fix: keep mac gateway attached (#982 ) (thanks @wes-davis)

Co-authored-by: Wes <wesleydavis@me.com>
Merge pull request #992 from tyler6204/fix/tool-typing-race-condition
2026-01-16 07:36:27 +00:00 · 2026-01-16 07:26:10 +00:00 · 2026-01-16 07:08:07 +00:00 · 2026-01-16 07:00:05 +00:00 · 2026-01-16 06:57:54 +00:00 · 2026-01-16 06:57:54 +00:00
493 changed files with 18498 additions and 7733 deletions
@@ -60,6 +60,9 @@
 - When merging a PR from a new contributor: add their avatar to the README “Thanks to all clawtributors” thumbnail list.
 - After merging a PR: run `bun scripts/update-clawtributors.ts` if the contributor is missing, then commit the regenerated README.
 ## Shorthand Commands
 - `sync up`: if working tree is dirty, commit all changes (pick a sensible Conventional Commit message), then `git pull --rebase`; if rebase conflicts and cannot resolve, stop; otherwise `git push`.
 ### PR Workflow (Review vs Land)
 - **Review mode (PR link only):** read `gh pr view/diff`; **do not** switch branches; **do not** change code.
 - **Landing mode:** create an integration branch from `main`, bring in PR commits (**prefer rebase** for linear history; **merge allowed** when complexity/conflicts make it safer), apply fixes, add changelog (+ thanks + PR #), run full gate **locally before committing** (`pnpm lint && pnpm build && pnpm test`), commit, merge back to `main`, then `git switch main` (never stay on a topic branch after landing). Important: contributor needs to be in git graph after this!
@@ -113,6 +116,14 @@
  - launchd PATH is minimal; ensure the app’s launch agent PATH includes standard system paths plus your pnpm bin (typically `$HOME/Library/pnpm`) so `pnpm`/`clawdbot` binaries resolve when invoked via `clawdbot-mac`.
 - For manual `clawdbot message send` messages that include `!`, use the heredoc pattern noted below to avoid the Bash tool’s escaping.
 ## NPM + 1Password (publish/verify)
 - Use the 1password skill; all `op` commands must run inside a fresh tmux session.
 - Sign in: `eval "$(op signin --account my.1password.com)"` (app unlocked + integration on).
 - OTP: `op read 'op://Private/Npmjs/one-time password?attribute=otp'`.
 - Publish: `npm publish --access public --otp="<otp>"` (run from the package dir).
 - Verify without local npmrc side effects: `npm view <pkg> version --userconfig "$(mktemp)"`.
 - Kill the tmux session after publish.
 ## Exclamation Mark Escaping Workaround
 The Claude Code Bash tool escapes `!` to `\\!` in command arguments. When using `clawdbot message send` with messages containing exclamation marks, use heredoc syntax:
@@ -2,7 +2,44 @@
 ## 2026.1.15 (unreleased)
- TBD
+- **BREAKING:** Microsoft Teams is now a plugin; install `@clawdbot/msteams` via `clawdbot plugins install @clawdbot/msteams`.
 - CLI: set process titles to `clawdbot-<command>` for clearer process listings.
 - Heartbeat: tighten prompt guidance + suppress duplicate alerts for 24h. (#980) — thanks @voidserf.
 - Sessions/Security: add `session.dmScope` for multi-user DM isolation and audit warnings. (#948) — thanks @Alphonse-arianee.
 - Plugins: add provider auth registry + `clawdbot models auth login` for plugin-driven OAuth/API key flows.
 - Onboarding: switch channels setup to a single-select loop with per-channel actions and disabled hints in the picker.
 - TUI: show provider/model labels for the active session and default model.
 - Heartbeat: add per-agent heartbeat configuration and multi-agent docs example.
 - Fix: list model picker entries as provider/model pairs for explicit selection. (#970) — thanks @mcinteerj.
 - Fix: persist `gateway.mode=local` after selecting Local run mode in `clawdbot configure`, even if no other sections are chosen.
 - Daemon: fix profile-aware service label resolution (env-driven) and add coverage for launchd/systemd/schtasks. (#969) — thanks @bjesuiter.
 - Daemon: share profile/state-dir resolution across service helpers and honor `CLAWDBOT_STATE_DIR` for Windows task scripts.
 - Docs: clarify multi-gateway rescue bot guidance. (#969) — thanks @bjesuiter.
 - Agents: add Current Date & Time system prompt section with configurable time format (auto/12/24).
 - Agents: avoid false positives when logging unsupported Google tool schema keywords.
 - Status: restore usage summary line for current provider when no OAuth profiles exist.
 - Tools: normalize Slack/Discord message timestamps with `timestampMs`/`timestampUtc` while keeping raw provider fields.
 - Docs: add Date & Time guide and update prompt/timezone configuration docs.
 - Messages: debounce rapid inbound messages across channels with per-connector overrides. (#971) — thanks @juanpablodlc.
 - Messages: allow media-only sends (CLI/tool) and show Telegram voice recording status for voice notes. (#957) — thanks @rdev.
 - Auth/Status: keep auth profiles sticky per session (rotate on compaction/new), surface provider usage headers in `/status` and `clawdbot models status`, and update docs.
 - Fix: guard model fallback against undefined provider/model values. (#954) — thanks @roshanasingh4.
 - Fix: refactor session store updates, add chat.inject, and harden subagent cleanup flow. (#944) — thanks @tyler6204.
 - Fix: clean up suspended CLI processes across backends. (#978) — thanks @Nachx639.
 - Fix: macOS gateway stays attached across restarts (no port flapping) and status probes pick the right auth. (#982) — thanks @wes-davis.
 - CLI: add `--json` output for `clawdbot daemon` lifecycle/install commands.
 - Memory: make `node-llama-cpp` an optional dependency (avoid Node 25 install failures) and improve local-embeddings fallback/errors.
 - Browser: add `snapshot refs=aria` (Playwright aria-ref ids) for self-resolving refs across `snapshot` → `act`.
 - Browser: `profile="chrome"` now defaults to host control and returns clearer “attach a tab” errors.
 - Browser: extension mode recovers when only one tab is attached (stale targetId fallback).
 - Browser: prefer stable Chrome for auto-detect, with Brave/Edge fallbacks and updated docs. (#983) — thanks @cpojer.
 - Browser: fix `tab not found` for extension relay snapshots/actions when Playwright blocks `newCDPSession` (use the single available Page).
 - Telegram: add bidirectional reaction support with configurable notifications and agent guidance. (#964) — thanks @bohdanpodvirnyi.
 - Telegram: skip `message_thread_id=1` for General topic sends while keeping typing indicators. (#848) — thanks @azade-c.
 - Discord: allow allowlisted guilds without channel lists to receive messages when `groupPolicy="allowlist"`. — thanks @thewilloftheshadow.
 - Discord: allow emoji/sticker uploads + channel actions in config defaults. (#870) — thanks @JDIVE.
 - Fix: sanitize user-facing error text + strip `<final>` tags across reply pipelines. (#975) — thanks @ThomsenDrake.
 - Fix: normalize pairing CLI aliases, allow extension channels, and harden Zalo webhook payload parsing. (#991) — thanks @longmaba.
 ## 2026.1.14-1
@@ -13,98 +50,56 @@
 - Security: expanded `clawdbot security audit` (+ `--fix`), detect-secrets CI scan, and a `SECURITY.md` reporting policy.
 ### Changes
 #### Web Tools
 - Tools: add `web_search`/`web_fetch` (Brave API), including helpful setup hints when the key is missing.
 - Tools: enable `web_fetch` by default (unless explicitly disabled in config).
 - CLI/Docs: add `clawdbot configure --section web` for storing Brave API keys and update onboarding tips.
 #### Browser / Control UI
 - Browser: add Chrome extension relay takeover mode (toolbar button) + `clawdbot browser serve` remote control + `browser.controlToken`.
 - Browser: ship a built-in `chrome` profile for extension relay and start the relay automatically when running locally.
 - Browser: default `browser.defaultProfile` to `chrome` (existing Chrome takeover mode).
 - Browser: add `clawdbot browser extension install/path` and copy extension path to clipboard.
 - Browser: add `snapshot refs=aria` (Playwright aria-ref ids) for self-resolving refs across `snapshot` → `act`.
 - Browser: `profile="chrome"` now defaults to host control and returns clearer “attach a tab” errors.
 - Browser: extension mode recovers when only one tab is attached (stale targetId fallback).
 - Browser: fix `tab not found` for extension relay snapshots/actions when Playwright blocks `newCDPSession` (use the single available Page).
 - Control UI: show raw any-map entries in config views; move Docs link into the left nav.
 #### Plugins
 - Plugins: add plugin HTTP hooks + loader updates to support channel plugins. (#854) — thanks @longmaba.
 - Plugins: add onboarding plugin install flow. (#854) — thanks @longmaba.
 - Channels: add Matrix plugin (external) with docs + onboarding hooks.
 - Voice Call: add Plivo provider (no SDK dependency). (#846) — thanks @vrknetha.
 #### Security
 - Security: expand `clawdbot security audit` checks and publish a `SECURITY.md` reporting policy.
 - Security: extend `clawdbot security audit --fix` to tighten more sensitive state paths.
 - Security: add detect-secrets CI scan and baseline guidance. (#227) — thanks @Hyaxia.
 #### Onboarding / Daemon
 - Onboarding: add a security checkpoint prompt (docs link + sandboxing hint); require `--accept-risk` for `--non-interactive`.
 - Daemon: support profile-aware service names for multi-gateway setups. (#671) — thanks @bjesuiter.
 #### Auth / Usage / Config
 - Usage: add MiniMax coding plan usage tracking.
 - Auth: label Claude Code CLI auth options. (#915) — thanks @SeanZoR.
 - Agents: add optional auth-profile copy prompt on `agents add` and improve auth error messaging.
 - Auth: add dynamic template variables to `messages.responsePrefix`. (#928) — thanks @sebslight.
 - Config: add `channels.<provider>.configWrites` gating for channel-initiated config writes; migrate Slack channel IDs.
 #### Channels
 - Telegram: add message delete action in the message tool. (#903) — thanks @sleontenko.
 - WhatsApp: add `channels.whatsapp.sendReadReceipts` to disable auto read receipts. (#882) — thanks @chrisrodz.
 #### Docs
 - Docs: clarify per-agent auth stores, sandboxed skill binaries, and elevated semantics.
 - Docs: add FAQ entries for missing provider auth after adding agents and Gemini thinking signature errors.
 - Agents: add optional auth-profile copy prompt on `agents add` and improve auth error messaging.
 - Security: expand `clawdbot security audit` checks (model hygiene, config includes, plugin allowlists, exposure matrix) and extend `--fix` to tighten more sensitive state paths.
 - Security: add `SECURITY.md` reporting policy.
 - Channels: add Matrix plugin (external) with docs + onboarding hooks.
 - Plugins: add Zalo channel plugin with gateway HTTP hooks and onboarding install prompt. (#854) — thanks @longmaba.
 - Onboarding: add a security checkpoint prompt (docs link + sandboxing hint); require `--accept-risk` for `--non-interactive`.
 - Docs: expand gateway security hardening guidance and incident response checklist.
 - Docs: document DM history limits for channel DMs. (#883) — thanks @pkrmf.
- Docs: standardize Claude Code CLI naming across docs and prompts. (follow-up to #915)
+- Security: add detect-secrets CI scan and baseline guidance. (#227) — thanks @Hyaxia.
- Docs: add per-command CLI doc pages and link them from `clawdbot <command> --help`.
+- Tools: add `web_search`/`web_fetch` (Brave API), auto-enable `web_fetch` for sandboxed sessions, and remove the `brave-search` skill.
- Docs: add multi-gateway guide (sidebar + nav).
+- CLI/Docs: add a web tools configure section for storing Brave API keys and update onboarding tips.
 - Browser: add Chrome extension relay takeover mode (toolbar button), plus `clawdbot browser extension install/path` and remote browser control via `clawdbot browser serve` + `browser.controlToken`.
 ### Fixes
-
+- Sessions: refactor session store updates to lock + mutate per-entry, add chat.inject, and harden subagent cleanup flow. (#944) — thanks @tyler6204.
 #### Gateway / Daemon / Sessions
 - Gateway: forward termination signals to respawned CLI child processes to avoid orphaned systemd runs. (#933) — thanks @roshanasingh4.
 - Gateway/UI: ship session defaults in the hello snapshot so the Control UI canonicalizes main session keys (no bare `main` alias).
 - Agents: skip thinking/final tag stripping inside Markdown code spans. (#939) — thanks @ngutman.
 - Browser: add tests for snapshot labels/efficient query params and labeled image responses.
 - Browser: persist role snapshot refs per CDP target so `snapshot` → `act` clicks work even if Playwright returns a different Page instance.
 - macOS: ensure launchd log directory exists with a test-only override. (#909) — thanks @roshanasingh4.
 - macOS: format ConnectionsStore config to satisfy SwiftFormat lint. (#852) — thanks @mneves75.
 - Packaging: run `pnpm build` on `prepack` so npm publishes include fresh `dist/` output.
 - Telegram: register dock native commands with underscores to avoid `BOT_COMMAND_INVALID` (#929, fixes #901) — thanks @grp06.
 - Google: downgrade unsigned thinking blocks before send to avoid missing signature errors.
 - Agents: make user time zone and 24-hour time explicit in the system prompt. (#859) — thanks @CashWilliams.
 - Agents: strip downgraded tool call text without eating adjacent replies and filter thinking-tag leaks. (#905) — thanks @erikpr1994.
 - Agents: cap tool call IDs for OpenAI/OpenRouter to avoid request rejections. (#875) — thanks @j1philli.
 - Doctor: avoid re-adding WhatsApp config when only legacy ack reactions are set. (#927, fixes #900) — thanks @grp06.
 - Agents: scrub tuple `items` schemas for Gemini tool calls. (#926, fixes #746) — thanks @grp06.
 - Agents: harden Antigravity Claude history/tool-call sanitization. (#968) — thanks @rdev.
 - Agents: stabilize sub-agent announce status from runtime outcomes and normalize Result/Notes. (#835) — thanks @roshanasingh4.
 - Apps: use canonical main session keys from gateway defaults across macOS/iOS/Android to avoid creating bare `main` sessions.
 - Embedded runner: suppress raw API error payloads from replies. (#924) — thanks @grp06.
 - Auth: normalize Claude Code CLI profile mode to oauth and auto-migrate config. (#855) — thanks @sebslight.
 - Daemon: clear persisted launchd disabled state before bootstrap (fixes `daemon install` after uninstall). (#849) — thanks @ndraiman.
- Sessions: return deep clones (`structuredClone`) so cached session entries can't be mutated. (#934) — thanks @ronak-guliani.
+- Logging: tolerate `EIO` from console writes to avoid gateway crashes. (#925, fixes #878) — thanks @grp06.
- Heartbeat: keep `updatedAt` monotonic when restoring heartbeat sessions. (#934) — thanks @ronak-guliani.
+- Sandbox: restore `docker.binds` config validation for custom bind mounts. (#873) — thanks @akonyer.
- Agent: clear run context after CLI runs (`clearAgentRunContext`) to avoid runaway contexts. (#934) — thanks @ronak-guliani.
+- Sandbox: preserve configured PATH for `docker exec` so custom tools remain available. (#873) — thanks @akonyer.
- Gateway/Dev: ensure `pnpm gateway:dev` always uses the dev profile config + state (`~/.clawdbot-dev`).
+- Slack: respect `channels.slack.requireMention` default when resolving channel mention gating. (#850) — thanks @evalexpr.
 - Telegram: aggregate split inbound messages into one prompt (reduces “one reply per fragment”).
 - Auto-reply: treat trailing `NO_REPLY` tokens as silent replies.
 - Config: prevent partial config writes from clobbering unrelated settings (base hash guard + merge patch for connection saves).
-#### CLI / Onboarding
+## 2026.1.14
 - Onboarding: show web search setup at the end (not the beginning).
 - Onboarding: show daemon install/restart progress (avoid “blinking cursor”) and fix daemon install output formatting.
 - Health: colorize “not configured” provider lines for easier scanning.
-#### Control UI / TUI
+### Changes
- Control UI: load cron run history on job selection and clarify empty-state messaging. (#866)
+- Usage: add MiniMax coding plan usage tracking.
- UI: use application-defined WebSocket close code and fix dashboard auth query items. (#918) — thanks @rahthakor.
+- Auth: label Claude Code CLI auth options. (#915) — thanks @SeanZoR.
- UI: always apply `?token=` from URL (fixes unauthorized after re-onboard).
+- Docs: standardize Claude Code CLI naming across docs and prompts. (follow-up to #915)
- Browser: add tests for snapshot labels/efficient query params and labeled image responses.
+- Telegram: add message delete action in the message tool. (#903) — thanks @sleontenko.
 - Config: add `channels.<provider>.configWrites` gating for channel-initiated config writes; migrate Slack channel IDs.
 ### Fixes
 - Mac: pass auth token/password to dashboard URL for authenticated access. (#918) — thanks @rahthakor.
 - UI: use application-defined WebSocket close code (browser compatibility). (#918) — thanks @rahthakor.
 - TUI: render picker overlays via the overlay stack so /models and /settings display. (#921) — thanks @grizzdank.
 - TUI: add a bright spinner + elapsed time in the status line for send/stream/run states.
 - TUI: show LLM error messages (rate limits, auth, etc.) instead of `(no output)`.
 - Gateway/Dev: ensure `pnpm gateway:dev` always uses the dev profile config + state (`~/.clawdbot-dev`).
 #### Agents / Auth / Tools / Sandbox
 - Agents: make user time zone and 24-hour time explicit in the system prompt. (#859) — thanks @CashWilliams.
@@ -123,34 +118,17 @@
 - macOS: format ConnectionsStore config to satisfy SwiftFormat lint. (#852) — thanks @mneves75.
 - macOS: pass auth token/password to dashboard URL for authenticated access. (#918) — thanks @rahthakor.
 - macOS: reuse launchd gateway auth and skip wizard when gateway config already exists. (#917)
 - macOS: prefer the default bridge tunnel port in remote mode for node bridge connectivity; document macOS remote control + bridge tunnels. (#960, fixes #865) — thanks @kkarimi.
 - Apps: use canonical main session keys from gateway defaults across macOS/iOS/Android to avoid creating bare `main` sessions.
 - macOS: fix cron preview/testing payload to use `channel` key. (#867) — thanks @wes-davis.
 - macOS: update cron testing channel arg. (#896) — thanks @ngutman.
 #### Channels / Messaging
 - Slack: isolate thread history and avoid inheriting channel transcripts for new threads by default. (#758)
 - Slack: respect `channels.slack.requireMention` default when resolving channel mention gating. (#850) — thanks @evalexpr.
 - Slack: drop Socket Mode events with mismatched `api_app_id`/`team_id`. (#889) — thanks @roshanasingh4.
 - Commands: add native command argument menus across Discord/Slack/Telegram. (#936) — thanks @thewilloftheshadow.
 - Discord: isolate autoThread thread context. (#856) — thanks @davidguttman.
 - Telegram: honor `channels.telegram.timeoutSeconds` for grammY API requests. (#863) — thanks @Snaver.
- Telegram: aggregate split inbound messages into one prompt (reduces “one reply per fragment”).
+- Telegram: split long captions into media + follow-up text messages. (#907) - thanks @jalehman.
 - Telegram: let control commands bypass per-chat sequentialization; always allow abort triggers.
 - Telegram: split long captions into media + follow-up text messages. (#907) — thanks @jalehman.
 - Telegram: migrate group config when supergroups change chat IDs. (#906) — thanks @sleontenko.
 - Telegram: register dock native commands with underscores to avoid `BOT_COMMAND_INVALID` (#929, fixes #901) — thanks @grp06.
 - Messaging: unify markdown formatting + format-first chunking for Slack/Telegram/Signal. (#920) — thanks @TheSethRose.
- iMessage: prefer handle routing for direct-message replies; include imsg RPC error details. (#935)
+- Slack: drop Socket Mode events with mismatched `api_app_id`/`team_id`. (#889) — thanks @roshanasingh4.
 - Discord: isolate autoThread thread context. (#856) — thanks @davidguttman.
 - WhatsApp: fix context isolation using wrong ID (was bot's number, now conversation ID). (#911) — thanks @tristanmanchester.
 - WhatsApp: normalize user JIDs with device suffix for allowlist checks in groups. (#838) — thanks @peschee.
 - WhatsApp: harden owner command auth.
 - Auto-reply: treat trailing `NO_REPLY` tokens as silent replies.
 #### Config / Doctor / Packaging
 - Config: prevent partial config writes from clobbering unrelated settings (base hash guard + merge patch for connection saves).
 - Config/Doctor: remove legacy Clawdis env fallbacks and config/service migrations (Clawdbot-only).
 - Doctor: avoid re-adding WhatsApp config when only legacy ack reactions are set. (#927, fixes #900) — thanks @grp06.
 - Packaging: run `pnpm build` on `prepack` so npm publishes include fresh `dist/` output.
 ## 2026.1.13
@@ -474,22 +474,23 @@ Core contributors:
 Thanks to all clawtributors:
 <p align="left">
-  <a href="https://github.com/steipete"><img src="https://avatars.githubusercontent.com/u/58493?v=4&s=48" width="48" height="48" alt="steipete" title="steipete"/></a> <a href="https://github.com/joaohlisboa"><img src="https://avatars.githubusercontent.com/u/8200873?v=4&s=48" width="48" height="48" alt="joaohlisboa" title="joaohlisboa"/></a> <a href="https://github.com/mneves75"><img src="https://avatars.githubusercontent.com/u/2423436?v=4&s=48" width="48" height="48" alt="mneves75" title="mneves75"/></a> <a href="https://github.com/rahthakor"><img src="https://avatars.githubusercontent.com/u/8470553?v=4&s=48" width="48" height="48" alt="rahthakor" title="rahthakor"/></a> <a href="https://github.com/joshp123"><img src="https://avatars.githubusercontent.com/u/1497361?v=4&s=48" width="48" height="48" alt="joshp123" title="joshp123"/></a> <a href="https://github.com/mukhtharcm"><img src="https://avatars.githubusercontent.com/u/56378562?v=4&s=48" width="48" height="48" alt="mukhtharcm" title="mukhtharcm"/></a> <a href="https://github.com/maxsumrall"><img src="https://avatars.githubusercontent.com/u/628843?v=4&s=48" width="48" height="48" alt="maxsumrall" title="maxsumrall"/></a> <a href="https://github.com/xadenryan"><img src="https://avatars.githubusercontent.com/u/165437834?v=4&s=48" width="48" height="48" alt="xadenryan" title="xadenryan"/></a> <a href="https://github.com/tobiasbischoff"><img src="https://avatars.githubusercontent.com/u/711564?v=4&s=48" width="48" height="48" alt="Tobias Bischoff" title="Tobias Bischoff"/></a> <a href="https://github.com/hsrvc"><img src="https://avatars.githubusercontent.com/u/129702169?v=4&s=48" width="48" height="48" alt="hsrvc" title="hsrvc"/></a>
+  <a href="https://github.com/steipete"><img src="https://avatars.githubusercontent.com/u/58493?v=4&s=48" width="48" height="48" alt="steipete" title="steipete"/></a> <a href="https://github.com/bohdanpodvirnyi"><img src="https://avatars.githubusercontent.com/u/31819391?v=4&s=48" width="48" height="48" alt="bohdanpodvirnyi" title="bohdanpodvirnyi"/></a> <a href="https://github.com/joaohlisboa"><img src="https://avatars.githubusercontent.com/u/8200873?v=4&s=48" width="48" height="48" alt="joaohlisboa" title="joaohlisboa"/></a> <a href="https://github.com/mneves75"><img src="https://avatars.githubusercontent.com/u/2423436?v=4&s=48" width="48" height="48" alt="mneves75" title="mneves75"/></a> <a href="https://github.com/rahthakor"><img src="https://avatars.githubusercontent.com/u/8470553?v=4&s=48" width="48" height="48" alt="rahthakor" title="rahthakor"/></a> <a href="https://github.com/vrknetha"><img src="https://avatars.githubusercontent.com/u/20596261?v=4&s=48" width="48" height="48" alt="vrknetha" title="vrknetha"/></a> <a href="https://github.com/joshp123"><img src="https://avatars.githubusercontent.com/u/1497361?v=4&s=48" width="48" height="48" alt="joshp123" title="joshp123"/></a> <a href="https://github.com/mukhtharcm"><img src="https://avatars.githubusercontent.com/u/56378562?v=4&s=48" width="48" height="48" alt="mukhtharcm" title="mukhtharcm"/></a> <a href="https://github.com/maxsumrall"><img src="https://avatars.githubusercontent.com/u/628843?v=4&s=48" width="48" height="48" alt="maxsumrall" title="maxsumrall"/></a> <a href="https://github.com/xadenryan"><img src="https://avatars.githubusercontent.com/u/165437834?v=4&s=48" width="48" height="48" alt="xadenryan" title="xadenryan"/></a>
-  <a href="https://github.com/magimetal"><img src="https://avatars.githubusercontent.com/u/36491250?v=4&s=48" width="48" height="48" alt="magimetal" title="magimetal"/></a> <a href="https://github.com/meaningfool"><img src="https://avatars.githubusercontent.com/u/2862331?v=4&s=48" width="48" height="48" alt="meaningfool" title="meaningfool"/></a> <a href="https://github.com/NicholasSpisak"><img src="https://avatars.githubusercontent.com/u/129075147?v=4&s=48" width="48" height="48" alt="NicholasSpisak" title="NicholasSpisak"/></a> <a href="https://github.com/AbhisekBasu1"><img src="https://avatars.githubusercontent.com/u/40645221?v=4&s=48" width="48" height="48" alt="abhisekbasu1" title="abhisekbasu1"/></a> <a href="https://github.com/claude"><img src="https://avatars.githubusercontent.com/u/81847?v=4&s=48" width="48" height="48" alt="claude" title="claude"/></a> <a href="https://github.com/jamesgroat"><img src="https://avatars.githubusercontent.com/u/2634024?v=4&s=48" width="48" height="48" alt="jamesgroat" title="jamesgroat"/></a> <a href="https://github.com/Hyaxia"><img src="https://avatars.githubusercontent.com/u/36747317?v=4&s=48" width="48" height="48" alt="Hyaxia" title="Hyaxia"/></a> <a href="https://github.com/dantelex"><img src="https://avatars.githubusercontent.com/u/631543?v=4&s=48" width="48" height="48" alt="dantelex" title="dantelex"/></a> <a href="https://github.com/daveonkels"><img src="https://avatars.githubusercontent.com/u/533642?v=4&s=48" width="48" height="48" alt="daveonkels" title="daveonkels"/></a> <a href="https://github.com/vrknetha"><img src="https://avatars.githubusercontent.com/u/20596261?v=4&s=48" width="48" height="48" alt="vrknetha" title="vrknetha"/></a>
+  <a href="https://github.com/tobiasbischoff"><img src="https://avatars.githubusercontent.com/u/711564?v=4&s=48" width="48" height="48" alt="Tobias Bischoff" title="Tobias Bischoff"/></a> <a href="https://github.com/juanpablodlc"><img src="https://avatars.githubusercontent.com/u/92012363?v=4&s=48" width="48" height="48" alt="juanpablodlc" title="juanpablodlc"/></a> <a href="https://github.com/hsrvc"><img src="https://avatars.githubusercontent.com/u/129702169?v=4&s=48" width="48" height="48" alt="hsrvc" title="hsrvc"/></a> <a href="https://github.com/magimetal"><img src="https://avatars.githubusercontent.com/u/36491250?v=4&s=48" width="48" height="48" alt="magimetal" title="magimetal"/></a> <a href="https://github.com/meaningfool"><img src="https://avatars.githubusercontent.com/u/2862331?v=4&s=48" width="48" height="48" alt="meaningfool" title="meaningfool"/></a> <a href="https://github.com/NicholasSpisak"><img src="https://avatars.githubusercontent.com/u/129075147?v=4&s=48" width="48" height="48" alt="NicholasSpisak" title="NicholasSpisak"/></a> <a href="https://github.com/AbhisekBasu1"><img src="https://avatars.githubusercontent.com/u/40645221?v=4&s=48" width="48" height="48" alt="abhisekbasu1" title="abhisekbasu1"/></a> <a href="https://github.com/claude"><img src="https://avatars.githubusercontent.com/u/81847?v=4&s=48" width="48" height="48" alt="claude" title="claude"/></a> <a href="https://github.com/jamesgroat"><img src="https://avatars.githubusercontent.com/u/2634024?v=4&s=48" width="48" height="48" alt="jamesgroat" title="jamesgroat"/></a> <a href="https://github.com/Hyaxia"><img src="https://avatars.githubusercontent.com/u/36747317?v=4&s=48" width="48" height="48" alt="Hyaxia" title="Hyaxia"/></a>
-  <a href="https://github.com/radek-paclt"><img src="https://avatars.githubusercontent.com/u/50451445?v=4&s=48" width="48" height="48" alt="radek-paclt" title="radek-paclt"/></a> <a href="https://github.com/mteam88"><img src="https://avatars.githubusercontent.com/u/84196639?v=4&s=48" width="48" height="48" alt="mteam88" title="mteam88"/></a> <a href="https://github.com/omniwired"><img src="https://avatars.githubusercontent.com/u/322761?v=4&s=48" width="48" height="48" alt="Eng. Juan Combetto" title="Eng. Juan Combetto"/></a> <a href="https://github.com/dbhurley"><img src="https://avatars.githubusercontent.com/u/5251425?v=4&s=48" width="48" height="48" alt="dbhurley" title="dbhurley"/></a> <a href="https://github.com/mbelinky"><img src="https://avatars.githubusercontent.com/u/132747814?v=4&s=48" width="48" height="48" alt="Mariano Belinky" title="Mariano Belinky"/></a> <a href="https://github.com/julianengel"><img src="https://avatars.githubusercontent.com/u/10634231?v=4&s=48" width="48" height="48" alt="julianengel" title="julianengel"/></a> <a href="https://github.com/benithors"><img src="https://avatars.githubusercontent.com/u/20652882?v=4&s=48" width="48" height="48" alt="benithors" title="benithors"/></a> <a href="https://github.com/sreekaransrinath"><img src="https://avatars.githubusercontent.com/u/50989977?v=4&s=48" width="48" height="48" alt="sreekaransrinath" title="sreekaransrinath"/></a> <a href="https://github.com/gupsammy"><img src="https://avatars.githubusercontent.com/u/20296019?v=4&s=48" width="48" height="48" alt="gupsammy" title="gupsammy"/></a> <a href="https://github.com/cristip73"><img src="https://avatars.githubusercontent.com/u/24499421?v=4&s=48" width="48" height="48" alt="cristip73" title="cristip73"/></a>
