Merge branch 'main' into nanogpt

src/agents/bash-tools.test.ts

@@ -1,3 +1,4 @@
+import fs from "node:fs";
 import path from "node:path";
 
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
@@ -8,6 +9,24 @@ import { buildDockerExecArgs } from "./bash-tools.shared.js";
 import { sanitizeBinaryOutput } from "./shell-utils.js";
 
 const isWin = process.platform === "win32";
+const resolveShellFromPath = (name: string) => {
+  const envPath = process.env.PATH ?? "";
+  if (!envPath) return undefined;
+  const entries = envPath.split(path.delimiter).filter(Boolean);
+  for (const entry of entries) {
+    const candidate = path.join(entry, name);
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      return candidate;
+    } catch {
+      // ignore missing or non-executable entries
+    }
+  }
+  return undefined;
+};
+const defaultShell = isWin
+  ? undefined
+  : process.env.CLAWDBOT_TEST_SHELL || resolveShellFromPath("bash") || process.env.SHELL || "sh";
 // PowerShell: Start-Sleep for delays, ; for command separation, $null for null device
 const shortDelayCmd = isWin ? "Start-Sleep -Milliseconds 50" : "sleep 0.05";
 const yieldDelayCmd = isWin ? "Start-Sleep -Milliseconds 200" : "sleep 0.2";
@@ -52,7 +71,7 @@ describe("exec tool backgrounding", () => {
   const originalShell = process.env.SHELL;
 
   beforeEach(() => {
-    if (!isWin) process.env.SHELL = "/bin/bash";
+    if (!isWin && defaultShell) process.env.SHELL = defaultShell;
   });
 
   afterEach(() => {
@@ -282,7 +301,7 @@ describe("exec PATH handling", () => {
   const originalShell = process.env.SHELL;
 
   beforeEach(() => {
-    if (!isWin) process.env.SHELL = "/bin/bash";
+    if (!isWin && defaultShell) process.env.SHELL = defaultShell;
   });
 
   afterEach(() => {

src/agents/model-auth.ts

@@ -281,6 +281,7 @@ export function resolveEnvApiKey(provider: string): EnvApiKeyResult | null {
     moonshot: "MOONSHOT_API_KEY",
     "kimi-code": "KIMICODE_API_KEY",
     minimax: "MINIMAX_API_KEY",
+    xiaomi: "XIAOMI_API_KEY",
     synthetic: "SYNTHETIC_API_KEY",
     venice: "VENICE_API_KEY",
     mistral: "MISTRAL_API_KEY",

src/agents/models-config.providers.ts

@@ -35,6 +35,17 @@ const MINIMAX_API_COST = {
   cacheWrite: 10,
 };
 
+const XIAOMI_BASE_URL = "https://api.xiaomimimo.com/anthropic";
+export const XIAOMI_DEFAULT_MODEL_ID = "mimo-v2-flash";
+const XIAOMI_DEFAULT_CONTEXT_WINDOW = 262144;
+const XIAOMI_DEFAULT_MAX_TOKENS = 8192;
+const XIAOMI_DEFAULT_COST = {
+  input: 0,
+  output: 0,
+  cacheRead: 0,
+  cacheWrite: 0,
+};
+
 const MOONSHOT_BASE_URL = "https://api.moonshot.ai/v1";
 const MOONSHOT_DEFAULT_MODEL_ID = "kimi-k2.5";
 const MOONSHOT_DEFAULT_CONTEXT_WINDOW = 256000;
@@ -346,6 +357,24 @@ function buildSyntheticProvider(): ProviderConfig {
   };
 }
 
+export function buildXiaomiProvider(): ProviderConfig {
+  return {
+    baseUrl: XIAOMI_BASE_URL,
+    api: "anthropic-messages",
+    models: [
+      {
+        id: XIAOMI_DEFAULT_MODEL_ID,
+        name: "Xiaomi MiMo V2 Flash",
+        reasoning: false,
+        input: ["text"],
+        cost: XIAOMI_DEFAULT_COST,
+        contextWindow: XIAOMI_DEFAULT_CONTEXT_WINDOW,
+        maxTokens: XIAOMI_DEFAULT_MAX_TOKENS,
+      },
+    ],
+  };
+}
+
 async function buildVeniceProvider(): Promise<ProviderConfig> {
   const models = await discoverVeniceModels();
   return {
@@ -429,6 +458,13 @@ export async function resolveImplicitProviders(params: {
   if (nanogptKey) {
     providers.nanogpt = { ...buildNanoGptProvider(), apiKey: nanogptKey };
   }
+  
+  const xiaomiKey =
+    resolveEnvApiKeyVarName("xiaomi") ??
+    resolveApiKeyFromProfiles({ provider: "xiaomi", store: authStore });
+  if (xiaomiKey) {
+    providers.xiaomi = { ...buildXiaomiProvider(), apiKey: xiaomiKey };
+  }
 
