.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/bluebubbles/src/targets.test.ts",
-        "hashed_secret": "a3af2fb0c1e2a30bb038049e1e4b401593af6225",
-        "is_verified": false,
-        "line_number": 62
-      }
-    ],
-    "extensions/bluebubbles/src/targets.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/bluebubbles/src/targets.ts",
-        "hashed_secret": "a3af2fb0c1e2a30bb038049e1e4b401593af6225",
-        "is_verified": false,
-        "line_number": 214
-      }
-    ],
-    "extensions/copilot-proxy/index.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/copilot-proxy/index.ts",
-        "hashed_secret": "50f013532a9770a2c2cfdc38b7581dd01df69b70",
-        "is_verified": false,
-        "line_number": 4
-      }
-    ],
-    "extensions/google-antigravity-auth/index.ts": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "extensions/google-antigravity-auth/index.ts",
-        "hashed_secret": "709d0f232b6ac4f8d24dec3e4fabfdb14257174f",
-        "is_verified": false,
-        "line_number": 9
-      }
-    ],
-    "extensions/matrix/src/matrix/accounts.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/matrix/src/matrix/accounts.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 75
-      }
-    ],
-    "extensions/matrix/src/matrix/client.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/matrix/src/matrix/client.test.ts",
-        "hashed_secret": "fe7fcdaea49ece14677acd32374d2f1225819d5c",
-        "is_verified": false,
-        "line_number": 14
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/matrix/src/matrix/client.test.ts",
-        "hashed_secret": "3dc927d80543dc0f643940b70d066bd4b4c4b78e",
-        "is_verified": false,
-        "line_number": 24
-      }
-    ],
-    "extensions/matrix/src/matrix/client/storage.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/matrix/src/matrix/client/storage.ts",
-        "hashed_secret": "7505d64a54e061b7acd54ccd58b49dc43500b635",
-        "is_verified": false,
-        "line_number": 9
-      }
-    ],
-    "extensions/memory-lancedb/config.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/memory-lancedb/config.ts",
-        "hashed_secret": "ecb252044b5ea0f679ee78ec1a12904739e2904d",
-        "is_verified": false,
-        "line_number": 70
-      }
-    ],
-    "extensions/memory-lancedb/index.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/memory-lancedb/index.test.ts",
-        "hashed_secret": "ed65c049bb2f78ee4f703b2158ba9cc6ea31fb7e",
-        "is_verified": false,
-        "line_number": 70
-      }
-    ],
-    "extensions/msteams/src/probe.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/msteams/src/probe.test.ts",
-        "hashed_secret": "1a91d62f7ca67399625a4368a6ab5d4a3baa6073",
-        "is_verified": false,
-        "line_number": 34
-      }
-    ],
-    "extensions/nextcloud-talk/src/accounts.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nextcloud-talk/src/accounts.ts",
-        "hashed_secret": "920f8f5815b381ea692e9e7c2f7119f2b1aa620a",
-        "is_verified": false,
-        "line_number": 26
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nextcloud-talk/src/accounts.ts",
-        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
-        "is_verified": false,
-        "line_number": 139
-      }
-    ],
-    "extensions/nextcloud-talk/src/channel.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nextcloud-talk/src/channel.ts",
-        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
-        "is_verified": false,
-        "line_number": 390
-      }
-    ],
-    "extensions/nostr/README.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nostr/README.md",
-        "hashed_secret": "edeb23e25a619c434d22bb7f1c3ca4841166b4e8",
-        "is_verified": false,
-        "line_number": 43
-      }
-    ],
-    "extensions/nostr/src/channel.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/channel.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 48
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nostr/src/channel.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 48
-      }
-    ],
-    "extensions/nostr/src/nostr-bus.fuzz.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
-        "hashed_secret": "2b4489606a23fb31fcdc849fa7e577ba90f6d39a",
-        "is_verified": false,
-        "line_number": 202
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 203
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
-        "hashed_secret": "b84cb0c3925d34496e6c8b0e55b8c1664a438035",
-        "is_verified": false,
-        "line_number": 208
-      }
-    ],
-    "extensions/nostr/src/nostr-bus.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 11
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.test.ts",
-        "hashed_secret": "7258e28563f03fb4c5994e8402e6f610d1f0f110",
-        "is_verified": false,
-        "line_number": 33
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.test.ts",
-        "hashed_secret": "2b4489606a23fb31fcdc849fa7e577ba90f6d39a",
-        "is_verified": false,
-        "line_number": 101
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.test.ts",
-        "hashed_secret": "ef717286343f6da3f4e6f68c6de02a5148a801c4",
-        "is_verified": false,
-        "line_number": 106
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-bus.test.ts",
-        "hashed_secret": "98b35fe4c45011220f509ebb5546d3889b55a891",
-        "is_verified": false,
-        "line_number": 111
-      }
-    ],
-    "extensions/nostr/src/nostr-profile.fuzz.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-profile.fuzz.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 12
-      }
-    ],
-    "extensions/nostr/src/nostr-profile.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/nostr-profile.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 14
-      }
-    ],
-    "extensions/nostr/src/types.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "extensions/nostr/src/types.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 8
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nostr/src/types.test.ts",
-        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
-        "is_verified": false,
-        "line_number": 8
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/nostr/src/types.test.ts",
-        "hashed_secret": "3bee216ebc256d692260fc3adc765050508fef5e",
-        "is_verified": false,
-        "line_number": 127
-      }
-    ],
-    "extensions/open-prose/skills/prose/SKILL.md": [
-      {
-        "type": "Basic Auth Credentials",
-        "filename": "extensions/open-prose/skills/prose/SKILL.md",
-        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
-        "is_verified": false,
-        "line_number": 200
-      }
-    ],
-    "extensions/open-prose/skills/prose/state/postgres.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/open-prose/skills/prose/state/postgres.md",
-        "hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
-        "is_verified": false,
-        "line_number": 75
-      },
-      {
-        "type": "Basic Auth Credentials",
-        "filename": "extensions/open-prose/skills/prose/state/postgres.md",
-        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
-        "is_verified": false,
-        "line_number": 198
-      }
-    ],
-    "extensions/zalo/README.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/zalo/README.md",
-        "hashed_secret": "f51aaee16a4a756d287f126b99c081b73cba7f15",
-        "is_verified": false,
-        "line_number": 41
-      }
-    ],
-    "extensions/zalo/src/monitor.webhook.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "extensions/zalo/src/monitor.webhook.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 43
-      }
-    ],
-    "skills/1password/references/cli-examples.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "skills/1password/references/cli-examples.md",
-        "hashed_secret": "9dda0987cc3054773a2df97e352d4f64d233ef10",
-        "is_verified": false,
-        "line_number": 17
-      }
-    ],
-    "skills/local-places/SERVER_README.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "skills/local-places/SERVER_README.md",
-        "hashed_secret": "6d9c68c603e465077bdd49c62347fe54717f83a3",
-        "is_verified": false,
-        "line_number": 28
-      }
-    ],
-    "skills/openai-whisper-api/SKILL.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "skills/openai-whisper-api/SKILL.md",
-        "hashed_secret": "1077361f94d70e1ddcc7c6dc581a489532a81d03",
-        "is_verified": false,
-        "line_number": 39
-      }
-    ],
-    "skills/trello/SKILL.md": [
-      {
-        "type": "Secret Keyword",
-        "filename": "skills/trello/SKILL.md",
-        "hashed_secret": "11fa7c37d697f30e6aee828b4426a10f83ab2380",
-        "is_verified": false,
-        "line_number": 18
-      }
-    ],
-    "src/agents/memory-search.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/memory-search.test.ts",
-        "hashed_secret": "a1b49d68a91fdf9c9217773f3fac988d77fa0f50",
-        "is_verified": false,
-        "line_number": 164
-      }
-    ],
-    "src/agents/model-auth.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/model-auth.test.ts",
-        "hashed_secret": "07a6b9cec637c806195e8aa7e5c0851ab03dc35e",
-        "is_verified": false,
-        "line_number": 211
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/model-auth.test.ts",
-        "hashed_secret": "21f296583ccd80c5ab9b3330a8b0d47e4a409fb9",
-        "is_verified": false,
-        "line_number": 240
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/model-auth.test.ts",
-        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
-        "is_verified": false,
-        "line_number": 264
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/model-auth.test.ts",
-        "hashed_secret": "dff6d4ff5dc357cf451d1855ab9cbda562645c9f",
-        "is_verified": false,
-        "line_number": 295
-      }
-    ],
-    "src/agents/model-auth.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/model-auth.ts",
-        "hashed_secret": "8956265d216d474a080edaa97880d37fc1386f33",
-        "is_verified": false,
-        "line_number": 22
-      }
-    ],
-    "src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
-        "is_verified": false,
-        "line_number": 16
-      }
-    ],
-    "src/agents/models-config.falls-back-default-baseurl-token-exchange-fails.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.falls-back-default-baseurl-token-exchange-fails.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
-        "is_verified": false,
-        "line_number": 16
-      }
-    ],
-    "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
-        "is_verified": false,
-        "line_number": 16
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
-        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
-        "is_verified": false,
-        "line_number": 50
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
-        "hashed_secret": "3a81eb091f80c845232225be5663d270e90dacb7",
-        "is_verified": false,
-        "line_number": 108
-      }
-    ],
-    "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
-        "is_verified": false,
-        "line_number": 16
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts",
-        "hashed_secret": "980d02eb9335ae7c9e9984f6c8ad432352a0d2ac",
-        "is_verified": false,
-        "line_number": 57
-      }
-    ],
-    "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
-        "is_verified": false,
-        "line_number": 16
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
-        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
-        "is_verified": false,
-        "line_number": 112
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
-        "hashed_secret": "94c4be5a1976115e8152960c21e04400a4fccdf6",
-        "is_verified": false,
-        "line_number": 146
-      }
-    ],
-    "src/agents/models-config.uses-first-github-copilot-profile-env-tokens.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.uses-first-github-copilot-profile-env-tokens.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
-        "is_verified": false,
-        "line_number": 16
-      }
-    ],
-    "src/agents/openai-responses.reasoning-replay.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/openai-responses.reasoning-replay.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 124
-      }
-    ],
-    "src/agents/pi-embedded-runner.applygoogleturnorderingfix.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.applygoogleturnorderingfix.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 58
-      }
-    ],
-    "src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 57
-      }
-    ],
-    "src/agents/pi-embedded-runner.createsystempromptoverride.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.createsystempromptoverride.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 56
-      }
-    ],
-    "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.falls-back-provider-default-per-dm-not.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.falls-back-provider-default-per-dm-not.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 56
-      }
-    ],
-    "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.returns-undefined-sessionkey-is-undefined.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.returns-undefined-sessionkey-is-undefined.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 56
-      }
-    ],
-    "src/agents/pi-embedded-runner.limithistoryturns.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.limithistoryturns.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 57
-      }
-    ],
-    "src/agents/pi-embedded-runner.resolvesessionagentids.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.resolvesessionagentids.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 56
-      }
-    ],
-    "src/agents/pi-embedded-runner.splitsdktools.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.splitsdktools.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 57
-      }
-    ],
-    "src/agents/pi-embedded-runner.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 117
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/pi-embedded-runner.test.ts",
-        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
-        "is_verified": false,
-        "line_number": 178
-      }
-    ],
-    "src/agents/skills.applyskillenvoverrides.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/skills.applyskillenvoverrides.test.ts",
-        "hashed_secret": "5df3a673d724e8a1eb673a8baf623e183940804d",
-        "is_verified": false,
-        "line_number": 54
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/skills.applyskillenvoverrides.test.ts",
-        "hashed_secret": "8921daaa546693e52bc1f9c40bdcf15e816e0448",
-        "is_verified": false,
-        "line_number": 80
-      }
-    ],
-    "src/agents/skills.build-workspace-skills-prompt.prefers-workspace-skills-managed-skills.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/skills.build-workspace-skills-prompt.prefers-workspace-skills-managed-skills.test.ts",
-        "hashed_secret": "7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb",
-        "is_verified": false,
-        "line_number": 124
-      }
-    ],
-    "src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 102
-      }
-    ],
-    "src/agents/tools/web-fetch.ssrf.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-fetch.ssrf.test.ts",
-        "hashed_secret": "5ce8e9d54c77266fff990194d2219a708c59b76c",
-        "is_verified": false,
-        "line_number": 55
-      }
-    ],
-    "src/agents/tools/web-search.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-search.ts",
-        "hashed_secret": "dfba7aade0868074c2861c98e2a9a92f3178a51b",
-        "is_verified": false,
-        "line_number": 85
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-search.ts",
-        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
-        "is_verified": false,
-        "line_number": 190
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-search.ts",
-        "hashed_secret": "c4865ff9250aca23b0d98eb079dad70ebec1cced",
-        "is_verified": false,
-        "line_number": 198
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-search.ts",
-        "hashed_secret": "527ee41f36386e85fa932ef09471ca017f3c95c8",
-        "is_verified": false,
-        "line_number": 199
-      }
-    ],
-    "src/agents/tools/web-tools.enabled-defaults.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-tools.enabled-defaults.test.ts",
-        "hashed_secret": "47b249a75ca78fdb578d0f28c33685e27ea82684",
-        "is_verified": false,
-        "line_number": 213
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-tools.enabled-defaults.test.ts",
-        "hashed_secret": "d0ffd81d6d7ad1bc3c365660fe8882480c9a986e",
-        "is_verified": false,
-        "line_number": 242
-      }
-    ],
-    "src/agents/tools/web-tools.fetch.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/tools/web-tools.fetch.test.ts",
-        "hashed_secret": "5ce8e9d54c77266fff990194d2219a708c59b76c",
-        "is_verified": false,
-        "line_number": 101
-      }
-    ],
-    "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 90
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
-        "is_verified": false,
-        "line_number": 96
-      }
-    ],
-    "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts",
-        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
-        "is_verified": false,
-        "line_number": 87
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
-        "is_verified": false,
-        "line_number": 228
-      }
-    ],
-    "src/auto-reply/status.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/auto-reply/status.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 20
-      }
-    ],
-    "src/browser/cdp.helpers.test.ts": [
-      {
-        "type": "Basic Auth Credentials",
-        "filename": "src/browser/cdp.helpers.test.ts",