+  <a href="https://github.com/dantelex"><img src="https://avatars.githubusercontent.com/u/631543?v=4&s=48" width="48" height="48" alt="dantelex" title="dantelex"/></a> <a href="https://github.com/daveonkels"><img src="https://avatars.githubusercontent.com/u/533642?v=4&s=48" width="48" height="48" alt="daveonkels" title="daveonkels"/></a> <a href="https://github.com/radek-paclt"><img src="https://avatars.githubusercontent.com/u/50451445?v=4&s=48" width="48" height="48" alt="radek-paclt" title="radek-paclt"/></a> <a href="https://github.com/mteam88"><img src="https://avatars.githubusercontent.com/u/84196639?v=4&s=48" width="48" height="48" alt="mteam88" title="mteam88"/></a> <a href="https://github.com/omniwired"><img src="https://avatars.githubusercontent.com/u/322761?v=4&s=48" width="48" height="48" alt="Eng. Juan Combetto" title="Eng. Juan Combetto"/></a> <a href="https://github.com/dbhurley"><img src="https://avatars.githubusercontent.com/u/5251425?v=4&s=48" width="48" height="48" alt="dbhurley" title="dbhurley"/></a> <a href="https://github.com/mbelinky"><img src="https://avatars.githubusercontent.com/u/132747814?v=4&s=48" width="48" height="48" alt="Mariano Belinky" title="Mariano Belinky"/></a> <a href="https://github.com/julianengel"><img src="https://avatars.githubusercontent.com/u/10634231?v=4&s=48" width="48" height="48" alt="julianengel" title="julianengel"/></a> <a href="https://github.com/benithors"><img src="https://avatars.githubusercontent.com/u/20652882?v=4&s=48" width="48" height="48" alt="benithors" title="benithors"/></a> <a href="https://github.com/Nachx639"><img src="https://avatars.githubusercontent.com/u/71144023?v=4&s=48" width="48" height="48" alt="nachx639" title="nachx639"/></a>
-  <a href="https://github.com/nachoiacovino"><img src="https://avatars.githubusercontent.com/u/50103937?v=4&s=48" width="48" height="48" alt="nachoiacovino" title="nachoiacovino"/></a> <a href="https://github.com/vsabavat"><img src="https://avatars.githubusercontent.com/u/50385532?v=4&s=48" width="48" height="48" alt="Vasanth Rao Naik Sabavat" title="Vasanth Rao Naik Sabavat"/></a> <a href="https://github.com/lc0rp"><img src="https://avatars.githubusercontent.com/u/2609441?v=4&s=48" width="48" height="48" alt="lc0rp" title="lc0rp"/></a> <a href="https://github.com/scald"><img src="https://avatars.githubusercontent.com/u/1215913?v=4&s=48" width="48" height="48" alt="scald" title="scald"/></a> <a href="https://github.com/andranik-sahakyan"><img src="https://avatars.githubusercontent.com/u/8908029?v=4&s=48" width="48" height="48" alt="andranik-sahakyan" title="andranik-sahakyan"/></a> <a href="https://github.com/Nachx639"><img src="https://avatars.githubusercontent.com/u/71144023?v=4&s=48" width="48" height="48" alt="nachx639" title="nachx639"/></a> <a href="https://github.com/davidguttman"><img src="https://avatars.githubusercontent.com/u/431696?v=4&s=48" width="48" height="48" alt="davidguttman" title="davidguttman"/></a> <a href="https://github.com/sleontenko"><img src="https://avatars.githubusercontent.com/u/7135949?v=4&s=48" width="48" height="48" alt="sleontenko" title="sleontenko"/></a> <a href="https://github.com/sircrumpet"><img src="https://avatars.githubusercontent.com/u/4436535?v=4&s=48" width="48" height="48" alt="sircrumpet" title="sircrumpet"/></a> <a href="https://github.com/peschee"><img src="https://avatars.githubusercontent.com/u/63866?v=4&s=48" width="48" height="48" alt="peschee" title="peschee"/></a>
+  <a href="https://github.com/sreekaransrinath"><img src="https://avatars.githubusercontent.com/u/50989977?v=4&s=48" width="48" height="48" alt="sreekaransrinath" title="sreekaransrinath"/></a> <a href="https://github.com/gupsammy"><img src="https://avatars.githubusercontent.com/u/20296019?v=4&s=48" width="48" height="48" alt="gupsammy" title="gupsammy"/></a> <a href="https://github.com/cristip73"><img src="https://avatars.githubusercontent.com/u/24499421?v=4&s=48" width="48" height="48" alt="cristip73" title="cristip73"/></a> <a href="https://github.com/nachoiacovino"><img src="https://avatars.githubusercontent.com/u/50103937?v=4&s=48" width="48" height="48" alt="nachoiacovino" title="nachoiacovino"/></a> <a href="https://github.com/vsabavat"><img src="https://avatars.githubusercontent.com/u/50385532?v=4&s=48" width="48" height="48" alt="Vasanth Rao Naik Sabavat" title="Vasanth Rao Naik Sabavat"/></a> <a href="https://github.com/lc0rp"><img src="https://avatars.githubusercontent.com/u/2609441?v=4&s=48" width="48" height="48" alt="lc0rp" title="lc0rp"/></a> <a href="https://github.com/scald"><img src="https://avatars.githubusercontent.com/u/1215913?v=4&s=48" width="48" height="48" alt="scald" title="scald"/></a> <a href="https://github.com/andranik-sahakyan"><img src="https://avatars.githubusercontent.com/u/8908029?v=4&s=48" width="48" height="48" alt="andranik-sahakyan" title="andranik-sahakyan"/></a> <a href="https://github.com/davidguttman"><img src="https://avatars.githubusercontent.com/u/431696?v=4&s=48" width="48" height="48" alt="davidguttman" title="davidguttman"/></a> <a href="https://github.com/sleontenko"><img src="https://avatars.githubusercontent.com/u/7135949?v=4&s=48" width="48" height="48" alt="sleontenko" title="sleontenko"/></a>
-  <a href="https://github.com/rafaelreis-r"><img src="https://avatars.githubusercontent.com/u/57492577?v=4&s=48" width="48" height="48" alt="rafaelreis-r" title="rafaelreis-r"/></a> <a href="https://github.com/ratulsarna"><img src="https://avatars.githubusercontent.com/u/105903728?v=4&s=48" width="48" height="48" alt="ratulsarna" title="ratulsarna"/></a> <a href="https://github.com/lutr0"><img src="https://avatars.githubusercontent.com/u/76906369?v=4&s=48" width="48" height="48" alt="lutr0" title="lutr0"/></a> <a href="https://github.com/thewilloftheshadow"><img src="https://avatars.githubusercontent.com/u/35580099?v=4&s=48" width="48" height="48" alt="thewilloftheshadow" title="thewilloftheshadow"/></a> <a href="https://github.com/emanuelst"><img src="https://avatars.githubusercontent.com/u/9994339?v=4&s=48" width="48" height="48" alt="emanuelst" title="emanuelst"/></a> <a href="https://github.com/KristijanJovanovski"><img src="https://avatars.githubusercontent.com/u/8942284?v=4&s=48" width="48" height="48" alt="KristijanJovanovski" title="KristijanJovanovski"/></a> <a href="https://github.com/CashWilliams"><img src="https://avatars.githubusercontent.com/u/613573?v=4&s=48" width="48" height="48" alt="CashWilliams" title="CashWilliams"/></a> <a href="https://github.com/osolmaz"><img src="https://avatars.githubusercontent.com/u/2453968?v=4&s=48" width="48" height="48" alt="osolmaz" title="osolmaz"/></a> <a href="https://github.com/kiranjd"><img src="https://avatars.githubusercontent.com/u/25822851?v=4&s=48" width="48" height="48" alt="kiranjd" title="kiranjd"/></a> <a href="https://github.com/sebslight"><img src="https://avatars.githubusercontent.com/u/19554889?v=4&s=48" width="48" height="48" alt="sebslight" title="sebslight"/></a>
+  <a href="https://github.com/sircrumpet"><img src="https://avatars.githubusercontent.com/u/4436535?v=4&s=48" width="48" height="48" alt="sircrumpet" title="sircrumpet"/></a> <a href="https://github.com/peschee"><img src="https://avatars.githubusercontent.com/u/63866?v=4&s=48" width="48" height="48" alt="peschee" title="peschee"/></a> <a href="https://github.com/rafaelreis-r"><img src="https://avatars.githubusercontent.com/u/57492577?v=4&s=48" width="48" height="48" alt="rafaelreis-r" title="rafaelreis-r"/></a> <a href="https://github.com/ratulsarna"><img src="https://avatars.githubusercontent.com/u/105903728?v=4&s=48" width="48" height="48" alt="ratulsarna" title="ratulsarna"/></a> <a href="https://github.com/lutr0"><img src="https://avatars.githubusercontent.com/u/76906369?v=4&s=48" width="48" height="48" alt="lutr0" title="lutr0"/></a> <a href="https://github.com/thewilloftheshadow"><img src="https://avatars.githubusercontent.com/u/35580099?v=4&s=48" width="48" height="48" alt="thewilloftheshadow" title="thewilloftheshadow"/></a> <a href="https://github.com/gumadeiras"><img src="https://avatars.githubusercontent.com/u/5599352?v=4&s=48" width="48" height="48" alt="gumadeiras" title="gumadeiras"/></a> <a href="https://github.com/emanuelst"><img src="https://avatars.githubusercontent.com/u/9994339?v=4&s=48" width="48" height="48" alt="emanuelst" title="emanuelst"/></a> <a href="https://github.com/KristijanJovanovski"><img src="https://avatars.githubusercontent.com/u/8942284?v=4&s=48" width="48" height="48" alt="KristijanJovanovski" title="KristijanJovanovski"/></a> <a href="https://github.com/CashWilliams"><img src="https://avatars.githubusercontent.com/u/613573?v=4&s=48" width="48" height="48" alt="CashWilliams" title="CashWilliams"/></a>
-  <a href="https://github.com/search?q=sheeek"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="sheeek" title="sheeek"/></a> <a href="https://github.com/onutc"><img src="https://avatars.githubusercontent.com/u/152018508?v=4&s=48" width="48" height="48" alt="onutc" title="onutc"/></a> <a href="https://github.com/ManuelHettich"><img src="https://avatars.githubusercontent.com/u/17690367?v=4&s=48" width="48" height="48" alt="manuelhettich" title="manuelhettich"/></a> <a href="https://github.com/minghinmatthewlam"><img src="https://avatars.githubusercontent.com/u/14224566?v=4&s=48" width="48" height="48" alt="minghinmatthewlam" title="minghinmatthewlam"/></a> <a href="https://github.com/myfunc"><img src="https://avatars.githubusercontent.com/u/19294627?v=4&s=48" width="48" height="48" alt="myfunc" title="myfunc"/></a> <a href="https://github.com/buddyh"><img src="https://avatars.githubusercontent.com/u/31752869?v=4&s=48" width="48" height="48" alt="buddyh" title="buddyh"/></a> <a href="https://github.com/mcinteerj"><img src="https://avatars.githubusercontent.com/u/3613653?v=4&s=48" width="48" height="48" alt="mcinteerj" title="mcinteerj"/></a> <a href="https://github.com/timkrase"><img src="https://avatars.githubusercontent.com/u/38947626?v=4&s=48" width="48" height="48" alt="timkrase" title="timkrase"/></a> <a href="https://github.com/obviyus"><img src="https://avatars.githubusercontent.com/u/22031114?v=4&s=48" width="48" height="48" alt="obviyus" title="obviyus"/></a> <a href="https://github.com/azade-c"><img src="https://avatars.githubusercontent.com/u/252790079?v=4&s=48" width="48" height="48" alt="azade-c" title="azade-c"/></a>
+  <a href="https://github.com/rdev"><img src="https://avatars.githubusercontent.com/u/8418866?v=4&s=48" width="48" height="48" alt="rdev" title="rdev"/></a> <a href="https://github.com/osolmaz"><img src="https://avatars.githubusercontent.com/u/2453968?v=4&s=48" width="48" height="48" alt="osolmaz" title="osolmaz"/></a> <a href="https://github.com/kiranjd"><img src="https://avatars.githubusercontent.com/u/25822851?v=4&s=48" width="48" height="48" alt="kiranjd" title="kiranjd"/></a> <a href="https://github.com/sebslight"><img src="https://avatars.githubusercontent.com/u/19554889?v=4&s=48" width="48" height="48" alt="sebslight" title="sebslight"/></a> <a href="https://github.com/search?q=sheeek"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="sheeek" title="sheeek"/></a> <a href="https://github.com/onutc"><img src="https://avatars.githubusercontent.com/u/152018508?v=4&s=48" width="48" height="48" alt="onutc" title="onutc"/></a> <a href="https://github.com/ManuelHettich"><img src="https://avatars.githubusercontent.com/u/17690367?v=4&s=48" width="48" height="48" alt="manuelhettich" title="manuelhettich"/></a> <a href="https://github.com/minghinmatthewlam"><img src="https://avatars.githubusercontent.com/u/14224566?v=4&s=48" width="48" height="48" alt="minghinmatthewlam" title="minghinmatthewlam"/></a> <a href="https://github.com/myfunc"><img src="https://avatars.githubusercontent.com/u/19294627?v=4&s=48" width="48" height="48" alt="myfunc" title="myfunc"/></a> <a href="https://github.com/buddyh"><img src="https://avatars.githubusercontent.com/u/31752869?v=4&s=48" width="48" height="48" alt="buddyh" title="buddyh"/></a>
-  <a href="https://github.com/danielz1z"><img src="https://avatars.githubusercontent.com/u/235270390?v=4&s=48" width="48" height="48" alt="danielz1z" title="danielz1z"/></a> <a href="https://github.com/j1philli"><img src="https://avatars.githubusercontent.com/u/3744255?v=4&s=48" width="48" height="48" alt="Josh Phillips" title="Josh Phillips"/></a> <a href="https://github.com/bjesuiter"><img src="https://avatars.githubusercontent.com/u/2365676?v=4&s=48" width="48" height="48" alt="bjesuiter" title="bjesuiter"/></a> <a href="https://github.com/roshanasingh4"><img src="https://avatars.githubusercontent.com/u/88576930?v=4&s=48" width="48" height="48" alt="roshanasingh4" title="roshanasingh4"/></a> <a href="https://github.com/superman32432432"><img src="https://avatars.githubusercontent.com/u/7228420?v=4&s=48" width="48" height="48" alt="superman32432432" title="superman32432432"/></a> <a href="https://github.com/search?q=Yurii%20Chukhlib"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Yurii Chukhlib" title="Yurii Chukhlib"/></a> <a href="https://github.com/antons"><img src="https://avatars.githubusercontent.com/u/129705?v=4&s=48" width="48" height="48" alt="antons" title="antons"/></a> <a href="https://github.com/austinm911"><img src="https://avatars.githubusercontent.com/u/31991302?v=4&s=48" width="48" height="48" alt="austinm911" title="austinm911"/></a> <a href="https://github.com/apps/blacksmith-sh"><img src="https://avatars.githubusercontent.com/in/807020?v=4&s=48" width="48" height="48" alt="blacksmith-sh[bot]" title="blacksmith-sh[bot]"/></a> <a href="https://github.com/grp06"><img src="https://avatars.githubusercontent.com/u/1573959?v=4&s=48" width="48" height="48" alt="grp06" title="grp06"/></a>
+  <a href="https://github.com/mcinteerj"><img src="https://avatars.githubusercontent.com/u/3613653?v=4&s=48" width="48" height="48" alt="mcinteerj" title="mcinteerj"/></a> <a href="https://github.com/timkrase"><img src="https://avatars.githubusercontent.com/u/38947626?v=4&s=48" width="48" height="48" alt="timkrase" title="timkrase"/></a> <a href="https://github.com/obviyus"><img src="https://avatars.githubusercontent.com/u/22031114?v=4&s=48" width="48" height="48" alt="obviyus" title="obviyus"/></a> <a href="https://github.com/azade-c"><img src="https://avatars.githubusercontent.com/u/252790079?v=4&s=48" width="48" height="48" alt="azade-c" title="azade-c"/></a> <a href="https://github.com/bjesuiter"><img src="https://avatars.githubusercontent.com/u/2365676?v=4&s=48" width="48" height="48" alt="bjesuiter" title="bjesuiter"/></a> <a href="https://github.com/danielz1z"><img src="https://avatars.githubusercontent.com/u/235270390?v=4&s=48" width="48" height="48" alt="danielz1z" title="danielz1z"/></a> <a href="https://github.com/j1philli"><img src="https://avatars.githubusercontent.com/u/3744255?v=4&s=48" width="48" height="48" alt="Josh Phillips" title="Josh Phillips"/></a> <a href="https://github.com/roshanasingh4"><img src="https://avatars.githubusercontent.com/u/88576930?v=4&s=48" width="48" height="48" alt="roshanasingh4" title="roshanasingh4"/></a> <a href="https://github.com/superman32432432"><img src="https://avatars.githubusercontent.com/u/7228420?v=4&s=48" width="48" height="48" alt="superman32432432" title="superman32432432"/></a> <a href="https://github.com/search?q=Yurii%20Chukhlib"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Yurii Chukhlib" title="Yurii Chukhlib"/></a>
-  <a href="https://github.com/HeimdallStrategy"><img src="https://avatars.githubusercontent.com/u/223014405?v=4&s=48" width="48" height="48" alt="HeimdallStrategy" title="HeimdallStrategy"/></a> <a href="https://github.com/imfing"><img src="https://avatars.githubusercontent.com/u/5097752?v=4&s=48" width="48" height="48" alt="imfing" title="imfing"/></a> <a href="https://github.com/jarvis-medmatic"><img src="https://avatars.githubusercontent.com/u/252428873?v=4&s=48" width="48" height="48" alt="jarvis-medmatic" title="jarvis-medmatic"/></a> <a href="https://github.com/mahmoudashraf93"><img src="https://avatars.githubusercontent.com/u/9130129?v=4&s=48" width="48" height="48" alt="mahmoudashraf93" title="mahmoudashraf93"/></a> <a href="https://github.com/petter-b"><img src="https://avatars.githubusercontent.com/u/62076402?v=4&s=48" width="48" height="48" alt="petter-b" title="petter-b"/></a> <a href="https://github.com/pkrmf"><img src="https://avatars.githubusercontent.com/u/1714267?v=4&s=48" width="48" height="48" alt="pkrmf" title="pkrmf"/></a> <a href="https://github.com/RandyVentures"><img src="https://avatars.githubusercontent.com/u/149904821?v=4&s=48" width="48" height="48" alt="RandyVentures" title="RandyVentures"/></a> <a href="https://github.com/dan-dr"><img src="https://avatars.githubusercontent.com/u/6669808?v=4&s=48" width="48" height="48" alt="dan-dr" title="dan-dr"/></a> <a href="https://github.com/erikpr1994"><img src="https://avatars.githubusercontent.com/u/6299331?v=4&s=48" width="48" height="48" alt="erikpr1994" title="erikpr1994"/></a> <a href="https://github.com/jalehman"><img src="https://avatars.githubusercontent.com/u/550978?v=4&s=48" width="48" height="48" alt="jalehman" title="jalehman"/></a>
+  <a href="https://github.com/antons"><img src="https://avatars.githubusercontent.com/u/129705?v=4&s=48" width="48" height="48" alt="antons" title="antons"/></a> <a href="https://github.com/austinm911"><img src="https://avatars.githubusercontent.com/u/31991302?v=4&s=48" width="48" height="48" alt="austinm911" title="austinm911"/></a> <a href="https://github.com/apps/blacksmith-sh"><img src="https://avatars.githubusercontent.com/in/807020?v=4&s=48" width="48" height="48" alt="blacksmith-sh[bot]" title="blacksmith-sh[bot]"/></a> <a href="https://github.com/grp06"><img src="https://avatars.githubusercontent.com/u/1573959?v=4&s=48" width="48" height="48" alt="grp06" title="grp06"/></a> <a href="https://github.com/HeimdallStrategy"><img src="https://avatars.githubusercontent.com/u/223014405?v=4&s=48" width="48" height="48" alt="HeimdallStrategy" title="HeimdallStrategy"/></a> <a href="https://github.com/imfing"><img src="https://avatars.githubusercontent.com/u/5097752?v=4&s=48" width="48" height="48" alt="imfing" title="imfing"/></a> <a href="https://github.com/jalehman"><img src="https://avatars.githubusercontent.com/u/550978?v=4&s=48" width="48" height="48" alt="jalehman" title="jalehman"/></a> <a href="https://github.com/jarvis-medmatic"><img src="https://avatars.githubusercontent.com/u/252428873?v=4&s=48" width="48" height="48" alt="jarvis-medmatic" title="jarvis-medmatic"/></a> <a href="https://github.com/mahmoudashraf93"><img src="https://avatars.githubusercontent.com/u/9130129?v=4&s=48" width="48" height="48" alt="mahmoudashraf93" title="mahmoudashraf93"/></a> <a href="https://github.com/petter-b"><img src="https://avatars.githubusercontent.com/u/62076402?v=4&s=48" width="48" height="48" alt="petter-b" title="petter-b"/></a>
-  <a href="https://github.com/jonasjancarik"><img src="https://avatars.githubusercontent.com/u/2459191?v=4&s=48" width="48" height="48" alt="jonasjancarik" title="jonasjancarik"/></a> <a href="https://github.com/search?q=Keith%20the%20Silly%20Goose"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Keith the Silly Goose" title="Keith the Silly Goose"/></a> <a href="https://github.com/search?q=L36%20Server"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="L36 Server" title="L36 Server"/></a> <a href="https://github.com/mitschabaude-bot"><img src="https://avatars.githubusercontent.com/u/247582884?v=4&s=48" width="48" height="48" alt="mitschabaude-bot" title="mitschabaude-bot"/></a> <a href="https://github.com/neist"><img src="https://avatars.githubusercontent.com/u/1029724?v=4&s=48" width="48" height="48" alt="neist" title="neist"/></a> <a href="https://github.com/chrisrodz"><img src="https://avatars.githubusercontent.com/u/2967620?v=4&s=48" width="48" height="48" alt="chrisrodz" title="chrisrodz"/></a> <a href="https://github.com/search?q=Friederike%20Seiler"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Friederike Seiler" title="Friederike Seiler"/></a> <a href="https://github.com/gabriel-trigo"><img src="https://avatars.githubusercontent.com/u/38991125?v=4&s=48" width="48" height="48" alt="gabriel-trigo" title="gabriel-trigo"/></a> <a href="https://github.com/Iamadig"><img src="https://avatars.githubusercontent.com/u/102129234?v=4&s=48" width="48" height="48" alt="iamadig" title="iamadig"/></a> <a href="https://github.com/search?q=Kit"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kit" title="Kit"/></a>
+  <a href="https://github.com/pkrmf"><img src="https://avatars.githubusercontent.com/u/1714267?v=4&s=48" width="48" height="48" alt="pkrmf" title="pkrmf"/></a> <a href="https://github.com/RandyVentures"><img src="https://avatars.githubusercontent.com/u/149904821?v=4&s=48" width="48" height="48" alt="RandyVentures" title="RandyVentures"/></a> <a href="https://github.com/dan-dr"><img src="https://avatars.githubusercontent.com/u/6669808?v=4&s=48" width="48" height="48" alt="dan-dr" title="dan-dr"/></a> <a href="https://github.com/erikpr1994"><img src="https://avatars.githubusercontent.com/u/6299331?v=4&s=48" width="48" height="48" alt="erikpr1994" title="erikpr1994"/></a> <a href="https://github.com/jonasjancarik"><img src="https://avatars.githubusercontent.com/u/2459191?v=4&s=48" width="48" height="48" alt="jonasjancarik" title="jonasjancarik"/></a> <a href="https://github.com/search?q=Keith%20the%20Silly%20Goose"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Keith the Silly Goose" title="Keith the Silly Goose"/></a> <a href="https://github.com/kkarimi"><img src="https://avatars.githubusercontent.com/u/875218?v=4&s=48" width="48" height="48" alt="kkarimi" title="kkarimi"/></a> <a href="https://github.com/search?q=L36%20Server"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="L36 Server" title="L36 Server"/></a> <a href="https://github.com/mitschabaude-bot"><img src="https://avatars.githubusercontent.com/u/247582884?v=4&s=48" width="48" height="48" alt="mitschabaude-bot" title="mitschabaude-bot"/></a> <a href="https://github.com/neist"><img src="https://avatars.githubusercontent.com/u/1029724?v=4&s=48" width="48" height="48" alt="neist" title="neist"/></a>
-  <a href="https://github.com/koala73"><img src="https://avatars.githubusercontent.com/u/996596?v=4&s=48" width="48" height="48" alt="koala73" title="koala73"/></a> <a href="https://github.com/manmal"><img src="https://avatars.githubusercontent.com/u/142797?v=4&s=48" width="48" height="48" alt="manmal" title="manmal"/></a> <a href="https://github.com/ngutman"><img src="https://avatars.githubusercontent.com/u/1540134?v=4&s=48" width="48" height="48" alt="ngutman" title="ngutman"/></a> <a href="https://github.com/ogulcancelik"><img src="https://avatars.githubusercontent.com/u/7064011?v=4&s=48" width="48" height="48" alt="ogulcancelik" title="ogulcancelik"/></a> <a href="https://github.com/pasogott"><img src="https://avatars.githubusercontent.com/u/23458152?v=4&s=48" width="48" height="48" alt="pasogott" title="pasogott"/></a> <a href="https://github.com/petradonka"><img src="https://avatars.githubusercontent.com/u/7353770?v=4&s=48" width="48" height="48" alt="petradonka" title="petradonka"/></a> <a href="https://github.com/VACInc"><img src="https://avatars.githubusercontent.com/u/3279061?v=4&s=48" width="48" height="48" alt="VACInc" title="VACInc"/></a> <a href="https://github.com/zats"><img src="https://avatars.githubusercontent.com/u/2688806?v=4&s=48" width="48" height="48" alt="zats" title="zats"/></a> <a href="https://github.com/search?q=Chris%20Taylor"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Chris Taylor" title="Chris Taylor"/></a> <a href="https://github.com/djangonavarro220"><img src="https://avatars.githubusercontent.com/u/251162586?v=4&s=48" width="48" height="48" alt="Django Navarro" title="Django Navarro"/></a>
+  <a href="https://github.com/chrisrodz"><img src="https://avatars.githubusercontent.com/u/2967620?v=4&s=48" width="48" height="48" alt="chrisrodz" title="chrisrodz"/></a> <a href="https://github.com/search?q=Friederike%20Seiler"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Friederike Seiler" title="Friederike Seiler"/></a> <a href="https://github.com/gabriel-trigo"><img src="https://avatars.githubusercontent.com/u/38991125?v=4&s=48" width="48" height="48" alt="gabriel-trigo" title="gabriel-trigo"/></a> <a href="https://github.com/Iamadig"><img src="https://avatars.githubusercontent.com/u/102129234?v=4&s=48" width="48" height="48" alt="iamadig" title="iamadig"/></a> <a href="https://github.com/search?q=Kit"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kit" title="Kit"/></a> <a href="https://github.com/koala73"><img src="https://avatars.githubusercontent.com/u/996596?v=4&s=48" width="48" height="48" alt="koala73" title="koala73"/></a> <a href="https://github.com/manmal"><img src="https://avatars.githubusercontent.com/u/142797?v=4&s=48" width="48" height="48" alt="manmal" title="manmal"/></a> <a href="https://github.com/ngutman"><img src="https://avatars.githubusercontent.com/u/1540134?v=4&s=48" width="48" height="48" alt="ngutman" title="ngutman"/></a> <a href="https://github.com/ogulcancelik"><img src="https://avatars.githubusercontent.com/u/7064011?v=4&s=48" width="48" height="48" alt="ogulcancelik" title="ogulcancelik"/></a> <a href="https://github.com/pasogott"><img src="https://avatars.githubusercontent.com/u/23458152?v=4&s=48" width="48" height="48" alt="pasogott" title="pasogott"/></a>
-  <a href="https://github.com/pcty-nextgen-service-account"><img src="https://avatars.githubusercontent.com/u/112553441?v=4&s=48" width="48" height="48" alt="pcty-nextgen-service-account" title="pcty-nextgen-service-account"/></a> <a href="https://github.com/rubyrunsstuff"><img src="https://avatars.githubusercontent.com/u/246602379?v=4&s=48" width="48" height="48" alt="rubyrunsstuff" title="rubyrunsstuff"/></a> <a href="https://github.com/Syhids"><img src="https://avatars.githubusercontent.com/u/671202?v=4&s=48" width="48" height="48" alt="Syhids" title="Syhids"/></a> <a href="https://github.com/search?q=Aaron%20Konyer"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Aaron Konyer" title="Aaron Konyer"/></a> <a href="https://github.com/erik-agens"><img src="https://avatars.githubusercontent.com/u/80908960?v=4&s=48" width="48" height="48" alt="erik-agens" title="erik-agens"/></a> <a href="https://github.com/evalexpr"><img src="https://avatars.githubusercontent.com/u/23485511?v=4&s=48" width="48" height="48" alt="evalexpr" title="evalexpr"/></a> <a href="https://github.com/fcatuhe"><img src="https://avatars.githubusercontent.com/u/17382215?v=4&s=48" width="48" height="48" alt="fcatuhe" title="fcatuhe"/></a> <a href="https://github.com/gumadeiras"><img src="https://avatars.githubusercontent.com/u/5599352?v=4&s=48" width="48" height="48" alt="gumadeiras" title="gumadeiras"/></a> <a href="https://github.com/henrino3"><img src="https://avatars.githubusercontent.com/u/4260288?v=4&s=48" width="48" height="48" alt="henrino3" title="henrino3"/></a> <a href="https://github.com/jayhickey"><img src="https://avatars.githubusercontent.com/u/1676460?v=4&s=48" width="48" height="48" alt="jayhickey" title="jayhickey"/></a>
+  <a href="https://github.com/petradonka"><img src="https://avatars.githubusercontent.com/u/7353770?v=4&s=48" width="48" height="48" alt="petradonka" title="petradonka"/></a> <a href="https://github.com/VACInc"><img src="https://avatars.githubusercontent.com/u/3279061?v=4&s=48" width="48" height="48" alt="VACInc" title="VACInc"/></a> <a href="https://github.com/zats"><img src="https://avatars.githubusercontent.com/u/2688806?v=4&s=48" width="48" height="48" alt="zats" title="zats"/></a> <a href="https://github.com/search?q=Chris%20Taylor"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Chris Taylor" title="Chris Taylor"/></a> <a href="https://github.com/djangonavarro220"><img src="https://avatars.githubusercontent.com/u/251162586?v=4&s=48" width="48" height="48" alt="Django Navarro" title="Django Navarro"/></a> <a href="https://github.com/pcty-nextgen-service-account"><img src="https://avatars.githubusercontent.com/u/112553441?v=4&s=48" width="48" height="48" alt="pcty-nextgen-service-account" title="pcty-nextgen-service-account"/></a> <a href="https://github.com/rubyrunsstuff"><img src="https://avatars.githubusercontent.com/u/246602379?v=4&s=48" width="48" height="48" alt="rubyrunsstuff" title="rubyrunsstuff"/></a> <a href="https://github.com/Syhids"><img src="https://avatars.githubusercontent.com/u/671202?v=4&s=48" width="48" height="48" alt="Syhids" title="Syhids"/></a> <a href="https://github.com/search?q=Aaron%20Konyer"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Aaron Konyer" title="Aaron Konyer"/></a> <a href="https://github.com/adam91holt"><img src="https://avatars.githubusercontent.com/u/9592417?v=4&s=48" width="48" height="48" alt="adam91holt" title="adam91holt"/></a>