   // Ollama provider - only add if explicitly configured
   const ollamaKey =

src/agents/models-config.skips-writing-models-json-no-env-token.test.ts

@@ -53,6 +53,7 @@ describe("models-config", () => {
       const previousMoonshot = process.env.MOONSHOT_API_KEY;
       const previousSynthetic = process.env.SYNTHETIC_API_KEY;
       const previousVenice = process.env.VENICE_API_KEY;
+      const previousXiaomi = process.env.XIAOMI_API_KEY;
       delete process.env.COPILOT_GITHUB_TOKEN;
       delete process.env.GH_TOKEN;
       delete process.env.GITHUB_TOKEN;
@@ -61,6 +62,7 @@ describe("models-config", () => {
       delete process.env.MOONSHOT_API_KEY;
       delete process.env.SYNTHETIC_API_KEY;
       delete process.env.VENICE_API_KEY;
+      delete process.env.XIAOMI_API_KEY;
 
       try {
         vi.resetModules();
@@ -93,6 +95,8 @@ describe("models-config", () => {
         else process.env.SYNTHETIC_API_KEY = previousSynthetic;
         if (previousVenice === undefined) delete process.env.VENICE_API_KEY;
         else process.env.VENICE_API_KEY = previousVenice;
+        if (previousXiaomi === undefined) delete process.env.XIAOMI_API_KEY;
+        else process.env.XIAOMI_API_KEY = previousXiaomi;
       }
     });
   });

src/agents/session-write-lock.ts

@@ -35,8 +35,8 @@ function isAlive(pid: number): boolean {
 function releaseAllLocksSync(): void {
   for (const [sessionFile, held] of HELD_LOCKS) {
     try {
-      if (typeof held.handle.fd === "number") {
-        fsSync.closeSync(held.handle.fd);
+      if (typeof held.handle.close === "function") {
+        void held.handle.close().catch(() => {});
       }
     } catch {
       // Ignore errors during cleanup - best effort

src/agents/tools/web-fetch.ssrf.test.ts

@@ -1,10 +1,9 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import * as ssrf from "../../infra/net/ssrf.js";
 
 const lookupMock = vi.fn();
-
-vi.mock("node:dns/promises", () => ({
-  lookup: lookupMock,
-}));
+const resolvePinnedHostname = ssrf.resolvePinnedHostname;
 
 function makeHeaders(map: Record<string, string>): { get: (key: string) => string | null } {
   return {
@@ -33,6 +32,12 @@ function textResponse(body: string): Response {
 describe("web_fetch SSRF protection", () => {
   const priorFetch = global.fetch;
 
+  beforeEach(() => {
+    vi.spyOn(ssrf, "resolvePinnedHostname").mockImplementation((hostname) =>
+      resolvePinnedHostname(hostname, lookupMock),
+    );
+  });
+
   afterEach(() => {
     // @ts-expect-error restore
     global.fetch = priorFetch;

src/agents/tools/web-tools.fetch.test.ts

@@ -1,5 +1,6 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import * as ssrf from "../../infra/net/ssrf.js";
 import { createWebFetchTool } from "./web-tools.js";
 
 type MockResponse = {
@@ -73,6 +74,18 @@ function requestUrl(input: RequestInfo): string {
 describe("web_fetch extraction fallbacks", () => {
   const priorFetch = global.fetch;
 
+  beforeEach(() => {
+    vi.spyOn(ssrf, "resolvePinnedHostname").mockImplementation(async (hostname) => {
+      const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+      const addresses = ["93.184.216.34", "93.184.216.35"];
+      return {
+        hostname: normalized,
+        addresses,
+        lookup: ssrf.createPinnedLookup({ hostname: normalized, addresses }),
+      };
+    });
+  });
+
   afterEach(() => {
     // @ts-expect-error restore
     global.fetch = priorFetch;

src/canvas-host/server.test.ts

@@ -202,6 +202,16 @@ describe("canvas host", () => {
 
   it("serves the gateway-hosted A2UI scaffold", async () => {
     const dir = await fs.mkdtemp(path.join(os.tmpdir(), "moltbot-canvas-"));
+    const a2uiRoot = path.resolve(process.cwd(), "src/canvas-host/a2ui");
+    const bundlePath = path.join(a2uiRoot, "a2ui.bundle.js");
+    let createdBundle = false;
+
+    try {
+      await fs.stat(bundlePath);
+    } catch {
+      await fs.writeFile(bundlePath, "window.moltbotA2UI = {};", "utf8");
+      createdBundle = true;
+    }
 
     const server = await startCanvasHost({
       runtime: defaultRuntime,
@@ -226,6 +236,9 @@ describe("canvas host", () => {
       expect(js).toContain("moltbotA2UI");
     } finally {
       await server.close();
+      if (createdBundle) {
+        await fs.rm(bundlePath, { force: true });
+      }
       await fs.rm(dir, { recursive: true, force: true });
     }
   });

src/cli/program/register.onboard.ts

@@ -52,7 +52,7 @@ export function registerOnboardCommand(program: Command) {
     .option("--mode <mode>", "Wizard mode: local|remote")
     .option(
       "--auth-choice <choice>",
-      "Auth: setup-token|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|synthetic-api-key|nanogpt-api-key|venice-api-key|gemini-api-key|zai-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip",
+      "Auth: setup-token|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|synthetic-api-key|nanogpt-api-key|venice-api-key|gemini-api-key|zai-api-key|xiaomi-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip",
     )
     .option(
       "--token-provider <id>",
@@ -72,6 +72,7 @@ export function registerOnboardCommand(program: Command) {
     .option("--kimi-code-api-key <key>", "Kimi Code API key")
     .option("--gemini-api-key <key>", "Gemini API key")
     .option("--zai-api-key <key>", "Z.AI API key")
+    .option("--xiaomi-api-key <key>", "Xiaomi API key")
     .option("--minimax-api-key <key>", "MiniMax API key")
     .option("--synthetic-api-key <key>", "Synthetic API key")
     .option("--nanogpt-api-key <key>", "NanoGPT API key")
@@ -123,6 +124,7 @@ export function registerOnboardCommand(program: Command) {
             kimiCodeApiKey: opts.kimiCodeApiKey as string | undefined,
             geminiApiKey: opts.geminiApiKey as string | undefined,
             zaiApiKey: opts.zaiApiKey as string | undefined,
+            xiaomiApiKey: opts.xiaomiApiKey as string | undefined,
             minimaxApiKey: opts.minimaxApiKey as string | undefined,
             syntheticApiKey: opts.syntheticApiKey as string | undefined,
             nanogptApiKey: opts.nanogptApiKey as string | undefined,