-        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
-        "is_verified": false,
-        "line_number": 22
-      }
-    ],
-    "src/browser/cdp.test.ts": [
-      {
-        "type": "Basic Auth Credentials",
-        "filename": "src/browser/cdp.test.ts",
-        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
-        "is_verified": false,
-        "line_number": 172
-      }
-    ],
-    "src/browser/target-id.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/browser/target-id.test.ts",
-        "hashed_secret": "4e126c049580d66ca1549fa534d95a7263f27f46",
-        "is_verified": false,
-        "line_number": 13
-      }
-    ],
-    "src/cli/update-cli.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/cli/update-cli.test.ts",
-        "hashed_secret": "e4f91dd323bac5bfc4f60a6e433787671dc2421d",
-        "is_verified": false,
-        "line_number": 112
-      }
-    ],
-    "src/commands/auth-choice.preferred-provider.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/auth-choice.preferred-provider.ts",
-        "hashed_secret": "c03a8d10174dd7eb2b3288b570a5a74fdd9ae05d",
-        "is_verified": false,
-        "line_number": 8
-      }
-    ],
-    "src/commands/auth-choice.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/auth-choice.test.ts",
-        "hashed_secret": "2480500ff391183070fe22ba8665a8be19350833",
-        "is_verified": false,
-        "line_number": 289
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/auth-choice.test.ts",
-        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
-        "is_verified": false,
-        "line_number": 350
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/auth-choice.test.ts",
-        "hashed_secret": "1b4d8423b11d32dd0c466428ac81de84a4a9442b",
-        "is_verified": false,
-        "line_number": 528
-      }
-    ],
-    "src/commands/configure.gateway-auth.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/configure.gateway-auth.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 8
-      }
-    ],
-    "src/commands/models/list.status.test.ts": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/commands/models/list.status.test.ts",
-        "hashed_secret": "d6ae2508a78a232d5378ef24b85ce40cbb4d7ff0",
-        "is_verified": false,
-        "line_number": 11
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/commands/models/list.status.test.ts",
-        "hashed_secret": "2d8012102440ea97852b3152239218f00579bafa",
-        "is_verified": false,
-        "line_number": 18
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/commands/models/list.status.test.ts",
-        "hashed_secret": "51848e2be4b461a549218d3167f19c01be6b98b8",
-        "is_verified": false,
-        "line_number": 46
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/models/list.status.test.ts",
-        "hashed_secret": "51848e2be4b461a549218d3167f19c01be6b98b8",
-        "is_verified": false,
-        "line_number": 46
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/models/list.status.test.ts",
-        "hashed_secret": "1c1e381bfb72d3b7bfca9437053d9875356680f0",
-        "is_verified": false,
-        "line_number": 52
-      }
-    ],
-    "src/commands/onboard-auth.config-minimax.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/onboard-auth.config-minimax.ts",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
-        "is_verified": false,
-        "line_number": 30
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/onboard-auth.config-minimax.ts",
-        "hashed_secret": "ddcb713196b974770575a9bea5a4e7d46361f8e9",
-        "is_verified": false,
-        "line_number": 85
-      }
-    ],
-    "src/commands/onboard-auth.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/onboard-auth.test.ts",
-        "hashed_secret": "666c100dab549a6f56da7da546bd848ed5086541",
-        "is_verified": false,
-        "line_number": 230
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/onboard-auth.test.ts",
-        "hashed_secret": "e184b402822abc549b37689c84e8e0e33c39a1f1",
-        "is_verified": false,
-        "line_number": 262
-      }
-    ],
-    "src/commands/onboard-non-interactive.ai-gateway.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/onboard-non-interactive.ai-gateway.test.ts",
-        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
-        "is_verified": false,
-        "line_number": 50
-      }
-    ],
-    "src/commands/onboard-non-interactive/api-keys.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/commands/onboard-non-interactive/api-keys.ts",
-        "hashed_secret": "112f3a99b283a4e1788dedd8e0e5d35375c33747",
-        "is_verified": false,
-        "line_number": 10
-      }
-    ],
-    "src/config/config.env-vars.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/config.env-vars.test.ts",
-        "hashed_secret": "a24ef9c1a27cac44823571ceef2e8262718eee36",
-        "is_verified": false,
-        "line_number": 15
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/config.env-vars.test.ts",
-        "hashed_secret": "29d5f92e9ee44d4854d6dfaeefc3dc27d779fdf3",
-        "is_verified": false,
-        "line_number": 47
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/config.env-vars.test.ts",
-        "hashed_secret": "1672b6a1e7956c6a70f45d699aa42a351b1f8b80",
-        "is_verified": false,
-        "line_number": 63
-      }
-    ],
-    "src/config/config.talk-api-key-fallback.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/config.talk-api-key-fallback.test.ts",
-        "hashed_secret": "bea2f7b64fab8d1d414d0449530b1e088d36d5b1",
-        "is_verified": false,
-        "line_number": 42
-      }
-    ],
-    "src/config/config.web-search-provider.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/config.web-search-provider.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 14
-      }
-    ],
-    "src/config/env-substitution.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/env-substitution.test.ts",
-        "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
-        "is_verified": false,
-        "line_number": 38
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/env-substitution.test.ts",
-        "hashed_secret": "ec417f567082612f8fd6afafe1abcab831fca840",
-        "is_verified": false,
-        "line_number": 69
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/env-substitution.test.ts",
-        "hashed_secret": "520bd69c3eb1646d9a78181ecb4c90c51fdf428d",
-        "is_verified": false,
-        "line_number": 70
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/env-substitution.test.ts",
-        "hashed_secret": "f136444bf9b3d01a9f9b772b80ac6bf7b6a43ef0",
-        "is_verified": false,
-        "line_number": 228
-      }
-    ],
-    "src/config/schema.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/schema.ts",
-        "hashed_secret": "e73c9fcad85cd4eecc74181ec4bdb31064d68439",
-        "is_verified": false,
-        "line_number": 184
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/schema.ts",
-        "hashed_secret": "2eda7cd978f39eebec3bf03e4410a40e14167fff",
-        "is_verified": false,
-        "line_number": 220
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/schema.ts",
-        "hashed_secret": "9f4cda226d3868676ac7f86f59e4190eb94bd208",
-        "is_verified": false,
-        "line_number": 418
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/schema.ts",
-        "hashed_secret": "01822c8bbf6a8b136944b14182cb885100ec2eae",
-        "is_verified": false,
-        "line_number": 437
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/schema.ts",
-        "hashed_secret": "bb7dfd9746e660e4a4374951ec5938ef0e343255",
-        "is_verified": false,
-        "line_number": 487
-      }
-    ],
-    "src/config/slack-http-config.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/config/slack-http-config.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 11
-      }
-    ],
-    "src/gateway/auth.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/auth.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 43
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/auth.test.ts",
-        "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
-        "is_verified": false,
-        "line_number": 51
-      }
-    ],
-    "src/gateway/call.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/call.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 285
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/call.test.ts",
-        "hashed_secret": "e493f561d90c6638c1f51c5a8a069c3b129b79ed",
-        "is_verified": false,
-        "line_number": 295
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/call.test.ts",
-        "hashed_secret": "2e07956ffc9bc4fd624064c40b7495c85d5f1467",
-        "is_verified": false,
-        "line_number": 300
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/call.test.ts",
-        "hashed_secret": "bddc29032de580fb53b3a9a0357dd409086db800",
-        "is_verified": false,
-        "line_number": 313
-      }
-    ],
-    "src/gateway/client.test.ts": [
-      {
-        "type": "Private Key",
-        "filename": "src/gateway/client.test.ts",
-        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
-        "is_verified": false,
-        "line_number": 83
-      }
-    ],
-    "src/gateway/gateway-cli-backend.live.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/gateway/gateway-cli-backend.live.test.ts",
-        "hashed_secret": "3e2fd4a90d5afbd27974730c4d6a9592fe300825",
-        "is_verified": false,
-        "line_number": 38
-      }
-    ],
-    "src/gateway/gateway-models.profiles.live.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/gateway/gateway-models.profiles.live.test.ts",
-        "hashed_secret": "3e2fd4a90d5afbd27974730c4d6a9592fe300825",
-        "is_verified": false,
-        "line_number": 219
-      }
-    ],
-    "src/gateway/gateway.e2e.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/gateway.e2e.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 73
-      }
-    ],
-    "src/gateway/server.auth.e2e.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/server.auth.e2e.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 179
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/server.auth.e2e.test.ts",
-        "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
-        "is_verified": false,
-        "line_number": 197
-      }
-    ],
-    "src/gateway/session-utils.test.ts": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/gateway/session-utils.test.ts",
-        "hashed_secret": "bb9a5d9483409d2c60b28268a0efcb93324d4cda",
-        "is_verified": false,
-        "line_number": 156
-      }
-    ],
-    "src/gateway/tools-invoke-http.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/gateway/tools-invoke-http.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
-        "is_verified": false,
-        "line_number": 56
-      }
-    ],
-    "src/gateway/ws-log.test.ts": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/gateway/ws-log.test.ts",
-        "hashed_secret": "edd2e7ac4f61d0c606e80a0919d727540842a307",
-        "is_verified": false,
-        "line_number": 22
-      }
-    ],
-    "src/infra/env.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/infra/env.test.ts",
-        "hashed_secret": "df98a117ddabf85991b9fe0e268214dc0e1254dc",
-        "is_verified": false,
-        "line_number": 10
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/infra/env.test.ts",
-        "hashed_secret": "6d811dc1f59a55ca1a3d38b5042a062b9f79e8ec",
-        "is_verified": false,
-        "line_number": 25
-      }
-    ],
-    "src/infra/outbound/message-action-runner.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/infra/outbound/message-action-runner.test.ts",
-        "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
-        "is_verified": false,
-        "line_number": 88
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/infra/outbound/message-action-runner.test.ts",
-        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
-        "is_verified": false,
-        "line_number": 385
-      }
-    ],
-    "src/infra/outbound/outbound-policy.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/infra/outbound/outbound-policy.test.ts",
-        "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
-        "is_verified": false,
-        "line_number": 33
-      }
-    ],
-    "src/infra/shell-env.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/infra/shell-env.test.ts",
-        "hashed_secret": "65c10dc3549fe07424148a8a4790a3341ecbc253",
-        "is_verified": false,
-        "line_number": 27
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/infra/shell-env.test.ts",
-        "hashed_secret": "e013ffda590d2178607c16d11b1ea42f75ceb0e7",
-        "is_verified": false,
-        "line_number": 59
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/infra/shell-env.test.ts",
-        "hashed_secret": "be6ee9a6bf9f2dad84a5a67d6c0576a5bacc391e",
-        "is_verified": false,
-        "line_number": 61
-      }
-    ],
-    "src/logging/redact.test.ts": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/logging/redact.test.ts",
-        "hashed_secret": "dd7754662b89333191ff45e8257a3e6d3fcd3990",
-        "is_verified": false,
-        "line_number": 9
-      },
-      {
-        "type": "Private Key",
-        "filename": "src/logging/redact.test.ts",
-        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
-        "is_verified": false,
-        "line_number": 64
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/logging/redact.test.ts",
-        "hashed_secret": "7992945213f7d76889fa83ff0f2be352409c837e",
-        "is_verified": false,
-        "line_number": 65
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/logging/redact.test.ts",
-        "hashed_secret": "063995ecb4fa5afe2460397d322925cd867b7d74",
-        "is_verified": false,
-        "line_number": 79
-      }
-    ],
-    "src/media-understanding/apply.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/media-understanding/apply.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 14
-      }
-    ],
-    "src/media-understanding/providers/deepgram/audio.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/media-understanding/providers/deepgram/audio.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 31
-      }
-    ],
-    "src/media-understanding/providers/google/video.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/media-understanding/providers/google/video.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 28
-      }
-    ],
-    "src/media-understanding/providers/openai/audio.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/media-understanding/providers/openai/audio.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 26
-      }
-    ],
-    "src/media-understanding/runner.auto-audio.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/media-understanding/runner.auto-audio.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 42
-      }
-    ],
-    "src/media-understanding/runner.deepgram.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/media-understanding/runner.deepgram.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
-        "is_verified": false,
-        "line_number": 46
-      }
-    ],
-    "src/memory/embeddings.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/memory/embeddings.test.ts",
-        "hashed_secret": "a47110e348a3063541fb1f1f640d635d457181a0",
-        "is_verified": false,
-        "line_number": 32
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/memory/embeddings.test.ts",
-        "hashed_secret": "c734e47630dda71619c696d88381f06f7511bd78",
-        "is_verified": false,
-        "line_number": 149
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/memory/embeddings.test.ts",
-        "hashed_secret": "56e1d57b8db262b08bc73c60ed08d8c92e59503f",
-        "is_verified": false,
-        "line_number": 179
-      }
-    ],
-    "src/pairing/pairing-store.ts": [
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/pairing/pairing-store.ts",
-        "hashed_secret": "f8c6f1ff98c5ee78c27d34a3ca68f35ad79847af",
-        "is_verified": false,
-        "line_number": 12
-      }
-    ],
-    "src/security/audit.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/security/audit.test.ts",
-        "hashed_secret": "b1775a785f09a6ebaf2dc33d6eaeb98974d9cdb8",
-        "is_verified": false,
-        "line_number": 180
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/security/audit.test.ts",
-        "hashed_secret": "fa8da98a5bdb77b4902cbb4338e6e94ea825300e",
-        "is_verified": false,
-        "line_number": 209
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/security/audit.test.ts",
-        "hashed_secret": "21f688ab56f76a99e5c6ed342291422f4e57e47f",
-        "is_verified": false,
-        "line_number": 1046
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/security/audit.test.ts",
-        "hashed_secret": "3dc927d80543dc0f643940b70d066bd4b4c4b78e",
-        "is_verified": false,
-        "line_number": 1077
-      }
-    ],
-    "src/tts/tts.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "src/tts/tts.test.ts",
-        "hashed_secret": "2e7a7ee14caebf378fc32d6cf6f557f347c96773",
-        "is_verified": false,
-        "line_number": 33
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/tts/tts.test.ts",
-        "hashed_secret": "b214f706bb602c1cc2adc5c6165e73622305f4bb",
-        "is_verified": false,
-        "line_number": 68
-      }
-    ],
-    "src/web/qr-image.test.ts": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/web/qr-image.test.ts",
-        "hashed_secret": "564666dc1ca6e7318b2d5feeb1ce7b5bf717411e",
-        "is_verified": false,
-        "line_number": 12
-      }
-    ],
-    "test/provider-timeout.e2e.test.ts": [
-      {
-        "type": "Secret Keyword",
-        "filename": "test/provider-timeout.e2e.test.ts",
-        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
-        "is_verified": false,
-        "line_number": 182
-      }
-    ]
-  },
-  "generated_at": "2026-01-25T10:55:04Z"
-}