-  <a href="https://github.com/jeffersonwarrior"><img src="https://avatars.githubusercontent.com/u/89030989?v=4&s=48" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/search?q=jeffersonwarrior"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/jdrhyne"><img src="https://avatars.githubusercontent.com/u/7828464?v=4&s=48" width="48" height="48" alt="Jonathan D. Rhyne (DJ-D)" title="Jonathan D. Rhyne (DJ-D)"/></a> <a href="https://github.com/juanpablodlc"><img src="https://avatars.githubusercontent.com/u/92012363?v=4&s=48" width="48" height="48" alt="juanpablodlc" title="juanpablodlc"/></a> <a href="https://github.com/jverdi"><img src="https://avatars.githubusercontent.com/u/345050?v=4&s=48" width="48" height="48" alt="jverdi" title="jverdi"/></a> <a href="https://github.com/mickahouan"><img src="https://avatars.githubusercontent.com/u/31423109?v=4&s=48" width="48" height="48" alt="mickahouan" title="mickahouan"/></a> <a href="https://github.com/mjrussell"><img src="https://avatars.githubusercontent.com/u/1641895?v=4&s=48" width="48" height="48" alt="mjrussell" title="mjrussell"/></a> <a href="https://github.com/oswalpalash"><img src="https://avatars.githubusercontent.com/u/6431196?v=4&s=48" width="48" height="48" alt="oswalpalash" title="oswalpalash"/></a> <a href="https://github.com/p6l-richard"><img src="https://avatars.githubusercontent.com/u/18185649?v=4&s=48" width="48" height="48" alt="p6l-richard" title="p6l-richard"/></a> <a href="https://github.com/philipp-spiess"><img src="https://avatars.githubusercontent.com/u/458591?v=4&s=48" width="48" height="48" alt="philipp-spiess" title="philipp-spiess"/></a>
+  <a href="https://github.com/erik-agens"><img src="https://avatars.githubusercontent.com/u/80908960?v=4&s=48" width="48" height="48" alt="erik-agens" title="erik-agens"/></a> <a href="https://github.com/evalexpr"><img src="https://avatars.githubusercontent.com/u/23485511?v=4&s=48" width="48" height="48" alt="evalexpr" title="evalexpr"/></a> <a href="https://github.com/fcatuhe"><img src="https://avatars.githubusercontent.com/u/17382215?v=4&s=48" width="48" height="48" alt="fcatuhe" title="fcatuhe"/></a> <a href="https://github.com/henrino3"><img src="https://avatars.githubusercontent.com/u/4260288?v=4&s=48" width="48" height="48" alt="henrino3" title="henrino3"/></a> <a href="https://github.com/jayhickey"><img src="https://avatars.githubusercontent.com/u/1676460?v=4&s=48" width="48" height="48" alt="jayhickey" title="jayhickey"/></a> <a href="https://github.com/jeffersonwarrior"><img src="https://avatars.githubusercontent.com/u/89030989?v=4&s=48" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/search?q=jeffersonwarrior"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/jdrhyne"><img src="https://avatars.githubusercontent.com/u/7828464?v=4&s=48" width="48" height="48" alt="Jonathan D. Rhyne (DJ-D)" title="Jonathan D. Rhyne (DJ-D)"/></a> <a href="https://github.com/jverdi"><img src="https://avatars.githubusercontent.com/u/345050?v=4&s=48" width="48" height="48" alt="jverdi" title="jverdi"/></a> <a href="https://github.com/mickahouan"><img src="https://avatars.githubusercontent.com/u/31423109?v=4&s=48" width="48" height="48" alt="mickahouan" title="mickahouan"/></a>
-  <a href="https://github.com/robaxelsen"><img src="https://avatars.githubusercontent.com/u/13132899?v=4&s=48" width="48" height="48" alt="robaxelsen" title="robaxelsen"/></a> <a href="https://github.com/search?q=Sash%20Catanzarite"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Sash Catanzarite" title="Sash Catanzarite"/></a> <a href="https://github.com/search?q=VAC"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="VAC" title="VAC"/></a> <a href="https://github.com/zknicker"><img src="https://avatars.githubusercontent.com/u/1164085?v=4&s=48" width="48" height="48" alt="zknicker" title="zknicker"/></a> <a href="https://github.com/adam91holt"><img src="https://avatars.githubusercontent.com/u/9592417?v=4&s=48" width="48" height="48" alt="adam91holt" title="adam91holt"/></a> <a href="https://github.com/search?q=alejandro%20maza"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="alejandro maza" title="alejandro maza"/></a> <a href="https://github.com/andrewting19"><img src="https://avatars.githubusercontent.com/u/10536704?v=4&s=48" width="48" height="48" alt="andrewting19" title="andrewting19"/></a> <a href="https://github.com/Asleep123"><img src="https://avatars.githubusercontent.com/u/122379135?v=4&s=48" width="48" height="48" alt="Asleep123" title="Asleep123"/></a> <a href="https://github.com/bolismauro"><img src="https://avatars.githubusercontent.com/u/771999?v=4&s=48" width="48" height="48" alt="bolismauro" title="bolismauro"/></a> <a href="https://github.com/cash-echo-bot"><img src="https://avatars.githubusercontent.com/u/252747386?v=4&s=48" width="48" height="48" alt="cash-echo-bot" title="cash-echo-bot"/></a>
+  <a href="https://github.com/mjrussell"><img src="https://avatars.githubusercontent.com/u/1641895?v=4&s=48" width="48" height="48" alt="mjrussell" title="mjrussell"/></a> <a href="https://github.com/oswalpalash"><img src="https://avatars.githubusercontent.com/u/6431196?v=4&s=48" width="48" height="48" alt="oswalpalash" title="oswalpalash"/></a> <a href="https://github.com/p6l-richard"><img src="https://avatars.githubusercontent.com/u/18185649?v=4&s=48" width="48" height="48" alt="p6l-richard" title="p6l-richard"/></a> <a href="https://github.com/philipp-spiess"><img src="https://avatars.githubusercontent.com/u/458591?v=4&s=48" width="48" height="48" alt="philipp-spiess" title="philipp-spiess"/></a> <a href="https://github.com/robaxelsen"><img src="https://avatars.githubusercontent.com/u/13132899?v=4&s=48" width="48" height="48" alt="robaxelsen" title="robaxelsen"/></a> <a href="https://github.com/search?q=Sash%20Catanzarite"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Sash Catanzarite" title="Sash Catanzarite"/></a> <a href="https://github.com/search?q=VAC"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="VAC" title="VAC"/></a> <a href="https://github.com/zknicker"><img src="https://avatars.githubusercontent.com/u/1164085?v=4&s=48" width="48" height="48" alt="zknicker" title="zknicker"/></a> <a href="https://github.com/search?q=alejandro%20maza"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="alejandro maza" title="alejandro maza"/></a> <a href="https://github.com/andrewting19"><img src="https://avatars.githubusercontent.com/u/10536704?v=4&s=48" width="48" height="48" alt="andrewting19" title="andrewting19"/></a>
-  <a href="https://github.com/search?q=Clawd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Clawd" title="Clawd"/></a> <a href="https://github.com/conhecendocontato"><img src="https://avatars.githubusercontent.com/u/82890727?v=4&s=48" width="48" height="48" alt="conhecendocontato" title="conhecendocontato"/></a> <a href="https://github.com/search?q=Drake%20Thomsen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Drake Thomsen" title="Drake Thomsen"/></a> <a href="https://github.com/gtsifrikas"><img src="https://avatars.githubusercontent.com/u/8904378?v=4&s=48" width="48" height="48" alt="gtsifrikas" title="gtsifrikas"/></a> <a href="https://github.com/HazAT"><img src="https://avatars.githubusercontent.com/u/363802?v=4&s=48" width="48" height="48" alt="HazAT" title="HazAT"/></a> <a href="https://github.com/hrdwdmrbl"><img src="https://avatars.githubusercontent.com/u/554881?v=4&s=48" width="48" height="48" alt="hrdwdmrbl" title="hrdwdmrbl"/></a> <a href="https://github.com/hugobarauna"><img src="https://avatars.githubusercontent.com/u/2719?v=4&s=48" width="48" height="48" alt="hugobarauna" title="hugobarauna"/></a> <a href="https://github.com/search?q=Jarvis"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jarvis" title="Jarvis"/></a> <a href="https://github.com/search?q=Jefferson%20Nunn"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jefferson Nunn" title="Jefferson Nunn"/></a> <a href="https://github.com/kitze"><img src="https://avatars.githubusercontent.com/u/1160594?v=4&s=48" width="48" height="48" alt="kitze" title="kitze"/></a>
+  <a href="https://github.com/Asleep123"><img src="https://avatars.githubusercontent.com/u/122379135?v=4&s=48" width="48" height="48" alt="Asleep123" title="Asleep123"/></a> <a href="https://github.com/bolismauro"><img src="https://avatars.githubusercontent.com/u/771999?v=4&s=48" width="48" height="48" alt="bolismauro" title="bolismauro"/></a> <a href="https://github.com/cash-echo-bot"><img src="https://avatars.githubusercontent.com/u/252747386?v=4&s=48" width="48" height="48" alt="cash-echo-bot" title="cash-echo-bot"/></a> <a href="https://github.com/search?q=Clawd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Clawd" title="Clawd"/></a> <a href="https://github.com/conhecendocontato"><img src="https://avatars.githubusercontent.com/u/82890727?v=4&s=48" width="48" height="48" alt="conhecendocontato" title="conhecendocontato"/></a> <a href="https://github.com/search?q=Drake%20Thomsen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Drake Thomsen" title="Drake Thomsen"/></a> <a href="https://github.com/gtsifrikas"><img src="https://avatars.githubusercontent.com/u/8904378?v=4&s=48" width="48" height="48" alt="gtsifrikas" title="gtsifrikas"/></a> <a href="https://github.com/HazAT"><img src="https://avatars.githubusercontent.com/u/363802?v=4&s=48" width="48" height="48" alt="HazAT" title="HazAT"/></a> <a href="https://github.com/hrdwdmrbl"><img src="https://avatars.githubusercontent.com/u/554881?v=4&s=48" width="48" height="48" alt="hrdwdmrbl" title="hrdwdmrbl"/></a> <a href="https://github.com/hugobarauna"><img src="https://avatars.githubusercontent.com/u/2719?v=4&s=48" width="48" height="48" alt="hugobarauna" title="hugobarauna"/></a>
-  <a href="https://github.com/kkarimi"><img src="https://avatars.githubusercontent.com/u/875218?v=4&s=48" width="48" height="48" alt="kkarimi" title="kkarimi"/></a> <a href="https://github.com/levifig"><img src="https://avatars.githubusercontent.com/u/1605?v=4&s=48" width="48" height="48" alt="levifig" title="levifig"/></a> <a href="https://github.com/search?q=Lloyd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Lloyd" title="Lloyd"/></a> <a href="https://github.com/loukotal"><img src="https://avatars.githubusercontent.com/u/18210858?v=4&s=48" width="48" height="48" alt="loukotal" title="loukotal"/></a> <a href="https://github.com/search?q=Marc"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Marc" title="Marc"/></a> <a href="https://github.com/martinpucik"><img src="https://avatars.githubusercontent.com/u/5503097?v=4&s=48" width="48" height="48" alt="martinpucik" title="martinpucik"/></a> <a href="https://github.com/search?q=Miles"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Miles" title="Miles"/></a> <a href="https://github.com/mrdbstn"><img src="https://avatars.githubusercontent.com/u/58957632?v=4&s=48" width="48" height="48" alt="mrdbstn" title="mrdbstn"/></a> <a href="https://github.com/MSch"><img src="https://avatars.githubusercontent.com/u/7475?v=4&s=48" width="48" height="48" alt="MSch" title="MSch"/></a> <a href="https://github.com/search?q=Mustafa%20Tag%20Eldeen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mustafa Tag Eldeen" title="Mustafa Tag Eldeen"/></a>
+  <a href="https://github.com/search?q=Jarvis"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jarvis" title="Jarvis"/></a> <a href="https://github.com/search?q=Jefferson%20Nunn"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jefferson Nunn" title="Jefferson Nunn"/></a> <a href="https://github.com/kitze"><img src="https://avatars.githubusercontent.com/u/1160594?v=4&s=48" width="48" height="48" alt="kitze" title="kitze"/></a> <a href="https://github.com/levifig"><img src="https://avatars.githubusercontent.com/u/1605?v=4&s=48" width="48" height="48" alt="levifig" title="levifig"/></a> <a href="https://github.com/search?q=Lloyd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Lloyd" title="Lloyd"/></a> <a href="https://github.com/loukotal"><img src="https://avatars.githubusercontent.com/u/18210858?v=4&s=48" width="48" height="48" alt="loukotal" title="loukotal"/></a> <a href="https://github.com/search?q=Marc"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Marc" title="Marc"/></a> <a href="https://github.com/martinpucik"><img src="https://avatars.githubusercontent.com/u/5503097?v=4&s=48" width="48" height="48" alt="martinpucik" title="martinpucik"/></a> <a href="https://github.com/search?q=Miles"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Miles" title="Miles"/></a> <a href="https://github.com/mrdbstn"><img src="https://avatars.githubusercontent.com/u/58957632?v=4&s=48" width="48" height="48" alt="mrdbstn" title="mrdbstn"/></a>
-  <a href="https://github.com/ndraiman"><img src="https://avatars.githubusercontent.com/u/12609607?v=4&s=48" width="48" height="48" alt="ndraiman" title="ndraiman"/></a> <a href="https://github.com/nexty5870"><img src="https://avatars.githubusercontent.com/u/3869659?v=4&s=48" width="48" height="48" alt="nexty5870" title="nexty5870"/></a> <a href="https://github.com/prathamdby"><img src="https://avatars.githubusercontent.com/u/134331217?v=4&s=48" width="48" height="48" alt="prathamdby" title="prathamdby"/></a> <a href="https://github.com/reeltimeapps"><img src="https://avatars.githubusercontent.com/u/637338?v=4&s=48" width="48" height="48" alt="reeltimeapps" title="reeltimeapps"/></a> <a href="https://github.com/RLTCmpe"><img src="https://avatars.githubusercontent.com/u/10762242?v=4&s=48" width="48" height="48" alt="RLTCmpe" title="RLTCmpe"/></a> <a href="https://github.com/search?q=Rolf%20Fredheim"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rolf Fredheim" title="Rolf Fredheim"/></a> <a href="https://github.com/search?q=Rony%20Kelner"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rony Kelner" title="Rony Kelner"/></a> <a href="https://github.com/search?q=Samrat%20Jha"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Samrat Jha" title="Samrat Jha"/></a> <a href="https://github.com/siraht"><img src="https://avatars.githubusercontent.com/u/73152895?v=4&s=48" width="48" height="48" alt="siraht" title="siraht"/></a> <a href="https://github.com/snopoke"><img src="https://avatars.githubusercontent.com/u/249606?v=4&s=48" width="48" height="48" alt="snopoke" title="snopoke"/></a>
+  <a href="https://github.com/MSch"><img src="https://avatars.githubusercontent.com/u/7475?v=4&s=48" width="48" height="48" alt="MSch" title="MSch"/></a> <a href="https://github.com/search?q=Mustafa%20Tag%20Eldeen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mustafa Tag Eldeen" title="Mustafa Tag Eldeen"/></a> <a href="https://github.com/ndraiman"><img src="https://avatars.githubusercontent.com/u/12609607?v=4&s=48" width="48" height="48" alt="ndraiman" title="ndraiman"/></a> <a href="https://github.com/nexty5870"><img src="https://avatars.githubusercontent.com/u/3869659?v=4&s=48" width="48" height="48" alt="nexty5870" title="nexty5870"/></a> <a href="https://github.com/prathamdby"><img src="https://avatars.githubusercontent.com/u/134331217?v=4&s=48" width="48" height="48" alt="prathamdby" title="prathamdby"/></a> <a href="https://github.com/reeltimeapps"><img src="https://avatars.githubusercontent.com/u/637338?v=4&s=48" width="48" height="48" alt="reeltimeapps" title="reeltimeapps"/></a> <a href="https://github.com/RLTCmpe"><img src="https://avatars.githubusercontent.com/u/10762242?v=4&s=48" width="48" height="48" alt="RLTCmpe" title="RLTCmpe"/></a> <a href="https://github.com/search?q=Rolf%20Fredheim"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rolf Fredheim" title="Rolf Fredheim"/></a> <a href="https://github.com/search?q=Rony%20Kelner"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rony Kelner" title="Rony Kelner"/></a> <a href="https://github.com/search?q=Samrat%20Jha"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Samrat Jha" title="Samrat Jha"/></a>
-  <a href="https://github.com/search?q=The%20Admiral"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="The Admiral" title="The Admiral"/></a> <a href="https://github.com/wes-davis"><img src="https://avatars.githubusercontent.com/u/16506720?v=4&s=48" width="48" height="48" alt="wes-davis" title="wes-davis"/></a> <a href="https://github.com/wstock"><img src="https://avatars.githubusercontent.com/u/1394687?v=4&s=48" width="48" height="48" alt="wstock" title="wstock"/></a> <a href="https://github.com/YuriNachos"><img src="https://avatars.githubusercontent.com/u/19365375?v=4&s=48" width="48" height="48" alt="YuriNachos" title="YuriNachos"/></a> <a href="https://github.com/search?q=Zach%20Knickerbocker"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Zach Knickerbocker" title="Zach Knickerbocker"/></a> <a href="https://github.com/search?q=Azade"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Azade" title="Azade"/></a> <a href="https://github.com/carlulsoe"><img src="https://avatars.githubusercontent.com/u/34673973?v=4&s=48" width="48" height="48" alt="carlulsoe" title="carlulsoe"/></a> <a href="https://github.com/cpojer"><img src="https://avatars.githubusercontent.com/u/13352?v=4&s=48" width="48" height="48" alt="cpojer" title="cpojer"/></a> <a href="https://github.com/search?q=ddyo"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ddyo" title="ddyo"/></a> <a href="https://github.com/search?q=Erik"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Erik" title="Erik"/></a>
+  <a href="https://github.com/siraht"><img src="https://avatars.githubusercontent.com/u/73152895?v=4&s=48" width="48" height="48" alt="siraht" title="siraht"/></a> <a href="https://github.com/snopoke"><img src="https://avatars.githubusercontent.com/u/249606?v=4&s=48" width="48" height="48" alt="snopoke" title="snopoke"/></a> <a href="https://github.com/search?q=The%20Admiral"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="The Admiral" title="The Admiral"/></a> <a href="https://github.com/voidserf"><img src="https://avatars.githubusercontent.com/u/477673?v=4&s=48" width="48" height="48" alt="voidserf" title="voidserf"/></a> <a href="https://github.com/wes-davis"><img src="https://avatars.githubusercontent.com/u/16506720?v=4&s=48" width="48" height="48" alt="wes-davis" title="wes-davis"/></a> <a href="https://github.com/wstock"><img src="https://avatars.githubusercontent.com/u/1394687?v=4&s=48" width="48" height="48" alt="wstock" title="wstock"/></a> <a href="https://github.com/YuriNachos"><img src="https://avatars.githubusercontent.com/u/19365375?v=4&s=48" width="48" height="48" alt="YuriNachos" title="YuriNachos"/></a> <a href="https://github.com/search?q=Zach%20Knickerbocker"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Zach Knickerbocker" title="Zach Knickerbocker"/></a> <a href="https://github.com/Alphonse-arianee"><img src="https://avatars.githubusercontent.com/u/254457365?v=4&s=48" width="48" height="48" alt="Alphonse-arianee" title="Alphonse-arianee"/></a> <a href="https://github.com/search?q=Azade"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Azade" title="Azade"/></a>
-  <a href="https://github.com/latitudeki5223"><img src="https://avatars.githubusercontent.com/u/119656367?v=4&s=48" width="48" height="48" alt="latitudeki5223" title="latitudeki5223"/></a> <a href="https://github.com/longmaba"><img src="https://avatars.githubusercontent.com/u/9361500?v=4&s=48" width="48" height="48" alt="longmaba" title="longmaba"/></a> <a href="https://github.com/search?q=Manuel%20Maly"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Manuel Maly" title="Manuel Maly"/></a> <a href="https://github.com/search?q=Mourad%20Boustani"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mourad Boustani" title="Mourad Boustani"/></a> <a href="https://github.com/pcty-nextgen-ios-builder"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="pcty-nextgen-ios-builder" title="pcty-nextgen-ios-builder"/></a> <a href="https://github.com/search?q=Quentin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Quentin" title="Quentin"/></a> <a href="https://github.com/search?q=Randy%20Torres"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Randy Torres" title="Randy Torres"/></a> <a href="https://github.com/ronak-guliani"><img src="https://avatars.githubusercontent.com/u/23518228?v=4&s=48" width="48" height="48" alt="ronak-guliani" title="ronak-guliani"/></a> <a href="https://github.com/thesash"><img src="https://avatars.githubusercontent.com/u/1166151?v=4&s=48" width="48" height="48" alt="thesash" title="thesash"/></a> <a href="https://github.com/search?q=William%20Stock"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="William Stock" title="William Stock"/></a>
+  <a href="https://github.com/carlulsoe"><img src="https://avatars.githubusercontent.com/u/34673973?v=4&s=48" width="48" height="48" alt="carlulsoe" title="carlulsoe"/></a> <a href="https://github.com/cpojer"><img src="https://avatars.githubusercontent.com/u/13352?v=4&s=48" width="48" height="48" alt="cpojer" title="cpojer"/></a> <a href="https://github.com/search?q=ddyo"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ddyo" title="ddyo"/></a> <a href="https://github.com/search?q=Erik"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Erik" title="Erik"/></a> <a href="https://github.com/latitudeki5223"><img src="https://avatars.githubusercontent.com/u/119656367?v=4&s=48" width="48" height="48" alt="latitudeki5223" title="latitudeki5223"/></a> <a href="https://github.com/longmaba"><img src="https://avatars.githubusercontent.com/u/9361500?v=4&s=48" width="48" height="48" alt="longmaba" title="longmaba"/></a> <a href="https://github.com/search?q=Manuel%20Maly"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Manuel Maly" title="Manuel Maly"/></a> <a href="https://github.com/search?q=Mourad%20Boustani"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mourad Boustani" title="Mourad Boustani"/></a> <a href="https://github.com/pcty-nextgen-ios-builder"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="pcty-nextgen-ios-builder" title="pcty-nextgen-ios-builder"/></a> <a href="https://github.com/search?q=Quentin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Quentin" title="Quentin"/></a>
  <a href="https://github.com/search?q=Randy%20Torres"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Randy Torres" title="Randy Torres"/></a> <a href="https://github.com/ronak-guliani"><img src="https://avatars.githubusercontent.com/u/23518228?v=4&s=48" width="48" height="48" alt="ronak-guliani" title="ronak-guliani"/></a> <a href="https://github.com/thesash"><img src="https://avatars.githubusercontent.com/u/1166151?v=4&s=48" width="48" height="48" alt="thesash" title="thesash"/></a> <a href="https://github.com/search?q=William%20Stock"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="William Stock" title="William Stock"/></a>
 </p>
@@ -119,7 +119,7 @@ dependencies {
  testImplementation("io.kotest:kotest-runner-junit5-jvm:6.0.7")
  testImplementation("io.kotest:kotest-assertions-core-jvm:6.0.7")
  testImplementation("org.robolectric:robolectric:4.16")
-  testRuntimeOnly("org.junit.vintage:junit-vintage-engine:6.0.1")
+  testRuntimeOnly("org.junit.vintage:junit-vintage-engine:6.0.2")
 }
 tasks.withType<Test>().configureEach {
@@ -16,6 +16,7 @@ import com.clawdbot.android.bridge.BridgeDiscovery
 import com.clawdbot.android.bridge.BridgeEndpoint
 import com.clawdbot.android.bridge.BridgePairingClient
 import com.clawdbot.android.bridge.BridgeSession
 import com.clawdbot.android.bridge.BridgeTlsParams
 import com.clawdbot.android.node.CameraCaptureManager
 import com.clawdbot.android.node.LocationCaptureManager
 import com.clawdbot.android.BuildConfig
@@ -160,6 +161,9 @@ class NodeRuntime(context: Context) {
      onInvoke = { req ->
        handleInvoke(req.command, req.paramsJson)
      },
      onTlsFingerprint = { stableId, fingerprint ->
        prefs.saveBridgeTlsFingerprint(stableId, fingerprint)
      },
    )
  private val chat = ChatController(scope = scope, session = session, json = json)
@@ -488,12 +492,17 @@ class NodeRuntime(context: Context) {
    scope.launch {
      _statusText.value = "Connecting…"
      val storedToken = prefs.loadBridgeToken()
      val tls = resolveTlsParams(endpoint)
      val resolved =
        if (storedToken.isNullOrBlank()) {
          _statusText.value = "Pairing…"
          BridgePairingClient().pairAndHello(
            endpoint = endpoint,
            hello = buildPairingHello(token = null),
            tls = tls,
            onTlsFingerprint = { fingerprint ->
              prefs.saveBridgeTlsFingerprint(endpoint.stableId, fingerprint)
            },
          )
        } else {
          BridgePairingClient.PairResult(ok = true, token = storedToken.trim())
@@ -510,6 +519,7 @@ class NodeRuntime(context: Context) {
      session.connect(
        endpoint = endpoint,
        hello = buildSessionHello(token = authToken),
        tls = tls,
      )
    }
  }
@@ -556,6 +566,41 @@ class NodeRuntime(context: Context) {
    session.disconnect()
  }
  private fun resolveTlsParams(endpoint: BridgeEndpoint): BridgeTlsParams? {
    val stored = prefs.loadBridgeTlsFingerprint(endpoint.stableId)
    val hinted = endpoint.tlsEnabled || !endpoint.tlsFingerprintSha256.isNullOrBlank()
    val manual = endpoint.stableId.startsWith("manual|")
    if (hinted) {
      return BridgeTlsParams(
        required = true,
        expectedFingerprint = endpoint.tlsFingerprintSha256 ?: stored,
        allowTOFU = stored == null,
        stableId = endpoint.stableId,
      )
    }
    if (!stored.isNullOrBlank()) {
      return BridgeTlsParams(
        required = true,
        expectedFingerprint = stored,
        allowTOFU = false,
        stableId = endpoint.stableId,
      )
    }
    if (manual) {
      return BridgeTlsParams(
        required = false,
        expectedFingerprint = null,
        allowTOFU = true,
        stableId = endpoint.stableId,
      )
    }
    return null
  }
  fun handleCanvasA2UIActionFromWebView(payloadJson: String) {
    scope.launch {
      val trimmed = payloadJson.trim()
@@ -147,6 +147,16 @@ class SecurePrefs(context: Context) {
    prefs.edit { putString(key, token.trim()) }
  }
  fun loadBridgeTlsFingerprint(stableId: String): String? {
    val key = "bridge.tls.$stableId"
    return prefs.getString(key, null)?.trim()?.takeIf { it.isNotEmpty() }
  }
  fun saveBridgeTlsFingerprint(stableId: String, fingerprint: String) {
    val key = "bridge.tls.$stableId"
    prefs.edit { putString(key, fingerprint.trim()) }
  }
  private fun loadOrCreateInstanceId(): String {
    val existing = prefs.getString("node.instanceId", null)?.trim()
    if (!existing.isNullOrBlank()) return existing
@@ -143,6 +143,8 @@ class BridgeDiscovery(
        val gatewayPort = txtInt(resolved, "gatewayPort")
        val bridgePort = txtInt(resolved, "bridgePort")
        val canvasPort = txtInt(resolved, "canvasPort")
        val tlsEnabled = txtBool(resolved, "bridgeTls")
        val tlsFingerprint = txt(resolved, "bridgeTlsSha256")
        val id = stableId(serviceName, "local.")
        localById[id] =
          BridgeEndpoint(
@@ -155,6 +157,8 @@ class BridgeDiscovery(
            gatewayPort = gatewayPort,
            bridgePort = bridgePort,
            canvasPort = canvasPort,
            tlsEnabled = tlsEnabled,
            tlsFingerprintSha256 = tlsFingerprint,
          )
        publish()
      }
@@ -209,6 +213,11 @@ class BridgeDiscovery(
    return txt(info, key)?.toIntOrNull()
  }
  private fun txtBool(info: NsdServiceInfo, key: String): Boolean {
    val raw = txt(info, key)?.trim()?.lowercase() ?: return false
    return raw == "1" || raw == "true" || raw == "yes"
  }
  private suspend fun refreshUnicast(domain: String) {
    val ptrName = "${serviceType}${domain}"
    val ptrMsg = lookupUnicastMessage(ptrName, Type.PTR) ?: return
@@ -252,6 +261,8 @@ class BridgeDiscovery(
      val gatewayPort = txtIntValue(txt, "gatewayPort")
      val bridgePort = txtIntValue(txt, "bridgePort")
      val canvasPort = txtIntValue(txt, "canvasPort")
      val tlsEnabled = txtBoolValue(txt, "bridgeTls")
      val tlsFingerprint = txtValue(txt, "bridgeTlsSha256")
      val id = stableId(instanceName, domain)
      next[id] =
        BridgeEndpoint(
@@ -264,6 +275,8 @@ class BridgeDiscovery(
          gatewayPort = gatewayPort,
          bridgePort = bridgePort,
          canvasPort = canvasPort,
          tlsEnabled = tlsEnabled,
          tlsFingerprintSha256 = tlsFingerprint,
        )
    }
@@ -474,6 +487,11 @@ class BridgeDiscovery(
    return txtValue(records, key)?.toIntOrNull()
  }
  private fun txtBoolValue(records: List<TXTRecord>, key: String): Boolean {
    val raw = txtValue(records, key)?.trim()?.lowercase() ?: return false
    return raw == "1" || raw == "true" || raw == "yes"
  }
  private fun decodeDnsTxtString(raw: String): String {
    // dnsjava treats TXT as opaque bytes and decodes as ISO-8859-1 to preserve bytes.