src/commands/auth-choice-options.test.ts

@@ -33,6 +33,16 @@ describe("buildAuthChoiceOptions", () => {
     expect(options.some((opt) => opt.value === "zai-api-key")).toBe(true);
   });
 
+  it("includes Xiaomi auth choice", () => {
+    const store: AuthProfileStore = { version: 1, profiles: {} };
+    const options = buildAuthChoiceOptions({
+      store,
+      includeSkip: false,
+    });
+
+    expect(options.some((opt) => opt.value === "xiaomi-api-key")).toBe(true);
+  });
+
   it("includes MiniMax auth choice", () => {
     const store: AuthProfileStore = { version: 1, profiles: {} };
     const options = buildAuthChoiceOptions({

src/commands/auth-choice-options.ts

@@ -16,6 +16,7 @@ export type AuthChoiceGroupId =
   | "ai-gateway"
   | "moonshot"
   | "zai"
+  | "xiaomi"
   | "opencode-zen"
   | "minimax"
   | "synthetic"
@@ -114,6 +115,12 @@ const AUTH_CHOICE_GROUP_DEFS: {
     hint: "API key",
     choices: ["zai-api-key"],
   },
+  {
+    value: "xiaomi",
+    label: "Xiaomi",
+    hint: "API key",
+    choices: ["xiaomi-api-key"],
+  },
   {
     value: "opencode-zen",
     label: "OpenCode Zen",
@@ -175,6 +182,10 @@ export function buildAuthChoiceOptions(params: {
     hint: "Uses the bundled Gemini CLI auth plugin",
   });
   options.push({ value: "zai-api-key", label: "Z.AI (GLM 4.7) API key" });
+  options.push({
+    value: "xiaomi-api-key",
+    label: "Xiaomi API key",
+  });
   options.push({ value: "qwen-portal", label: "Qwen OAuth" });
   options.push({
     value: "copilot-proxy",

src/commands/auth-choice.apply.api-providers.ts

@@ -29,6 +29,8 @@ import {
   applyVeniceProviderConfig,
   applyVercelAiGatewayConfig,
   applyVercelAiGatewayProviderConfig,
+  applyXiaomiConfig,
+  applyXiaomiProviderConfig,
   applyZaiConfig,
   KIMI_CODE_MODEL_REF,
   MOONSHOT_DEFAULT_MODEL_REF,
@@ -37,6 +39,7 @@ import {
   NANOGPT_DEFAULT_MODEL_REF,
   VENICE_DEFAULT_MODEL_REF,
   VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF,
+  XIAOMI_DEFAULT_MODEL_REF,
   setGeminiApiKey,
   setKimiCodeApiKey,
   setMoonshotApiKey,
@@ -46,6 +49,7 @@ import {
   setSyntheticApiKey,
   setVeniceApiKey,
   setVercelAiGatewayApiKey,
+  setXiaomiApiKey,
   setZaiApiKey,
   ZAI_DEFAULT_MODEL_REF,
 } from "./onboard-auth.js";
@@ -83,6 +87,8 @@ export async function applyAuthChoiceApiProviders(
       authChoice = "gemini-api-key";
     } else if (params.opts.tokenProvider === "zai") {
       authChoice = "zai-api-key";
+    } else if (params.opts.tokenProvider === "xiaomi") {
+      authChoice = "xiaomi-api-key";
     } else if (params.opts.tokenProvider === "synthetic") {
       authChoice = "synthetic-api-key";
     } else if (params.opts.tokenProvider === "venice") {
@@ -440,6 +446,54 @@ export async function applyAuthChoiceApiProviders(
     return { config: nextConfig, agentModelOverride };
   }
 