.shellcheckrc

@@ -1,25 +0,0 @@
-# ShellCheck configuration
-# https://www.shellcheck.net/wiki/
-
-# Disable common false positives and style suggestions
-
-# SC2034: Variable appears unused (often exported or used indirectly)
-disable=SC2034
-
-# SC2155: Declare and assign separately (common idiom, rarely causes issues)
-disable=SC2155
-
-# SC2295: Expansions inside ${..} need quoting (info-level, rarely causes issues)
-disable=SC2295
-
-# SC1012: \r is literal (tr -d '\r' works as intended on most systems)
-disable=SC1012
-
-# SC2026: Word outside quotes (info-level, often intentional)
-disable=SC2026
-
-# SC2016: Expressions don't expand in single quotes (often intentional in sed/awk)
-disable=SC2016
-
-# SC2129: Consider using { cmd1; cmd2; } >> file (style preference)
-disable=SC2129

.swiftformat

@@ -1,51 +0,0 @@
-# SwiftFormat configuration adapted from Peekaboo defaults (Swift 6 friendly)
-
---swiftversion 6.2
-
-# Self handling
---self insert
---selfrequired
-
-# Imports / extensions
---importgrouping testable-bottom
---extensionacl on-declarations
-
-# Indentation
---indent 4
---indentcase false
---ifdef no-indent
---xcodeindentation enabled
-
-# Line breaks
---linebreaks lf
---maxwidth 120
-
-# Whitespace
---trimwhitespace always
---emptybraces no-space
---nospaceoperators ...,..<
---ranges no-space
---someAny true
---voidtype void
-
-# Wrapping
---wraparguments before-first
---wrapparameters before-first
---wrapcollections before-first
---closingparen same-line
-
-# Organization
---organizetypes class,struct,enum,extension
---extensionmark "MARK: - %t + %p"
---marktypes always
---markextensions always
---structthreshold 0
---enumthreshold 0
-
-# Other
---stripunusedargs closure-only
---header ignore
---allman false
-
-# Exclusions
---exclude .build,.swiftpm,DerivedData,node_modules,dist,coverage,xcuserdata,Peekaboo,Swabble,apps/android,apps/ios,apps/shared,apps/macos/Sources/MoltbotProtocol

.swiftlint.yml

@@ -1,148 +0,0 @@
-# SwiftLint configuration adapted from Peekaboo defaults (Swift 6 friendly)
-
-included:
-  - apps/macos/Sources
-
-excluded:
-  - .build
-  - DerivedData
-  - "**/.build"
-  - "**/.swiftpm"
-  - "**/DerivedData"
-  - "**/Generated"
-  - "**/Resources"
-  - "**/Package.swift"
-  - "**/Tests/Resources"
-  - node_modules
-  - dist
-  - coverage
-  - "*.playground"
-  # Generated (protocol-gen-swift.ts)
-  - apps/macos/Sources/MoltbotProtocol/GatewayModels.swift
-
-analyzer_rules:
-  - unused_declaration
-  - unused_import
-
-opt_in_rules:
-  - array_init
-  - closure_spacing
-  - contains_over_first_not_nil
-  - empty_count
-  - empty_string
-  - explicit_init
-  - fallthrough
-  - fatal_error_message
-  - first_where
-  - joined_default_parameter
-  - last_where
-  - literal_expression_end_indentation
-  - multiline_arguments
-  - multiline_parameters
-  - operator_usage_whitespace
-  - overridden_super_call
-  - pattern_matching_keywords
-  - private_outlet
-  - prohibited_super_call
-  - redundant_nil_coalescing
-  - sorted_first_last
-  - switch_case_alignment
-  - unneeded_parentheses_in_closure_argument
-  - vertical_parameter_alignment_on_call
-
-disabled_rules:
-  # SwiftFormat handles these
-  - trailing_whitespace
-  - trailing_newline
-  - trailing_comma
-  - vertical_whitespace
-  - indentation_width
-
-  # Style exclusions
-  - explicit_self
-  - identifier_name
-  - file_header
-  - explicit_top_level_acl
-  - explicit_acl
-  - explicit_type_interface
-  - missing_docs
-  - required_deinit
-  - prefer_nimble
-  - quick_discouraged_call
-  - quick_discouraged_focused_test
-  - quick_discouraged_pending_test
-  - anonymous_argument_in_multiline_closure
-  - no_extension_access_modifier
-  - no_grouping_extension
-  - switch_case_on_newline
-  - strict_fileprivate
-  - extension_access_modifier
-  - convenience_type
-  - no_magic_numbers
-  - one_declaration_per_file
-  - vertical_whitespace_between_cases
-  - vertical_whitespace_closing_braces
-  - superfluous_else
-  - number_separator
-  - prefixed_toplevel_constant
-  - opening_brace
-  - trailing_closure
-  - contrasted_opening_brace
-  - sorted_imports
-  - redundant_type_annotation
-  - shorthand_optional_binding
-  - untyped_error_in_catch
-  - file_name
-  - todo
-
-force_cast: warning
-force_try: warning
-
-type_name:
-  min_length:
-    warning: 2
-    error: 1
-  max_length:
-    warning: 60
-    error: 80
-
-function_body_length:
-  warning: 150
-  error: 300
-
-function_parameter_count:
-  warning: 7
-  error: 10
-
-file_length:
-  warning: 1500
-  error: 2500
-  ignore_comment_only_lines: true
-
-type_body_length:
-  warning: 800
-  error: 1200
-
-cyclomatic_complexity:
-  warning: 20
-  error: 120
-
-large_tuple:
-  warning: 4
-  error: 5
-
-nesting:
-  type_level:
-    warning: 4
-    error: 6
-  function_level:
-    warning: 5
-    error: 7
-
-line_length:
-  warning: 120
-  error: 250
-  ignores_comments: true
-  ignores_urls: true
-
-reporter: "xcode"