    // Our TXT payload is UTF-8 (written by the gateway), so re-decode when possible.
@@ -10,6 +10,8 @@ data class BridgeEndpoint(
  val gatewayPort: Int? = null,
  val bridgePort: Int? = null,
  val canvasPort: Int? = null,
  val tlsEnabled: Boolean = false,
  val tlsFingerprintSha256: String? = null,
 ) {
  companion object {
    fun manual(host: String, port: Int): BridgeEndpoint =
@@ -18,6 +20,8 @@ data class BridgeEndpoint(
        name = "$host:$port",
        host = host,
        port = port,
        tlsEnabled = false,
        tlsFingerprintSha256 = null,
      )
  }
 }
@@ -14,7 +14,6 @@ import java.io.BufferedWriter
 import java.io.InputStreamReader
 import java.io.OutputStreamWriter
 import java.net.InetSocketAddress
 import java.net.Socket
 class BridgePairingClient {
  private val json = Json { ignoreUnknownKeys = true }
@@ -33,13 +32,38 @@ class BridgePairingClient {
  data class PairResult(val ok: Boolean, val token: String?, val error: String? = null)
-  suspend fun pairAndHello(endpoint: BridgeEndpoint, hello: Hello): PairResult =
+  suspend fun pairAndHello(
    endpoint: BridgeEndpoint,
    hello: Hello,
    tls: BridgeTlsParams? = null,
    onTlsFingerprint: ((String) -> Unit)? = null,
  ): PairResult =
    withContext(Dispatchers.IO) {
-      val socket = Socket()
+      if (tls != null) {
        try {
          return@withContext pairAndHelloWithTls(endpoint, hello, tls, onTlsFingerprint)
        } catch (e: Exception) {
          if (tls.required) throw e
        }
      }
      pairAndHelloWithTls(endpoint, hello, null, null)
    }
  private fun pairAndHelloWithTls(
    endpoint: BridgeEndpoint,
    hello: Hello,
    tls: BridgeTlsParams?,
    onTlsFingerprint: ((String) -> Unit)?,
  ): PairResult {
    val socket =
      createBridgeSocket(tls) { fingerprint ->
        onTlsFingerprint?.invoke(fingerprint)
      }
    socket.tcpNoDelay = true
    try {
      socket.connect(InetSocketAddress(endpoint.host, endpoint.port), 8_000)
      socket.soTimeout = 60_000
      startTlsHandshakeIfNeeded(socket)
      val reader = BufferedReader(InputStreamReader(socket.getInputStream(), Charsets.UTF_8))
      val writer = BufferedWriter(OutputStreamWriter(socket.getOutputStream(), Charsets.UTF_8))
@@ -68,14 +92,14 @@ class BridgePairingClient {
      )
      val firstObj = json.parseToJsonElement(reader.readLine()).asObjectOrNull()
-          ?: return@withContext PairResult(ok = false, token = null, error = "unexpected bridge response")
+        ?: return PairResult(ok = false, token = null, error = "unexpected bridge response")
-        when (firstObj["type"].asStringOrNull()) {
+      return when (firstObj["type"].asStringOrNull()) {
        "hello-ok" -> PairResult(ok = true, token = hello.token)
        "error" -> {
          val code = firstObj["code"].asStringOrNull() ?: "UNAVAILABLE"
          val message = firstObj["message"].asStringOrNull() ?: "pairing required"
          if (code != "NOT_PAIRED" && code != "UNAUTHORIZED") {
-              return@withContext PairResult(ok = false, token = null, error = "$code: $message")
+            return PairResult(ok = false, token = null, error = "$code: $message")
          }
          sendJson(
@@ -98,12 +122,12 @@ class BridgePairingClient {
            when (next["type"].asStringOrNull()) {
              "pair-ok" -> {
                val token = next["token"].asStringOrNull()
-                  return@withContext PairResult(ok = !token.isNullOrBlank(), token = token)
+                return PairResult(ok = !token.isNullOrBlank(), token = token)
              }
              "error" -> {
                val c = next["code"].asStringOrNull() ?: "UNAVAILABLE"
                val m = next["message"].asStringOrNull() ?: "pairing failed"
-                  return@withContext PairResult(ok = false, token = null, error = "$c: $m")
+                return PairResult(ok = false, token = null, error = "$c: $m")
              }
            }
          }
@@ -113,7 +137,7 @@ class BridgePairingClient {
      }
    } catch (e: Exception) {
      val message = e.message?.trim().orEmpty().ifEmpty { "gateway unreachable" }
-        PairResult(ok = false, token = null, error = message)
+      return PairResult(ok = false, token = null, error = message)
    } finally {
      try {
        socket.close()
@@ -35,6 +35,7 @@ class BridgeSession(
  private val onDisconnected: (message: String) -> Unit,
  private val onEvent: (event: String, payloadJson: String?) -> Unit,
  private val onInvoke: suspend (InvokeRequest) -> InvokeResult,
  private val onTlsFingerprint: ((stableId: String, fingerprint: String) -> Unit)? = null,
 ) {
  data class Hello(
    val nodeId: String,
@@ -66,11 +67,17 @@ class BridgeSession(
  @Volatile private var canvasHostUrl: String? = null
  @Volatile private var mainSessionKey: String? = null
-  private var desired: Pair<BridgeEndpoint, Hello>? = null
+  private data class DesiredConnection(
    val endpoint: BridgeEndpoint,
    val hello: Hello,
    val tls: BridgeTlsParams?,
  )
  private var desired: DesiredConnection? = null
  private var job: Job? = null
-  fun connect(endpoint: BridgeEndpoint, hello: Hello) {
+  fun connect(endpoint: BridgeEndpoint, hello: Hello, tls: BridgeTlsParams? = null) {
-    desired = endpoint to hello
+    desired = DesiredConnection(endpoint, hello, tls)
    if (job == null) {
      job = scope.launch(Dispatchers.IO) { runLoop() }
    }
@@ -78,7 +85,7 @@ class BridgeSession(
  suspend fun updateHello(hello: Hello) {
    val target = desired ?: return
-    desired = target.first to hello
+    desired = target.copy(hello = hello)
    val conn = currentConnection ?: return
    conn.sendJson(buildHelloJson(hello))
  }
@@ -165,10 +172,10 @@ class BridgeSession(
        continue
      }
-      val (endpoint, hello) = target
+      val (endpoint, hello, tls) = target
      try {
        onDisconnected(if (attempt == 0) "Connecting…" else "Reconnecting…")
-        connectOnce(endpoint, hello)
+        connectOnce(endpoint, hello, tls)
        attempt = 0
      } catch (err: Throwable) {
        attempt += 1
@@ -192,12 +199,28 @@ class BridgeSession(
    return InvokeResult.error(code = "UNAVAILABLE", message = msg)
  }
-  private suspend fun connectOnce(endpoint: BridgeEndpoint, hello: Hello) =
+  private suspend fun connectOnce(endpoint: BridgeEndpoint, hello: Hello, tls: BridgeTlsParams?) =
    withContext(Dispatchers.IO) {
-      val socket = Socket()
+      if (tls != null) {
        try {
          connectWithSocket(endpoint, hello, tls)
          return@withContext
        } catch (err: Throwable) {
          if (tls.required) throw err
        }
      }
      connectWithSocket(endpoint, hello, null)
    }
  private suspend fun connectWithSocket(endpoint: BridgeEndpoint, hello: Hello, tls: BridgeTlsParams?) {
    val socket =
      createBridgeSocket(tls) { fingerprint ->
        onTlsFingerprint?.invoke(tls?.stableId ?: endpoint.stableId, fingerprint)
      }
    socket.tcpNoDelay = true
    socket.connect(InetSocketAddress(endpoint.host, endpoint.port), 8_000)
    socket.soTimeout = 0
    startTlsHandshakeIfNeeded(socket)
    val reader = BufferedReader(InputStreamReader(socket.getInputStream(), Charsets.UTF_8))
    val writer = BufferedWriter(OutputStreamWriter(socket.getOutputStream(), Charsets.UTF_8))
@@ -242,7 +265,7 @@ class BridgeSession(
        val frame = json.parseToJsonElement(line).asObjectOrNull() ?: continue
        when (frame["type"].asStringOrNull()) {
          "event" -> {
-              val event = frame["event"].asStringOrNull() ?: return@withContext
+            val event = frame["event"].asStringOrNull() ?: continue
            val payload = frame["payloadJSON"].asStringOrNull()
            onEvent(event, payload)
          }
@@ -0,0 +1,81 @@
 package com.clawdbot.android.bridge
 import android.annotation.SuppressLint
 import java.net.Socket
 import java.security.MessageDigest
 import java.security.SecureRandom
 import java.security.cert.CertificateException
 import java.security.cert.X509Certificate
 import javax.net.ssl.SSLContext
 import javax.net.ssl.SSLSocket
 import javax.net.ssl.TrustManagerFactory
 import javax.net.ssl.X509TrustManager
 data class BridgeTlsParams(
  val required: Boolean,
  val expectedFingerprint: String?,
  val allowTOFU: Boolean,
  val stableId: String,
 )
 fun createBridgeSocket(params: BridgeTlsParams?, onStore: ((String) -> Unit)? = null): Socket {
  if (params == null) return Socket()
  val expected = params.expectedFingerprint?.let(::normalizeFingerprint)
  val defaultTrust = defaultTrustManager()
  @SuppressLint("CustomX509TrustManager")
  val trustManager =
    object : X509TrustManager {
      override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) {
        defaultTrust.checkClientTrusted(chain, authType)
      }
      override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) {
        if (chain.isEmpty()) throw CertificateException("empty certificate chain")
        val fingerprint = sha256Hex(chain[0].encoded)
        if (expected != null) {
          if (fingerprint != expected) {
            throw CertificateException("bridge TLS fingerprint mismatch")
          }
          return
        }
        if (params.allowTOFU) {
          onStore?.invoke(fingerprint)
          return
        }
        defaultTrust.checkServerTrusted(chain, authType)
      }
      override fun getAcceptedIssuers(): Array<X509Certificate> = defaultTrust.acceptedIssuers
    }
  val context = SSLContext.getInstance("TLS")
  context.init(null, arrayOf(trustManager), SecureRandom())
  return context.socketFactory.createSocket()
 }
 fun startTlsHandshakeIfNeeded(socket: Socket) {
  if (socket is SSLSocket) {
    socket.startHandshake()
  }
 }
 private fun defaultTrustManager(): X509TrustManager {
  val factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
  factory.init(null as java.security.KeyStore?)
  val trust =
    factory.trustManagers.firstOrNull { it is X509TrustManager } as? X509TrustManager
  return trust ?: throw IllegalStateException("No default X509TrustManager found")
 }
 private fun sha256Hex(data: ByteArray): String {
  val digest = MessageDigest.getInstance("SHA-256").digest(data)
  val out = StringBuilder(digest.size * 2)
  for (byte in digest) {
    out.append(String.format("%02x", byte))
  }
  return out.toString()
 }
 private fun normalizeFingerprint(raw: String): String {
  return raw.lowercase().filter { it in '0'..'9' || it in 'a'..'f' }
 }
@@ -10,10 +10,36 @@ actor BridgeClient {
    func pairAndHello(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: BridgeTLSParams? = nil,
        onStatus: (@Sendable (String) -> Void)? = nil) async throws -> String
    {
        do {
            return try await self.pairAndHelloOnce(
                endpoint: endpoint,
                hello: hello,
                tls: tls,
                onStatus: onStatus)
        } catch {
            if let tls, !tls.required {
                return try await self.pairAndHelloOnce(
                    endpoint: endpoint,
                    hello: hello,
                    tls: nil,
                    onStatus: onStatus)
            }
            throw error
        }
    }
    private func pairAndHelloOnce(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: BridgeTLSParams?,
        onStatus: (@Sendable (String) -> Void)? = nil) async throws -> String
    {
        self.lineBuffer = Data()
-        let connection = NWConnection(to: endpoint, using: .tcp)
+        let params = self.makeParameters(tls: tls)
        let connection = NWConnection(to: endpoint, using: params)
        let queue = DispatchQueue(label: "com.clawdbot.ios.bridge-client")
        defer { connection.cancel() }
        try await self.withTimeout(seconds: 8, purpose: "connect") {
@@ -142,6 +168,18 @@ actor BridgeClient {
        }
    }
    private func makeParameters(tls: BridgeTLSParams?) -> NWParameters {
        if let tlsOptions = makeBridgeTLSOptions(tls) {
            let tcpOptions = NWProtocolTCP.Options()
            let params = NWParameters(tls: tlsOptions, tcp: tcpOptions)
            params.includePeerToPeer = true
            return params
        }
        let params = NWParameters.tcp
        params.includePeerToPeer = true
        return params
    }
    private struct TimeoutError: LocalizedError, Sendable {
        var purpose: String
        var seconds: Int
@@ -10,6 +10,7 @@ protocol BridgePairingClient: Sendable {
    func pairAndHello(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: BridgeTLSParams?,
        onStatus: (@Sendable (String) -> Void)?) async throws -> String
 }
@@ -115,9 +116,12 @@ final class BridgeConnectionController {
            self.didAutoConnect = true
            let endpoint = NWEndpoint.hostPort(host: NWEndpoint.Host(manualHost), port: port)
            let stableID = BridgeEndpointID.stableID(endpoint)
            let tlsParams = self.resolveManualTLSParams(stableID: stableID)
            self.startAutoConnect(
                endpoint: endpoint,
-                bridgeStableID: BridgeEndpointID.stableID(endpoint),
+                bridgeStableID: stableID,
                tls: tlsParams,
                token: token,
                instanceId: instanceId)
            return
@@ -135,10 +139,12 @@ final class BridgeConnectionController {
        guard let target = self.bridges.first(where: { $0.stableID == targetStableID }) else { return }
        let tlsParams = self.resolveDiscoveredTLSParams(bridge: target)
        self.didAutoConnect = true
        self.startAutoConnect(
            endpoint: target.endpoint,
            bridgeStableID: target.stableID,
            tls: tlsParams,
            token: token,
            instanceId: instanceId)
    }
@@ -182,6 +188,7 @@ final class BridgeConnectionController {
    private func startAutoConnect(
        endpoint: NWEndpoint,
        bridgeStableID: String,
        tls: BridgeTLSParams?,
        token: String,
        instanceId: String)
    {
@@ -193,6 +200,7 @@ final class BridgeConnectionController {
                let refreshed = try await self.bridgeClientFactory().pairAndHello(
                    endpoint: endpoint,
                    hello: hello,
                    tls: tls,
                    onStatus: { status in
                        Task { @MainActor in
                            appModel.bridgeStatusText = status
@@ -208,6 +216,7 @@ final class BridgeConnectionController {
                appModel.connectToBridge(
                    endpoint: endpoint,
                    bridgeStableID: bridgeStableID,
                    tls: tls,
                    hello: self.makeHello(token: resolvedToken))
            } catch {
                await MainActor.run {
@@ -217,6 +226,47 @@ final class BridgeConnectionController {
        }
    }
    private func resolveDiscoveredTLSParams(
        bridge: BridgeDiscoveryModel.DiscoveredBridge) -> BridgeTLSParams?
    {
        let stableID = bridge.stableID
        let stored = BridgeTLSStore.loadFingerprint(stableID: stableID)
        if bridge.tlsEnabled || bridge.tlsFingerprintSha256 != nil {
            return BridgeTLSParams(
                required: true,
                expectedFingerprint: bridge.tlsFingerprintSha256 ?? stored,
                allowTOFU: stored == nil,
                storeKey: stableID)
        }
        if let stored {
            return BridgeTLSParams(
                required: true,
                expectedFingerprint: stored,
                allowTOFU: false,
                storeKey: stableID)
        }
        return nil
    }
    private func resolveManualTLSParams(stableID: String) -> BridgeTLSParams? {
        if let stored = BridgeTLSStore.loadFingerprint(stableID: stableID) {
            return BridgeTLSParams(
                required: true,
                expectedFingerprint: stored,
                allowTOFU: false,
                storeKey: stableID)
        }
        return BridgeTLSParams(
            required: false,
            expectedFingerprint: nil,
            allowTOFU: true,
            storeKey: stableID)
    }
    private func resolvedDisplayName(defaults: UserDefaults) -> String {
        let key = "node.displayName"
        let existing = defaults.string(forKey: key)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
@@ -23,6 +23,8 @@ final class BridgeDiscoveryModel {
        var gatewayPort: Int?
        var bridgePort: Int?
        var canvasPort: Int?
        var tlsEnabled: Bool
        var tlsFingerprintSha256: String?
        var cliPath: String?
    }
@@ -90,6 +92,8 @@ final class BridgeDiscoveryModel {
                                gatewayPort: Self.txtIntValue(txt, key: "gatewayPort"),
                                bridgePort: Self.txtIntValue(txt, key: "bridgePort"),
                                canvasPort: Self.txtIntValue(txt, key: "canvasPort"),
                                tlsEnabled: Self.txtBoolValue(txt, key: "bridgeTls"),
                                tlsFingerprintSha256: Self.txtValue(txt, key: "bridgeTlsSha256"),
                                cliPath: Self.txtValue(txt, key: "cliPath"))
                        default:
                            return nil
@@ -214,4 +218,9 @@ final class BridgeDiscoveryModel {
        guard let raw = self.txtValue(dict, key: key) else { return nil }
        return Int(raw)
    }
    private static func txtBoolValue(_ dict: [String: String], key: String) -> Bool {
        guard let raw = self.txtValue(dict, key: key)?.lowercased() else { return false }
        return raw == "1" || raw == "true" || raw == "yes"
    }
 }
@@ -69,15 +69,42 @@ actor BridgeSession {
    func connect(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: BridgeTLSParams? = nil,
        onConnected: (@Sendable (String, String?) async -> Void)? = nil,
        onInvoke: @escaping @Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse)
        async throws
    {
        await self.disconnect()
        self.state = .connecting
        do {
            try await self.connectOnce(
                endpoint: endpoint,
                hello: hello,
                tls: tls,
                onConnected: onConnected,
                onInvoke: onInvoke)
        } catch {
            if let tls, !tls.required {
                try await self.connectOnce(
                    endpoint: endpoint,
                    hello: hello,
                    tls: nil,
                    onConnected: onConnected,
                    onInvoke: onInvoke)
                return
            }
            throw error
        }
    }
-        let params = NWParameters.tcp
+    private func connectOnce(
-        params.includePeerToPeer = true
+        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: BridgeTLSParams?,
        onConnected: (@Sendable (String, String?) async -> Void)?,
        onInvoke: @escaping @Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse) async throws
    {
        let params = self.makeParameters(tls: tls)
        let connection = NWConnection(to: endpoint, using: params)
        let queue = DispatchQueue(label: "com.clawdbot.ios.bridge-session")
        self.connection = connection
@@ -255,6 +282,18 @@ actor BridgeSession {
        }
    }
    private func makeParameters(tls: BridgeTLSParams?) -> NWParameters {
        if let tlsOptions = makeBridgeTLSOptions(tls) {
            let tcpOptions = NWProtocolTCP.Options()
            let params = NWParameters(tls: tlsOptions, tcp: tcpOptions)
            params.includePeerToPeer = true
            return params
        }
        let params = NWParameters.tcp
        params.includePeerToPeer = true
        return params
    }
    private func timeoutRPC(id: String) async {
        guard let cont = self.pendingRPC.removeValue(forKey: id) else { return }
        cont.resume(throwing: NSError(domain: "Bridge", code: 15, userInfo: [
@@ -0,0 +1,66 @@
 import CryptoKit
 import Foundation
 import Network
 import Security
 struct BridgeTLSParams: Sendable {
    let required: Bool
    let expectedFingerprint: String?
    let allowTOFU: Bool
    let storeKey: String?
 }
 enum BridgeTLSStore {
    private static let service = "com.clawdbot.bridge.tls"
    static func loadFingerprint(stableID: String) -> String? {
        KeychainStore.loadString(service: service, account: stableID)?.trimmingCharacters(in: .whitespacesAndNewlines)
    }
    static func saveFingerprint(_ value: String, stableID: String) {
        _ = KeychainStore.saveString(value, service: service, account: stableID)
    }
 }
 func makeBridgeTLSOptions(_ params: BridgeTLSParams?) -> NWProtocolTLS.Options? {
    guard let params else { return nil }
    let options = NWProtocolTLS.Options()
    let expected = params.expectedFingerprint.map(normalizeBridgeFingerprint)
    let allowTOFU = params.allowTOFU
    let storeKey = params.storeKey
    sec_protocol_options_set_verify_block(
        options.securityProtocolOptions,
        { _, trust, complete in
            let trustRef = sec_trust_copy_ref(trust).takeRetainedValue()
            if let chain = SecTrustCopyCertificateChain(trustRef) as? [SecCertificate],
               let cert = chain.first
            {
                let data = SecCertificateCopyData(cert) as Data
                let fingerprint = sha256Hex(data)
                if let expected {
                    complete(fingerprint == expected)
                    return
                }
                if allowTOFU {
                    if let storeKey { BridgeTLSStore.saveFingerprint(fingerprint, stableID: storeKey) }
                    complete(true)
                    return
                }
            }
            let ok = SecTrustEvaluateWithError(trustRef, nil)
            complete(ok)
        },
        DispatchQueue(label: "com.clawdbot.bridge.tls.verify"))
    return options
 }
 private func sha256Hex(_ data: Data) -> String {
    let digest = SHA256.hash(data: data)
    return digest.map { String(format: "%02x", $0) }.joined()
 }
 private func normalizeBridgeFingerprint(_ raw: String) -> String {
    raw.lowercased().filter { $0.isHexDigit }
 }
@@ -190,14 +190,7 @@ actor CameraController {
    }
    func listDevices() -> [CameraDeviceInfo] {
-        let types: [AVCaptureDevice.DeviceType] = [
+        return Self.discoverVideoDevices().map { device in
            .builtInWideAngleCamera,
        ]
        let session = AVCaptureDevice.DiscoverySession(
            deviceTypes: types,
            mediaType: .video,
            position: .unspecified)
        return session.devices.map { device in
            CameraDeviceInfo(
                id: device.uniqueID,
                name: device.localizedName,
@@ -232,7 +225,7 @@ actor CameraController {
        deviceId: String?) -> AVCaptureDevice?
    {
        if let deviceId, !deviceId.isEmpty {
-            if let match = AVCaptureDevice.devices(for: .video).first(where: { $0.uniqueID == deviceId }) {
+            if let match = Self.discoverVideoDevices().first(where: { $0.uniqueID == deviceId }) {
                return match
            }
        }
@@ -252,6 +245,24 @@ actor CameraController {
        }
    }
    private nonisolated static func discoverVideoDevices() -> [AVCaptureDevice] {
        let types: [AVCaptureDevice.DeviceType] = [
            .builtInWideAngleCamera,
            .builtInUltraWideCamera,
            .builtInTelephotoCamera,
            .builtInDualCamera,
            .builtInDualWideCamera,
            .builtInTripleCamera,
            .builtInTrueDepthCamera,
            .builtInLiDARDepthCamera,
        ]
        let session = AVCaptureDevice.DiscoverySession(
            deviceTypes: types,
            mediaType: .video,
            position: .unspecified)
        return session.devices
    }
    nonisolated static func clampQuality(_ quality: Double?) -> Double {
        let q = quality ?? 0.9
        return min(1.0, max(0.05, q))
@@ -205,6 +205,7 @@ final class NodeAppModel {
    func connectToBridge(
        endpoint: NWEndpoint,
        bridgeStableID: String,
        tls: BridgeTLSParams?,
        hello: BridgeHello)
    {
        self.bridgeTask?.cancel()
@@ -232,6 +233,7 @@ final class NodeAppModel {
                    try await self.bridge.connect(
                        endpoint: endpoint,
                        hello: hello,
                        tls: tls,
                        onConnected: { [weak self] serverName, mainSessionKey in
                            guard let self else { return }
                            await MainActor.run {
@@ -137,9 +137,11 @@ final class ScreenRecordService: @unchecked Sendable {
        recordQueue: DispatchQueue) -> @Sendable (CMSampleBuffer, RPSampleBufferType, Error?) -> Void
    {
        { sample, type, error in
            let sampleBox = UncheckedSendableBox(value: sample)
            // ReplayKit can call the capture handler on a background queue.
            // Serialize writes to avoid queue asserts.
            recordQueue.async {
                let sample = sampleBox.value
                if let error {
                    state.withLock { state in
                        if state.handlerError == nil { state.handlerError = error }
@@ -407,9 +407,11 @@ struct SettingsTab: View {
                modelIdentifier: self.modelIdentifier(),
                caps: self.currentCaps(),
                commands: self.currentCommands())
            let tlsParams = self.resolveDiscoveredTLSParams(bridge: bridge)
            let token = try await BridgeClient().pairAndHello(
                endpoint: bridge.endpoint,
                hello: hello,
                tls: tlsParams,
                onStatus: { status in
                    Task { @MainActor in
                        statusStore.text = status
@@ -426,6 +428,7 @@ struct SettingsTab: View {
            self.appModel.connectToBridge(
                endpoint: bridge.endpoint,
                bridgeStableID: bridge.stableID,
                tls: tlsParams,
                hello: BridgeHello(
                    nodeId: self.instanceId,
                    displayName: self.displayName,
@@ -462,6 +465,8 @@ struct SettingsTab: View {
        defer { self.connectingBridgeID = nil }
        let endpoint: NWEndpoint = .hostPort(host: NWEndpoint.Host(host), port: port)
        let stableID = BridgeEndpointID.stableID(endpoint)
        let tlsParams = self.resolveManualTLSParams(stableID: stableID)
        do {
            let statusStore = self.connectStatus
@@ -485,6 +490,7 @@ struct SettingsTab: View {
            let token = try await BridgeClient().pairAndHello(
                endpoint: endpoint,
                hello: hello,
                tls: tlsParams,
                onStatus: { status in
                    Task { @MainActor in
                        statusStore.text = status
@@ -500,7 +506,8 @@ struct SettingsTab: View {
            self.appModel.connectToBridge(
                endpoint: endpoint,
-                bridgeStableID: BridgeEndpointID.stableID(endpoint),
+                bridgeStableID: stableID,
                tls: tlsParams,
                hello: BridgeHello(
                    nodeId: self.instanceId,
                    displayName: self.displayName,
@@ -517,6 +524,47 @@ struct SettingsTab: View {
        }
    }
    private func resolveDiscoveredTLSParams(
        bridge: BridgeDiscoveryModel.DiscoveredBridge) -> BridgeTLSParams?
    {
        let stableID = bridge.stableID
        let stored = BridgeTLSStore.loadFingerprint(stableID: stableID)
        if bridge.tlsEnabled || bridge.tlsFingerprintSha256 != nil {
            return BridgeTLSParams(
                required: true,
                expectedFingerprint: bridge.tlsFingerprintSha256 ?? stored,
                allowTOFU: stored == nil,
                storeKey: stableID)
        }
        if let stored {
            return BridgeTLSParams(
                required: true,
                expectedFingerprint: stored,
                allowTOFU: false,
                storeKey: stableID)
        }
        return nil
    }
    private func resolveManualTLSParams(stableID: String) -> BridgeTLSParams? {
        if let stored = BridgeTLSStore.loadFingerprint(stableID: stableID) {
            return BridgeTLSParams(
                required: true,
                expectedFingerprint: stored,
                allowTOFU: false,
                storeKey: stableID)
        }
        return BridgeTLSParams(
            required: false,
            expectedFingerprint: nil,
            allowTOFU: true,
            storeKey: stableID)
    }
    private static func primaryIPv4Address() -> String? {
        var addrList: UnsafeMutablePointer<ifaddrs>?
        guard getifaddrs(&addrList) == 0, let first = addrList else { return nil }
@@ -27,6 +27,7 @@ private actor MockBridgePairingClient: BridgePairingClient {
    func pairAndHello(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: BridgeTLSParams?,
        onStatus: (@Sendable (String) -> Void)?) async throws -> String
    {
        self.lastToken = hello.token
@@ -244,6 +245,8 @@ private func withKeychainValues<T>(
            gatewayPort: 18789,
            bridgePort: 18790,
            canvasPort: 18793,
            tlsEnabled: false,
            tlsFingerprintSha256: nil,
            cliPath: nil)
        let mock = MockBridgePairingClient(resultToken: "new-token")
        let account = "bridge-token.ios-test"
@@ -292,6 +295,8 @@ private func withKeychainValues<T>(
            gatewayPort: 18789,
            bridgePort: 18790,
            canvasPort: 18793,
            tlsEnabled: false,
            tlsFingerprintSha256: nil,
            cliPath: nil)
        let bridgeB = BridgeDiscoveryModel.DiscoveredBridge(
            name: "Gateway B",
@@ -303,6 +308,8 @@ private func withKeychainValues<T>(
            gatewayPort: 28789,
            bridgePort: 28790,
            canvasPort: 28793,
            tlsEnabled: false,
            tlsFingerprintSha256: nil,
            cliPath: nil)
        let mock = MockBridgePairingClient(resultToken: "token-ok")
@@ -170,6 +170,10 @@ final class AppState {
        didSet { self.ifNotPreview { UserDefaults.standard.set(self.canvasEnabled, forKey: canvasEnabledKey) } }
    }
    var systemRunPolicy: SystemRunPolicy {
        didSet { self.ifNotPreview { MacNodeConfigFile.setSystemRunPolicy(self.systemRunPolicy) } }
    }
    /// Tracks whether the Canvas panel is currently visible (not persisted).
    var canvasPanelVisible: Bool = false
@@ -292,6 +296,7 @@ final class AppState {
        self.remoteProjectRoot = UserDefaults.standard.string(forKey: remoteProjectRootKey) ?? ""
        self.remoteCliPath = UserDefaults.standard.string(forKey: remoteCliPathKey) ?? ""
        self.canvasEnabled = UserDefaults.standard.object(forKey: canvasEnabledKey) as? Bool ?? true
        self.systemRunPolicy = SystemRunPolicy.load()
        self.peekabooBridgeEnabled = UserDefaults.standard
            .object(forKey: peekabooBridgeEnabledKey) as? Bool ?? true
        if !self.isPreview {
@@ -26,6 +26,9 @@ let remoteProjectRootKey = "clawdbot.remoteProjectRoot"
 let remoteCliPathKey = "clawdbot.remoteCliPath"
 let canvasEnabledKey = "clawdbot.canvasEnabled"
 let cameraEnabledKey = "clawdbot.cameraEnabled"
 let systemRunPolicyKey = "clawdbot.systemRunPolicy"
 let systemRunAllowlistKey = "clawdbot.systemRunAllowlist"
 let systemRunEnabledKey = "clawdbot.systemRunEnabled"
 let locationModeKey = "clawdbot.locationMode"
 let locationPreciseKey = "clawdbot.locationPreciseEnabled"
 let peekabooBridgeEnabledKey = "clawdbot.peekabooBridgeEnabled"
@@ -178,7 +178,7 @@ enum GatewayEnvironment {
        let port = self.gatewayPort()
        if let gatewayBin {
            let bind = self.preferredGatewayBind() ?? "loopback"
-            let cmd = [gatewayBin, "gateway-daemon", "--port", "\(port)", "--bind", bind]
+            let cmd = [gatewayBin, "gateway", "--port", "\(port)", "--bind", bind]
            return GatewayCommandResolution(status: status, command: cmd)
        }
@@ -186,7 +186,7 @@ enum GatewayEnvironment {
           case let .success(resolvedRuntime) = runtime
        {
            let bind = self.preferredGatewayBind() ?? "loopback"
-            let cmd = [resolvedRuntime.path, entry, "gateway-daemon", "--port", "\(port)", "--bind", bind]
+            let cmd = [resolvedRuntime.path, entry, "gateway", "--port", "\(port)", "--bind", bind]
            return GatewayCommandResolution(status: status, command: cmd)
        }
@@ -2,77 +2,16 @@ import Foundation
 enum GatewayLaunchAgentManager {
    private static let logger = Logger(subsystem: "com.clawdbot", category: "gateway.launchd")
    private static let supportedBindModes: Set<String> = ["loopback", "tailnet", "lan", "auto"]
    private static let legacyGatewayLaunchdLabel = "com.steipete.clawdbot.gateway"
    private static let disableLaunchAgentMarker = ".clawdbot/disable-launchagent"
    private enum GatewayProgramArgumentsError: LocalizedError {
        case message(String)
        var errorDescription: String? {
            switch self {
            case let .message(message):
                message
            }
        }
    }
    private static var plistURL: URL {
        FileManager.default.homeDirectoryForCurrentUser
            .appendingPathComponent("Library/LaunchAgents/\(gatewayLaunchdLabel).plist")
    }
    private static var legacyPlistURL: URL {
        FileManager.default.homeDirectoryForCurrentUser
            .appendingPathComponent("Library/LaunchAgents/\(legacyGatewayLaunchdLabel).plist")
    }
    private static func gatewayProgramArguments(
        port: Int,
        bind: String) -> Result<[String], GatewayProgramArgumentsError>
    {
        let projectRoot = CommandResolver.projectRoot()
        #if DEBUG
        if let localBin = CommandResolver.projectClawdbotExecutable(projectRoot: projectRoot) {
            return .success([localBin, "gateway-daemon", "--port", "\(port)", "--bind", bind])
        }
        if let entry = CommandResolver.gatewayEntrypoint(in: projectRoot) {
            switch CommandResolver.runtimeResolution() {
            case let .success(runtime):
                let cmd = CommandResolver.makeRuntimeCommand(
                    runtime: runtime,
                    entrypoint: entry,
                    subcommand: "gateway-daemon",
                    extraArgs: ["--port", "\(port)", "--bind", bind])
                return .success(cmd)
            case .failure:
                break
            }
        }
        #endif
        let searchPaths = CommandResolver.preferredPaths()
        if let gatewayBin = CommandResolver.clawdbotExecutable(searchPaths: searchPaths) {
            return .success([gatewayBin, "gateway-daemon", "--port", "\(port)", "--bind", bind])
        }
        if let entry = CommandResolver.gatewayEntrypoint(in: projectRoot),
           case let .success(runtime) = CommandResolver.runtimeResolution(searchPaths: searchPaths)
        {
            let cmd = CommandResolver.makeRuntimeCommand(
                runtime: runtime,
                entrypoint: entry,
                subcommand: "gateway-daemon",
                extraArgs: ["--port", "\(port)", "--bind", bind])
            return .success(cmd)
        }
        return .failure(.message("clawdbot CLI not found in PATH; install the CLI."))