+  if (authChoice === "xiaomi-api-key") {
+    let hasCredential = false;
+
+    if (!hasCredential && params.opts?.token && params.opts?.tokenProvider === "xiaomi") {
+      await setXiaomiApiKey(normalizeApiKeyInput(params.opts.token), params.agentDir);
+      hasCredential = true;
+    }
+
+    const envKey = resolveEnvApiKey("xiaomi");
+    if (envKey) {
+      const useExisting = await params.prompter.confirm({
+        message: `Use existing XIAOMI_API_KEY (${envKey.source}, ${formatApiKeyPreview(envKey.apiKey)})?`,
+        initialValue: true,
+      });
+      if (useExisting) {
+        await setXiaomiApiKey(envKey.apiKey, params.agentDir);
+        hasCredential = true;
+      }
+    }
+    if (!hasCredential) {
+      const key = await params.prompter.text({
+        message: "Enter Xiaomi API key",
+        validate: validateApiKeyInput,
+      });
+      await setXiaomiApiKey(normalizeApiKeyInput(String(key)), params.agentDir);
+    }
+    nextConfig = applyAuthProfileConfig(nextConfig, {
+      profileId: "xiaomi:default",
+      provider: "xiaomi",
+      mode: "api_key",
+    });
+    {
+      const applied = await applyDefaultModelChoice({
+        config: nextConfig,
+        setDefaultModel: params.setDefaultModel,
+        defaultModel: XIAOMI_DEFAULT_MODEL_REF,
+        applyDefaultConfig: applyXiaomiConfig,
+        applyProviderConfig: applyXiaomiProviderConfig,
+        noteDefault: XIAOMI_DEFAULT_MODEL_REF,
+        noteAgentModel,
+        prompter: params.prompter,
+      });
+      nextConfig = applied.config;
+      agentModelOverride = applied.agentModelOverride ?? agentModelOverride;
+    }
+    return { config: nextConfig, agentModelOverride };
+  }
+
   if (authChoice === "synthetic-api-key") {
     if (params.opts?.token && params.opts?.tokenProvider === "synthetic") {
       await setSyntheticApiKey(String(params.opts.token).trim(), params.agentDir);

src/commands/auth-choice.preferred-provider.ts

@@ -18,6 +18,7 @@ const PREFERRED_PROVIDER_BY_AUTH_CHOICE: Partial<Record<AuthChoice, string>> = {
   "google-antigravity": "google-antigravity",
   "google-gemini-cli": "google-gemini-cli",
   "zai-api-key": "zai",
+  "xiaomi-api-key": "xiaomi",
   "synthetic-api-key": "synthetic",
   "venice-api-key": "venice",
   "nanogpt-api-key": "nanogpt",

src/commands/gateway-status.test.ts

@@ -192,6 +192,45 @@ describe("gateway-status command", () => {
     expect(targets.some((t) => t.kind === "sshTunnel")).toBe(true);
   });
 
+  it("skips invalid ssh-auto discovery targets", async () => {
+    const runtimeLogs: string[] = [];
+    const runtime = {
+      log: (msg: string) => runtimeLogs.push(msg),
+      error: (_msg: string) => {},
+      exit: (code: number) => {
+        throw new Error(`__exit__:${code}`);
+      },
+    };
+
+    const originalUser = process.env.USER;
+    try {
+      process.env.USER = "steipete";
+      loadConfig.mockReturnValueOnce({
+        gateway: {
+          mode: "remote",
+          remote: {},
+        },
+      });
+      discoverGatewayBeacons.mockResolvedValueOnce([
+        { tailnetDns: "-V" },
+        { tailnetDns: "goodhost" },
+      ]);
+
+      startSshPortForward.mockClear();
+      const { gatewayStatusCommand } = await import("./gateway-status.js");
+      await gatewayStatusCommand(
+        { timeout: "1000", json: true, sshAuto: true },
+        runtime as unknown as import("../runtime.js").RuntimeEnv,
+      );
+
+      expect(startSshPortForward).toHaveBeenCalledTimes(1);
+      const call = startSshPortForward.mock.calls[0]?.[0] as { target: string };
+      expect(call.target).toBe("steipete@goodhost");
+    } finally {
+      process.env.USER = originalUser;
+    }
+  });
+
   it("infers SSH target from gateway.remote.url and ssh config", async () => {
     const runtimeLogs: string[] = [];
     const runtime = {

src/commands/gateway-status.ts

@@ -107,7 +107,9 @@ export async function gatewayStatusCommand(
             const base = user ? `${user}@${host.trim()}` : host.trim();
             return sshPort !== 22 ? `${base}:${sshPort}` : base;
           })
-          .filter((x): x is string => Boolean(x));
+          .filter((candidate): candidate is string =>
+            Boolean(candidate && parseSshTarget(candidate)),
+          );
         if (candidates.length > 0) sshTarget = candidates[0] ?? null;
       }
 

src/commands/onboard-auth.config-core.ts

@@ -1,3 +1,4 @@
+import { buildXiaomiProvider, XIAOMI_DEFAULT_MODEL_ID } from "../agents/models-config.providers.js";
 import {
   buildSyntheticModelDefinition,
   SYNTHETIC_BASE_URL,
@@ -20,6 +21,7 @@ import type { MoltbotConfig } from "../config/config.js";
 import {
   OPENROUTER_DEFAULT_MODEL_REF,
   VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF,
+  XIAOMI_DEFAULT_MODEL_REF,
   ZAI_DEFAULT_MODEL_REF,
 } from "./onboard-auth.credentials.js";
 import {
@@ -342,6 +344,77 @@ export function applySyntheticConfig(cfg: MoltbotConfig): MoltbotConfig {
   };
 }
 