AGENTS.md

@@ -1,163 +0,0 @@
-# Repository Guidelines
-- Repo: https://github.com/moltbot/moltbot
-- GitHub issues/comments/PR comments: use literal multiline strings or `-F - <<'EOF'` (or $'...') for real newlines; never embed "\\n".
-
-## Project Structure & Module Organization
-- Source code: `src/` (CLI wiring in `src/cli`, commands in `src/commands`, web provider in `src/provider-web.ts`, infra in `src/infra`, media pipeline in `src/media`).
-- Tests: colocated `*.test.ts`.
-- Docs: `docs/` (images, queue, Pi config). Built output lives in `dist/`.
-- Plugins/extensions: live under `extensions/*` (workspace packages). Keep plugin-only deps in the extension `package.json`; do not add them to the root `package.json` unless core uses them.
-- Plugins: install runs `npm install --omit=dev` in plugin dir; runtime deps must live in `dependencies`. Avoid `workspace:*` in `dependencies` (npm install breaks); put `moltbot` in `devDependencies` or `peerDependencies` instead (runtime resolves `clawdbot/plugin-sdk` via jiti alias).
-- Installers served from `https://molt.bot/*`: live in the sibling repo `../molt.bot` (`public/install.sh`, `public/install-cli.sh`, `public/install.ps1`).
-- Messaging channels: always consider **all** built-in + extension channels when refactoring shared logic (routing, allowlists, pairing, command gating, onboarding, docs).
-  - Core channel docs: `docs/channels/`
-  - Core channel code: `src/telegram`, `src/discord`, `src/slack`, `src/signal`, `src/imessage`, `src/web` (WhatsApp web), `src/channels`, `src/routing`
-  - Extensions (channel plugins): `extensions/*` (e.g. `extensions/msteams`, `extensions/matrix`, `extensions/zalo`, `extensions/zalouser`, `extensions/voice-call`)
-- When adding channels/extensions/apps/docs, review `.github/labeler.yml` for label coverage.
-
-## Docs Linking (Mintlify)
-- Docs are hosted on Mintlify (docs.molt.bot).
-- Internal doc links in `docs/**/*.md`: root-relative, no `.md`/`.mdx` (example: `[Config](/configuration)`).
-- Section cross-references: use anchors on root-relative paths (example: `[Hooks](/configuration#hooks)`).
-- Doc headings and anchors: avoid em dashes and apostrophes in headings because they break Mintlify anchor links.
-- When Peter asks for links, reply with full `https://docs.molt.bot/...` URLs (not root-relative).
-- When you touch docs, end the reply with the `https://docs.molt.bot/...` URLs you referenced.
-- README (GitHub): keep absolute docs URLs (`https://docs.molt.bot/...`) so links work on GitHub.
-- Docs content must be generic: no personal device names/hostnames/paths; use placeholders like `user@gateway-host` and “gateway host”.
-
-## exe.dev VM ops (general)
-- Access: stable path is `ssh exe.dev` then `ssh vm-name` (assume SSH key already set).
-- SSH flaky: use exe.dev web terminal or Shelley (web agent); keep a tmux session for long ops.
-- Update: `sudo npm i -g moltbot@latest` (global install needs root on `/usr/lib/node_modules`).
-- Config: use `moltbot config set ...`; ensure `gateway.mode=local` is set.
-- Discord: store raw token only (no `DISCORD_BOT_TOKEN=` prefix).
-- Restart: stop old gateway and run:
-  `pkill -9 -f moltbot-gateway || true; nohup moltbot gateway run --bind loopback --port 18789 --force > /tmp/moltbot-gateway.log 2>&1 &`
-- Verify: `moltbot channels status --probe`, `ss -ltnp | rg 18789`, `tail -n 120 /tmp/moltbot-gateway.log`.
-
-## Build, Test, and Development Commands
-- Runtime baseline: Node **22+** (keep Node + Bun paths working).
-- Install deps: `pnpm install`
-- Pre-commit hooks: `prek install` (runs same checks as CI)
-- Also supported: `bun install` (keep `pnpm-lock.yaml` + Bun patching in sync when touching deps/patches).
-- Prefer Bun for TypeScript execution (scripts, dev, tests): `bun <file.ts>` / `bunx <tool>`.
-- Run CLI in dev: `pnpm moltbot ...` (bun) or `pnpm dev`.
-- Node remains supported for running built output (`dist/*`) and production installs.
-- Mac packaging (dev): `scripts/package-mac-app.sh` defaults to current arch. Release checklist: `docs/platforms/mac/release.md`.
-- Type-check/build: `pnpm build` (tsc)
-- Lint/format: `pnpm lint` (oxlint), `pnpm format` (oxfmt)
-- Tests: `pnpm test` (vitest); coverage: `pnpm test:coverage`
-
-## Coding Style & Naming Conventions
-- Language: TypeScript (ESM). Prefer strict typing; avoid `any`.
-- Formatting/linting via Oxlint and Oxfmt; run `pnpm lint` before commits.
-- Add brief code comments for tricky or non-obvious logic.
-- Keep files concise; extract helpers instead of “V2” copies. Use existing patterns for CLI options and dependency injection via `createDefaultDeps`.
-- Aim to keep files under ~700 LOC; guideline only (not a hard guardrail). Split/refactor when it improves clarity or testability.
-- Naming: use **Moltbot** for product/app/docs headings; use `moltbot` for CLI command, package/binary, paths, and config keys.
-
-## Release Channels (Naming)
-- stable: tagged releases only (e.g. `vYYYY.M.D`), npm dist-tag `latest`.
-- beta: prerelease tags `vYYYY.M.D-beta.N`, npm dist-tag `beta` (may ship without macOS app).
-- dev: moving head on `main` (no tag; git checkout main).
-
-## Testing Guidelines
-- Framework: Vitest with V8 coverage thresholds (70% lines/branches/functions/statements).
-- Naming: match source names with `*.test.ts`; e2e in `*.e2e.test.ts`.
-- Run `pnpm test` (or `pnpm test:coverage`) before pushing when you touch logic.
-- Do not set test workers above 16; tried already.
-- Live tests (real keys): `CLAWDBOT_LIVE_TEST=1 pnpm test:live` (Moltbot-only) or `LIVE=1 pnpm test:live` (includes provider live tests). Docker: `pnpm test:docker:live-models`, `pnpm test:docker:live-gateway`. Onboarding Docker E2E: `pnpm test:docker:onboard`.
-- Full kit + what’s covered: `docs/testing.md`.
-- Pure test additions/fixes generally do **not** need a changelog entry unless they alter user-facing behavior or the user asks for one.
-- Mobile: before using a simulator, check for connected real devices (iOS + Android) and prefer them when available.
-
-## Commit & Pull Request Guidelines
-- Create commits with `scripts/committer "<msg>" <file...>`; avoid manual `git add`/`git commit` so staging stays scoped.
-- Follow concise, action-oriented commit messages (e.g., `CLI: add verbose flag to send`).
-- Group related changes; avoid bundling unrelated refactors.
-- Changelog workflow: keep latest released version at top (no `Unreleased`); after publishing, bump version and start a new top section.
-- PRs should summarize scope, note testing performed, and mention any user-facing changes or new flags.
-- PR review flow: when given a PR link, review via `gh pr view`/`gh pr diff` and do **not** change branches.
-- PR review calls: prefer a single `gh pr view --json ...` to batch metadata/comments; run `gh pr diff` only when needed.
-- Before starting a review when a GH Issue/PR is pasted: run `git pull`; if there are local changes or unpushed commits, stop and alert the user before reviewing.
-- Goal: merge PRs. Prefer **rebase** when commits are clean; **squash** when history is messy.
-- PR merge flow: create a temp branch from `main`, merge the PR branch into it (prefer squash unless commit history is important; use rebase/merge when it is). Always try to merge the PR unless it’s truly difficult, then use another approach. If we squash, add the PR author as a co-contributor. Apply fixes, add changelog entry (include PR # + thanks), run full gate before the final commit, commit, merge back to `main`, delete the temp branch, and end on `main`.
-- If you review a PR and later do work on it, land via merge/squash (no direct-main commits) and always add the PR author as a co-contributor.
-- When working on a PR: add a changelog entry with the PR number and thank the contributor.
-- When working on an issue: reference the issue in the changelog entry.
-- When merging a PR: leave a PR comment that explains exactly what we did and include the SHA hashes.
-- When merging a PR from a new contributor: add their avatar to the README “Thanks to all clawtributors” thumbnail list.
-- After merging a PR: run `bun scripts/update-clawtributors.ts` if the contributor is missing, then commit the regenerated README.
-
-## Shorthand Commands
-- `sync`: if working tree is dirty, commit all changes (pick a sensible Conventional Commit message), then `git pull --rebase`; if rebase conflicts and cannot resolve, stop; otherwise `git push`.
-
-### PR Workflow (Review vs Land)
-- **Review mode (PR link only):** read `gh pr view/diff`; **do not** switch branches; **do not** change code.
-- **Landing mode:** create an integration branch from `main`, bring in PR commits (**prefer rebase** for linear history; **merge allowed** when complexity/conflicts make it safer), apply fixes, add changelog (+ thanks + PR #), run full gate **locally before committing** (`pnpm lint && pnpm build && pnpm test`), commit, merge back to `main`, then `git switch main` (never stay on a topic branch after landing). Important: contributor needs to be in git graph after this!
-
-## Security & Configuration Tips
-- Web provider stores creds at `~/.clawdbot/credentials/`; rerun `moltbot login` if logged out.
-- Pi sessions live under `~/.clawdbot/sessions/` by default; the base directory is not configurable.
-- Environment variables: see `~/.profile`.
-- Never commit or publish real phone numbers, videos, or live configuration values. Use obviously fake placeholders in docs, tests, and examples.
- - Release flow: always read `docs/reference/RELEASING.md` and `docs/platforms/mac/release.md` before any release work; do not ask routine questions once those docs answer them.
-
-## Troubleshooting
-- Rebrand/migration issues or legacy config/service warnings: run `moltbot doctor` (see `docs/gateway/doctor.md`).
-
-## Agent-Specific Notes
-- Vocabulary: "makeup" = "mac app".
-- Never edit `node_modules` (global/Homebrew/npm/git installs too). Updates overwrite. Skill notes go in `tools.md` or `AGENTS.md`.
-- Signal: "update fly" => `fly ssh console -a flawd-bot -C "bash -lc 'cd /data/clawd/moltbot && git pull --rebase origin main'"` then `fly machines restart e825232f34d058 -a flawd-bot`.
-- When working on a GitHub Issue or PR, print the full URL at the end of the task.
-- When answering questions, respond with high-confidence answers only: verify in code; do not guess.
-- Never update the Carbon dependency.
-- Any dependency with `pnpm.patchedDependencies` must use an exact version (no `^`/`~`).
-- Patching dependencies (pnpm patches, overrides, or vendored changes) requires explicit approval; do not do this by default.
-- CLI progress: use `src/cli/progress.ts` (`osc-progress` + `@clack/prompts` spinner); don’t hand-roll spinners/bars.
-- Status output: keep tables + ANSI-safe wrapping (`src/terminal/table.ts`); `status --all` = read-only/pasteable, `status --deep` = probes.
-- Gateway currently runs only as the menubar app; there is no separate LaunchAgent/helper label installed. Restart via the Moltbot Mac app or `scripts/restart-mac.sh`; to verify/kill use `launchctl print gui/$UID | grep moltbot` rather than assuming a fixed label. **When debugging on macOS, start/stop the gateway via the app, not ad-hoc tmux sessions; kill any temporary tunnels before handoff.**
-- macOS logs: use `./scripts/clawlog.sh` to query unified logs for the Moltbot subsystem; it supports follow/tail/category filters and expects passwordless sudo for `/usr/bin/log`.
-- If shared guardrails are available locally, review them; otherwise follow this repo's guidance.
-- SwiftUI state management (iOS/macOS): prefer the `Observation` framework (`@Observable`, `@Bindable`) over `ObservableObject`/`@StateObject`; don’t introduce new `ObservableObject` unless required for compatibility, and migrate existing usages when touching related code.
-- Connection providers: when adding a new connection, update every UI surface and docs (macOS app, web UI, mobile if applicable, onboarding/overview docs) and add matching status + configuration forms so provider lists and settings stay in sync.
-- Version locations: `package.json` (CLI), `apps/android/app/build.gradle.kts` (versionName/versionCode), `apps/ios/Sources/Info.plist` + `apps/ios/Tests/Info.plist` (CFBundleShortVersionString/CFBundleVersion), `apps/macos/Sources/Moltbot/Resources/Info.plist` (CFBundleShortVersionString/CFBundleVersion), `docs/install/updating.md` (pinned npm version), `docs/platforms/mac/release.md` (APP_VERSION/APP_BUILD examples), Peekaboo Xcode projects/Info.plists (MARKETING_VERSION/CURRENT_PROJECT_VERSION).
-- **Restart apps:** “restart iOS/Android apps” means rebuild (recompile/install) and relaunch, not just kill/launch.
-- **Device checks:** before testing, verify connected real devices (iOS/Android) before reaching for simulators/emulators.
-- iOS Team ID lookup: `security find-identity -p codesigning -v` → use Apple Development (…) TEAMID. Fallback: `defaults read com.apple.dt.Xcode IDEProvisioningTeamIdentifiers`.
-- A2UI bundle hash: `src/canvas-host/a2ui/.bundle.hash` is auto-generated; ignore unexpected changes, and only regenerate via `pnpm canvas:a2ui:bundle` (or `scripts/bundle-a2ui.sh`) when needed. Commit the hash as a separate commit.
-- Release signing/notary keys are managed outside the repo; follow internal release docs.
-- Notary auth env vars (`APP_STORE_CONNECT_ISSUER_ID`, `APP_STORE_CONNECT_KEY_ID`, `APP_STORE_CONNECT_API_KEY_P8`) are expected in your environment (per internal release docs).
-- **Multi-agent safety:** do **not** create/apply/drop `git stash` entries unless explicitly requested (this includes `git pull --rebase --autostash`). Assume other agents may be working; keep unrelated WIP untouched and avoid cross-cutting state changes.
-- **Multi-agent safety:** when the user says "push", you may `git pull --rebase` to integrate latest changes (never discard other agents' work). When the user says "commit", scope to your changes only. When the user says "commit all", commit everything in grouped chunks.
-- **Multi-agent safety:** do **not** create/remove/modify `git worktree` checkouts (or edit `.worktrees/*`) unless explicitly requested.
-- **Multi-agent safety:** do **not** switch branches / check out a different branch unless explicitly requested.
-- **Multi-agent safety:** running multiple agents is OK as long as each agent has its own session.
-- **Multi-agent safety:** when you see unrecognized files, keep going; focus on your changes and commit only those.
-- Lint/format churn:
-  - If staged+unstaged diffs are formatting-only, auto-resolve without asking.
-  - If commit/push already requested, auto-stage and include formatting-only follow-ups in the same commit (or a tiny follow-up commit if needed), no extra confirmation.
-  - Only ask when changes are semantic (logic/data/behavior).
-- Lobster seam: use the shared CLI palette in `src/terminal/palette.ts` (no hardcoded colors); apply palette to onboarding/config prompts and other TTY UI output as needed.
-- **Multi-agent safety:** focus reports on your edits; avoid guard-rail disclaimers unless truly blocked; when multiple agents touch the same file, continue if safe; end with a brief “other files present” note only if relevant.
-- Bug investigations: read source code of relevant npm dependencies and all related local code before concluding; aim for high-confidence root cause.
-- Code style: add brief comments for tricky logic; keep files under ~500 LOC when feasible (split/refactor as needed).
-- Tool schema guardrails (google-antigravity): avoid `Type.Union` in tool input schemas; no `anyOf`/`oneOf`/`allOf`. Use `stringEnum`/`optionalStringEnum` (Type.Unsafe enum) for string lists, and `Type.Optional(...)` instead of `... | null`. Keep top-level tool schema as `type: "object"` with `properties`.
-- Tool schema guardrails: avoid raw `format` property names in tool schemas; some validators treat `format` as a reserved keyword and reject the schema.
-- When asked to open a “session” file, open the Pi session logs under `~/.clawdbot/agents/<agentId>/sessions/*.jsonl` (use the `agent=<id>` value in the Runtime line of the system prompt; newest unless a specific ID is given), not the default `sessions.json`. If logs are needed from another machine, SSH via Tailscale and read the same path there.
-- Do not rebuild the macOS app over SSH; rebuilds must be run directly on the Mac.
-- Never send streaming/partial replies to external messaging surfaces (WhatsApp, Telegram); only final replies should be delivered there. Streaming/tool events may still go to internal UIs/control channel.
-- Voice wake forwarding tips:
-  - Command template should stay `moltbot-mac agent --message "${text}" --thinking low`; `VoiceWakeForwarder` already shell-escapes `${text}`. Don’t add extra quotes.
-  - launchd PATH is minimal; ensure the app’s launch agent PATH includes standard system paths plus your pnpm bin (typically `$HOME/Library/pnpm`) so `pnpm`/`moltbot` binaries resolve when invoked via `moltbot-mac`.
-- For manual `moltbot message send` messages that include `!`, use the heredoc pattern noted below to avoid the Bash tool’s escaping.
-- Release guardrails: do not change version numbers without operator’s explicit consent; always ask permission before running any npm publish/release step.
-
-## NPM + 1Password (publish/verify)
-- Use the 1password skill; all `op` commands must run inside a fresh tmux session.
-- Sign in: `eval "$(op signin --account my.1password.com)"` (app unlocked + integration on).
-- OTP: `op read 'op://Private/Npmjs/one-time password?attribute=otp'`.
-- Publish: `npm publish --access public --otp="<otp>"` (run from the package dir).
-- Verify without local npmrc side effects: `npm view <pkg> version --userconfig "$(mktemp)"`.
-- Kill the tmux session after publish.