    }
    static func isLoaded() async -> Bool {
-        guard FileManager.default.fileExists(atPath: self.plistURL.path) else { return false }
+        guard let loaded = await self.readDaemonLoaded() else { return false }
-        let result = await Launchctl.run(["print", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
+        return loaded
        return result.status == 0
    }
    static func set(enabled: Bool, bundlePath: String, port: Int) async -> String? {
@@ -81,255 +20,44 @@ enum GatewayLaunchAgentManager {
            self.logger.info("launchd enable skipped (disable marker set)")
            return nil
        }
        if enabled {
-            _ = await Launchctl.run(["bootout", "gui/\(getuid())/\(self.legacyGatewayLaunchdLabel)"])
+            self.logger.info("launchd enable requested via CLI port=\(port)")
-            try? FileManager.default.removeItem(at: self.legacyPlistURL)
+            return await self.runDaemonCommand([
-
+                "install",
-            let desiredBind = self.preferredGatewayBind() ?? "loopback"
+                "--force",
-            let desiredToken = self.preferredGatewayToken()
+                "--port",
-            let desiredPassword = self.preferredGatewayPassword()
+                "\(port)",
-            let desiredConfig = DesiredConfig(
+                "--runtime",
-                port: port,
+                "node",
-                bind: desiredBind,
+            ])
                token: desiredToken,
                password: desiredPassword)
            let programArgumentsResult = self.gatewayProgramArguments(port: port, bind: desiredBind)
            guard case let .success(programArguments) = programArgumentsResult else {
                if case let .failure(error) = programArgumentsResult {
                    let message = error.localizedDescription
                    self.logger.error("launchd enable failed: \(message)")
                    return message
                }
                return "Failed to resolve gateway command."
        }
-            // If launchd already loaded the job (common on login), avoid `bootout` unless we must
+        self.logger.info("launchd disable requested via CLI")
-            // change the config. `bootout` can kill a just-started gateway and cause attach loops.
+        return await self.runDaemonCommand(["uninstall"])
            let loaded = await self.isLoaded()
            if loaded {
                if let existing = self.readPlistConfig(), existing.matches(desiredConfig) {
                    self.logger.info("launchd job already loaded with desired config; skipping bootout")
                    await self.ensureEnabled()
                    _ = await Launchctl.run(["kickstart", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
                    return nil
                }
            }
            self.logger.info("launchd enable requested port=\(port) bind=\(desiredBind)")
            self.writePlist(programArguments: programArguments)
            await self.ensureEnabled()
            if loaded {
                _ = await Launchctl.run(["bootout", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
            }
            let bootstrap = await Launchctl.run(["bootstrap", "gui/\(getuid())", self.plistURL.path])
            if bootstrap.status != 0 {
                let msg = bootstrap.output.trimmingCharacters(in: .whitespacesAndNewlines)
                self.logger.error("launchd bootstrap failed: \(msg)")
                return bootstrap.output.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
                    ? "Failed to bootstrap gateway launchd job"
                    : bootstrap.output.trimmingCharacters(in: .whitespacesAndNewlines)
            }
            await self.ensureEnabled()
            return nil
        }
        self.logger.info("launchd disable requested")
        _ = await Launchctl.run(["bootout", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
        await self.ensureDisabled()
        try? FileManager.default.removeItem(at: self.plistURL)
        return nil
    }
    static func kickstart() async {
-        _ = await Launchctl.run(["kickstart", "-k", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
+        _ = await self.runDaemonCommand(["restart"], timeout: 20)
    }
    private static func writePlist(programArguments: [String]) {
        let preferredPath = CommandResolver.preferredPaths().joined(separator: ":")
        let token = self.preferredGatewayToken()
        let password = self.preferredGatewayPassword()
        var envEntries = """
            <key>PATH</key>
            <string>\(preferredPath)</string>
        """
        if let token {
            let escapedToken = self.escapePlistValue(token)
            envEntries += """
                <key>CLAWDBOT_GATEWAY_TOKEN</key>
                <string>\(escapedToken)</string>
            """
        }
        if let password {
            let escapedPassword = self.escapePlistValue(password)
            envEntries += """
                <key>CLAWDBOT_GATEWAY_PASSWORD</key>
                <string>\(escapedPassword)</string>
            """
        }
        let argsXml = programArguments
            .map { "<string>\(self.escapePlistValue($0))</string>" }
            .joined(separator: "\n            ")
        let plist = """
        <?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
        <plist version="1.0">
        <dict>
          <key>Label</key>
          <string>\(gatewayLaunchdLabel)</string>
          <key>ProgramArguments</key>
          <array>
            \(argsXml)
          </array>
          <key>WorkingDirectory</key>
          <string>\(FileManager.default.homeDirectoryForCurrentUser.path)</string>
          <key>RunAtLoad</key>
          <true/>
          <key>KeepAlive</key>
          <true/>
          <key>EnvironmentVariables</key>
          <dict>
        \(envEntries)
          </dict>
          <key>StandardOutPath</key>
          <string>\(LogLocator.launchdGatewayLogPath)</string>
          <key>StandardErrorPath</key>
          <string>\(LogLocator.launchdGatewayLogPath)</string>
        </dict>
        </plist>
        """
        do {
            try plist.write(to: self.plistURL, atomically: true, encoding: .utf8)
        } catch {
            self.logger.error("launchd plist write failed: \(error.localizedDescription)")
        }
    }
    private static func preferredGatewayBind() -> String? {
        if CommandResolver.connectionModeIsRemote() {
            return nil
        }
        if let env = ProcessInfo.processInfo.environment["CLAWDBOT_GATEWAY_BIND"] {
            let trimmed = env.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
            if self.supportedBindModes.contains(trimmed) {
                return trimmed
            }
        }
        let root = ClawdbotConfigFile.loadDict()
        if let gateway = root["gateway"] as? [String: Any],
           let bind = gateway["bind"] as? String
        {
            let trimmed = bind.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
            if self.supportedBindModes.contains(trimmed) {
                return trimmed
            }
        }
        return nil
    }
    private static func preferredGatewayToken() -> String? {
        let raw = ProcessInfo.processInfo.environment["CLAWDBOT_GATEWAY_TOKEN"] ?? ""
        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
        if !trimmed.isEmpty {
            return trimmed
        }
        let root = ClawdbotConfigFile.loadDict()
        if let gateway = root["gateway"] as? [String: Any],
           let auth = gateway["auth"] as? [String: Any],
           let token = auth["token"] as? String
        {
            let value = token.trimmingCharacters(in: .whitespacesAndNewlines)
            if !value.isEmpty {
                return value
            }
        }
        return nil
    }
    private static func preferredGatewayPassword() -> String? {
        // First check environment variable
        let raw = ProcessInfo.processInfo.environment["CLAWDBOT_GATEWAY_PASSWORD"] ?? ""
        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
        if !trimmed.isEmpty {
            return trimmed
        }
        // Then check config file (gateway.auth.password)
        let root = ClawdbotConfigFile.loadDict()
        if let gateway = root["gateway"] as? [String: Any],
           let auth = gateway["auth"] as? [String: Any],
           let password = auth["password"] as? String
        {
            return password.trimmingCharacters(in: .whitespacesAndNewlines)
        }
        return nil
    }
    private static func escapePlistValue(_ raw: String) -> String {
        raw
            .replacingOccurrences(of: "&", with: "&amp;")
            .replacingOccurrences(of: "<", with: "&lt;")
            .replacingOccurrences(of: ">", with: "&gt;")
            .replacingOccurrences(of: "\"", with: "&quot;")
            .replacingOccurrences(of: "'", with: "&apos;")
    }
    private struct DesiredConfig: Equatable {
        let port: Int
        let bind: String
        let token: String?
        let password: String?
    }
    private struct InstalledConfig: Equatable {
        let port: Int?
        let bind: String?
        let token: String?
        let password: String?
        func matches(_ desired: DesiredConfig) -> Bool {
            guard self.port == desired.port else { return false }
            guard (self.bind ?? "loopback") == desired.bind else { return false }
            guard self.token == desired.token else { return false }
            guard self.password == desired.password else { return false }
            return true
        }
    }
    private static func readPlistConfig() -> InstalledConfig? {
        guard let snapshot = LaunchAgentPlist.snapshot(url: self.plistURL) else { return nil }
        return InstalledConfig(
            port: snapshot.port,
            bind: snapshot.bind,
            token: snapshot.token,
            password: snapshot.password)
    }
    static func launchdConfigSnapshot() -> LaunchAgentPlistSnapshot? {
        LaunchAgentPlist.snapshot(url: self.plistURL)
    }
-    private static func ensureEnabled() async {
+    static func launchdGatewayLogPath() -> String {
-        let result = await Launchctl.run(["enable", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
+        let snapshot = self.launchdConfigSnapshot()
-        guard result.status != 0 else { return }
+        if let stdout = snapshot?.stdoutPath?.trimmingCharacters(in: .whitespacesAndNewlines),
-        let msg = result.output.trimmingCharacters(in: .whitespacesAndNewlines)
+           !stdout.isEmpty
-        if msg.isEmpty {
+        {
-            self.logger.warning("launchd enable failed")
+            return stdout
        } else {
            self.logger.warning("launchd enable failed: \(msg)")
        }
        if let stderr = snapshot?.stderrPath?.trimmingCharacters(in: .whitespacesAndNewlines),
           !stderr.isEmpty
        {
            return stderr
        }
-
+        return LogLocator.launchdGatewayLogPath
    private static func ensureDisabled() async {
        let result = await Launchctl.run(["disable", "gui/\(getuid())/\(gatewayLaunchdLabel)"])
        guard result.status != 0 else { return }
        let msg = result.output.trimmingCharacters(in: .whitespacesAndNewlines)
        if msg.isEmpty {
            self.logger.warning("launchd disable failed")
        } else {
            self.logger.warning("launchd disable failed: \(msg)")
        }
    }
 }
@@ -339,20 +67,102 @@ extension GatewayLaunchAgentManager {
            .appendingPathComponent(self.disableLaunchAgentMarker)
        return FileManager.default.fileExists(atPath: marker.path)
    }
    private static func readDaemonLoaded() async -> Bool? {
        let result = await self.runDaemonCommandResult(
            ["status", "--json", "--no-probe"],
            timeout: 15,
            quiet: true)
        guard result.success, let payload = result.payload else { return nil }
        guard
            let json = try? JSONSerialization.jsonObject(with: payload) as? [String: Any],
            let service = json["service"] as? [String: Any],
            let loaded = service["loaded"] as? Bool
        else {
            return nil
        }
        return loaded
    }
-#if DEBUG
+    private struct CommandResult {
-extension GatewayLaunchAgentManager {
+        let success: Bool
-    static func _testPreferredGatewayBind() -> String? {
+        let payload: Data?
-        self.preferredGatewayBind()
+        let message: String?
    }
-    static func _testPreferredGatewayToken() -> String? {
+    private struct ParsedDaemonJson {
-        self.preferredGatewayToken()
+        let text: String
        let object: [String: Any]
    }
-    static func _testEscapePlistValue(_ raw: String) -> String {
+    private static func runDaemonCommand(
-        self.escapePlistValue(raw)
+        _ args: [String],
        timeout: Double = 15,
        quiet: Bool = false) async -> String?
    {
        let result = await self.runDaemonCommandResult(args, timeout: timeout, quiet: quiet)
        if result.success { return nil }
        return result.message ?? "Gateway daemon command failed"
    }
    private static func runDaemonCommandResult(
        _ args: [String],
        timeout: Double,
        quiet: Bool) async -> CommandResult
    {
        let command = CommandResolver.clawdbotCommand(
            subcommand: "daemon",
            extraArgs: self.withJsonFlag(args))
        var env = ProcessInfo.processInfo.environment
        env["PATH"] = CommandResolver.preferredPaths().joined(separator: ":")
        let response = await ShellExecutor.runDetailed(command: command, cwd: nil, env: env, timeout: timeout)
        let parsed = self.parseDaemonJson(from: response.stdout) ?? self.parseDaemonJson(from: response.stderr)
        let ok = parsed?.object["ok"] as? Bool
        let message = (parsed?.object["error"] as? String) ?? (parsed?.object["message"] as? String)
        let payload = parsed?.text.data(using: .utf8)
            ?? (response.stdout.isEmpty ? response.stderr : response.stdout).data(using: .utf8)
        let success = ok ?? response.success
        if success {
            return CommandResult(success: true, payload: payload, message: nil)
        }
        if quiet {
            return CommandResult(success: false, payload: payload, message: message)
        }
        let detail = message ?? self.summarize(response.stderr) ?? self.summarize(response.stdout)
        let exit = response.exitCode.map { "exit \($0)" } ?? (response.errorMessage ?? "failed")
        let fullMessage = detail.map { "Gateway daemon command failed (\(exit)): \($0)" }
            ?? "Gateway daemon command failed (\(exit))"
        self.logger.error("\(fullMessage, privacy: .public)")
        return CommandResult(success: false, payload: payload, message: detail)
    }
    private static func withJsonFlag(_ args: [String]) -> [String] {
        if args.contains("--json") { return args }
        return args + ["--json"]
    }
    private static func parseDaemonJson(from raw: String) -> ParsedDaemonJson? {
        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
        guard let start = trimmed.firstIndex(of: "{"),
              let end = trimmed.lastIndex(of: "}")
        else {
            return nil
        }
        let jsonText = String(trimmed[start...end])
        guard let data = jsonText.data(using: .utf8) else { return nil }
        guard let object = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else { return nil }
        return ParsedDaemonJson(text: jsonText, object: object)
    }
    private static func summarize(_ text: String) -> String? {
        let lines = text
            .split(whereSeparator: \.isNewline)
            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
            .filter { !$0.isEmpty }
        guard let last = lines.last else { return nil }
        let normalized = last.replacingOccurrences(of: "\\s+", with: " ", options: .regularExpression)
        return normalized.count > 200 ? String(normalized.prefix(199)) + "…" : normalized
    }
 }
 #endif
@@ -87,6 +87,14 @@ final class GatewayProcessManager {
            self.status = .stopped
            return
        }
        // Many surfaces can call `setActive(true)` in quick succession (startup, Canvas, health checks).
        // Avoid spawning multiple concurrent "start" tasks that can thrash launchd and flap the port.
        switch self.status {
        case .starting, .running, .attachedExisting:
            return
        case .stopped, .failed:
            break
        }
        self.status = .starting
        self.logger.debug("gateway start requested")
@@ -140,7 +148,7 @@ final class GatewayProcessManager {
    func refreshLog() {
        guard self.logRefreshTask == nil else { return }
-        let path = LogLocator.launchdGatewayLogPath
+        let path = GatewayLaunchAgentManager.launchdGatewayLogPath()
        let limit = self.logLimit
        self.logRefreshTask = Task { [weak self] in
            let log = await Task.detached(priority: .utility) {
@@ -354,7 +362,7 @@ final class GatewayProcessManager {
    func clearLog() {
        self.log = ""
-        try? FileManager.default.removeItem(atPath: LogLocator.launchdGatewayLogPath)
+        try? FileManager.default.removeItem(atPath: GatewayLaunchAgentManager.launchdGatewayLogPath())
        self.logger.debug("gateway log cleared")
    }
@@ -83,6 +83,28 @@ struct GeneralSettings: View {
                        subtitle: "Allow the agent to capture a photo or short video via the built-in camera.",
                        binding: self.$cameraEnabled)
                    VStack(alignment: .leading, spacing: 6) {
                        Text("Node Run Commands")
                            .font(.body)
                        Picker("", selection: self.$state.systemRunPolicy) {
                            ForEach(SystemRunPolicy.allCases) { policy in
                                Text(policy.title).tag(policy)
                            }
                        }
                        .labelsHidden()
                        .pickerStyle(.menu)
                        Text("""
                        Controls remote command execution on this Mac when it is paired as a node. \
                        "Always Ask" prompts on each command; "Always Allow" runs without prompts; \
                        "Never" disables `system.run`.
                        """)
                        .font(.footnote)
                        .foregroundStyle(.tertiary)
                        .fixedSize(horizontal: false, vertical: true)
                    }
                    VStack(alignment: .leading, spacing: 6) {
                        Text("Location Access")
                            .font(.body)
@@ -92,7 +114,8 @@ struct GeneralSettings: View {
                            Text("While Using").tag(ClawdbotLocationMode.whileUsing.rawValue)
                            Text("Always").tag(ClawdbotLocationMode.always.rawValue)
                        }
-                        .pickerStyle(.segmented)
+                        .labelsHidden()
                        .pickerStyle(.menu)
                        Toggle("Precise Location", isOn: self.$locationPreciseEnabled)
                            .disabled(self.locationMode == .off)
@@ -31,6 +31,8 @@ enum Launchctl {
 struct LaunchAgentPlistSnapshot: Equatable, Sendable {
    let programArguments: [String]
    let environment: [String: String]
    let stdoutPath: String?
    let stderrPath: String?
    let port: Int?
    let bind: String?
@@ -53,6 +55,10 @@ enum LaunchAgentPlist {
        guard let root = rootAny as? [String: Any] else { return nil }
        let programArguments = root["ProgramArguments"] as? [String] ?? []
        let env = root["EnvironmentVariables"] as? [String: String] ?? [:]
        let stdoutPath = (root["StandardOutPath"] as? String)?
            .trimmingCharacters(in: .whitespacesAndNewlines).nonEmpty
        let stderrPath = (root["StandardErrorPath"] as? String)?
            .trimmingCharacters(in: .whitespacesAndNewlines).nonEmpty
        let port = Self.extractFlagInt(programArguments, flag: "--port")
        let bind = Self.extractFlagString(programArguments, flag: "--bind")?.lowercased()
        let token = env["CLAWDBOT_GATEWAY_TOKEN"]?.trimmingCharacters(in: .whitespacesAndNewlines).nonEmpty
@@ -60,6 +66,8 @@ enum LaunchAgentPlist {
        return LaunchAgentPlistSnapshot(
            programArguments: programArguments,
            environment: env,
            stdoutPath: stdoutPath,
            stderrPath: stderrPath,
            port: port,
            bind: bind,
            token: token,
@@ -0,0 +1,81 @@
 import Foundation
 import OSLog
 enum MacNodeConfigFile {
    private static let logger = Logger(subsystem: "com.clawdbot", category: "mac-node-config")
    static func url() -> URL {
        ClawdbotPaths.stateDirURL.appendingPathComponent("macos-node.json")
    }
    static func loadDict() -> [String: Any] {
        let url = self.url()
        guard FileManager.default.fileExists(atPath: url.path) else { return [:] }
        do {
            let data = try Data(contentsOf: url)
            guard let root = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
                self.logger.warning("mac node config JSON root invalid")
                return [:]
            }
            return root
        } catch {
            self.logger.warning("mac node config read failed: \(error.localizedDescription, privacy: .public)")
            return [:]
        }
    }
    static func saveDict(_ dict: [String: Any]) {
        do {
            let data = try JSONSerialization.data(withJSONObject: dict, options: [.prettyPrinted, .sortedKeys])
            let url = self.url()
            try FileManager.default.createDirectory(
                at: url.deletingLastPathComponent(),
                withIntermediateDirectories: true)
            try data.write(to: url, options: [.atomic])
            try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: url.path)
        } catch {
            self.logger.error("mac node config save failed: \(error.localizedDescription, privacy: .public)")
        }
    }
    static func systemRunPolicy() -> SystemRunPolicy? {
        let root = self.loadDict()
        let systemRun = root["systemRun"] as? [String: Any]
        let raw = systemRun?["policy"] as? String
        guard let raw, let policy = SystemRunPolicy(rawValue: raw) else { return nil }
        return policy
    }
    static func setSystemRunPolicy(_ policy: SystemRunPolicy) {
        var root = self.loadDict()
        var systemRun = root["systemRun"] as? [String: Any] ?? [:]
        systemRun["policy"] = policy.rawValue
        root["systemRun"] = systemRun
        self.saveDict(root)
    }
    static func systemRunAllowlist() -> [String]? {
        let root = self.loadDict()
        let systemRun = root["systemRun"] as? [String: Any]
        return systemRun?["allowlist"] as? [String]
    }
    static func setSystemRunAllowlist(_ allowlist: [String]) {
        let cleaned = allowlist
            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
            .filter { !$0.isEmpty }
        var root = self.loadDict()
        var systemRun = root["systemRun"] as? [String: Any] ?? [:]
        if cleaned.isEmpty {
            systemRun.removeValue(forKey: "allowlist")
        } else {
            systemRun["allowlist"] = cleaned
        }
        if systemRun.isEmpty {
            root.removeValue(forKey: "systemRun")
        } else {
            root["systemRun"] = systemRun
        }
        self.saveDict(root)
    }
 }
@@ -31,6 +31,12 @@ struct MenuContent: View {
        self._updateStatus = Bindable(wrappedValue: updater?.updateStatus ?? UpdateStatus.disabled)
    }
    private var systemRunPolicyBinding: Binding<SystemRunPolicy> {
        Binding(
            get: { self.state.systemRunPolicy },
            set: { self.state.systemRunPolicy = $0 })
    }
    var body: some View {
        VStack(alignment: .leading, spacing: 8) {
            Toggle(isOn: self.activeBinding) {
@@ -68,6 +74,13 @@ struct MenuContent: View {
            Toggle(isOn: self.$cameraEnabled) {
                Label("Allow Camera", systemImage: "camera")
            }
            Picker(selection: self.systemRunPolicyBinding) {
                ForEach(SystemRunPolicy.allCases) { policy in
                    Text(policy.title).tag(policy)
                }
            } label: {
                Label("Node Run Commands", systemImage: "terminal")
            }
            Toggle(isOn: Binding(get: { self.state.canvasEnabled }, set: { self.state.canvasEnabled = $0 })) {
                Label("Allow Canvas", systemImage: "rectangle.and.pencil.and.ellipsis")
            }
@@ -103,6 +103,7 @@ final class MenuSessionsInjector: NSObject, NSMenuDelegate {
 extension MenuSessionsInjector {
    // MARK: - Injection
    private var mainSessionKey: String { WorkActivityStore.shared.mainSessionKey }
    private func inject(into menu: NSMenu) {
@@ -11,10 +11,39 @@ actor MacNodeBridgePairingClient {
        endpoint: NWEndpoint,
        hello: BridgeHello,
        silent: Bool,
        tls: MacNodeBridgeTLSParams? = nil,
        onStatus: (@Sendable (String) -> Void)? = nil) async throws -> String
    {
        do {
            return try await self.pairAndHelloOnce(
                endpoint: endpoint,
                hello: hello,
                silent: silent,
                tls: tls,
                onStatus: onStatus)
        } catch {
            if let tls, !tls.required {
                return try await self.pairAndHelloOnce(
                    endpoint: endpoint,
                    hello: hello,
                    silent: silent,
                    tls: nil,
                    onStatus: onStatus)
            }
            throw error
        }
    }
    private func pairAndHelloOnce(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        silent: Bool,
        tls: MacNodeBridgeTLSParams?,
        onStatus: (@Sendable (String) -> Void)? = nil) async throws -> String
    {
        self.lineBuffer = Data()
-        let connection = NWConnection(to: endpoint, using: .tcp)
+        let params = self.makeParameters(tls: tls)
        let connection = NWConnection(to: endpoint, using: params)
        let queue = DispatchQueue(label: "com.clawdbot.macos.bridge-client")
        defer { connection.cancel() }
        try await AsyncTimeout.withTimeout(
@@ -164,6 +193,18 @@ actor MacNodeBridgePairingClient {
        }
    }
    private func makeParameters(tls: MacNodeBridgeTLSParams?) -> NWParameters {
        let tcpOptions = NWProtocolTCP.Options()
        if let tlsOptions = makeMacNodeTLSOptions(tls) {
            let params = NWParameters(tls: tlsOptions, tcp: tcpOptions)
            params.includePeerToPeer = true
            return params
        }
        let params = NWParameters.tcp
        params.includePeerToPeer = true
        return params
    }
    private func startAndWaitForReady(
        _ connection: NWConnection,
        queue: DispatchQueue) async throws
@@ -36,6 +36,7 @@ actor MacNodeBridgeSession {
    func connect(
        endpoint: NWEndpoint,
        hello: BridgeHello,
        tls: MacNodeBridgeTLSParams? = nil,
        onConnected: (@Sendable (String, String?) async -> Void)? = nil,
        onDisconnected: (@Sendable (String) async -> Void)? = nil,
        onInvoke: @escaping @Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse)
@@ -44,15 +45,35 @@ actor MacNodeBridgeSession {
        await self.disconnect()
        self.disconnectHandler = onDisconnected
        self.state = .connecting
        do {
            try await self.connectOnce(
                endpoint: endpoint,
                hello: hello,
                tls: tls,
                onConnected: onConnected,
                onInvoke: onInvoke)
        } catch {
            if let tls, !tls.required {
                try await self.connectOnce(
                    endpoint: endpoint,
                    hello: hello,
                    tls: nil,
                    onConnected: onConnected,
                    onInvoke: onInvoke)
                return
            }
            throw error
        }
    }
-        let params = NWParameters.tcp
+    private func connectOnce(
-        params.includePeerToPeer = true
+        endpoint: NWEndpoint,
-        let tcpOptions = NWProtocolTCP.Options()
+        hello: BridgeHello,
-        tcpOptions.enableKeepalive = true
+        tls: MacNodeBridgeTLSParams?,
-        tcpOptions.keepaliveIdle = 30
+        onConnected: (@Sendable (String, String?) async -> Void)? = nil,
-        tcpOptions.keepaliveInterval = 15
+        onInvoke: @escaping @Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse) async throws
-        tcpOptions.keepaliveCount = 3
+    {
-        params.defaultProtocolStack.transportProtocol = tcpOptions
+        let params = self.makeParameters(tls: tls)
        let connection = NWConnection(to: endpoint, using: params)
        let queue = DispatchQueue(label: "com.clawdbot.macos.bridge-session")
        self.connection = connection
@@ -262,6 +283,25 @@ actor MacNodeBridgeSession {
        }
    }
    private func makeParameters(tls: MacNodeBridgeTLSParams?) -> NWParameters {
        let tcpOptions = NWProtocolTCP.Options()
        tcpOptions.enableKeepalive = true
        tcpOptions.keepaliveIdle = 30
        tcpOptions.keepaliveInterval = 15
        tcpOptions.keepaliveCount = 3
        if let tlsOptions = makeMacNodeTLSOptions(tls) {
            let params = NWParameters(tls: tlsOptions, tcp: tcpOptions)
            params.includePeerToPeer = true
            return params
        }
        let params = NWParameters.tcp
        params.includePeerToPeer = true
        params.defaultProtocolStack.transportProtocol = tcpOptions
        return params
    }
    private func failRPC(id: String, error: Error) async {
        if let cont = self.pendingRPC.removeValue(forKey: id) {
            cont.resume(throwing: error)
@@ -420,7 +460,7 @@ actor MacNodeBridgeSession {
        do {
            try await self.send(response)
        } catch {
-            await self.logInvokeSendFailure(error)
+            self.logInvokeSendFailure(error)
        }
    }
@@ -0,0 +1,74 @@
 import CryptoKit
 import Foundation
 import Network
 import Security
 struct MacNodeBridgeTLSParams: Sendable {
    let required: Bool
    let expectedFingerprint: String?
    let allowTOFU: Bool
    let storeKey: String?