+export function applyXiaomiProviderConfig(cfg: MoltbotConfig): MoltbotConfig {
+  const models = { ...cfg.agents?.defaults?.models };
+  models[XIAOMI_DEFAULT_MODEL_REF] = {
+    ...models[XIAOMI_DEFAULT_MODEL_REF],
+    alias: models[XIAOMI_DEFAULT_MODEL_REF]?.alias ?? "Xiaomi",
+  };
+
+  const providers = { ...cfg.models?.providers };
+  const existingProvider = providers.xiaomi;
+  const defaultProvider = buildXiaomiProvider();
+  const existingModels = Array.isArray(existingProvider?.models) ? existingProvider.models : [];
+  const defaultModels = defaultProvider.models ?? [];
+  const hasDefaultModel = existingModels.some((model) => model.id === XIAOMI_DEFAULT_MODEL_ID);
+  const mergedModels =
+    existingModels.length > 0
+      ? hasDefaultModel
+        ? existingModels
+        : [...existingModels, ...defaultModels]
+      : defaultModels;
+  const { apiKey: existingApiKey, ...existingProviderRest } = (existingProvider ?? {}) as Record<
+    string,
+    unknown
+  > as { apiKey?: string };
+  const resolvedApiKey = typeof existingApiKey === "string" ? existingApiKey : undefined;
+  const normalizedApiKey = resolvedApiKey?.trim();
+  providers.xiaomi = {
+    ...existingProviderRest,
+    baseUrl: defaultProvider.baseUrl,
+    api: defaultProvider.api,
+    ...(normalizedApiKey ? { apiKey: normalizedApiKey } : {}),
+    models: mergedModels.length > 0 ? mergedModels : defaultProvider.models,
+  };
+
+  return {
+    ...cfg,
+    agents: {
+      ...cfg.agents,
+      defaults: {
+        ...cfg.agents?.defaults,
+        models,
+      },
+    },
+    models: {
+      mode: cfg.models?.mode ?? "merge",
+      providers,
+    },
+  };
+}
+
+export function applyXiaomiConfig(cfg: MoltbotConfig): MoltbotConfig {
+  const next = applyXiaomiProviderConfig(cfg);
+  const existingModel = next.agents?.defaults?.model;
+  return {
+    ...next,
+    agents: {
+      ...next.agents,
+      defaults: {
+        ...next.agents?.defaults,
+        model: {
+          ...(existingModel && "fallbacks" in (existingModel as Record<string, unknown>)
+            ? {
+                fallbacks: (existingModel as { fallbacks?: string[] }).fallbacks,
+              }
+            : undefined),
+          primary: XIAOMI_DEFAULT_MODEL_REF,
+        },
+      },
+    },
+  };
+}
+
 /**
  * Apply NanoGPT provider configuration without changing the default model.
  */

src/commands/onboard-auth.credentials.ts

@@ -126,6 +126,7 @@ export async function setVeniceApiKey(key: string, agentDir?: string) {
 }
 
 export const ZAI_DEFAULT_MODEL_REF = "zai/glm-4.7";
+export const XIAOMI_DEFAULT_MODEL_REF = "xiaomi/mimo-v2-flash";
 export const OPENROUTER_DEFAULT_MODEL_REF = "openrouter/auto";
 export const VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF = "vercel-ai-gateway/anthropic/claude-opus-4.5";
 
@@ -142,6 +143,18 @@ export async function setZaiApiKey(key: string, agentDir?: string) {
   });
 }
 
+export async function setXiaomiApiKey(key: string, agentDir?: string) {
+  upsertAuthProfile({
+    profileId: "xiaomi:default",
+    credential: {
+      type: "api_key",
+      provider: "xiaomi",
+      key,
+    },
+    agentDir: resolveAuthAgentDir(agentDir),
+  });
+}
+
 export async function setOpenrouterApiKey(key: string, agentDir?: string) {
   upsertAuthProfile({
     profileId: "openrouter:default",

src/commands/onboard-auth.test.ts

@@ -15,6 +15,8 @@ import {
   applyOpenrouterProviderConfig,
   applySyntheticConfig,
   applySyntheticProviderConfig,
+  applyXiaomiConfig,
+  applyXiaomiProviderConfig,
   OPENROUTER_DEFAULT_MODEL_REF,
   SYNTHETIC_DEFAULT_MODEL_ID,
   SYNTHETIC_DEFAULT_MODEL_REF,
@@ -343,6 +345,50 @@ describe("applySyntheticConfig", () => {
   });
 });
 
+describe("applyXiaomiConfig", () => {
+  it("adds Xiaomi provider with correct settings", () => {
+    const cfg = applyXiaomiConfig({});
+    expect(cfg.models?.providers?.xiaomi).toMatchObject({
+      baseUrl: "https://api.xiaomimimo.com/anthropic",
+      api: "anthropic-messages",
+    });
+    expect(cfg.agents?.defaults?.model?.primary).toBe("xiaomi/mimo-v2-flash");
+  });
+
+  it("merges Xiaomi models and keeps existing provider overrides", () => {
+    const cfg = applyXiaomiProviderConfig({
+      models: {
+        providers: {
+          xiaomi: {
+            baseUrl: "https://old.example.com",
+            apiKey: "old-key",
+            api: "openai-completions",
+            models: [
+              {
+                id: "custom-model",
+                name: "Custom",
+                reasoning: false,
+                input: ["text"],
+                cost: { input: 1, output: 2, cacheRead: 0, cacheWrite: 0 },
+                contextWindow: 1000,
+                maxTokens: 100,
+              },
+            ],
+          },
+        },
+      },
+    });
+
+    expect(cfg.models?.providers?.xiaomi?.baseUrl).toBe("https://api.xiaomimimo.com/anthropic");
+    expect(cfg.models?.providers?.xiaomi?.api).toBe("anthropic-messages");
+    expect(cfg.models?.providers?.xiaomi?.apiKey).toBe("old-key");
+    expect(cfg.models?.providers?.xiaomi?.models.map((m) => m.id)).toEqual([
+      "custom-model",
+      "mimo-v2-flash",
+    ]);
+  });
+});
+
 describe("applyOpencodeZenProviderConfig", () => {
   it("adds allowlist entry for the default model", () => {
     const cfg = applyOpencodeZenProviderConfig({});