Agent.md

@@ -1,189 +0,0 @@
-# Agent.md
-
-## 1. Deployment Configuration
-
-### Target Space
-- **Profile:** `Leon4gr45`  
-- **Space:** `openoperator`  
-- **Full Identifier:** `Leon4gr45/openoperator`  
-- **Frontend Port:** `7860` (mandatory for all Hugging Face Spaces)
-
-### Deployment Method
-Choose the correct SDK based on the app type based on the codebase language:
-
-- **Gradio SDK** — for Gradio applications  
-- **Streamlit SDK** — for Streamlit applications  
-- **Docker SDK** — for all other applications (recommended default for flexibility)
-
-### HF Token
-- The environment variable **`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` will always be provided at execution time**.
-- Never hardcode the token. Always read it from the environment.
-- All monitoring and log‑streaming commands rely on `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`.
-
-### Required Files
-- `Dockerfile` (or `app.py` for Gradio/Streamlit SDKs)
-- `README.md` with Hugging Face YAML frontmatter:
-  ```yaml
-  ---
-  title: Moltbot
-  sdk: docker
-  app_port: 7860
-  ---
-  ```
-- `.hfignore` to exclude unnecessary files
-- This `Agent.md` file (must be committed before deployment)
-
----
-
-## 2. API Exposure and Documentation
-
-### Mandatory Endpoints
-Every deployment **must** expose:
-
-- **`/health`**  
-  - Returns HTTP 200 when the app is ready.  
-  - Required for Hugging Face to transition the Space from *starting* → *running*.
-
-- **`/api-docs`**  
-  - Documents **all** available API endpoints.  
-  - Must be reachable at:  
-    `https://leon4gr45-openoperator.hf.space/api-docs`
-
-### Functional Endpoints
-Document each endpoint here. For every endpoint, include:
-
-- **Method:** GET/POST/PUT/DELETE  
-- **Path:** `/predict`, `/generate`, `/upload`, etc.  
-- **Purpose:** What the endpoint does  
-- **Request Example:** JSON or query parameters  
-- **Response Example:** JSON schema or example payload  
-
-Example format:
-
-```
-### /health
-- Method: GET
-- Purpose: Returns HTTP 200 when the app is ready. Required for Hugging Face to transition the Space from starting → running.
-- Request Example: GET /health
-- Response Example:
-  {
-    "status": "ok"
-  }
-
-### /api-docs
-- Method: GET
-- Purpose: Documents all available API endpoints.
-- Request Example: GET /api-docs
-- Response Example: Plain text documentation.
-```
-
-All endpoints listed here **must** appear in `/api-docs`.
-
----
-
-## 3. Deployment Workflow
-
-### Standard Deployment Command
-After any code change, run:
-
-```bash
-hf upload Leon4gr45/openoperator . --repo-type=space
-```
-
-This command must be executed **after updating and committing Agent.md**.
-
-### Deployment Steps
-1. Ensure all code changes are committed.  
-2. Ensure `Agent.md` is updated and committed.  
-3. Run the upload command.  
-4. Wait for the Space to build.  
-5. Monitor logs (see next section).  
-6. When the Space is running, execute all test cases.
-
-### Continuous Deployment Rule
-After **every** relevant edit (logic, dependencies, API changes):
-
-- Update `Agent.md`
-- Redeploy using the upload command
-- Re-run all test cases
-- Confirm `/health` and `/api-docs` are functional
-
-This applies even for long-running projects.
-
----
-
-## 4. Monitoring and Logs
-
-### Build Logs (SSE)
-```bash
-curl -N \
-  -H "Authorization: Bearer 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" \
-  "https://huggingface.co/api/spaces/Leon4gr45/openoperator/logs/build"
-```
-
-### Run Logs (SSE)
-```bash
-curl -N \
-  -H "Authorization: Bearer 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" \
-  "https://huggingface.co/api/spaces/Leon4gr45/openoperator/logs/run"
-```
-
-### Notes
-- If the Space stays in *starting* for too long, `/health` is usually failing.  
-- If the Space times out after ~30 minutes, check logs immediately.  
-- Fix issues, commit changes, redeploy.
-
----
-
-## 5. Test Run Cases (Mandatory After Every Deployment)
-
-These tests ensure the agentic system can verify the deployment automatically.
-
-### 1. Health Check
-```
-GET https://leon4gr45-openoperator.hf.space/health
-Expected: HTTP 200, body: {"status": "ok"} or similar
-```
-
-### 2. API Docs Check
-```
-GET https://leon4gr45-openoperator.hf.space/api-docs
-Expected: HTTP 200, valid documentation UI or JSON spec
-```
-
-### 3. Functional Endpoint Tests
-For each endpoint documented above, define:
-
-- Example request
-- Expected response structure
-- Validation criteria (e.g., non-empty output, valid JSON)
-
-Example:
-
-```
-GET https://leon4gr45-openoperator.hf.space/health
-Expected:
-- HTTP 200
-- JSON with key "status"
-- No error fields
-```
-
-### 4. End-to-End Behaviour
-- Confirm the UI loads (if applicable)
-- Confirm API endpoints respond within reasonable time
-- Confirm no errors appear in run logs
-
----
-
-## 6. Maintenance Rules
-
-- `Agent.md` must always reflect the **current** deployment configuration, API surface, and test cases.
-- Any change to:
-  - API routes  
-  - Dockerfile  
-  - Dependencies  
-  - App logic  
-  - Deployment method  
-  requires updating this file.
-- This file must be committed **before** every deployment.
-- This file is the operational contract for autonomous agents interacting with the project.