 }
 enum MacNodeBridgeTLSStore {
    private static let suiteName = "com.clawdbot.shared"
    private static let keyPrefix = "mac.node.bridge.tls."
    private static var defaults: UserDefaults {
        UserDefaults(suiteName: suiteName) ?? .standard
    }
    static func loadFingerprint(stableID: String) -> String? {
        let key = self.keyPrefix + stableID
        let raw = self.defaults.string(forKey: key)?.trimmingCharacters(in: .whitespacesAndNewlines)
        return raw?.isEmpty == false ? raw : nil
    }
    static func saveFingerprint(_ value: String, stableID: String) {
        let key = self.keyPrefix + stableID
        self.defaults.set(value, forKey: key)
    }
 }
 func makeMacNodeTLSOptions(_ params: MacNodeBridgeTLSParams?) -> NWProtocolTLS.Options? {
    guard let params else { return nil }
    let options = NWProtocolTLS.Options()
    let expected = params.expectedFingerprint.map(normalizeMacNodeFingerprint)
    let allowTOFU = params.allowTOFU
    let storeKey = params.storeKey
    sec_protocol_options_set_verify_block(
        options.securityProtocolOptions,
        { _, trust, complete in
            let trustRef = sec_trust_copy_ref(trust).takeRetainedValue()
            if let chain = SecTrustCopyCertificateChain(trustRef) as? [SecCertificate],
               let cert = chain.first
            {
                let data = SecCertificateCopyData(cert) as Data
                let fingerprint = sha256Hex(data)
                if let expected {
                    complete(fingerprint == expected)
                    return
                }
                if allowTOFU {
                    if let storeKey { MacNodeBridgeTLSStore.saveFingerprint(fingerprint, stableID: storeKey) }
                    complete(true)
                    return
                }
            }
            let ok = SecTrustEvaluateWithError(trustRef, nil)
            complete(ok)
        },
        DispatchQueue(label: "com.clawdbot.macos.bridge.tls.verify"))
    return options
 }
 private func sha256Hex(_ data: Data) -> String {
    let digest = SHA256.hash(data: data)
    return digest.map { String(format: "%02x", $0) }.joined()
 }
 private func normalizeMacNodeFingerprint(_ raw: String) -> String {
    raw.lowercased().filter(\.isHexDigit)
 }
@@ -4,6 +4,12 @@ import Foundation
 import Network
 import OSLog
 private struct BridgeTarget {
    let endpoint: NWEndpoint
    let stableID: String
    let tls: MacNodeBridgeTLSParams?
 }
@MainActor
 final class MacNodeModeCoordinator {
    static let shared = MacNodeModeCoordinator()
@@ -37,6 +43,7 @@ final class MacNodeModeCoordinator {
    private func run() async {
        var retryDelay: UInt64 = 1_000_000_000
        var lastCameraEnabled: Bool?
        var lastSystemRunPolicy: SystemRunPolicy?
        let defaults = UserDefaults.standard
        while !Task.isCancelled {
            if await MainActor.run(body: { AppStateStore.shared.isPaused }) {
@@ -53,7 +60,16 @@ final class MacNodeModeCoordinator {
                try? await Task.sleep(nanoseconds: 200_000_000)
            }
-            guard let endpoint = await self.resolveBridgeEndpoint(timeoutSeconds: 5) else {
+            let systemRunPolicy = SystemRunPolicy.load()
            if lastSystemRunPolicy == nil {
                lastSystemRunPolicy = systemRunPolicy
            } else if lastSystemRunPolicy != systemRunPolicy {
                lastSystemRunPolicy = systemRunPolicy
                await self.session.disconnect()
                try? await Task.sleep(nanoseconds: 200_000_000)
            }
            guard let target = await self.resolveBridgeEndpoint(timeoutSeconds: 5) else {
                try? await Task.sleep(nanoseconds: min(retryDelay, 5_000_000_000))
                retryDelay = min(retryDelay * 2, 10_000_000_000)
                continue
@@ -63,10 +79,11 @@ final class MacNodeModeCoordinator {
            do {
                let hello = await self.makeHello()
                self.logger.info(
-                    "mac node bridge connecting endpoint=\(endpoint, privacy: .public)")
+                    "mac node bridge connecting endpoint=\(target.endpoint, privacy: .public)")
                try await self.session.connect(
-                    endpoint: endpoint,
+                    endpoint: target.endpoint,
                    hello: hello,
                    tls: target.tls,
                    onConnected: { [weak self] serverName, mainSessionKey in
                        self?.logger.info("mac node connected to \(serverName, privacy: .public)")
                        if let mainSessionKey {
@@ -86,7 +103,7 @@ final class MacNodeModeCoordinator {
                        return await self.runtime.handleInvoke(req)
                    })
            } catch {
-                if await self.tryPair(endpoint: endpoint, error: error) {
+                if await self.tryPair(target: target, error: error) {
                    continue
                }
                self.logger.error(
@@ -143,10 +160,13 @@ final class MacNodeModeCoordinator {
            ClawdbotCanvasA2UICommand.pushJSONL.rawValue,
            ClawdbotCanvasA2UICommand.reset.rawValue,
            MacNodeScreenCommand.record.rawValue,
            ClawdbotSystemCommand.run.rawValue,
            ClawdbotSystemCommand.notify.rawValue,
        ]
        if SystemRunPolicy.load() != .never {
            commands.append(ClawdbotSystemCommand.run.rawValue)
        }
        let capsSet = Set(caps)
        if capsSet.contains(ClawdbotCapability.camera.rawValue) {
            commands.append(ClawdbotCameraCommand.list.rawValue)
@@ -160,7 +180,7 @@ final class MacNodeModeCoordinator {
        return commands
    }
-    private func tryPair(endpoint: NWEndpoint, error: Error) async -> Bool {
+    private func tryPair(target: BridgeTarget, error: Error) async -> Bool {
        let text = error.localizedDescription.uppercased()
        guard text.contains("NOT_PAIRED") || text.contains("UNAUTHORIZED") else { return false }
@@ -170,9 +190,10 @@ final class MacNodeModeCoordinator {
            }
            let hello = await self.makeHello()
            let token = try await MacNodeBridgePairingClient().pairAndHello(
-                endpoint: endpoint,
+                endpoint: target.endpoint,
                hello: hello,
                silent: shouldSilent,
                tls: target.tls,
                onStatus: { [weak self] status in
                    self?.logger.info("mac node pairing: \(status, privacy: .public)")
                })
@@ -190,7 +211,7 @@ final class MacNodeModeCoordinator {
        "mac-\(InstanceIdentity.instanceId)"
    }
-    private func resolveLoopbackBridgeEndpoint(timeoutSeconds: Double) async -> NWEndpoint? {
+    private func resolveLoopbackBridgeEndpoint(timeoutSeconds: Double) async -> BridgeTarget? {
        guard let port = Self.loopbackBridgePort(),
              let endpointPort = NWEndpoint.Port(rawValue: port)
        else {
@@ -198,7 +219,10 @@ final class MacNodeModeCoordinator {
        }
        let endpoint = NWEndpoint.hostPort(host: "127.0.0.1", port: endpointPort)
        let reachable = await Self.probeEndpoint(endpoint, timeoutSeconds: timeoutSeconds)
-        return reachable ? endpoint : nil
+        guard reachable else { return nil }
        let stableID = BridgeEndpointID.stableID(endpoint)
        let tlsParams = Self.resolveManualTLSParams(stableID: stableID)
        return BridgeTarget(endpoint: endpoint, stableID: stableID, tls: tlsParams)
    }
    static func loopbackBridgePort() -> UInt16? {
@@ -291,7 +315,7 @@ final class MacNodeModeCoordinator {
            })
    }
-    private func resolveBridgeEndpoint(timeoutSeconds: Double) async -> NWEndpoint? {
+    private func resolveBridgeEndpoint(timeoutSeconds: Double) async -> BridgeTarget? {
        let mode = await MainActor.run(body: { AppStateStore.shared.connectionMode })
        if mode == .remote {
            do {
@@ -303,7 +327,10 @@ final class MacNodeModeCoordinator {
                    if healthy, let port = NWEndpoint.Port(rawValue: localPort) {
                        self.logger.info(
                            "reusing mac node bridge tunnel localPort=\(localPort, privacy: .public)")
-                        return .hostPort(host: "127.0.0.1", port: port)
+                        let endpoint = NWEndpoint.hostPort(host: "127.0.0.1", port: port)
                        let stableID = BridgeEndpointID.stableID(endpoint)
                        let tlsParams = Self.resolveManualTLSParams(stableID: stableID)
                        return BridgeTarget(endpoint: endpoint, stableID: stableID, tls: tlsParams)
                    }
                    self.logger.error(
                        "mac node bridge tunnel unhealthy localPort=\(localPort, privacy: .public); restarting")
@@ -312,9 +339,23 @@ final class MacNodeModeCoordinator {
                }
                let remotePort = Self.remoteBridgePort()
                let preferredLocalPort = Self.loopbackBridgePort()
                if let preferredLocalPort {
                    self.logger.info(
                        "mac node bridge tunnel starting " +
                            "preferredLocalPort=\(preferredLocalPort, privacy: .public) " +
                            "remotePort=\(remotePort, privacy: .public)")
                } else {
                    self.logger.info(
                        "mac node bridge tunnel starting " +
                            "preferredLocalPort=none " +
                            "remotePort=\(remotePort, privacy: .public)")
                }
                self.tunnel = try await RemotePortTunnel.create(
                    remotePort: remotePort,
-                    allowRemoteUrlOverride: false)
+                    preferredLocalPort: preferredLocalPort,
                    allowRemoteUrlOverride: false,
                    allowRandomLocalPort: true)
                if let localPort = self.tunnel?.localPort,
                   let port = NWEndpoint.Port(rawValue: localPort)
                {
@@ -322,7 +363,10 @@ final class MacNodeModeCoordinator {
                        "mac node bridge tunnel ready " +
                            "localPort=\(localPort, privacy: .public) " +
                            "remotePort=\(remotePort, privacy: .public)")
-                    return .hostPort(host: "127.0.0.1", port: port)
+                    let endpoint = NWEndpoint.hostPort(host: "127.0.0.1", port: port)
                    let stableID = BridgeEndpointID.stableID(endpoint)
                    let tlsParams = Self.resolveManualTLSParams(stableID: stableID)
                    return BridgeTarget(endpoint: endpoint, stableID: stableID, tls: tlsParams)
                }
            } catch {
                self.logger.error("mac node bridge tunnel failed: \(error.localizedDescription, privacy: .public)")
@@ -333,8 +377,8 @@ final class MacNodeModeCoordinator {
            tunnel.terminate()
            self.tunnel = nil
        }
-        if mode == .local, let endpoint = await self.resolveLoopbackBridgeEndpoint(timeoutSeconds: 0.4) {
+        if mode == .local, let target = await self.resolveLoopbackBridgeEndpoint(timeoutSeconds: 0.4) {
-            return endpoint
+            return target
        }
        return await Self.discoverBridgeEndpoint(timeoutSeconds: timeoutSeconds)
    }
@@ -354,14 +398,14 @@ final class MacNodeModeCoordinator {
        return await Self.probeEndpoint(.hostPort(host: "127.0.0.1", port: port), timeoutSeconds: timeoutSeconds)
    }
-    private static func discoverBridgeEndpoint(timeoutSeconds: Double) async -> NWEndpoint? {
+    private static func discoverBridgeEndpoint(timeoutSeconds: Double) async -> BridgeTarget? {
        final class DiscoveryState: @unchecked Sendable {
            let lock = NSLock()
            var resolved = false
            var browsers: [NWBrowser] = []
-            var continuation: CheckedContinuation<NWEndpoint?, Never>?
+            var continuation: CheckedContinuation<BridgeTarget?, Never>?
-            func finish(_ endpoint: NWEndpoint?) {
+            func finish(_ target: BridgeTarget?) {
                self.lock.lock()
                defer { lock.unlock() }
                if self.resolved { return }
@@ -369,7 +413,7 @@ final class MacNodeModeCoordinator {
                for browser in self.browsers {
                    browser.cancel()
                }
-                self.continuation?.resume(returning: endpoint)
+                self.continuation?.resume(returning: target)
                self.continuation = nil
            }
        }
@@ -395,12 +439,12 @@ final class MacNodeModeCoordinator {
                           return false
                       })
                    {
-                        state.finish(match.endpoint)
+                        state.finish(Self.targetFromResult(match))
                        return
                    }
                    if let result = results.first(where: { if case .service = $0.endpoint { true } else { false } }) {
-                        state.finish(result.endpoint)
+                        state.finish(Self.targetFromResult(result))
                    }
                }
                browser.stateUpdateHandler = { browserState in
@@ -418,6 +462,72 @@ final class MacNodeModeCoordinator {
            }
        }
    }
    private nonisolated static func targetFromResult(_ result: NWBrowser.Result) -> BridgeTarget? {
        let endpoint = result.endpoint
        guard case .service = endpoint else { return nil }
        let stableID = BridgeEndpointID.stableID(endpoint)
        let txt = result.endpoint.txtRecord?.dictionary ?? [:]
        let tlsEnabled = Self.txtBoolValue(txt, key: "bridgeTls")
        let tlsFingerprint = Self.txtValue(txt, key: "bridgeTlsSha256")
        let tlsParams = Self.resolveDiscoveredTLSParams(
            stableID: stableID,
            tlsEnabled: tlsEnabled,
            tlsFingerprintSha256: tlsFingerprint)
        return BridgeTarget(endpoint: endpoint, stableID: stableID, tls: tlsParams)
    }
    private nonisolated static func resolveDiscoveredTLSParams(
        stableID: String,
        tlsEnabled: Bool,
        tlsFingerprintSha256: String?) -> MacNodeBridgeTLSParams?
    {
        let stored = MacNodeBridgeTLSStore.loadFingerprint(stableID: stableID)
        if tlsEnabled || tlsFingerprintSha256 != nil {
            return MacNodeBridgeTLSParams(
                required: true,
                expectedFingerprint: tlsFingerprintSha256 ?? stored,
                allowTOFU: stored == nil,
                storeKey: stableID)
        }
        if let stored {
            return MacNodeBridgeTLSParams(
                required: true,
                expectedFingerprint: stored,
                allowTOFU: false,
                storeKey: stableID)
        }
        return nil
    }
    private nonisolated static func resolveManualTLSParams(stableID: String) -> MacNodeBridgeTLSParams? {
        if let stored = MacNodeBridgeTLSStore.loadFingerprint(stableID: stableID) {
            return MacNodeBridgeTLSParams(
                required: true,
                expectedFingerprint: stored,
                allowTOFU: false,
                storeKey: stableID)
        }
        return MacNodeBridgeTLSParams(
            required: false,
            expectedFingerprint: nil,
            allowTOFU: true,
            storeKey: stableID)
    }
    private nonisolated static func txtValue(_ dict: [String: String], key: String) -> String? {
        let raw = dict[key]?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
        return raw.isEmpty ? nil : raw
    }
    private nonisolated static func txtBoolValue(_ dict: [String: String], key: String) -> Bool {
        guard let raw = self.txtValue(dict, key: key)?.lowercased() else { return false }
        return raw == "1" || raw == "true" || raw == "yes"
    }
 }
 enum MacNodeTokenStore {
@@ -426,6 +426,37 @@ actor MacNodeRuntime {
            return Self.errorResponse(req, code: .invalidRequest, message: "INVALID_REQUEST: command required")
        }
        let wasAllowlisted = SystemRunAllowlist.contains(command)
        switch Self.systemRunPolicy() {
        case .never:
            return Self.errorResponse(
                req,
                code: .unavailable,
                message: "SYSTEM_RUN_DISABLED: policy=never")
        case .always:
            break
        case .ask:
            if !wasAllowlisted {
                let services = await self.mainActorServices()
                let decision = await services.confirmSystemRun(
                    command: SystemRunAllowlist.displayString(for: command),
                    cwd: params.cwd)
                switch decision {
                case .allowOnce:
                    break
                case .allowAlways:
                    SystemRunAllowlist.add(command)
                case .deny:
                    return Self.errorResponse(
                        req,
                        code: .unavailable,
                        message: "SYSTEM_RUN_DENIED: user denied")
                }
            }
        }
        let env = Self.sanitizedEnv(params.env)
        if params.needsScreenRecording == true {
            let authorized = await PermissionManager
                .status([.screenRecording])[.screenRecording] ?? false
@@ -441,7 +472,7 @@ actor MacNodeRuntime {
        let result = await ShellExecutor.runDetailed(
            command: command,
            cwd: params.cwd,
-            env: params.env,
+            env: env,
            timeout: timeoutSec)
        struct RunPayload: Encodable {
@@ -529,6 +560,39 @@ actor MacNodeRuntime {
        UserDefaults.standard.object(forKey: cameraEnabledKey) as? Bool ?? false
    }
    private nonisolated static func systemRunPolicy() -> SystemRunPolicy {
        SystemRunPolicy.load()
    }
    private static let blockedEnvKeys: Set<String> = [
        "PATH",
        "NODE_OPTIONS",
        "PYTHONHOME",
        "PYTHONPATH",
        "PERL5LIB",
        "PERL5OPT",
        "RUBYOPT",
    ]
    private static let blockedEnvPrefixes: [String] = [
        "DYLD_",
        "LD_",
    ]
    private static func sanitizedEnv(_ overrides: [String: String]?) -> [String: String]? {
        guard let overrides else { return nil }
        var merged = ProcessInfo.processInfo.environment
        for (rawKey, value) in overrides {
            let key = rawKey.trimmingCharacters(in: .whitespacesAndNewlines)
            guard !key.isEmpty else { continue }
            let upper = key.uppercased()
            if self.blockedEnvKeys.contains(upper) { continue }
            if self.blockedEnvPrefixes.contains(where: { upper.hasPrefix($0) }) { continue }
            merged[key] = value
        }
        return merged
    }
    private nonisolated static func locationMode() -> ClawdbotLocationMode {
        let raw = UserDefaults.standard.string(forKey: locationModeKey) ?? "off"
        return ClawdbotLocationMode(rawValue: raw) ?? .off
@@ -1,7 +1,14 @@
 import AppKit
 import ClawdbotKit
 import CoreLocation
 import Foundation
 enum SystemRunDecision: Sendable {
    case allowOnce
    case allowAlways
    case deny
 }
@MainActor
 protocol MacNodeRuntimeMainActorServices: Sendable {
    func recordScreen(
@@ -17,6 +24,8 @@ protocol MacNodeRuntimeMainActorServices: Sendable {
        desiredAccuracy: ClawdbotLocationAccuracy,
        maxAgeMs: Int?,
        timeoutMs: Int?) async throws -> CLLocation
    func confirmSystemRun(command: String, cwd: String?) async -> SystemRunDecision
 }
@MainActor
@@ -57,4 +66,31 @@ final class LiveMacNodeRuntimeMainActorServices: MacNodeRuntimeMainActorServices
            maxAgeMs: maxAgeMs,
            timeoutMs: timeoutMs)
    }
    func confirmSystemRun(command: String, cwd: String?) async -> SystemRunDecision {
        let alert = NSAlert()
        alert.alertStyle = .warning
        alert.messageText = "Allow this command?"
        var details = "Clawdbot wants to run:\n\n\(command)"
        let trimmedCwd = cwd?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
        if !trimmedCwd.isEmpty {
            details += "\n\nWorking directory:\n\(trimmedCwd)"
        }
        details += "\n\nThis runs on this Mac via node mode."
        alert.informativeText = details
        alert.addButton(withTitle: "Allow Once")
        alert.addButton(withTitle: "Always Allow")
        alert.addButton(withTitle: "Don't Allow")
        switch alert.runModal() {
        case .alertFirstButtonReturn:
            return .allowOnce
        case .alertSecondButtonReturn:
            return .allowAlways
        default:
            return .deny
        }
    }
 }
@@ -351,10 +351,14 @@ actor PortGuardian {
            if port == GatewayEnvironment.gatewayPort() { return cmd.contains("ssh") }
            return false
        case .local:
-            if !cmd.contains("clawdbot") { return false }
+            // The gateway may listen as `clawdbot` or via its runtime (e.g. node).
-            if full.contains("gateway-daemon") { return true }
+            let hasGatewayArgs =
                full.contains(" gateway ") &&
                full.contains(" --port \(port)")
            if hasGatewayArgs { return true }
            // If args are unavailable, treat a clawdbot listener as expected.
-            return full == cmd
+            if cmd.contains("clawdbot"), full == cmd { return true }
            return false
        case .unconfigured:
            return false
        }
@@ -0,0 +1,89 @@
 import Foundation
 enum SystemRunPolicy: String, CaseIterable, Identifiable {
    case never
    case ask
    case always
    var id: String { self.rawValue }
    var title: String {
        switch self {
        case .never:
            "Never"
        case .ask:
            "Always Ask"
        case .always:
            "Always Allow"
        }
    }
    static func load(from defaults: UserDefaults = .standard) -> SystemRunPolicy {
        if let policy = MacNodeConfigFile.systemRunPolicy() {
            return policy
        }
        if let raw = defaults.string(forKey: systemRunPolicyKey),
           let policy = SystemRunPolicy(rawValue: raw)
        {
            MacNodeConfigFile.setSystemRunPolicy(policy)
            return policy
        }
        if let legacy = defaults.object(forKey: systemRunEnabledKey) as? Bool {
            let policy: SystemRunPolicy = legacy ? .ask : .never
            MacNodeConfigFile.setSystemRunPolicy(policy)
            return policy
        }
        let fallback: SystemRunPolicy = .ask
        MacNodeConfigFile.setSystemRunPolicy(fallback)
        return fallback
    }
 }
 enum SystemRunAllowlist {
    static func key(for argv: [String]) -> String {
        let trimmed = argv.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
        guard !trimmed.isEmpty else { return "" }
        if let data = try? JSONEncoder().encode(trimmed),
           let json = String(data: data, encoding: .utf8)
        {
            return json
        }
        return trimmed.joined(separator: " ")
    }
    static func displayString(for argv: [String]) -> String {
        argv.map { arg in
            let trimmed = arg.trimmingCharacters(in: .whitespacesAndNewlines)
            guard !trimmed.isEmpty else { return "\"\"" }
            let needsQuotes = trimmed.contains { $0.isWhitespace || $0 == "\"" }
            if !needsQuotes { return trimmed }
            let escaped = trimmed.replacingOccurrences(of: "\"", with: "\\\"")
            return "\"\(escaped)\""
        }.joined(separator: " ")
    }
    static func load(from defaults: UserDefaults = .standard) -> Set<String> {
        if let allowlist = MacNodeConfigFile.systemRunAllowlist() {
            return Set(allowlist)
        }
        if let legacy = defaults.stringArray(forKey: systemRunAllowlistKey), !legacy.isEmpty {
            MacNodeConfigFile.setSystemRunAllowlist(legacy)
            return Set(legacy)
        }
        return []
    }
    static func contains(_ argv: [String], defaults: UserDefaults = .standard) -> Bool {
        let key = key(for: argv)
        return self.load(from: defaults).contains(key)
    }
    static func add(_ argv: [String], defaults: UserDefaults = .standard) {
        let key = key(for: argv)
        guard !key.isEmpty else { return }
        var allowlist = self.load(from: defaults)
        if allowlist.insert(key).inserted {
            MacNodeConfigFile.setSystemRunAllowlist(Array(allowlist).sorted())
        }
    }
 }
@@ -1679,6 +1679,27 @@ public struct ChatAbortParams: Codable, Sendable {
    }
 }
 public struct ChatInjectParams: Codable, Sendable {
    public let sessionkey: String
    public let message: String
    public let label: String?
    public init(
        sessionkey: String,
        message: String,
        label: String?
    ) {
        self.sessionkey = sessionkey
        self.message = message
        self.label = label
    }
    private enum CodingKeys: String, CodingKey {
        case sessionkey = "sessionKey"
        case message
        case label
    }
 }
 public struct ChatEvent: Codable, Sendable {
    public let runid: String
    public let sessionkey: String
@@ -7,6 +7,8 @@ import Testing
        let snapshot = LaunchAgentPlistSnapshot(
            programArguments: [],
            environment: ["CLAWDBOT_GATEWAY_TOKEN": "launchd-token"],
            stdoutPath: nil,
            stderrPath: nil,
            port: nil,
            bind: nil,
            token: "launchd-token",
@@ -31,6 +33,8 @@ import Testing
        let snapshot = LaunchAgentPlistSnapshot(
            programArguments: [],
            environment: ["CLAWDBOT_GATEWAY_TOKEN": "launchd-token"],
            stdoutPath: nil,
            stderrPath: nil,
            port: nil,
            bind: nil,
            token: "launchd-token",
@@ -48,6 +52,8 @@ import Testing
        let snapshot = LaunchAgentPlistSnapshot(
            programArguments: [],
            environment: ["CLAWDBOT_GATEWAY_PASSWORD": "launchd-pass"],
            stdoutPath: nil,
            stderrPath: nil,
            port: nil,
            bind: nil,
            token: nil,
@@ -7,7 +7,7 @@ import Testing
        let url = FileManager.default.temporaryDirectory
            .appendingPathComponent("clawdbot-launchd-\(UUID().uuidString).plist")
        let plist: [String: Any] = [
-            "ProgramArguments": ["clawdbot", "gateway-daemon", "--port", "18789", "--bind", "loopback"],
+            "ProgramArguments": ["clawdbot", "gateway", "--port", "18789", "--bind", "loopback"],
            "EnvironmentVariables": [
                "CLAWDBOT_GATEWAY_TOKEN": " secret ",
                "CLAWDBOT_GATEWAY_PASSWORD": "pw",
@@ -28,7 +28,7 @@ import Testing
        let url = FileManager.default.temporaryDirectory
            .appendingPathComponent("clawdbot-launchd-\(UUID().uuidString).plist")
        let plist: [String: Any] = [
-            "ProgramArguments": ["clawdbot", "gateway-daemon", "--port", "18789"],
+            "ProgramArguments": ["clawdbot", "gateway", "--port", "18789"],
        ]
        let data = try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0)
        try data.write(to: url, options: [.atomic])
@@ -112,20 +112,6 @@ struct LowCoverageHelperTests {
        _ = PresenceReporter._testPrimaryIPv4Address()
    }
    @Test func gatewayLaunchAgentHelpers() async throws {
        await TestIsolation.withEnvValues(
            [
                "CLAWDBOT_GATEWAY_BIND": "Lan",
                "CLAWDBOT_GATEWAY_TOKEN": " secret ",
            ]) {
                #expect(GatewayLaunchAgentManager._testPreferredGatewayBind() == "lan")
                #expect(GatewayLaunchAgentManager._testPreferredGatewayToken() == "secret")
                #expect(
                    GatewayLaunchAgentManager._testEscapePlistValue("a&b<c>\"'") ==
                        "a&amp;b&lt;c&gt;&quot;&apos;")
            }
    }
    @Test func portGuardianParsesListenersAndBuildsReports() {
        let output = """
        p123
@@ -191,7 +191,7 @@ Notes:
  - Your config requires mentions and you didn’t mention it, or
  - Your guild/channel allowlist denies the channel/user.
 - **`requireMention: false` but still no replies**:
-  - `channels.discord.groupPolicy` defaults to **allowlist**; set it to `"open"` or explicitly list channels under `channels.discord.guilds.<id>.channels`.
+  - `channels.discord.groupPolicy` defaults to **allowlist**; set it to `"open"` or add a guild entry under `channels.discord.guilds` (optionally list channels under `channels.discord.guilds.<id>.channels` to restrict).
  - `requireMention` must live under `channels.discord.guilds` (or a specific channel). `channels.discord.requireMention` at the top level is ignored.
 - **Permission audits** (`channels status --probe`) only check numeric channel IDs. If you use slugs/names as `channels.discord.guilds.*.channels` keys, the audit can’t verify permissions.
 - **DMs don’t work**: `channels.discord.dm.enabled=false`, `channels.discord.dm.policy="disabled"`, or you haven’t been approved yet (`channels.discord.dm.policy="pairing"`).
@@ -227,6 +227,8 @@ Outbound Discord API calls retry on rate limits (429) using Discord `retry_after
      actions: {
        reactions: true,
        stickers: true,
        emojiUploads: true,
        stickerUploads: true,
        polls: true,
        permissions: true,
        messages: true,
@@ -237,6 +239,7 @@ Outbound Discord API calls retry on rate limits (429) using Discord `retry_after
        roleInfo: true,
        roles: false,
        channelInfo: true,
        channels: true,
        voiceStatus: true,
        events: true,
        moderation: false
@@ -304,8 +307,9 @@ ack reaction after the bot replies.
 - `retry`: retry policy for outbound Discord API calls (attempts, minDelayMs, maxDelayMs, jitter).
 - `actions`: per-action tool gates; omit to allow all (set `false` to disable).
  - `reactions` (covers react + read reactions)
-  - `stickers`, `polls`, `permissions`, `messages`, `threads`, `pins`, `search`
+  - `stickers`, `emojiUploads`, `stickerUploads`, `polls`, `permissions`, `messages`, `threads`, `pins`, `search`
  - `memberInfo`, `roleInfo`, `channelInfo`, `voiceStatus`, `events`
  - `channels` (create/edit/delete channels + categories + permissions)
  - `roles` (role add/remove, default `false`)
  - `moderation` (timeout/kick/ban, default `false`)
@@ -321,6 +325,8 @@ Reaction notifications use `guilds.<id>.reactionNotifications`:
 | --- | --- | --- |
 | reactions | enabled | React + list reactions + emojiList |
 | stickers | enabled | Send stickers |
 | emojiUploads | enabled | Upload emojis |
 | stickerUploads | enabled | Upload stickers |
 | polls | enabled | Create polls |
 | permissions | enabled | Channel permission snapshot |
 | messages | enabled | Read/send/edit/delete |
@@ -330,6 +336,7 @@ Reaction notifications use `guilds.<id>.reactionNotifications`:
 | memberInfo | enabled | Member info |
 | roleInfo | enabled | Role list |
 | channelInfo | enabled | Channel info + list |
 | channels | enabled | Channel/category management |
 | voiceStatus | enabled | Voice state lookup |
 | events | enabled | List/create scheduled events |
 | roles | disabled | Role add/remove |
@@ -352,6 +359,7 @@ Allowlist matching notes:
 - Prefixes like `discord:`/`user:` (users) and `channel:` (group DMs) are supported.
 - Use `*` to allow any sender/channel.
 - When `guilds.<id>.channels` is present, channels not listed are denied by default.
 - When `guilds.<id>.channels` is omitted, all channels in the allowlisted guild are allowed.
 Native command notes:
 - The registered commands mirror Clawdbot’s chat commands.