src/commands/onboard-auth.ts

@@ -20,6 +20,8 @@ export {
   applyVeniceProviderConfig,
   applyVercelAiGatewayConfig,
   applyVercelAiGatewayProviderConfig,
+  applyXiaomiConfig,
+  applyXiaomiProviderConfig,
   applyZaiConfig,
 } from "./onboard-auth.config-core.js";
 export {
@@ -48,9 +50,11 @@ export {
   setSyntheticApiKey,
   setVeniceApiKey,
   setVercelAiGatewayApiKey,
+  setXiaomiApiKey,
   setZaiApiKey,
   writeOAuthCredentials,
   VERCEL_AI_GATEWAY_DEFAULT_MODEL_REF,
+  XIAOMI_DEFAULT_MODEL_REF,
   ZAI_DEFAULT_MODEL_REF,
 } from "./onboard-auth.credentials.js";
 export {

src/commands/onboard-non-interactive/local/auth-choice.ts

@@ -18,6 +18,7 @@ import {
   applySyntheticConfig,
   applyVeniceConfig,
   applyVercelAiGatewayConfig,
+  applyXiaomiConfig,
   applyZaiConfig,
   setAnthropicApiKey,
   setGeminiApiKey,
@@ -30,6 +31,7 @@ import {
   setSyntheticApiKey,
   setVeniceApiKey,
   setVercelAiGatewayApiKey,
+  setXiaomiApiKey,
   setZaiApiKey,
 } from "../../onboard-auth.js";
 import type { AuthChoice, OnboardOptions } from "../../onboard-types.js";
@@ -179,6 +181,25 @@ export async function applyNonInteractiveAuthChoice(params: {
     return applyZaiConfig(nextConfig);
   }
 
+  if (authChoice === "xiaomi-api-key") {
+    const resolved = await resolveNonInteractiveApiKey({
+      provider: "xiaomi",
+      cfg: baseConfig,
+      flagValue: opts.xiaomiApiKey,
+      flagName: "--xiaomi-api-key",
+      envVar: "XIAOMI_API_KEY",
+      runtime,
+    });
+    if (!resolved) return null;
+    if (resolved.source !== "profile") await setXiaomiApiKey(resolved.key);
+    nextConfig = applyAuthProfileConfig(nextConfig, {
+      profileId: "xiaomi:default",
+      provider: "xiaomi",
+      mode: "api_key",
+    });
+    return applyXiaomiConfig(nextConfig);
+  }
+
   if (authChoice === "openai-api-key") {
     const resolved = await resolveNonInteractiveApiKey({
       provider: "openai",

src/commands/onboard-types.ts

@@ -24,6 +24,7 @@ export type AuthChoice =
   | "google-antigravity"
   | "google-gemini-cli"
   | "zai-api-key"
+  | "xiaomi-api-key"
   | "minimax-cloud"
   | "minimax"
   | "minimax-api"
@@ -68,6 +69,7 @@ export type OnboardOptions = {
   kimiCodeApiKey?: string;
   geminiApiKey?: string;
   zaiApiKey?: string;
+  xiaomiApiKey?: string;
   minimaxApiKey?: string;
   syntheticApiKey?: string;
   nanogptApiKey?: string;

src/gateway/tools-invoke-http.ts

@@ -18,6 +18,7 @@ import {
 import { loadConfig } from "../config/config.js";
 import { resolveMainSessionKey } from "../config/sessions.js";
 import { logWarn } from "../logger.js";
+import { isTestDefaultMemorySlotDisabled } from "../plugins/config-state.js";
 import { getPluginToolMeta } from "../plugins/tools.js";
 import { isSubagentSessionKey } from "../routing/session-key.js";
 import { normalizeMessageChannel } from "../utils/message-channel.js";
@@ -33,6 +34,7 @@ import {
 } from "./http-common.js";
 
 const DEFAULT_BODY_BYTES = 2 * 1024 * 1024;
+const MEMORY_TOOL_NAMES = new Set(["memory_search", "memory_get"]);
 
 type ToolsInvokeBody = {
   tool?: unknown;
@@ -47,6 +49,26 @@ function resolveSessionKeyFromBody(body: ToolsInvokeBody): string | undefined {
   return undefined;
 }
 
+function resolveMemoryToolDisableReasons(cfg: ReturnType<typeof loadConfig>): string[] {
+  if (!process.env.VITEST) return [];
+  const reasons: string[] = [];
+  const plugins = cfg.plugins;
+  const slotRaw = plugins?.slots?.memory;
+  const slotDisabled =
+    slotRaw === null || (typeof slotRaw === "string" && slotRaw.trim().toLowerCase() === "none");
+  const pluginsDisabled = plugins?.enabled === false;
+  const defaultDisabled = isTestDefaultMemorySlotDisabled(cfg);
+
+  if (pluginsDisabled) reasons.push("plugins.enabled=false");
+  if (slotDisabled) {
+    reasons.push(slotRaw === null ? "plugins.slots.memory=null" : 'plugins.slots.memory="none"');
+  }
+  if (!pluginsDisabled && !slotDisabled && defaultDisabled) {
+    reasons.push("memory plugin disabled by test default");
+  }
+  return reasons;
+}
+
 function mergeActionIntoArgsIfSupported(params: {
   toolSchema: unknown;
   action: string | undefined;
@@ -103,6 +125,23 @@ export async function handleToolsInvokeHttpRequest(
     return true;
   }
 