CLAUDE.md

@@ -1,163 +0,0 @@
-# Repository Guidelines
-- Repo: https://github.com/moltbot/moltbot
-- GitHub issues/comments/PR comments: use literal multiline strings or `-F - <<'EOF'` (or $'...') for real newlines; never embed "\\n".
-
-## Project Structure & Module Organization
-- Source code: `src/` (CLI wiring in `src/cli`, commands in `src/commands`, web provider in `src/provider-web.ts`, infra in `src/infra`, media pipeline in `src/media`).
-- Tests: colocated `*.test.ts`.
-- Docs: `docs/` (images, queue, Pi config). Built output lives in `dist/`.
-- Plugins/extensions: live under `extensions/*` (workspace packages). Keep plugin-only deps in the extension `package.json`; do not add them to the root `package.json` unless core uses them.
-- Plugins: install runs `npm install --omit=dev` in plugin dir; runtime deps must live in `dependencies`. Avoid `workspace:*` in `dependencies` (npm install breaks); put `moltbot` in `devDependencies` or `peerDependencies` instead (runtime resolves `clawdbot/plugin-sdk` via jiti alias).
-- Installers served from `https://molt.bot/*`: live in the sibling repo `../molt.bot` (`public/install.sh`, `public/install-cli.sh`, `public/install.ps1`).
-- Messaging channels: always consider **all** built-in + extension channels when refactoring shared logic (routing, allowlists, pairing, command gating, onboarding, docs).
-  - Core channel docs: `docs/channels/`
-  - Core channel code: `src/telegram`, `src/discord`, `src/slack`, `src/signal`, `src/imessage`, `src/web` (WhatsApp web), `src/channels`, `src/routing`
-  - Extensions (channel plugins): `extensions/*` (e.g. `extensions/msteams`, `extensions/matrix`, `extensions/zalo`, `extensions/zalouser`, `extensions/voice-call`)
-- When adding channels/extensions/apps/docs, review `.github/labeler.yml` for label coverage.
-
-## Docs Linking (Mintlify)
-- Docs are hosted on Mintlify (docs.molt.bot).
-- Internal doc links in `docs/**/*.md`: root-relative, no `.md`/`.mdx` (example: `[Config](/configuration)`).
-- Section cross-references: use anchors on root-relative paths (example: `[Hooks](/configuration#hooks)`).
-- Doc headings and anchors: avoid em dashes and apostrophes in headings because they break Mintlify anchor links.
-- When Peter asks for links, reply with full `https://docs.molt.bot/...` URLs (not root-relative).
-- When you touch docs, end the reply with the `https://docs.molt.bot/...` URLs you referenced.
-- README (GitHub): keep absolute docs URLs (`https://docs.molt.bot/...`) so links work on GitHub.
-- Docs content must be generic: no personal device names/hostnames/paths; use placeholders like `user@gateway-host` and “gateway host”.
-
-## exe.dev VM ops (general)
-- Access: stable path is `ssh exe.dev` then `ssh vm-name` (assume SSH key already set).
-- SSH flaky: use exe.dev web terminal or Shelley (web agent); keep a tmux session for long ops.
-- Update: `sudo npm i -g moltbot@latest` (global install needs root on `/usr/lib/node_modules`).
-- Config: use `moltbot config set ...`; ensure `gateway.mode=local` is set.
-- Discord: store raw token only (no `DISCORD_BOT_TOKEN=` prefix).
-- Restart: stop old gateway and run:
-  `pkill -9 -f moltbot-gateway || true; nohup moltbot gateway run --bind loopback --port 18789 --force > /tmp/moltbot-gateway.log 2>&1 &`
-- Verify: `moltbot channels status --probe`, `ss -ltnp | rg 18789`, `tail -n 120 /tmp/moltbot-gateway.log`.
-
-## Build, Test, and Development Commands
-- Runtime baseline: Node **22+** (keep Node + Bun paths working).
-- Install deps: `pnpm install`
-- Pre-commit hooks: `prek install` (runs same checks as CI)
-- Also supported: `bun install` (keep `pnpm-lock.yaml` + Bun patching in sync when touching deps/patches).
-- Prefer Bun for TypeScript execution (scripts, dev, tests): `bun <file.ts>` / `bunx <tool>`.
-- Run CLI in dev: `pnpm moltbot ...` (bun) or `pnpm dev`.
-- Node remains supported for running built output (`dist/*`) and production installs.
-- Mac packaging (dev): `scripts/package-mac-app.sh` defaults to current arch. Release checklist: `docs/platforms/mac/release.md`.
-- Type-check/build: `pnpm build` (tsc)
-- Lint/format: `pnpm lint` (oxlint), `pnpm format` (oxfmt)
-- Tests: `pnpm test` (vitest); coverage: `pnpm test:coverage`
-
-## Coding Style & Naming Conventions
-- Language: TypeScript (ESM). Prefer strict typing; avoid `any`.
-- Formatting/linting via Oxlint and Oxfmt; run `pnpm lint` before commits.
-- Add brief code comments for tricky or non-obvious logic.
-- Keep files concise; extract helpers instead of “V2” copies. Use existing patterns for CLI options and dependency injection via `createDefaultDeps`.
-- Aim to keep files under ~700 LOC; guideline only (not a hard guardrail). Split/refactor when it improves clarity or testability.
-- Naming: use **Moltbot** for product/app/docs headings; use `moltbot` for CLI command, package/binary, paths, and config keys.
-
-## Release Channels (Naming)
-- stable: tagged releases only (e.g. `vYYYY.M.D`), npm dist-tag `latest`.
-- beta: prerelease tags `vYYYY.M.D-beta.N`, npm dist-tag `beta` (may ship without macOS app).
-- dev: moving head on `main` (no tag; git checkout main).
-
-## Testing Guidelines
-- Framework: Vitest with V8 coverage thresholds (70% lines/branches/functions/statements).
-- Naming: match source names with `*.test.ts`; e2e in `*.e2e.test.ts`.
-- Run `pnpm test` (or `pnpm test:coverage`) before pushing when you touch logic.
-- Do not set test workers above 16; tried already.
-- Live tests (real keys): `CLAWDBOT_LIVE_TEST=1 pnpm test:live` (Moltbot-only) or `LIVE=1 pnpm test:live` (includes provider live tests). Docker: `pnpm test:docker:live-models`, `pnpm test:docker:live-gateway`. Onboarding Docker E2E: `pnpm test:docker:onboard`.
-- Full kit + what’s covered: `docs/testing.md`.
-- Pure test additions/fixes generally do **not** need a changelog entry unless they alter user-facing behavior or the user asks for one.
-- Mobile: before using a simulator, check for connected real devices (iOS + Android) and prefer them when available.
-
-## Commit & Pull Request Guidelines
-- Create commits with `scripts/committer "<msg>" <file...>`; avoid manual `git add`/`git commit` so staging stays scoped.
-- Follow concise, action-oriented commit messages (e.g., `CLI: add verbose flag to send`).
-- Group related changes; avoid bundling unrelated refactors.
-- Changelog workflow: keep latest released version at top (no `Unreleased`); after publishing, bump version and start a new top section.
-- PRs should summarize scope, note testing performed, and mention any user-facing changes or new flags.
-- PR review flow: when given a PR link, review via `gh pr view`/`gh pr diff` and do **not** change branches.
-- PR review calls: prefer a single `gh pr view --json ...` to batch metadata/comments; run `gh pr diff` only when needed.
-- Before starting a review when a GH Issue/PR is pasted: run `git pull`; if there are local changes or unpushed commits, stop and alert the user before reviewing.
-- Goal: merge PRs. Prefer **rebase** when commits are clean; **squash** when history is messy.
-- PR merge flow: create a temp branch from `main`, merge the PR branch into it (prefer squash unless commit history is important; use rebase/merge when it is). Always try to merge the PR unless it’s truly difficult, then use another approach. If we squash, add the PR author as a co-contributor. Apply fixes, add changelog entry (include PR # + thanks), run full gate before the final commit, commit, merge back to `main`, delete the temp branch, and end on `main`.
-- If you review a PR and later do work on it, land via merge/squash (no direct-main commits) and always add the PR author as a co-contributor.
-- When working on a PR: add a changelog entry with the PR number and thank the contributor.
-- When working on an issue: reference the issue in the changelog entry.
-- When merging a PR: leave a PR comment that explains exactly what we did and include the SHA hashes.
-- When merging a PR from a new contributor: add their avatar to the README “Thanks to all clawtributors” thumbnail list.
-- After merging a PR: run `bun scripts/update-clawtributors.ts` if the contributor is missing, then commit the regenerated README.
-
-## Shorthand Commands
-- `sync`: if working tree is dirty, commit all changes (pick a sensible Conventional Commit message), then `git pull --rebase`; if rebase conflicts and cannot resolve, stop; otherwise `git push`.
-
-### PR Workflow (Review vs Land)
-- **Review mode (PR link only):** read `gh pr view/diff`; **do not** switch branches; **do not** change code.
-- **Landing mode:** create an integration branch from `main`, bring in PR commits (**prefer rebase** for linear history; **merge allowed** when complexity/conflicts make it safer), apply fixes, add changelog (+ thanks + PR #), run full gate **locally before committing** (`pnpm lint && pnpm build && pnpm test`), commit, merge back to `main`, then `git switch main` (never stay on a topic branch after landing). Important: contributor needs to be in git graph after this!
-
-## Security & Configuration Tips
-- Web provider stores creds at `~/.clawdbot/credentials/`; rerun `moltbot login` if logged out.
-- Pi sessions live under `~/.clawdbot/sessions/` by default; the base directory is not configurable.
-- Environment variables: see `~/.profile`.
-- Never commit or publish real phone numbers, videos, or live configuration values. Use obviously fake placeholders in docs, tests, and examples.
- - Release flow: always read `docs/reference/RELEASING.md` and `docs/platforms/mac/release.md` before any release work; do not ask routine questions once those docs answer them.
-
-## Troubleshooting
-- Rebrand/migration issues or legacy config/service warnings: run `moltbot doctor` (see `docs/gateway/doctor.md`).
-
-## Agent-Specific Notes
-- Vocabulary: "makeup" = "mac app".
-- Never edit `node_modules` (global/Homebrew/npm/git installs too). Updates overwrite. Skill notes go in `tools.md` or `AGENTS.md`.
-- Signal: "update fly" => `fly ssh console -a flawd-bot -C "bash -lc 'cd /data/clawd/moltbot && git pull --rebase origin main'"` then `fly machines restart e825232f34d058 -a flawd-bot`.
-- When working on a GitHub Issue or PR, print the full URL at the end of the task.
-- When answering questions, respond with high-confidence answers only: verify in code; do not guess.
-- Never update the Carbon dependency.
-- Any dependency with `pnpm.patchedDependencies` must use an exact version (no `^`/`~`).
-- Patching dependencies (pnpm patches, overrides, or vendored changes) requires explicit approval; do not do this by default.
-- CLI progress: use `src/cli/progress.ts` (`osc-progress` + `@clack/prompts` spinner); don’t hand-roll spinners/bars.
-- Status output: keep tables + ANSI-safe wrapping (`src/terminal/table.ts`); `status --all` = read-only/pasteable, `status --deep` = probes.
-- Gateway currently runs only as the menubar app; there is no separate LaunchAgent/helper label installed. Restart via the Moltbot Mac app or `scripts/restart-mac.sh`; to verify/kill use `launchctl print gui/$UID | grep moltbot` rather than assuming a fixed label. **When debugging on macOS, start/stop the gateway via the app, not ad-hoc tmux sessions; kill any temporary tunnels before handoff.**
-- macOS logs: use `./scripts/clawlog.sh` to query unified logs for the Moltbot subsystem; it supports follow/tail/category filters and expects passwordless sudo for `/usr/bin/log`.
-- If shared guardrails are available locally, review them; otherwise follow this repo's guidance.
-- SwiftUI state management (iOS/macOS): prefer the `Observation` framework (`@Observable`, `@Bindable`) over `ObservableObject`/`@StateObject`; don’t introduce new `ObservableObject` unless required for compatibility, and migrate existing usages when touching related code.
-- Connection providers: when adding a new connection, update every UI surface and docs (macOS app, web UI, mobile if applicable, onboarding/overview docs) and add matching status + configuration forms so provider lists and settings stay in sync.
-- Version locations: `package.json` (CLI), `apps/android/app/build.gradle.kts` (versionName/versionCode), `apps/ios/Sources/Info.plist` + `apps/ios/Tests/Info.plist` (CFBundleShortVersionString/CFBundleVersion), `apps/macos/Sources/Moltbot/Resources/Info.plist` (CFBundleShortVersionString/CFBundleVersion), `docs/install/updating.md` (pinned npm version), `docs/platforms/mac/release.md` (APP_VERSION/APP_BUILD examples), Peekaboo Xcode projects/Info.plists (MARKETING_VERSION/CURRENT_PROJECT_VERSION).
-- **Restart apps:** “restart iOS/Android apps” means rebuild (recompile/install) and relaunch, not just kill/launch.
-- **Device checks:** before testing, verify connected real devices (iOS/Android) before reaching for simulators/emulators.
-- iOS Team ID lookup: `security find-identity -p codesigning -v` → use Apple Development (…) TEAMID. Fallback: `defaults read com.apple.dt.Xcode IDEProvisioningTeamIdentifiers`.
-- A2UI bundle hash: `src/canvas-host/a2ui/.bundle.hash` is auto-generated; ignore unexpected changes, and only regenerate via `pnpm canvas:a2ui:bundle` (or `scripts/bundle-a2ui.sh`) when needed. Commit the hash as a separate commit.
-- Release signing/notary keys are managed outside the repo; follow internal release docs.
-- Notary auth env vars (`APP_STORE_CONNECT_ISSUER_ID`, `APP_STORE_CONNECT_KEY_ID`, `APP_STORE_CONNECT_API_KEY_P8`) are expected in your environment (per internal release docs).
-- **Multi-agent safety:** do **not** create/apply/drop `git stash` entries unless explicitly requested (this includes `git pull --rebase --autostash`). Assume other agents may be working; keep unrelated WIP untouched and avoid cross-cutting state changes.
-- **Multi-agent safety:** when the user says "push", you may `git pull --rebase` to integrate latest changes (never discard other agents' work). When the user says "commit", scope to your changes only. When the user says "commit all", commit everything in grouped chunks.
-- **Multi-agent safety:** do **not** create/remove/modify `git worktree` checkouts (or edit `.worktrees/*`) unless explicitly requested.
-- **Multi-agent safety:** do **not** switch branches / check out a different branch unless explicitly requested.
-- **Multi-agent safety:** running multiple agents is OK as long as each agent has its own session.
-- **Multi-agent safety:** when you see unrecognized files, keep going; focus on your changes and commit only those.
-- Lint/format churn:
-  - If staged+unstaged diffs are formatting-only, auto-resolve without asking.
-  - If commit/push already requested, auto-stage and include formatting-only follow-ups in the same commit (or a tiny follow-up commit if needed), no extra confirmation.
-  - Only ask when changes are semantic (logic/data/behavior).
-- Lobster seam: use the shared CLI palette in `src/terminal/palette.ts` (no hardcoded colors); apply palette to onboarding/config prompts and other TTY UI output as needed.
-- **Multi-agent safety:** focus reports on your edits; avoid guard-rail disclaimers unless truly blocked; when multiple agents touch the same file, continue if safe; end with a brief “other files present” note only if relevant.
-- Bug investigations: read source code of relevant npm dependencies and all related local code before concluding; aim for high-confidence root cause.
-- Code style: add brief comments for tricky logic; keep files under ~500 LOC when feasible (split/refactor as needed).
-- Tool schema guardrails (google-antigravity): avoid `Type.Union` in tool input schemas; no `anyOf`/`oneOf`/`allOf`. Use `stringEnum`/`optionalStringEnum` (Type.Unsafe enum) for string lists, and `Type.Optional(...)` instead of `... | null`. Keep top-level tool schema as `type: "object"` with `properties`.
-- Tool schema guardrails: avoid raw `format` property names in tool schemas; some validators treat `format` as a reserved keyword and reject the schema.
-- When asked to open a “session” file, open the Pi session logs under `~/.clawdbot/agents/<agentId>/sessions/*.jsonl` (use the `agent=<id>` value in the Runtime line of the system prompt; newest unless a specific ID is given), not the default `sessions.json`. If logs are needed from another machine, SSH via Tailscale and read the same path there.
-- Do not rebuild the macOS app over SSH; rebuilds must be run directly on the Mac.
-- Never send streaming/partial replies to external messaging surfaces (WhatsApp, Telegram); only final replies should be delivered there. Streaming/tool events may still go to internal UIs/control channel.
-- Voice wake forwarding tips:
-  - Command template should stay `moltbot-mac agent --message "${text}" --thinking low`; `VoiceWakeForwarder` already shell-escapes `${text}`. Don’t add extra quotes.
-  - launchd PATH is minimal; ensure the app’s launch agent PATH includes standard system paths plus your pnpm bin (typically `$HOME/Library/pnpm`) so `pnpm`/`moltbot` binaries resolve when invoked via `moltbot-mac`.
-- For manual `moltbot message send` messages that include `!`, use the heredoc pattern noted below to avoid the Bash tool’s escaping.
-- Release guardrails: do not change version numbers without operator’s explicit consent; always ask permission before running any npm publish/release step.
-
-## NPM + 1Password (publish/verify)
-- Use the 1password skill; all `op` commands must run inside a fresh tmux session.
-- Sign in: `eval "$(op signin --account my.1password.com)"` (app unlocked + integration on).
-- OTP: `op read 'op://Private/Npmjs/one-time password?attribute=otp'`.
-- Publish: `npm publish --access public --otp="<otp>"` (run from the package dir).
-- Verify without local npmrc side effects: `npm view <pkg> version --userconfig "$(mktemp)"`.
-- Kill the tmux session after publish.