@@ -362,6 +370,7 @@ The agent can call `discord` with actions like:
 - `react` / `reactions` (add or list reactions)
 - `sticker`, `poll`, `permissions`
 - `readMessages`, `sendMessage`, `editMessage`, `deleteMessage`
 - Read/search/pin tool payloads include normalized `timestampMs` (UTC epoch ms) and `timestampUtc` alongside raw Discord `timestamp`.
 - `threadCreate`, `threadList`, `threadReply`
 - `pinMessage`, `unpinMessage`, `listPins`
 - `searchMessages`, `memberInfo`, `roleInfo`, `roleAdd`, `roleRemove`, `emojiList`
@@ -17,7 +17,7 @@ Text is supported everywhere; media and reactions vary by channel.
 - [Slack](/channels/slack) — Bolt SDK; workspace apps.
 - [Signal](/channels/signal) — signal-cli; privacy-focused.
 - [iMessage](/channels/imessage) — macOS only; native integration.
- [Microsoft Teams](/channels/msteams) — Bot Framework; enterprise support.
+- [Microsoft Teams](/channels/msteams) — Bot Framework; enterprise support (plugin, installed separately).
 - [Matrix](/channels/matrix) — Matrix protocol (plugin, installed separately).
 - [Zalo](/channels/zalo) — Zalo Bot API; Vietnam's popular messenger (plugin, installed separately).
 - [WebChat](/web/webchat) — Gateway WebChat UI over WebSocket.
@@ -3,20 +3,43 @@ summary: "Microsoft Teams bot support status, capabilities, and configuration"
 read_when:
  - Working on MS Teams channel features
 ---
-# Microsoft Teams (Bot Framework)
+# Microsoft Teams (plugin)
 > "Abandon all hope, ye who enter here."
-Updated: 2026-01-08
+Updated: 2026-01-16
 Status: text + DM attachments are supported; channel/group attachments require Microsoft Graph permissions. Polls are sent via Adaptive Cards.
 ## Plugin required
 Microsoft Teams ships as a plugin and is not bundled with the core install.
 **Breaking change (2026.1.15):** MS Teams moved out of core. If you use it, you must install the plugin.
 Explainable: keeps core installs lighter and lets MS Teams dependencies update independently.
 Install via CLI (npm registry):
 ```bash
 clawdbot plugins install @clawdbot/msteams
 ```
 Local checkout (when running from a git repo):
 ```bash
 clawdbot plugins install ./extensions/msteams
 ```
 If you choose Teams during configure/onboarding and a git checkout is detected,
 Clawdbot will offer the local install path automatically.
 Details: [Plugins](/plugin)
 ## Quick setup (beginner)
-1) Create an **Azure Bot** (App ID + client secret + tenant ID).
+1) Install the Microsoft Teams plugin.
-2) Configure Clawdbot with those credentials.
+2) Create an **Azure Bot** (App ID + client secret + tenant ID).
-3) Expose `/api/messages` (port 3978 by default) via a public URL or tunnel.
+3) Configure Clawdbot with those credentials.
-4) Install the Teams app package and start the gateway.
+4) Expose `/api/messages` (port 3978 by default) via a public URL or tunnel.
 5) Install the Teams app package and start the gateway.
 Minimal config:
 ```json5
@@ -73,11 +96,12 @@ Example:
 ```
 ## How it works
-1. Create an **Azure Bot** (App ID + secret + tenant ID).
+1. Install the Microsoft Teams plugin.
-2. Build a **Teams app package** that references the bot and includes the RSC permissions below.
+2. Create an **Azure Bot** (App ID + secret + tenant ID).
-3. Upload/install the Teams app into a team (or personal scope for DMs).
+3. Build a **Teams app package** that references the bot and includes the RSC permissions below.
-4. Configure `msteams` in `~/.clawdbot/clawdbot.json` (or env vars) and start the gateway.
+4. Upload/install the Teams app into a team (or personal scope for DMs).
-5. The gateway listens for Bot Framework webhook traffic on `/api/messages` by default.
+5. Configure `msteams` in `~/.clawdbot/clawdbot.json` (or env vars) and start the gateway.
 6. The gateway listens for Bot Framework webhook traffic on `/api/messages` by default.
 ## Azure Bot Setup (Prerequisites)
@@ -166,13 +190,17 @@ This is often easier than hand-editing JSON manifests.
 3. Check gateway logs for incoming activity
 ## Setup (minimal text-only)
-1. **Bot registration**
+1. **Install the Microsoft Teams plugin**
   - From npm: `clawdbot plugins install @clawdbot/msteams`
   - From a local checkout: `clawdbot plugins install ./extensions/msteams`
 2. **Bot registration**
   - Create an Azure Bot (see above) and note:
     - App ID
     - Client secret (App password)
     - Tenant ID (single-tenant)
-2. **Teams app manifest**
+3. **Teams app manifest**
   - Include a `bot` entry with `botId = <App ID>`.
   - Scopes: `personal`, `team`, `groupChat`.
   - `supportsFiles: true` (required for personal scope file handling).
@@ -180,7 +208,7 @@ This is often easier than hand-editing JSON manifests.
   - Create icons: `outline.png` (32x32) and `color.png` (192x192).
   - Zip all three files together: `manifest.json`, `outline.png`, `color.png`.
-3. **Configure Clawdbot**
+4. **Configure Clawdbot**
   ```json
   {
     "msteams": {
@@ -198,12 +226,12 @@ This is often easier than hand-editing JSON manifests.
   - `MSTEAMS_APP_PASSWORD`
   - `MSTEAMS_TENANT_ID`
-4. **Bot endpoint**
+5. **Bot endpoint**
   - Set the Azure Bot Messaging Endpoint to:
     - `https://<host>:3978/api/messages` (or your chosen path/port).
-5. **Run the gateway**
+6. **Run the gateway**
-   - The Teams channel starts automatically when `msteams` config exists and credentials are set.
+   - The Teams channel starts automatically when the plugin is installed and `msteams` config exists with credentials.
 ## History context
 - `channels.msteams.historyLimit` controls how many recent channel/group messages are wrapped into the prompt.
@@ -27,17 +27,17 @@ Minimal config:
 1) Create a Slack app (From scratch) in https://api.channels.slack.com/apps.
 2) **Socket Mode** → toggle on. Then go to **Basic Information** → **App-Level Tokens** → **Generate Token and Scopes** with scope `connections:write`. Copy the **App Token** (`xapp-...`).
 3) **OAuth & Permissions** → add bot token scopes (use the manifest below). Click **Install to Workspace**. Copy the **Bot User OAuth Token** (`xoxb-...`).
-4) **Event Subscriptions** → enable events and subscribe to:
+4) Optional: **OAuth & Permissions** → add **User Token Scopes** (see the read-only list below). Reinstall the app and copy the **User OAuth Token** (`xoxp-...`).
 5) **Event Subscriptions** → enable events and subscribe to:
   - `message.*` (includes edits/deletes/thread broadcasts)
   - `app_mention`
   - `reaction_added`, `reaction_removed`
   - `member_joined_channel`, `member_left_channel`
   - `channel_id_changed`
   - `channel_rename`
   - `pin_added`, `pin_removed`
-5) Invite the bot to channels you want it to read.
+6) Invite the bot to channels you want it to read.
-6) Slash Commands → create `/clawd` if you use `channels.slack.slashCommand`. If you enable native commands, add one slash command per built-in command (same names as `/help`). Native defaults to off for Slack unless you set `channels.slack.commands.native: true` (global `commands.native` is `"auto"` which leaves Slack off).
+7) Slash Commands → create `/clawd` if you use `channels.slack.slashCommand`. If you enable native commands, add one slash command per built-in command (same names as `/help`). Native defaults to off for Slack unless you set `channels.slack.commands.native: true` (global `commands.native` is `"auto"` which leaves Slack off).
-7) App Home → enable the **Messages Tab** so users can DM the bot.
+8) App Home → enable the **Messages Tab** so users can DM the bot.
 Use the manifest below so scopes and events stay in sync.
@@ -63,27 +63,59 @@ Or via config:
 }
 ```
-## History context
+## User token (optional)
- `channels.slack.historyLimit` (or `channels.slack.accounts.*.historyLimit`) controls how many recent channel/group messages are wrapped into the prompt.
+Clawdbot can use a Slack user token (`xoxp-...`) for read operations (history,
- Falls back to `messages.groupChat.historyLimit`. Set `0` to disable (default 50).
+pins, reactions, emoji, member info). By default this stays read-only: reads
- DM history can be limited with `channels.slack.dmHistoryLimit` (user turns). Per-user overrides: `channels.slack.dms["<user_id>"].historyLimit`.
+prefer the user token when present, and writes still use the bot token unless
 you explicitly opt in. Even with `userTokenReadOnly: false`, the bot token stays
 preferred for writes when it is available.
-## Config writes
+User tokens are configured in the config file (no env var support). For
-By default, Slack is allowed to write config updates triggered by channel events or `/config set|unset`.
+multi-account, set `channels.slack.accounts.<id>.userToken`.
-This happens when:
+Example with bot + app + user tokens:
 - Slack emits `channel_id_changed` (e.g. Slack Connect channel ID changes). Clawdbot can migrate `channels.slack.channels` automatically.
 - You run `/config set` or `/config unset` in Slack (requires `commands.config: true`).
 Disable with:
 ```json5
 {
-  channels: { slack: { configWrites: false } }
+  channels: {
    slack: {
      enabled: true,
      appToken: "xapp-...",
      botToken: "xoxb-...",
      userToken: "xoxp-..."
    }
  }
 }
 ```
 Example with userTokenReadOnly explicitly set (allow user token writes):
 ```json5
 {
  channels: {
    slack: {
      enabled: true,
      appToken: "xapp-...",
      botToken: "xoxb-...",
      userToken: "xoxp-...",
      userTokenReadOnly: false
    }
  }
 }
 ```
 ### Token usage
 - Read operations (history, reactions list, pins list, emoji list, member info,
  search) prefer the user token when configured, otherwise the bot token.
 - Write operations (send/edit/delete messages, add/remove reactions, pin/unpin,
  file uploads) use the bot token by default. If `userTokenReadOnly: false` and
  no bot token is available, Clawdbot falls back to the user token.
 ## History context
 - `channels.slack.historyLimit` (or `channels.slack.accounts.*.historyLimit`) controls how many recent channel/group messages are wrapped into the prompt.
 - Falls back to `messages.groupChat.historyLimit`. Set `0` to disable (default 50).
 ## Manifest (optional)
-Use this Slack app manifest to create the app quickly (adjust the name/command if you want).
+Use this Slack app manifest to create the app quickly (adjust the name/command if you want). Include the
 user scopes if you plan to configure a user token.
 ```json
 {
@@ -133,6 +165,21 @@ Use this Slack app manifest to create the app quickly (adjust the name/command i
        "commands",
        "files:read",
        "files:write"
      ],
      "user": [
        "channels:history",
        "channels:read",
        "groups:history",
        "groups:read",
        "im:history",
        "im:read",
        "mpim:history",
        "mpim:read",
        "users:read",
        "reactions:read",
        "pins:read",
        "emoji:read",
        "search:read"
      ]
    }
  },
@@ -149,7 +196,6 @@ Use this Slack app manifest to create the app quickly (adjust the name/command i
        "reaction_removed",
        "member_joined_channel",
        "member_left_channel",
        "channel_id_changed",
        "channel_rename",
        "pin_added",
        "pin_removed"
@@ -166,7 +212,7 @@ Slack's Conversations API is type-scoped: you only need the scopes for the
 conversation types you actually touch (channels, groups, im, mpim). See
 https://api.channels.slack.com/docs/conversations-api for the overview.
-### Required scopes
+### Bot token scopes (required)
 - `chat:write` (send/update/delete messages via `chat.postMessage`)
  https://api.channels.slack.com/methods/chat.postMessage
 - `im:write` (open DMs via `conversations.open` for user DMs)
@@ -188,6 +234,17 @@ https://api.channels.slack.com/docs/conversations-api for the overview.
 - `files:write` (uploads via `files.uploadV2`)
  https://api.channels.slack.com/messaging/files/uploading
 ### User token scopes (optional, read-only by default)
 Add these under **User Token Scopes** if you configure `channels.slack.userToken`.
 - `channels:history`, `groups:history`, `im:history`, `mpim:history`
 - `channels:read`, `groups:read`, `im:read`, `mpim:read`
 - `users:read`
 - `reactions:read`
 - `pins:read`
 - `emoji:read`
 - `search:read`
 ### Not needed today (but likely future)
 - `mpim:write` (only if we add group-DM open/DM start via `conversations.open`)
 - `groups:write` (only if we add private-channel management: create/rename/invite/archive)
@@ -269,11 +326,6 @@ By default, Clawdbot replies in the main channel. Use `channels.slack.replyToMod
 The mode applies to both auto-replies and agent tool calls (`slack sendMessage`).
 ### Thread session isolation
 Slack thread sessions are isolated by default. Configure with:
 - `channels.slack.thread.historyScope`: `thread` (default) keeps per-thread history; `channel` shares history across the channel.
 - `channels.slack.thread.inheritParent`: `false` (default) starts a clean thread session; `true` copies the parent channel transcript into the thread session.
 ### Manual threading tags
 For fine-grained control, use these tags in agent responses:
 - `[[reply_to_current]]` — reply to the triggering message (start/continue thread).
@@ -320,6 +372,17 @@ Slack tool actions can be gated with `channels.slack.actions.*`:
 | memberInfo | enabled | Member info |
 | emojiList | enabled | Custom emoji list |
 ## Security notes
 - Writes default to the bot token so state-changing actions stay scoped to the
  app's bot permissions and identity.
 - Setting `userTokenReadOnly: false` allows the user token to be used for write
  operations when a bot token is unavailable, which means actions run with the
  installing user's access. Treat the user token as highly privileged and keep
  action gates and allowlists tight.
 - If you enable user-token writes, make sure the user token includes the write
  scopes you expect (`chat:write`, `reactions:write`, `pins:write`,
  `files:write`) or those operations will fail.
 ## Notes
 - Mention gating is controlled via `channels.slack.channels` (set `requireMention` to `true`); `agents.list[].groupChat.mentionPatterns` (or `messages.groupChat.mentionPatterns`) also count as mentions.
 - Multi-agent override: set per-agent patterns on `agents.list[].groupChat.mentionPatterns`.
@@ -188,11 +188,74 @@ Disable with:
 Telegram forum topics include a `message_thread_id` per message. Clawdbot:
 - Appends `:topic:<threadId>` to the Telegram group session key so each topic is isolated.
 - Sends typing indicators and replies with `message_thread_id` so responses stay in the topic.
 - General topic (thread id `1`) is special: message sends omit `message_thread_id` (Telegram rejects it), but typing indicators still include it.
 - Exposes `MessageThreadId` + `IsForum` in template context for routing/templating.
 - Topic-specific configuration is available under `channels.telegram.groups.<chatId>.topics.<threadId>` (skills, allowlists, auto-reply, system prompts, disable).
 Private chats can include `message_thread_id` in some edge cases. Clawdbot keeps the DM session key unchanged, but still uses the thread id for replies/draft streaming when it is present.
 ## Inline Buttons
 Telegram supports inline keyboards with callback buttons. Enable this feature via capabilities:
 ```json5
 {
  "channels": {
    "telegram": {
      "capabilities": ["inlineButtons"]
    }
  }
 }
 ```
 For per-account configuration:
 ```json5
 {
  "channels": {
    "telegram": {
      "accounts": {
        "main": {
          "capabilities": ["inlineButtons"]
        }
      }
    }
  }
 }
 ```
 ### Sending buttons
 Use the message tool with the `buttons` parameter:
 ```json5
 {
  "action": "send",
  "channel": "telegram",
  "to": "123456789",
  "message": "Choose an option:",
  "buttons": [
    [
      {"text": "Yes", "callback_data": "yes"},
      {"text": "No", "callback_data": "no"}
    ],
    [
      {"text": "Cancel", "callback_data": "cancel"}
    ]
  ]
 }
 ```
 When a user clicks a button, the callback data is sent back to the agent as a message with the format:
 `callback_data: value`
 ### Configuration options
 Telegram capabilities can be configured at two levels:
 - `channels.telegram.capabilities`: Global default capability list applied to all Telegram accounts unless overridden.
 - `channels.telegram.accounts.<account>.capabilities`: Per-account capabilities that override or extend the global defaults for that specific account.
 Use the global setting when all Telegram bots/accounts should behave the same. Use per-account configuration when different bots need different behaviors (for example, one account only handles DMs while another is allowed in groups or has extra capabilities).
 ## Access control (DMs + groups)
 ### DM access
@@ -297,6 +360,49 @@ Outbound Telegram API calls retry on transient network/429 errors with exponenti
 - Reaction removal semantics: see [/tools/reactions](/tools/reactions).
 - Tool gating: `channels.telegram.actions.reactions`, `channels.telegram.actions.sendMessage`, `channels.telegram.actions.deleteMessage` (default: enabled).
 ## Reaction notifications
 **How reactions work:**
 Telegram reactions arrive as **separate `message_reaction` events**, not as properties in message payloads. When a user adds a reaction, Clawdbot:
 1. Receives the `message_reaction` update from Telegram API
 2. Converts it to a **system event** with format: `"Telegram reaction added: {emoji} by {user} on msg {id}"`
 3. Enqueues the system event using the **same session key** as regular messages
 4. When the next message arrives in that conversation, system events are drained and prepended to the agent's context
 The agent sees reactions as **system notifications** in the conversation history, not as message metadata.
 **Configuration:**
 - `channels.telegram.reactionNotifications`: Controls which reactions trigger notifications
  - `"off"` — ignore all reactions (default when not set)
  - `"own"` — notify when users react to bot messages (best-effort; in-memory)
  - `"all"` — notify for all reactions
 - `channels.telegram.reactionLevel`: Controls agent's reaction capability
  - `"off"` — agent cannot react to messages
  - `"ack"` — bot sends acknowledgment reactions (👀 while processing) (default)
  - `"minimal"` — agent can react sparingly (guideline: 1 per 5-10 exchanges)
  - `"extensive"` — agent can react liberally when appropriate
 **Forum groups:** Reactions in forum groups include `message_thread_id` and use session keys like `agent:main:telegram:group:{chatId}:topic:{threadId}`. This ensures reactions and messages in the same topic stay together.
 **Example config:**
 ```json5
 {
  channels: {
    telegram: {
      reactionNotifications: "all",  // See all reactions
      reactionLevel: "minimal"        // Agent can react sparingly
    }
  }
 }
 ```
 **Requirements:**
 - Telegram bots must explicitly request `message_reaction` in `allowed_updates` (configured automatically by Clawdbot)
 - For webhook mode, reactions are included in the webhook `allowed_updates`
 - For polling mode, reactions are included in the `getUpdates` `allowed_updates`
 ## Delivery targets (CLI/cron)
 - Use a chat id (`123456789`) or a username (`@name`) as the target.
 - Example: `clawdbot message send --channel telegram --to 123456789 --message "hi"`.
@@ -348,6 +454,8 @@ Provider options:
  - `channels.telegram.groups.<id>.enabled`: disable the group when `false`.
  - `channels.telegram.groups.<id>.topics.<threadId>.*`: per-topic overrides (same fields as group).
  - `channels.telegram.groups.<id>.topics.<threadId>.requireMention`: per-topic mention gating override.
 - `channels.telegram.capabilities`: Enable channel features (e.g., "inlineButtons").
 - `channels.telegram.accounts.<account>.capabilities`: Per-account capabilities.
 - `channels.telegram.replyToMode`: `off | first | all` (default: `first`).
 - `channels.telegram.textChunkLimit`: outbound chunk size (chars).
 - `channels.telegram.streamMode`: `off | partial | block` (draft streaming).
@@ -360,6 +468,8 @@ Provider options:
 - `channels.telegram.actions.reactions`: gate Telegram tool reactions.
 - `channels.telegram.actions.sendMessage`: gate Telegram tool message sends.
 - `channels.telegram.actions.deleteMessage`: gate Telegram tool message deletes.
 - `channels.telegram.reactionNotifications`: `off | own | all` — control which reactions trigger system events (default: `off` when not set).
 - `channels.telegram.reactionLevel`: `off | ack | minimal | extensive` — control agent's reaction capability (default: `ack` when not set).
 Related global options:
 - `agents.list[].groupChat.mentionPatterns` (mention gating patterns).
@@ -296,8 +296,9 @@ WhatsApp can automatically send emoji reactions to incoming messages immediately
 ## Heartbeats
 - **Gateway heartbeat** logs connection health (`web.heartbeatSeconds`, default 60s).
- **Agent heartbeat** is global (`agents.defaults.heartbeat.*`) and runs in the main session.
+- **Agent heartbeat** can be configured per agent (`agents.list[].heartbeat`) or globally
-  - Uses the configured heartbeat prompt (default: `Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.`) + `HEARTBEAT_OK` skip behavior.
+  via `agents.defaults.heartbeat` (fallback when no per-agent entries are set).
  - Uses the configured heartbeat prompt (default: `Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`) + `HEARTBEAT_OK` skip behavior.
  - Delivery defaults to the last used channel (or configured target).
 ## Reconnect behavior
@@ -330,6 +331,7 @@ WhatsApp can automatically send emoji reactions to incoming messages immediately
 - `agents.defaults.heartbeat.model` (optional override)
 - `agents.defaults.heartbeat.target`
 - `agents.defaults.heartbeat.to`
 - `agents.list[].heartbeat.*` (per-agent overrides)
 - `session.*` (scope, idle, store, mainKey)
 - `web.enabled` (disable channel startup when false)
 - `web.heartbeatSeconds`
@@ -0,0 +1,41 @@
 ---
 summary: "CLI reference for `clawdbot config` (get/set/unset config values)"
 read_when:
  - You want to read or edit config non-interactively
 ---
 # `clawdbot config`
 Config helpers: get/set/unset values by path. Run without a subcommand to open
 the configure wizard (same as `clawdbot configure`).
 ## Examples
 ```bash
 clawdbot config get browser.executablePath
 clawdbot config set browser.executablePath "/usr/bin/google-chrome"
 clawdbot config set agents.defaults.heartbeat.every "2h"
 clawdbot config unset tools.web.search.apiKey
 ```
 ## Paths
 Paths use dot or bracket notation:
 ```bash
 clawdbot config get agents.defaults.workspace
 clawdbot config get agents.list[0].id
 ```
 ## Values
 Values are parsed as JSON5 when possible; otherwise they are treated as strings.
 Use `--json` to require JSON5 parsing.
 ```bash
 clawdbot config set agents.defaults.heartbeat.every "0m"
 clawdbot config set gateway.port 19001 --json
 clawdbot config set channels.whatsapp.groups '["*"]' --json
 ```
 Restart the gateway after edits.
@@ -1,15 +1,22 @@
 ---
-summary: "CLI reference for `clawdbot configure` / `clawdbot config` (interactive configuration prompts)"
+summary: "CLI reference for `clawdbot configure` (interactive configuration prompts)"
 read_when:
  - You want to tweak credentials, devices, or agent defaults interactively
 ---
-# `clawdbot configure` (alias: `config`)
+# `clawdbot configure`
 Interactive prompt to set up credentials, devices, and agent defaults.
 Tip: `clawdbot config` without a subcommand opens the same wizard. Use
 `clawdbot config get|set|unset` for non-interactive edits.
 Related:
 - Gateway configuration reference: [Configuration](/gateway/configuration)
 - Config CLI: [Config](/cli/config)
 Notes:
 - Choosing where the Gateway runs always updates `gateway.mode`. You can select "Continue" without other sections if that is all you need.
 ## Examples
@@ -17,4 +24,3 @@ Related:
 clawdbot configure
 clawdbot configure --section models --section channels
 ```
@@ -15,3 +15,6 @@ Related:
 Tip: run `clawdbot daemon --help` for platform-specific flags.
 Notes:
 - `daemon status` supports `--json` for scripting.
 - `daemon install|uninstall|start|stop|restart` support `--json` for scripting (default output stays human-friendly).
@@ -78,7 +78,7 @@ clawdbot gateway health --url ws://127.0.0.1:18789
 - your configured remote gateway (if set), and
 - localhost (loopback) **even if remote is configured**.
-If multiple gateways are reachable, it prints all of them. Multiple gateways are supported when you use profiles for redundancy, but most installs still run a single gateway.
+If multiple gateways are reachable, it prints all of them. Multiple gateways are supported when you use isolated profiles/ports (e.g., a rescue bot), but most installs still run a single gateway.
 ```bash
 clawdbot gateway status
@@ -13,7 +13,8 @@ This page describes the current CLI behavior. If commands change, update this do
 - [`setup`](/cli/setup)
 - [`onboard`](/cli/onboard)
- [`configure`](/cli/configure) (alias: `config`)
+- [`configure`](/cli/configure)
 - [`config`](/cli/config)
 - [`doctor`](/cli/doctor)
 - [`dashboard`](/cli/dashboard)
 - [`reset`](/cli/reset)
@@ -83,7 +84,11 @@ Palette source of truth: `src/terminal/palette.ts` (aka “lobster seam”).
 clawdbot [--dev] [--profile <name>] <command>
  setup
  onboard
-  configure (alias: config)
+  configure
  config
    get
    set
    unset
  doctor
  security
    audit
@@ -310,9 +315,18 @@ Options:
 - `--node-manager <npm|pnpm|bun>` (pnpm recommended; bun not recommended for Gateway runtime)
 - `--json`
-### `configure` / `config`
+### `configure`
 Interactive configuration wizard (models, channels, skills, gateway).
 ### `config`
 Non-interactive config helpers (get/set/unset). Running `clawdbot config` with no
 subcommand launches the wizard.
 Subcommands:
 - `config get <path>`: print a config value (dot/bracket path).
 - `config set <path> <value>`: set a value (JSON5 or raw string).
 - `config unset <path>`: remove a value.
 ### `doctor`
 Health checks + quick fixes (config + gateway + legacy services).
@@ -594,8 +608,9 @@ Notes:
 - `daemon status` supports `--no-probe`, `--deep`, and `--json` for scripting.
 - `daemon status` also surfaces legacy or extra gateway services when it can detect them (`--deep` adds system-level scans). Profile-named Clawdbot services are treated as first-class and aren't flagged as "extra".
 - `daemon status` prints which config path the CLI uses vs which config the daemon likely uses (service env), plus the resolved probe target URL.
 - `daemon install|uninstall|start|stop|restart` support `--json` for scripting (default output stays human-friendly).
 - `daemon install` defaults to Node runtime; bun is **not recommended** (WhatsApp/Telegram bugs).
- `daemon install` options: `--port`, `--runtime`, `--token`, `--force`.
+- `daemon install` options: `--port`, `--runtime`, `--token`, `--force`, `--json`.
 ### `logs`
 Tail Gateway file logs via RPC.
@@ -785,7 +800,7 @@ Location:
 ## Browser
-Browser control CLI (dedicated Chrome/Chromium). See [`clawdbot browser`](/cli/browser) and the [Browser tool](/tools/browser).
+Browser control CLI (dedicated Chrome/Brave/Edge/Chromium). See [`clawdbot browser`](/cli/browser) and the [Browser tool](/tools/browser).
 Common options:
 - `--url <controlUrl>`
@@ -44,7 +44,7 @@ Target formats (`--to`):
 - `send`
  - Channels: WhatsApp/Telegram/Discord/Slack/Signal/iMessage/MS Teams
-  - Required: `--to`, `--message`
+  - Required: `--to`, plus `--message` or `--media`
  - Optional: `--media`, `--reply-to`, `--thread-id`, `--gif-playback`
  - Telegram only: `--buttons` (requires `"inlineButtons"` in `channels.telegram.capabilities` or `channels.telegram.accounts.<id>.capabilities`)
  - Telegram only: `--thread-id` (forum topic id)
@@ -22,6 +22,10 @@ clawdbot models set <model-or-alias>
 clawdbot models scan
 ```
 `clawdbot models status` shows the resolved default/fallbacks plus an auth overview.
 When provider usage snapshots are available, the OAuth/token status section includes
 provider usage headers.
 ## Aliases + fallbacks
 ```bash
@@ -33,7 +37,13 @@ clawdbot models fallbacks list
 ```bash
 clawdbot models auth add
 clawdbot models auth login --provider <id>
 clawdbot models auth setup-token
 clawdbot models auth paste-token
 ```
 `models auth login` runs a provider plugin’s auth flow (OAuth/API key). Use
 `clawdbot plugins list` to see which providers are installed.
 Notes:
 - `setup-token` runs `claude setup-token` on the current machine (requires the Claude Code CLI).
 - `paste-token` accepts a token string generated elsewhere.
@@ -21,6 +21,8 @@ clawdbot plugins info <id>
 clawdbot plugins enable <id>
 clawdbot plugins disable <id>
 clawdbot plugins doctor
 clawdbot plugins update <id>
 clawdbot plugins update --all
 ```
 ### Install
@@ -31,3 +33,12 @@ clawdbot plugins install <npm-spec>
 Security note: treat plugin installs like running code. Prefer pinned versions.
 ### Update
 ```bash
 clawdbot plugins update <id>
 clawdbot plugins update --all
 clawdbot plugins update <id> --dry-run
 ```
 Updates only apply to plugins installed from npm (tracked in `plugins.installs`).
@@ -20,3 +20,4 @@ clawdbot security audit --deep
 clawdbot security audit --fix
 ```
 The audit warns when multiple DM senders share the main session and recommends `session.dmScope="per-channel-peer"` for shared inboxes.
@@ -33,6 +33,32 @@ Channels can redeliver the same message after reconnects. Clawdbot keeps a
 short-lived cache keyed by channel/account/peer/session/message id so duplicate
 deliveries do not trigger another agent run.
 ## Inbound debouncing
 Rapid consecutive messages from the **same sender** can be batched into a single
 agent turn via `messages.inbound`. Debouncing is scoped per channel + conversation
 and uses the most recent message for reply threading/IDs.
 Config (global default + per-channel overrides):
 ```json5
 {
  messages: {
    inbound: {
      debounceMs: 2000,
      byChannel: {
        whatsapp: 5000,
        slack: 1500,
        discord: 1500
      }
    }
  }
 }
 ```
 Notes:
 - Debounce applies to **text-only** messages; media/attachments flush immediately.
 - Control commands bypass debouncing so they remain standalone.
 ## Sessions and devices
 Sessions are owned by the gateway, not by clients.
@@ -48,6 +48,17 @@ If no explicit order is configured, Clawdbot uses a round‑robin order:
 - **Secondary key:** `usageStats.lastUsed` (oldest first, within each type).
 - **Cooldown/disabled profiles** are moved to the end, ordered by soonest expiry.
 ### Session stickiness (cache-friendly)
 Clawdbot **pins the chosen auth profile per session** to keep provider caches warm.