+  if (process.env.VITEST && MEMORY_TOOL_NAMES.has(toolName)) {
+    const reasons = resolveMemoryToolDisableReasons(cfg);
+    if (reasons.length > 0) {
+      const suffix = reasons.length > 0 ? ` (${reasons.join(", ")})` : "";
+      sendJson(res, 400, {
+        ok: false,
+        error: {
+          type: "invalid_request",
+          message:
+            `memory tools are disabled in tests${suffix}. ` +
+            'Enable by setting plugins.slots.memory="memory-core" (and ensure plugins.enabled is not false).',
+        },
+      });
+      return true;
+    }
+  }
+
   const action = typeof body.action === "string" ? body.action.trim() : undefined;
 
   const argsRaw = body.args;

src/infra/provider-usage.auth.ts

@@ -96,6 +96,33 @@ function resolveMinimaxApiKey(): string | undefined {
   return undefined;
 }
 
+function resolveXiaomiApiKey(): string | undefined {
+  const envDirect = process.env.XIAOMI_API_KEY?.trim();
+  if (envDirect) return envDirect;
+
+  const envResolved = resolveEnvApiKey("xiaomi");
+  if (envResolved?.apiKey) return envResolved.apiKey;
+
+  const cfg = loadConfig();
+  const key = getCustomProviderApiKey(cfg, "xiaomi");
+  if (key) return key;
+
+  const store = ensureAuthProfileStore();
+  const apiProfile = listProfilesForProvider(store, "xiaomi").find((id) => {
+    const cred = store.profiles[id];
+    return cred?.type === "api_key" || cred?.type === "token";
+  });
+  if (!apiProfile) return undefined;
+  const cred = store.profiles[apiProfile];
+  if (cred?.type === "api_key" && cred.key?.trim()) {
+    return cred.key.trim();
+  }
+  if (cred?.type === "token" && cred.token?.trim()) {
+    return cred.token.trim();
+  }
+  return undefined;
+}
+
 async function resolveOAuthToken(params: {
   provider: UsageProviderId;
   agentDir?: string;
@@ -199,6 +226,11 @@ export async function resolveProviderAuths(params: {
       if (apiKey) auths.push({ provider, token: apiKey });
       continue;
     }
+    if (provider === "xiaomi") {
+      const apiKey = resolveXiaomiApiKey();
+      if (apiKey) auths.push({ provider, token: apiKey });
+      continue;
+    }
 
     if (!oauthProviders.includes(provider)) continue;
     const auth = await resolveOAuthToken({

src/infra/provider-usage.load.ts

@@ -66,6 +66,12 @@ export async function loadProviderUsageSummary(
             return await fetchCodexUsage(auth.token, auth.accountId, timeoutMs, fetchFn);
           case "minimax":
             return await fetchMinimaxUsage(auth.token, timeoutMs, fetchFn);
+          case "xiaomi":
+            return {
+              provider: "xiaomi",
+              displayName: PROVIDER_LABELS.xiaomi,
+              windows: [],
+            };
           case "zai":
             return await fetchZaiUsage(auth.token, timeoutMs, fetchFn);
           default:

src/infra/provider-usage.shared.ts

@@ -10,6 +10,7 @@ export const PROVIDER_LABELS: Record<UsageProviderId, string> = {
   "google-antigravity": "Antigravity",
   minimax: "MiniMax",
   "openai-codex": "Codex",
+  xiaomi: "Xiaomi",
   zai: "z.ai",
 };
 
@@ -20,6 +21,7 @@ export const usageProviders: UsageProviderId[] = [
   "google-antigravity",
   "minimax",
   "openai-codex",
+  "xiaomi",
   "zai",
 ];
 

src/infra/provider-usage.types.ts

@@ -24,4 +24,5 @@ export type UsageProviderId =
   | "google-antigravity"
   | "minimax"
   | "openai-codex"
+  | "xiaomi"
   | "zai";

src/infra/ssh-config.test.ts

@@ -54,6 +54,8 @@ describe("ssh-config", () => {
     expect(config?.host).toBe("peters-mac-studio-1.sheep-coho.ts.net");
     expect(config?.port).toBe(2222);
     expect(config?.identityFiles).toEqual(["/tmp/id_ed25519"]);
+    const args = spawnMock.mock.calls[0]?.[1] as string[] | undefined;
+    expect(args?.slice(-2)).toEqual(["--", "me@alias"]);
   });
 
   it("returns null when ssh -G fails", async () => {

src/infra/ssh-config.ts

@@ -58,7 +58,8 @@ export async function resolveSshConfig(
     args.push("-i", opts.identity.trim());
   }
   const userHost = target.user ? `${target.user}@${target.host}` : target.host;
-  args.push(userHost);
+  // Use "--" so userHost can't be parsed as an ssh option.
+  args.push("--", userHost);
 
   return await new Promise<SshResolvedConfig | null>((resolve) => {
     const child = spawn(sshPath, args, {