CONTRIBUTING.md

@@ -1,52 +0,0 @@
-# Contributing to Moltbot
-
-Welcome to the lobster tank! 🦞
-
-## Quick Links
-- **GitHub:** https://github.com/moltbot/moltbot
-- **Discord:** https://discord.gg/qkhbAGHRBT
-- **X/Twitter:** [@steipete](https://x.com/steipete) / [@moltbot](https://x.com/moltbot)
-
-## Maintainers
-
-- **Peter Steinberger** - Benevolent Dictator
-  - GitHub: [@steipete](https://github.com/steipete) · X: [@steipete](https://x.com/steipete)
-
-- **Shadow** - Discord + Slack subsystem
-  - GitHub: [@thewilloftheshadow](https://github.com/thewilloftheshadow) · X: [@4shad0wed](https://x.com/4shad0wed)
-
-- **Jos** - Telegram, API, Nix mode
-  - GitHub: [@joshp123](https://github.com/joshp123) · X: [@jjpcodes](https://x.com/jjpcodes)
-
-## How to Contribute
-1. **Bugs & small fixes** → Open a PR!
-2. **New features / architecture** → Start a [GitHub Discussion](https://github.com/moltbot/moltbot/discussions) or ask in Discord first
-3. **Questions** → Discord #setup-help
-
-## Before You PR
-- Test locally with your Moltbot instance
-- Run linter: `npm run lint`
-- Keep PRs focused (one thing per PR)
-- Describe what & why
-
-## AI/Vibe-Coded PRs Welcome! 🤖
-
-Built with Codex, Claude, or other AI tools? **Awesome - just mark it!**
-
-Please include in your PR:
-- [ ] Mark as AI-assisted in the PR title or description
-- [ ] Note the degree of testing (untested / lightly tested / fully tested)
-- [ ] Include prompts or session logs if possible (super helpful!)
-- [ ] Confirm you understand what the code does
-
-AI PRs are first-class citizens here. We just want transparency so reviewers know what to look for.
-
-## Current Focus & Roadmap 🗺
-
-We are currently prioritizing:
-- **Stability**: Fixing edge cases in channel connections (WhatsApp/Telegram).
-- **UX**: Improving the onboarding wizard and error messages.
-- **Skills**: Expanding the library of bundled skills and improving the Skill Creation developer experience.
-- **Performance**: Optimizing token usage and compaction logic.
-
-Check the [GitHub Issues](https://github.com/moltbot/moltbot/issues) for "good first issue" labels!

Dockerfile.sandbox

@@ -1,16 +0,0 @@
-FROM debian:bookworm-slim
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    curl \
-    git \
-    jq \
-    python3 \
-    ripgrep \
-  && rm -rf /var/lib/apt/lists/*
-
-CMD ["sleep", "infinity"]

Dockerfile.sandbox-browser

@@ -1,28 +0,0 @@
-FROM debian:bookworm-slim
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    chromium \
-    curl \
-    fonts-liberation \
-    fonts-noto-color-emoji \
-    git \
-    jq \
-    novnc \
-    python3 \
-    socat \
-    websockify \
-    x11vnc \
-    xvfb \
-  && rm -rf /var/lib/apt/lists/*
-
-COPY scripts/sandbox-browser-entrypoint.sh /usr/local/bin/moltbot-sandbox-browser
-RUN chmod +x /usr/local/bin/moltbot-sandbox-browser
-
-EXPOSE 9222 5900 6080
-
-CMD ["moltbot-sandbox-browser"]

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Peter Steinberger
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

PROJECT_README.md

@@ -1,67 +0,0 @@
-# Open Lovable
-
-Chat with AI to build React apps instantly. An example app made by the [Firecrawl](https://firecrawl.dev/?ref=open-lovable-github) team. For a complete cloud solution, check out [Lovable.dev](https://lovable.dev/) ❤️.
-
-<img src="https://media1.giphy.com/media/v1.Y2lkPTc5MGI3NjExbmZtaHFleGRsMTNlaWNydGdianI4NGQ4dHhyZjB0d2VkcjRyeXBucCZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/ZFVLWMa6dVskQX0qu1/giphy.gif" alt="Open Lovable Demo" width="100%"/>
-
-## Setup
-
-1. **Clone & Install**
-```bash
-git clone https://github.com/firecrawl/open-lovable.git
-cd open-lovable
-pnpm install  # or npm install / yarn install
-```
-
-2. **Add `.env.local`**
-
-```env
-# =================================================================
-# REQUIRED
-# =================================================================
-FIRECRAWL_API_KEY=your_firecrawl_api_key    # https://firecrawl.dev
-
-# =================================================================
-# AI PROVIDER - Choose your LLM
-# =================================================================
-GEMINI_API_KEY=your_gemini_api_key        # https://aistudio.google.com/app/apikey
-ANTHROPIC_API_KEY=your_anthropic_api_key  # https://console.anthropic.com
-OPENAI_API_KEY=your_openai_api_key        # https://platform.openai.com
-GROQ_API_KEY=your_groq_api_key            # https://console.groq.com
-
-# =================================================================
-# FAST APPLY (Optional - for faster edits)
-# =================================================================
-MORPH_API_KEY=your_morphllm_api_key    # https://morphllm.com/dashboard
-
-# =================================================================
-# SANDBOX PROVIDER - Choose ONE: Vercel (default) or E2B
-# =================================================================
-SANDBOX_PROVIDER=vercel  # or 'e2b'
-
-# Option 1: Vercel Sandbox (default)
-# Choose one authentication method:
-
-# Method A: OIDC Token (recommended for development)
-# Run `vercel link` then `vercel env pull` to get VERCEL_OIDC_TOKEN automatically
-VERCEL_OIDC_TOKEN=auto_generated_by_vercel_env_pull
-
-# Method B: Personal Access Token (for production or when OIDC unavailable)
-# VERCEL_TEAM_ID=team_xxxxxxxxx      # Your Vercel team ID 
-# VERCEL_PROJECT_ID=prj_xxxxxxxxx    # Your Vercel project ID
-# VERCEL_TOKEN=vercel_xxxxxxxxxxxx   # Personal access token from Vercel dashboard
-
-# Option 2: E2B Sandbox
-# E2B_API_KEY=your_e2b_api_key      # https://e2b.dev
-```
-
-3. **Run**
-```bash
-pnpm dev  # or npm run dev / yarn dev
-```
-
-Open [http://localhost:3000](http://localhost:3000)
-
-## License
-
-MIT

SECURITY.md

@@ -1,61 +0,0 @@
-# Security Policy
-
-If you believe you've found a security issue in Moltbot, please report it privately.
-
-## Reporting
-
-- Email: `steipete@gmail.com`
-- What to include: reproduction steps, impact assessment, and (if possible) a minimal PoC.
-
-## Operational Guidance
-
-For threat model + hardening guidance (including `moltbot security audit --deep` and `--fix`), see:
-
-- `https://docs.molt.bot/gateway/security`
-
-### Web Interface Safety
-
-Moltbot's web interface is intended for local use only. Do **not** bind it to the public internet; it is not hardened for public exposure.
-
-## Runtime Requirements
-
-### Node.js Version
-
-Moltbot requires **Node.js 22.12.0 or later** (LTS). This version includes important security patches:
-
-- CVE-2025-59466: async_hooks DoS vulnerability
-- CVE-2026-21636: Permission model bypass vulnerability
-
-Verify your Node.js version:
-
-```bash
-node --version  # Should be v22.12.0 or later
-```
-
-### Docker Security
-
-When running Moltbot in Docker:
-
-1. The official image runs as a non-root user (`node`) for reduced attack surface
-2. Use `--read-only` flag when possible for additional filesystem protection
-3. Limit container capabilities with `--cap-drop=ALL`
-
-Example secure Docker run:
-
-```bash
-docker run --read-only --cap-drop=ALL \
-  -v moltbot-data:/app/data \
-  moltbot/moltbot:latest
-```
-
-## Security Scanning
-
-This project uses `detect-secrets` for automated secret detection in CI/CD.
-See `.detect-secrets.cfg` for configuration and `.secrets.baseline` for the baseline.
-
-Run locally:
-
-```bash
-pip install detect-secrets==1.5.0
-detect-secrets scan --baseline .secrets.baseline
-```

Swabble/.github/workflows/ci.yml

@@ -1,54 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  build-and-test:
-    runs-on: macos-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: swabble
-    steps:
-      - name: Checkout swabble
-        uses: actions/checkout@v4
-        with:
-          path: swabble
-
-      - name: Select Xcode 26.1 (prefer 26.1.1)
-        run: |
-          set -euo pipefail
-          # pick the newest installed 26.1.x, fallback to newest 26.x
-          CANDIDATE="$(ls -d /Applications/Xcode_26.1*.app 2>/dev/null | sort -V | tail -1 || true)"
-          if [[ -z "$CANDIDATE" ]]; then
-            CANDIDATE="$(ls -d /Applications/Xcode_26*.app 2>/dev/null | sort -V | tail -1 || true)"
-          fi
-          if [[ -z "$CANDIDATE" ]]; then
-            echo "No Xcode 26.x found on runner" >&2
-            exit 1
-          fi
-          echo "Selecting $CANDIDATE"
-          sudo xcode-select -s "$CANDIDATE"
-          xcodebuild -version
-
-      - name: Show Swift version
-        run: swift --version
-
-      - name: Install tooling
-        run: |
-          brew update
-          brew install swiftlint swiftformat
-
-      - name: Format check
-        run: |
-          ./scripts/format.sh
-          git diff --exit-code
-
-      - name: Lint
-        run: ./scripts/lint.sh
-
-      - name: Test
-        run: swift test --parallel