src/infra/ssh-tunnel.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+
+import { parseSshTarget } from "./ssh-tunnel.js";
+
+describe("parseSshTarget", () => {
+  it("parses user@host:port targets", () => {
+    expect(parseSshTarget("me@example.com:2222")).toEqual({
+      user: "me",
+      host: "example.com",
+      port: 2222,
+    });
+  });
+
+  it("parses host-only targets with default port", () => {
+    expect(parseSshTarget("example.com")).toEqual({
+      user: undefined,
+      host: "example.com",
+      port: 22,
+    });
+  });
+
+  it("rejects hostnames that start with '-'", () => {
+    expect(parseSshTarget("-V")).toBeNull();
+    expect(parseSshTarget("me@-badhost")).toBeNull();
+    expect(parseSshTarget("-oProxyCommand=echo")).toBeNull();
+  });
+});

src/infra/ssh-tunnel.ts

@@ -41,10 +41,14 @@ export function parseSshTarget(raw: string): SshParsedTarget | null {
     const portRaw = hostPart.slice(colonIdx + 1).trim();
     const port = Number.parseInt(portRaw, 10);
     if (!host || !Number.isFinite(port) || port <= 0) return null;
+    // Security: Reject hostnames starting with '-' to prevent argument injection
+    if (host.startsWith("-")) return null;
     return { user: userPart, host, port };
   }
 
   if (!hostPart) return null;
+  // Security: Reject hostnames starting with '-' to prevent argument injection
+  if (hostPart.startsWith("-")) return null;
   return { user: userPart, host: hostPart, port: 22 };
 }
 
@@ -134,7 +138,8 @@ export async function startSshPortForward(opts: {
   if (opts.identity?.trim()) {
     args.push("-i", opts.identity.trim());
   }
-  args.push(userHost);
+  // Security: Use '--' to prevent userHost from being interpreted as an option
+  args.push("--", userHost);
 
   const stderr: string[] = [];
   const child = spawn("/usr/bin/ssh", args, {

src/plugins/config-state.ts

@@ -64,6 +64,72 @@ export const normalizePluginsConfig = (
   };
 };
 
+const hasExplicitMemorySlot = (plugins?: MoltbotConfig["plugins"]) =>
+  Boolean(plugins?.slots && Object.prototype.hasOwnProperty.call(plugins.slots, "memory"));
+
+const hasExplicitMemoryEntry = (plugins?: MoltbotConfig["plugins"]) =>
+  Boolean(plugins?.entries && Object.prototype.hasOwnProperty.call(plugins.entries, "memory-core"));
+
+const hasExplicitPluginConfig = (plugins?: MoltbotConfig["plugins"]) => {
+  if (!plugins) return false;
+  if (typeof plugins.enabled === "boolean") return true;
+  if (Array.isArray(plugins.allow) && plugins.allow.length > 0) return true;
+  if (Array.isArray(plugins.deny) && plugins.deny.length > 0) return true;
+  if (plugins.load?.paths && Array.isArray(plugins.load.paths) && plugins.load.paths.length > 0)
+    return true;
+  if (plugins.slots && Object.keys(plugins.slots).length > 0) return true;
+  if (plugins.entries && Object.keys(plugins.entries).length > 0) return true;
+  return false;
+};
+
+export function applyTestPluginDefaults(
+  cfg: MoltbotConfig,
+  env: NodeJS.ProcessEnv = process.env,
+): MoltbotConfig {
+  if (!env.VITEST) return cfg;
+  const plugins = cfg.plugins;
+  const explicitConfig = hasExplicitPluginConfig(plugins);
+  if (explicitConfig) {
+    if (hasExplicitMemorySlot(plugins) || hasExplicitMemoryEntry(plugins)) {
+      return cfg;
+    }
+    return {
+      ...cfg,
+      plugins: {
+        ...plugins,
+        slots: {
+          ...plugins?.slots,
+          memory: "none",
+        },
+      },
+    };
+  }
+
+  return {
+    ...cfg,
+    plugins: {
+      ...plugins,
+      enabled: false,
+      slots: {
+        ...plugins?.slots,
+        memory: "none",
+      },
+    },
+  };
+}
+
+export function isTestDefaultMemorySlotDisabled(
+  cfg: MoltbotConfig,
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  if (!env.VITEST) return false;
+  const plugins = cfg.plugins;
+  if (hasExplicitMemorySlot(plugins) || hasExplicitMemoryEntry(plugins)) {
+    return false;
+  }
+  return true;
+}
+
 export function resolveEnableState(
   id: string,
   origin: PluginRecord["origin"],

src/plugins/loader.ts

@@ -10,6 +10,7 @@ import { resolveUserPath } from "../utils.js";
 import { discoverMoltbotPlugins } from "./discovery.js";
 import { loadPluginManifestRegistry } from "./manifest-registry.js";
 import {
+  applyTestPluginDefaults,
   normalizePluginsConfig,
   resolveEnableState,
   resolveMemorySlotDecision,
@@ -162,7 +163,7 @@ function pushDiagnostics(diagnostics: PluginDiagnostic[], append: PluginDiagnost
 }
 
 export function loadMoltbotPlugins(options: PluginLoadOptions = {}): PluginRegistry {
-  const cfg = options.config ?? {};
+  const cfg = applyTestPluginDefaults(options.config ?? {});
   const logger = options.logger ?? defaultLogger();
   const validateOnly = options.mode === "validate";
   const normalized = normalizePluginsConfig(cfg.plugins);