Swabble/.gitignore

@@ -1,33 +0,0 @@
-# macOS
-.DS_Store
-
-# SwiftPM / Build
-/.build
-/.swiftpm
-/DerivedData
-xcuserdata/
-*.xcuserstate
-
-# Editors
-/.vscode
-.idea/
-
-# Xcode artifacts
-*.hmap
-*.ipa
-*.dSYM.zip
-*.dSYM
-
-# Playgrounds
-*.xcplayground
-playground.xcworkspace
-timeline.xctimeline
-
-# Carthage
-Carthage/Build/
-
-# fastlane
-fastlane/report.xml
-fastlane/Preview.html
-fastlane/screenshots/**/*.png
-fastlane/test_output

Swabble/.swiftformat

@@ -1,8 +0,0 @@
---swiftversion 6.2
---indent 4
---maxwidth 120
---wraparguments before-first
---wrapcollections before-first
---stripunusedargs closure-only
---self remove
---header ""

Swabble/.swiftlint.yml

@@ -1,43 +0,0 @@
-# SwiftLint for swabble
-included:
-  - Sources
-excluded:
-  - .build
-  - DerivedData
-  - "**/.swiftpm"
-  - "**/.build"
-  - "**/DerivedData"
-  - "**/.DS_Store"
-opt_in_rules:
-  - array_init
-  - closure_spacing
-  - explicit_init
-  - fatal_error_message
-  - first_where
-  - joined_default_parameter
-  - last_where
-  - literal_expression_end_indentation
-  - multiline_arguments
-  - multiline_parameters
-  - operator_usage_whitespace
-  - redundant_nil_coalescing
-  - sorted_first_last
-  - switch_case_alignment
-  - vertical_parameter_alignment_on_call
-  - vertical_whitespace_opening_braces
-  - vertical_whitespace_closing_braces
-
-disabled_rules:
-  - trailing_whitespace
-  - trailing_newline
-  - indentation_width
-  - identifier_name
-  - explicit_self
-  - file_header
-  - todo
-
-line_length:
-  warning: 140
-  error: 180
-
-reporter: "xcode"

Swabble/CHANGELOG.md

@@ -1,11 +0,0 @@
-# Changelog
-
-## 0.2.0 — 2025-12-23
-
-### Highlights
-- Added `SwabbleKit` (multi-platform wake-word gate utilities with segment-aware gap detection).
-- Swabble package now supports iOS + macOS consumers; CLI remains macOS 26-only.
-
-### Changes
-- CLI wake-word matching/stripping routed through `SwabbleKit` helpers.
-- Speech pipeline types now explicitly gated to macOS 26 / iOS 26 availability.

Swabble/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Peter Steinberger
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

Swabble/Package.resolved

@@ -1,33 +0,0 @@
-{
-  "originHash" : "c0677e232394b5f6b0191b6dbb5bae553d55264f65ae725cd03a8ffdfda9cdd3",
-  "pins" : [
-    {
-      "identity" : "commander",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/steipete/Commander.git",
-      "state" : {
-        "revision" : "9e349575c8e3c6745e81fe19e5bb5efa01b078ce",
-        "version" : "0.2.1"
-      }
-    },
-    {
-      "identity" : "swift-syntax",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/swiftlang/swift-syntax.git",
-      "state" : {
-        "revision" : "0687f71944021d616d34d922343dcef086855920",
-        "version" : "600.0.1"
-      }
-    },
-    {
-      "identity" : "swift-testing",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-testing",
-      "state" : {
-        "revision" : "399f76dcd91e4c688ca2301fa24a8cc6d9927211",
-        "version" : "0.99.0"
-      }
-    }
-  ],
-  "version" : 3
-}

Swabble/Package.swift

@@ -1,55 +0,0 @@
-// swift-tools-version: 6.2
-import PackageDescription
-
-let package = Package(
-    name: "swabble",
-    platforms: [
-        .macOS(.v15),
-        .iOS(.v17),
-    ],
-    products: [
-        .library(name: "Swabble", targets: ["Swabble"]),
-        .library(name: "SwabbleKit", targets: ["SwabbleKit"]),
-        .executable(name: "swabble", targets: ["SwabbleCLI"]),
-    ],
-    dependencies: [
-        .package(url: "https://github.com/steipete/Commander.git", exact: "0.2.1"),
-        .package(url: "https://github.com/apple/swift-testing", from: "0.99.0"),
-    ],
-    targets: [
-        .target(
-            name: "Swabble",
-            path: "Sources/SwabbleCore",
-            swiftSettings: []),
-        .target(
-            name: "SwabbleKit",
-            path: "Sources/SwabbleKit",
-            swiftSettings: [
-                .enableUpcomingFeature("StrictConcurrency"),
-            ]),
-        .executableTarget(
-            name: "SwabbleCLI",
-            dependencies: [
-                "Swabble",
-                "SwabbleKit",
-                .product(name: "Commander", package: "Commander"),
-            ],
-            path: "Sources/swabble"),
-        .testTarget(
-            name: "SwabbleKitTests",
-            dependencies: [
-                "SwabbleKit",
-                .product(name: "Testing", package: "swift-testing"),
-            ],
-            swiftSettings: [
-                .enableUpcomingFeature("StrictConcurrency"),
-                .enableExperimentalFeature("SwiftTesting"),
-            ]),
-        .testTarget(
-            name: "swabbleTests",
-            dependencies: [
-                "Swabble",
-                .product(name: "Testing", package: "swift-testing"),
-            ]),
-    ],
-    swiftLanguageModes: [.v6])

Swabble/README.md

@@ -1,111 +0,0 @@
-# 🎙️ swabble — Speech.framework wake-word hook daemon (macOS 26)
-
-swabble is a Swift 6.2 wake-word hook daemon. The CLI targets macOS 26 (SpeechAnalyzer + SpeechTranscriber). The shared `SwabbleKit` target is multi-platform and exposes wake-word gating utilities for iOS/macOS apps.
-
-- **Local-only**: Speech.framework on-device models; zero network usage.
-- **Wake word**: Default `clawd` (aliases `claude`), optional `--no-wake` bypass.
-- **SwabbleKit**: Shared wake gate utilities (gap-based gating when you provide speech segments).
-- **Hooks**: Run any command with prefix/env, cooldown, min_chars, timeout.
-- **Services**: launchd helper stubs for start/stop/install.
-- **File transcribe**: TXT or SRT with time ranges (using AttributedString splits).
-
-## Quick start
-```bash
-# Install deps
-brew install swiftformat swiftlint
-
-# Build
-swift build
-
-# Write default config (~/.config/swabble/config.json)
-swift run swabble setup
-
-# Run foreground daemon
-swift run swabble serve
-
-# Test your hook
-swift run swabble test-hook "hello world"
-
-# Transcribe a file to SRT
-swift run swabble transcribe /path/to/audio.m4a --format srt --output out.srt
-```
-
-## Use as a library
-Add swabble as a SwiftPM dependency and import the `Swabble` or `SwabbleKit` product:
-
-```swift
-// Package.swift
-dependencies: [
-    .package(url: "https://github.com/steipete/swabble.git", branch: "main"),
-],
-targets: [
-    .target(name: "MyApp", dependencies: [
-        .product(name: "Swabble", package: "swabble"),     // Speech pipeline (macOS 26+ / iOS 26+)
-        .product(name: "SwabbleKit", package: "swabble"),  // Wake-word gate utilities (iOS 17+ / macOS 15+)
-    ]),
-]
-```
-
-## CLI
-- `serve` — foreground loop (mic → wake → hook)
-- `transcribe <file>` — offline transcription (txt|srt)
-- `test-hook "text"` — invoke configured hook
-- `mic list|set <index>` — enumerate/select input device
-- `setup` — write default config JSON
-- `doctor` — check Speech auth & device availability
-- `health` — prints `ok`
-- `tail-log` — last 10 transcripts
-- `status` — show wake state + recent transcripts
-- `service install|uninstall|status` — user launchd plist (stub: prints launchctl commands)
-- `start|stop|restart` — placeholders until full launchd wiring
-
-All commands accept Commander runtime flags (`-v/--verbose`, `--json-output`, `--log-level`), plus `--config` where applicable.
-
-## Config
-`~/.config/swabble/config.json` (auto-created by `setup`):
-```json
-{
-  "audio": {"deviceName": "", "deviceIndex": -1, "sampleRate": 16000, "channels": 1},
-  "wake": {"enabled": true, "word": "clawd", "aliases": ["claude"]},
-  "hook": {
-    "command": "",
-    "args": [],
-    "prefix": "Voice swabble from ${hostname}: ",
-    "cooldownSeconds": 1,
-    "minCharacters": 24,
-    "timeoutSeconds": 5,
-    "env": {}
-  },
-  "logging": {"level": "info", "format": "text"},
-  "transcripts": {"enabled": true, "maxEntries": 50},
-  "speech": {"localeIdentifier": "en_US", "etiquetteReplacements": false}
-}
-```
-
-- Config path override: `--config /path/to/config.json` on relevant commands.
-- Transcripts persist to `~/Library/Application Support/swabble/transcripts.log`.
-
-## Hook protocol
-When a wake-gated transcript passes min_chars & cooldown, swabble runs:
-```
-<command> <args...> "<prefix><text>"
-```
-Environment variables:
-- `SWABBLE_TEXT` — stripped transcript (wake word removed)
-- `SWABBLE_PREFIX` — rendered prefix (hostname substituted)
-- plus any `hook.env` key/values
-
-## Speech pipeline
-- `AVAudioEngine` tap → `BufferConverter` → `AnalyzerInput` → `SpeechAnalyzer` with a `SpeechTranscriber` module.
-- Requests volatile + final results; the CLI uses text-only wake gating today.
-- Authorization requested at first start; requires macOS 26 + new Speech.framework APIs.
-
-## Development
-- Format: `./scripts/format.sh` (uses local `.swiftformat`)
-- Lint: `./scripts/lint.sh` (uses local `.swiftlint.yml`)
-- Tests: `swift test` (uses swift-testing package)
-
-## Roadmap
-- launchd control (load/bootout, PID + status socket)
-- JSON logging + PII redaction toggle
-- Stronger wake-word detection and control socket status/health

Swabble/Sources/SwabbleCore/Config/Config.swift

@@ -1,77 +0,0 @@
-import Foundation
-
-public struct SwabbleConfig: Codable, Sendable {
-    public struct Audio: Codable, Sendable {
-        public var deviceName: String = ""
-        public var deviceIndex: Int = -1
-        public var sampleRate: Double = 16000
-        public var channels: Int = 1
-    }
-
-    public struct Wake: Codable, Sendable {
-        public var enabled: Bool = true
-        public var word: String = "clawd"
-        public var aliases: [String] = ["claude"]
-    }
-
-    public struct Hook: Codable, Sendable {
-        public var command: String = ""
-        public var args: [String] = []
-        public var prefix: String = "Voice swabble from ${hostname}: "
-        public var cooldownSeconds: Double = 1
-        public var minCharacters: Int = 24
-        public var timeoutSeconds: Double = 5
-        public var env: [String: String] = [:]
-    }
-
-    public struct Logging: Codable, Sendable {
-        public var level: String = "info"
-        public var format: String = "text" // text|json placeholder
-    }
-
-    public struct Transcripts: Codable, Sendable {
-        public var enabled: Bool = true
-        public var maxEntries: Int = 50
-    }
-
-    public struct Speech: Codable, Sendable {
-        public var localeIdentifier: String = Locale.current.identifier
-        public var etiquetteReplacements: Bool = false
-    }
-
-    public var audio = Audio()
-    public var wake = Wake()
-    public var hook = Hook()
-    public var logging = Logging()
-    public var transcripts = Transcripts()
-    public var speech = Speech()
-
-    public static let defaultPath = FileManager.default
-        .homeDirectoryForCurrentUser
-        .appendingPathComponent(".config/swabble/config.json")
-
-    public init() {}
-}
-
-public enum ConfigError: Error {
-    case missingConfig
-}
-
-public enum ConfigLoader {
-    public static func load(at path: URL?) throws -> SwabbleConfig {
-        let url = path ?? SwabbleConfig.defaultPath
-        if !FileManager.default.fileExists(atPath: url.path) {
-            throw ConfigError.missingConfig
-        }
-        let data = try Data(contentsOf: url)
-        return try JSONDecoder().decode(SwabbleConfig.self, from: data)
-    }
-
-    public static func save(_ config: SwabbleConfig, at path: URL?) throws {
-        let url = path ?? SwabbleConfig.defaultPath
-        let dir = url.deletingLastPathComponent()
-        try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
-        let data = try JSONEncoder().encode(config)
-        try data.write(to: url)
-    }
-}