 It does **not** rotate on every request. The pinned profile is reused until:
 - the session is reset (`/new` / `/reset`)
 - a compaction completes (compaction count increments)
 - the profile is in cooldown/disabled
 Manual selection via `/model …@<profileId>` sets a **user override** for that session
 and is not auto‑rotated until a new session starts.
 ### Why OAuth can “look lost”
 If you have both an OAuth profile and an API key profile for the same provider, round‑robin can switch between them across messages unless pinned. To force a single profile:
@@ -152,7 +152,7 @@ JSON includes `auth.oauth` (warn window + profiles) and `auth.providers`
 (effective auth per provider).
 Use `--check` for automation (exit `1` when missing/expired, `2` when expiring).
-Preferred Anthropic auth is the Claude Code CLI setup-token (run on the gateway host):
+Preferred Anthropic auth is the Claude Code CLI setup-token (run anywhere; paste on the gateway host if needed):
 ```bash
 claude setup-token
@@ -15,6 +15,13 @@ Clawdbot supports “subscription auth” via OAuth for providers that offer it
 - how we **reuse external CLI tokens** (Claude Code / Codex CLI)
 - how to handle **multiple accounts** (profiles + per-session overrides)
 Clawdbot also supports **provider plugins** that ship their own OAuth or API‑key
 flows. Run them via:
 ```bash
 clawdbot models auth login --provider <id>
 ```
 ## The token sink (why it exists)
 OAuth providers commonly mint a **new refresh token** during login/refresh flows. Some providers (or OAuth clients) can invalidate older refresh tokens when a new one is issued for the same user/app.
@@ -7,6 +7,11 @@ read_when:
 Clawdbot treats **one direct-chat session per agent** as primary. Direct chats collapse to `agent:<agentId>:<mainKey>` (default `main`), while group/channel chats get their own keys. `session.mainKey` is honored.
 Use `session.dmScope` to control how **direct messages** are grouped:
 - `main` (default): all DMs share the main session for continuity.
 - `per-peer`: isolate by sender id across channels.
 - `per-channel-peer`: isolate by channel + sender (recommended for multi-user inboxes).
 ## Gateway is the source of truth
 All session state is **owned by the gateway** (the “master” Clawdbot). UI clients (macOS app, WebChat, etc.) must query the gateway for session lists and token counts instead of reading local files.
@@ -32,8 +37,11 @@ the workspace is writable. See [Memory](/concepts/memory) and
 [Compaction](/concepts/compaction).
 ## Mapping transports → session keys
- Direct chats collapse to the per-agent primary key: `agent:<agentId>:<mainKey>`.
+- Direct chats follow `session.dmScope` (default `main`).
  - `main`: `agent:<agentId>:<mainKey>` (continuity across devices/channels).
    - Multiple phone numbers and channels can map to the same agent main key; they act as transports into one conversation.
  - `per-peer`: `agent:<agentId>:dm:<peerId>`.
  - `per-channel-peer`: `agent:<agentId>:<channel>:dm:<peerId>`.
 - Group chats isolate state: `agent:<agentId>:<channel>:group:<id>` (rooms/channels use `agent:<agentId>:<channel>:channel:<id>`).
  - Telegram forum topics append `:topic:<threadId>` to the group id for isolation.
  - Legacy `group:<id>` keys are still recognized for migration.
@@ -77,6 +85,7 @@ Send these as standalone messages so they register.
 {
  session: {
    scope: "per-sender",      // keep group keys separate
    dmScope: "main",          // DM continuity (set per-channel-peer for shared inboxes)
    idleMinutes: 120,
    resetTriggers: ["/new", "/reset"],
    store: "~/.clawdbot/agents/{agentId}/sessions/sessions.json",
@@ -20,12 +20,28 @@ The prompt is intentionally compact and uses fixed sections:
 - **Workspace**: working directory (`agents.defaults.workspace`).
 - **Workspace Files (injected)**: indicates bootstrap files are included below.
 - **Sandbox** (when enabled): indicates sandboxed runtime, sandbox paths, and whether elevated exec is available.
- **Time**: UTC default + the user’s local time (already converted).
+- **Current Date & Time**: user-local time, timezone, and time format.
 - **Reply Tags**: optional reply tag syntax for supported providers.
 - **Heartbeats**: heartbeat prompt and ack behavior.
 - **Runtime**: host, OS, node, model, thinking level (one line).
 - **Reasoning**: current visibility level + /reasoning toggle hint.
 ## Prompt modes
 Clawdbot can render smaller system prompts for sub-agents. The runtime sets a
 `promptMode` for each run (not a user-facing config):
 - `full` (default): includes all sections above.
 - `minimal`: used for sub-agents; omits **Skills**, **Memory Recall**, **Clawdbot
  Self-Update**, **Model Aliases**, **User Identity**, **Reply Tags**,
  **Messaging**, **Silent Replies**, and **Heartbeats**. Tooling, Workspace,
  Sandbox, Current Date & Time (when known), Runtime, and injected context stay
  available.
 - `none`: returns only the base identity line.
 When `promptMode=minimal`, extra injected prompts are labeled **Subagent
 Context** instead of **Group Chat Context**.
 ## Workspace bootstrap injection
 Bootstrap files are trimmed and appended under **Project Context** so the model sees identity and profile context without needing explicit reads:
@@ -46,12 +62,19 @@ To inspect how much each injected file contributes (raw vs injected, truncation,
 ## Time handling
-The Time line is compact and explicit:
+The system prompt includes a dedicated **Current Date & Time** section when user
 time or timezone is known. It is explicit about:
- Assume timestamps are **UTC** unless stated.
+- The user’s **local time** (already converted).
- The listed **user time** is already converted to `agents.defaults.userTimezone` (if set).
+- The **time zone** used for the conversion.
 - The **time format** (12-hour / 24-hour).
-Use `agents.defaults.userTimezone` in `~/.clawdbot/clawdbot.json` to change the user time zone.
+Configure with:
 - `agents.defaults.userTimezone`
 - `agents.defaults.timeFormat` (`auto` | `12` | `24`)
 See [Date & Time](/date-time) for full behavior details.
 ## Skills
@@ -19,10 +19,15 @@ Inbound messages are wrapped in an envelope like:
 The timestamp in the envelope is **always UTC**, with minutes precision.
-## Tool payloads (raw provider data)
+## Tool payloads (raw provider data + normalized fields)
 Tool calls (`channels.discord.readMessages`, `channels.slack.readMessages`, etc.) return **raw provider timestamps**.
-These are typically UTC ISO strings (Discord) or UTC epoch strings (Slack). We do not rewrite them.
+We also attach normalized fields for consistency:
 - `timestampMs` (UTC epoch milliseconds)
 - `timestampUtc` (ISO 8601 UTC string)
 Raw provider fields are preserved.
 ## User timezone for the system prompt
@@ -31,10 +36,14 @@ unset, Clawdbot resolves the **host timezone at runtime** (no config write).
 ```json5
 {
-  agent: { userTimezone: "America/Chicago" }
+  agents: { defaults: { userTimezone: "America/Chicago" } }
 }
 ```
 The system prompt includes:
- `User timezone: America/Chicago`
+- `Current Date & Time` section with local time and timezone
- `Current user time: 2026-01-05 15:26`
+- `Time format: 12-hour` or `24-hour`
 You can control the prompt format with `agents.defaults.timeFormat` (`auto` | `12` | `24`).
 See [Date & Time](/date-time) for the full behavior and examples.
@@ -44,7 +44,7 @@ Common methods + events:
 | --- | --- | --- |
 | Core | `connect`, `health`, `status` | `connect` must be first |
 | Messaging | `send`, `poll`, `agent`, `agent.wait` | side-effects need `idempotencyKey` |
-| Chat | `chat.history`, `chat.send`, `chat.abort` | WebChat uses these |
+| Chat | `chat.history`, `chat.send`, `chat.abort`, `chat.inject` | WebChat uses these |
 | Sessions | `sessions.list`, `sessions.patch`, `sessions.delete` | session admin |
 | Nodes | `node.list`, `node.invoke`, `node.pair.*` | bridge + node actions |
 | Events | `tick`, `presence`, `agent`, `chat`, `health`, `shutdown` | server push |
@@ -11,7 +11,7 @@ read_when:
 - No estimated costs; only the provider-reported windows.
 ## Where it shows up
- `/status` in chats: emoji‑rich status card with session tokens + estimated cost (API key only) and provider quota windows when available.
+- `/status` in chats: emoji‑rich status card with session tokens + estimated cost (API key only). When OAuth/token profiles exist, the **OAuth/token status block** includes provider usage headers (when available).
 - `/cost on|off` in chats: toggles per‑response usage lines (OAuth shows tokens only).
 - CLI: `clawdbot status --usage` prints a full per-provider breakdown.
 - CLI: `clawdbot channels list` prints the same usage snapshot alongside provider config (use `--no-usage` to skip).
@@ -0,0 +1,85 @@
 ---
 summary: "Date and time handling across envelopes, prompts, tools, and connectors"
 read_when:
  - You are changing how timestamps are shown to the model or users
  - You are debugging time formatting in messages or system prompt output
 ---
 # Date & Time
 Clawdbot uses **UTC for transport timestamps** and **user-local time only in the system prompt**.
 We avoid rewriting provider timestamps so tools keep their native semantics.
 ## Message envelopes (UTC)
 Inbound messages are wrapped with a UTC timestamp (minute precision):
 ```
 [Provider ... 2026-01-05T21:26Z] message text
 ```
 This envelope timestamp is **always UTC**, regardless of the host timezone.
 ## System prompt: Current Date & Time
 If the user timezone or local time is known, the system prompt includes a dedicated
 **Current Date & Time** section:
 ```
 Thursday, January 15th, 2026 — 3:07 PM (America/Chicago)
 Time format: 12-hour
 ```
 If only the timezone is known, we still include the section and instruct the model
 to assume UTC for unknown time references.
 ## System event lines (UTC)
 Queued system events inserted into agent context are prefixed with a UTC timestamp:
 ```
 System: [2026-01-12T20:19:17Z] Model switched.
 ```
 ### Configure user timezone + format
 ```json5
 {
  agents: {
    defaults: {
      userTimezone: "America/Chicago",
      timeFormat: "auto" // auto | 12 | 24
    }
  }
 }
 ```
 - `userTimezone` sets the **user-local timezone** for prompt context.
 - `timeFormat` controls **12h/24h display** in the prompt. `auto` follows OS prefs.
 ## Time format detection (auto)
 When `timeFormat: "auto"`, Clawdbot inspects the OS preference (macOS/Windows)
 and falls back to locale formatting. The detected value is **cached per process**
 to avoid repeated system calls.
 ## Tool payloads + connectors (raw provider time + normalized fields)
 Channel tools return **provider-native timestamps** and add normalized fields for consistency:
 - `timestampMs`: epoch milliseconds (UTC)
 - `timestampUtc`: ISO 8601 UTC string
 Raw provider fields are preserved so nothing is lost.
 - Slack: epoch-like strings from the API
 - Discord: UTC ISO timestamps
 - Telegram/WhatsApp: provider-specific numeric/ISO timestamps
 If you need local time, convert it downstream using the known timezone.
 ## Related docs
 - [System Prompt](/concepts/system-prompt)
 - [Timezones](/concepts/timezone)
 - [Messages](/concepts/messages)
@@ -28,8 +28,12 @@ If you are building an operator client (CLI, web UI, automations), use the
 ## Transport
 - TCP, one JSON object per line (JSONL).
 - Optional TLS (when `bridge.tls.enabled` is true).
 - Gateway owns the listener (default `18790`).
 When TLS is enabled, discovery TXT records include `bridgeTls=1` plus
 `bridgeTlsSha256` so nodes can pin the certificate.
 ## Handshake + pairing
 1) Client sends `hello` with node metadata + token (if already paired).  
@@ -455,6 +455,44 @@ Save to `~/.clawdbot/clawdbot.json` and you can DM the bot from that number.
 }
 ```
 ### Anthropic subscription + API key, MiniMax fallback
 ```json5
 {
  auth: {
    profiles: {
      "anthropic:subscription": {
        provider: "anthropic",
        mode: "oauth",
        email: "user@example.com"
      },
      "anthropic:api": {
        provider: "anthropic",
        mode: "api_key"
      }
    },
    order: {
      anthropic: ["anthropic:subscription", "anthropic:api"]
    }
  },
  models: {
    providers: {
      minimax: {
        baseUrl: "https://api.minimax.io/anthropic",
        api: "anthropic-messages",
        apiKey: "${MINIMAX_API_KEY}"
      }
    }
  },
  agent: {
    workspace: "~/clawd",
    model: {
      primary: "anthropic/claude-opus-4-5",
      fallbacks: ["minimax/MiniMax-M2.1"]
    }
  }
 }
 ```
 ### Work bot (restricted access)
 ```json5
 {
@@ -822,6 +822,31 @@ Controls how inbound messages behave when an agent run is already active.
 }
 ```
 ### `messages.inbound`
 Debounce rapid inbound messages from the **same sender** so multiple back-to-back
 messages become a single agent turn. Debouncing is scoped per channel + conversation
 and uses the most recent message for reply threading/IDs.
 ```json5
 {
  messages: {
    inbound: {
      debounceMs: 2000, // 0 disables
      byChannel: {
        whatsapp: 5000,
        slack: 1500,
        discord: 1500
      }
    }
  }
 }
 ```
 Notes:
 - Debounce batches **text-only** messages; media/attachments flush immediately.
 - Control commands (e.g. `/queue`, `/new`) bypass debouncing so they stay standalone.
 ### `commands` (chat command handling)
 Controls how chat commands are enabled across connectors.
@@ -1211,6 +1236,17 @@ message envelopes). If unset, Clawdbot uses the host timezone at runtime.
 }
 ```
 ### `agents.defaults.timeFormat`
 Controls the **time format** shown in the system prompt’s Current Date & Time section.
 Default: `auto` (OS preference).
 ```json5
 {
  agents: { defaults: { timeFormat: "auto" } } // auto | 12 | 24
 }
 ```
 ### `messages`
 Controls inbound/outbound prefixes and optional ack reactions.
@@ -1639,9 +1675,14 @@ Z.AI models are available as `zai/<model>` (e.g. `zai/glm-4.7`) and require
 - `includeReasoning`: when `true`, heartbeats will also deliver the separate `Reasoning:` message when available (same shape as `/reasoning on`). Default: `false`.
 - `target`: optional delivery channel (`last`, `whatsapp`, `telegram`, `discord`, `slack`, `signal`, `imessage`, `none`). Default: `last`.
 - `to`: optional recipient override (channel-specific id, e.g. E.164 for WhatsApp, chat id for Telegram).
- `prompt`: optional override for the heartbeat body (default: `Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.`). Overrides are sent verbatim; include a `Read HEARTBEAT.md if exists` line if you still want the file read.
+- `prompt`: optional override for the heartbeat body (default: `Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`). Overrides are sent verbatim; include a `Read HEARTBEAT.md` line if you still want the file read.
 - `ackMaxChars`: max chars allowed after `HEARTBEAT_OK` before delivery (default: 300).
 Per-agent heartbeats:
 - Set `agents.list[].heartbeat` to enable or override heartbeat settings for a specific agent.
 - If any agent entry defines `heartbeat`, **only those agents** run heartbeats; defaults
  become the shared baseline for those agents.
 Heartbeats run full agent turns. Shorter intervals burn more tokens; be mindful
 of `every`, keep `HEARTBEAT.md` tiny, and/or choose a cheaper `model`.
@@ -2220,6 +2261,7 @@ Controls session scoping, idle expiry, reset triggers, and where the session sto
 {
  session: {
    scope: "per-sender",
    dmScope: "main",
    idleMinutes: 60,
    resetTriggers: ["/new", "/reset"],
    // Default is already per-agent under ~/.clawdbot/agents/<agentId>/sessions/sessions.json
@@ -2244,6 +2286,10 @@ Controls session scoping, idle expiry, reset triggers, and where the session sto
 Fields:
 - `mainKey`: direct-chat bucket key (default: `"main"`). Useful when you want to “rename” the primary DM thread without changing `agentId`.
  - Sandbox note: `agents.defaults.sandbox.mode: "non-main"` uses this key to detect the main session. Any session key that does not match `mainKey` (groups/channels) is sandboxed.
 - `dmScope`: how DM sessions are grouped (default: `"main"`).
  - `main`: all DMs share the main session for continuity.
  - `per-peer`: isolate DMs by sender id across channels.
  - `per-channel-peer`: isolate DMs per channel + sender (recommended for multi-user inboxes).
 - `agentToAgent.maxPingPongTurns`: max reply-back turns between requester/target (0–5, default 5).
 - `sendPolicy.default`: `allow` or `deny` fallback when no rule matches.
 - `sendPolicy.rules[]`: match by `channel`, `chatType` (`direct|group|room`), or `keyPrefix` (e.g. `cron:`). First deny wins; otherwise allow.
@@ -2335,10 +2381,10 @@ Example:
 }
 ```
-### `browser` (clawd-managed Chrome)
+### `browser` (clawd-managed browser)
-Clawdbot can start a **dedicated, isolated** Chrome/Chromium instance for clawd and expose a small loopback control server.
+Clawdbot can start a **dedicated, isolated** Chrome/Brave/Edge/Chromium instance for clawd and expose a small loopback control server.
-Profiles can point at a **remote** Chrome via `profiles.<name>.cdpUrl`. Remote
+Profiles can point at a **remote** Chromium-based browser via `profiles.<name>.cdpUrl`. Remote
 profiles are attach-only (start/stop/reset are disabled).
 `browser.cdpUrl` remains for legacy single-profile configs and as the base
@@ -2350,6 +2396,7 @@ Defaults:
 - CDP URL: `http://127.0.0.1:18792` (control URL + 1, legacy single-profile)
 - profile color: `#FF4500` (lobster-orange)
 - Note: the control server is started by the running gateway (Clawdbot.app menubar, or `clawdbot gateway`).
 - Auto-detect order: default browser if Chromium-based; otherwise Chrome → Brave → Edge → Chromium → Chrome Canary.
 ```json5
 {
@@ -2367,7 +2414,7 @@ Defaults:
    // Advanced:
    // headless: false,
    // noSandbox: false,
-    // executablePath: "/usr/bin/chromium",
+    // executablePath: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
    // attachOnly: false, // set true when tunneling a remote CDP to localhost
  }
 }
@@ -2512,7 +2559,7 @@ Requires full Gateway restart:
 ### Multi-instance isolation
-To run multiple gateways on one host, isolate per-instance state + config and use unique ports:
+To run multiple gateways on one host (for redundancy or a rescue bot), isolate per-instance state + config and use unique ports:
 - `CLAWDBOT_CONFIG_PATH` (per-instance config)
 - `CLAWDBOT_STATE_DIR` (sessions/creds)
 - `agents.defaults.workspace` (memories)
@@ -2685,12 +2732,29 @@ Bind modes:
 - `loopback`: `127.0.0.1` (local only)
 - `auto`: prefer tailnet IP if present, else `lan`
 TLS:
 - `bridge.tls.enabled`: enable TLS for bridge connections (TLS-only when enabled).
 - `bridge.tls.autoGenerate`: generate a self-signed cert when no cert/key are present (default: true).
 - `bridge.tls.certPath` / `bridge.tls.keyPath`: PEM paths for the bridge certificate + private key.
 - `bridge.tls.caPath`: optional PEM CA bundle (custom roots or future mTLS).
 When TLS is enabled, the Gateway advertises `bridgeTls=1` and `bridgeTlsSha256` in discovery TXT
 records so nodes can pin the certificate. Manual connections use trust-on-first-use if no
 fingerprint is stored yet.
 Auto-generated certs require `openssl` on PATH; if generation fails, the bridge will not start.
 ```json5
 {
  bridge: {
    enabled: true,
    port: 18790,
-    bind: "tailnet"
+    bind: "tailnet",
    tls: {
      enabled: true,
      // Uses ~/.clawdbot/bridge/tls/bridge-{cert,key}.pem when omitted.
      // certPath: "~/.clawdbot/bridge/tls/bridge-cert.pem",
      // keyPath: "~/.clawdbot/bridge/tls/bridge-key.pem"
    }
  }
 }
 ```
@@ -16,7 +16,7 @@ The design goal is to keep all network discovery/advertising in the **Node Gatew
 ## Terms
- **Gateway**: the single, long-running gateway process that owns state (sessions, pairing, node registry) and runs channels.
+- **Gateway**: a single long-running gateway process that owns state (sessions, pairing, node registry) and runs channels. Most setups use one per host; isolated multi-gateway setups are possible.
 - **Gateway WS (loopback)**: the existing gateway WebSocket control endpoint on `127.0.0.1:18789`.
 - **Bridge (direct transport)**: a LAN/tailnet-facing endpoint owned by the gateway that allows authenticated clients/nodes to call a scoped subset of gateway methods. The bridge exists so the gateway can remain loopback-only.
 - **SSH transport (fallback)**: remote control by forwarding `127.0.0.1:18789` over SSH.
@@ -165,7 +165,7 @@ Doctor checks:
 ### 5) Model auth health (OAuth expiry)
 Doctor inspects OAuth profiles in the auth store, warns when tokens are
 expiring/expired, and can refresh them when safe. If the Anthropic Claude Code
-profile is stale, it suggests `claude setup-token` on the gateway host.
+profile is stale, it suggests running `claude setup-token` (or pasting a setup-token).
 Refresh prompts only appear when running interactively (TTY); `--non-interactive`
 skips refresh attempts.
@@ -9,7 +9,7 @@ read_when:
 Last updated: 2025-12-11
 ## Why
- Ensure only one gateway instance runs per host.
+- Ensure only one gateway instance runs per base port on the same host; additional gateways must use isolated profiles and unique ports.
 - Survive crashes/SIGKILL without leaving stale lock files.
 - Fail fast with a clear error when the control port is already occupied.
@@ -33,9 +33,9 @@ Example config:
 ## Defaults
- Interval: `30m` (set `agents.defaults.heartbeat.every`; use `0m` to disable).
+- Interval: `30m` (set `agents.defaults.heartbeat.every` or per-agent `agents.list[].heartbeat.every`; use `0m` to disable).
 - Prompt body (configurable via `agents.defaults.heartbeat.prompt`):
-  `Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.`
+  `Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`
 - The heartbeat prompt is sent **verbatim** as the user message. The system
  prompt includes a “Heartbeat” section and the run is flagged internally.
@@ -49,8 +49,8 @@ The default prompt is intentionally broad:
  by using your configured local timezone (see [/concepts/timezone](/concepts/timezone)).
 If you want a heartbeat to do something very specific (e.g. “check Gmail PubSub
-stats” or “verify gateway health”), set `agents.defaults.heartbeat.prompt` to a
+stats” or “verify gateway health”), set `agents.defaults.heartbeat.prompt` (or
-custom body (sent verbatim).
+`agents.list[].heartbeat.prompt`) to a custom body (sent verbatim).
 ## Response contract
@@ -77,7 +77,7 @@ and logged; a message that is only `HEARTBEAT_OK` is dropped.
        includeReasoning: false, // default: false (deliver separate Reasoning: message when available)
        target: "last",         // last | whatsapp | telegram | discord | slack | signal | imessage | none
        to: "+15551234567",     // optional channel-specific override
-        prompt: "Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.",
+        prompt: "Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.",
        ackMaxChars: 300         // max chars allowed after HEARTBEAT_OK
      }
    }
@@ -85,6 +85,39 @@ and logged; a message that is only `HEARTBEAT_OK` is dropped.
 }
 ```
 ### Per-agent heartbeats
 If any `agents.list[]` entry includes a `heartbeat` block, **only those agents**
 run heartbeats. The per-agent block merges on top of `agents.defaults.heartbeat`
 (so you can set shared defaults once and override per agent).
 Example: two agents, only the second agent runs heartbeats.
 ```json5
 {
  agents: {
    defaults: {
      heartbeat: {
        every: "30m",
        target: "last"
      }
    },
    list: [
      { id: "main", default: true },
      {
        id: "ops",
        heartbeat: {
          every: "1h",
          target: "whatsapp",
          to: "+15551234567",
          prompt: "Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK."
        }
      }
    ]
  }
 }
 ```
 ### Field notes
 - `every`: heartbeat interval (duration string; default unit = minutes).
@@ -100,7 +133,8 @@ and logged; a message that is only `HEARTBEAT_OK` is dropped.
 ## Delivery behavior
- Heartbeats run in the **main session** (`main`, or `global` when scope is global).
+- Heartbeats run in each agent’s **main session** (`agent:<id>:<mainKey>`), or `global`
  when `session.scope = "global"`.
 - If the main queue is busy, the heartbeat is skipped and retried later.
 - If `target` resolves to no external destination, the run still happens but no
  outbound message is sent.
@@ -149,6 +183,9 @@ You can enqueue a system event and trigger an immediate heartbeat with:
 clawdbot wake --text "Check for urgent follow-ups" --mode now
 ```
 If multiple agents have `heartbeat` configured, a manual wake runs each of those
 agent heartbeats immediately.
 Use `--mode next-heartbeat` to wait for the next scheduled tick.
 ## Reasoning delivery (optional)
@@ -63,6 +63,8 @@ Install metadata is embedded in the service config:
 - `CLAWDBOT_SERVICE_KIND=gateway`
 - `CLAWDBOT_SERVICE_VERSION=<version>`
 Rescue-Bot Pattern: keep a second Gateway isolated with its own profile, state dir, workspace, and base port spacing. Full guide: [Rescue-bot guide](/gateway/multiple-gateways#rescue-bot-guide).
 ### Dev profile (`--dev`)
 Fast path: run a fully-isolated dev instance (config/state/workspace) without touching your primary setup.
@@ -205,7 +207,7 @@ Notes:
 - `daemon status` includes the last gateway error line when the service looks running but the port is closed.
 - `logs` tails the Gateway file log via RPC (no manual `tail`/`grep` needed).
 - If other gateway-like services are detected, the CLI warns unless they are Clawdbot profile services.
-  We still recommend **one gateway per machine** unless you need redundant profiles.
+  We still recommend **one gateway per machine** for most setups; use isolated profiles/ports for redundancy or a rescue bot. See [Multiple gateways](/gateway/multiple-gateways).
  - Cleanup: `clawdbot daemon uninstall` (current service) and `clawdbot doctor` (legacy migrations).
 - `daemon install` is a no-op when already installed; use `clawdbot daemon install --force` to reinstall (profile/env/path changes).
@@ -6,7 +6,7 @@ read_when:
 ---
 # Multiple Gateways (same host)
-Most setups should use one Gateway because a single Gateway can handle multiple messaging connections and agents. If you need stronger isolation or redundancy, run separate Gateways. Both are supported.
+Most setups should use one Gateway because a single Gateway can handle multiple messaging connections and agents. If you need stronger isolation or redundancy (e.g., a rescue bot), run separate Gateways with isolated profiles/ports.
 ## Isolation checklist (required)
 - `CLAWDBOT_CONFIG_PATH` — per-instance config file
@@ -37,6 +37,38 @@ clawdbot --profile main daemon install
 clawdbot --profile rescue daemon install
 ```
 ## Rescue-bot guide
 Run a second Gateway on the same host with its own:
 - profile/config
 - state dir
 - workspace
 - base port (plus derived ports)
 This keeps the rescue bot isolated from the main bot so it can debug or apply config changes if the primary bot is down.
 Port spacing: leave at least 20 ports between base ports so the derived bridge/browser/canvas/CDP ports never collide.
 ### How to install (rescue bot)
 ```bash
 # Main bot (existing or fresh, without --profile param)
 # Runs on port 18789 + Chrome CDC/Canvas/... Ports 
 clawdbot onboard
 clawdbot daemon install
 # Rescue bot (isolated profile + ports)
 clawdbot --profile rescue onboard
 # Notes: 
 # - workspace name will be postfixed with -rescue per default
 # - Port should be at least 18789 + 20 Ports, 
 #   better choose completely different base port, like 19789,
 # - rest of the onboarding is the same as normal
 # To install the daemon (if not happened automatically during onboarding)
 clawdbot --profile rescue daemon install
 ```
 ## Port mapping (derived)
 Base port = `gateway.port` (or `CLAWDBOT_GATEWAY_PORT` / `--port`).
@@ -26,7 +26,7 @@ Flow example (Telegram → node):
 - Node returns the result; Gateway replies back out to Telegram.
 Notes:
- **Nodes do not run the gateway daemon.** Only one gateway should run per host.
+- **Nodes do not run the gateway daemon.** Only one gateway should run per host unless you intentionally run isolated profiles (see [Multiple gateways](/gateway/multiple-gateways)).
 - macOS app “node mode” is just a node client over the Bridge.
 ## SSH tunnel (CLI + tools)
@@ -52,6 +52,22 @@ When the audit prints findings, treat this as a priority order:
 5. **Plugins/extensions**: only load what you explicitly trust.
 6. **Model choice**: prefer modern, instruction-hardened models for any bot with tools.
 ## Node execution (system.run)
 If a macOS node is paired, the Gateway can invoke `system.run` on that node. This is **remote code execution** on the Mac:
 - Requires node pairing (approval + token).
 - Controlled on the Mac via **Settings → "Node Run Commands"**: "Always Ask" (default), "Always Allow", or "Never".
 - If you don’t want remote execution, set the policy to "Never" and remove node pairing for that Mac.
 ## Dynamic skills (watcher / remote nodes)
 Clawdbot can refresh the skills list mid-session:
 - **Skills watcher**: changes to `SKILL.md` can update the skills snapshot on the next agent turn.
 - **Remote nodes**: connecting a macOS node can make macOS-only skills eligible (based on bin probing).
 Treat skill folders as **trusted code** and restrict who can modify them.
 ## The Threat Model
 Your AI assistant can:
@@ -107,6 +123,18 @@ clawdbot pairing approve <channel> <code>
 Details + files on disk: [Pairing](/start/pairing)
 ## DM session isolation (multi-user mode)
 By default, Clawdbot routes **all DMs into the main session** so your assistant has continuity across devices and channels. If **multiple people** can DM the bot (open DMs or a multi-person allowlist), consider isolating DM sessions:
 ```json5
 {
  session: { dmScope: "per-channel-peer" }
 }
 ```
 This prevents cross-user context leakage while keeping group chats isolated. See [Session Management](/concepts/session) and [Configuration](/gateway/configuration).
 ## Allowlists (DM + groups) — terminology
 Clawdbot has two separate “who can trigger me?” layers:
@@ -169,6 +169,20 @@ The agent was interrupted mid-response.
 **Fix:** Just send another message. The session continues.
 ### "Agent failed before reply: Unknown model: anthropic/claude-haiku-3-5"
 Clawdbot intentionally rejects **older/insecure models** (especially those more
 vulnerable to prompt injection). If you see this error, the model name is no
 longer supported.
 **Fix:**
 - Pick a **latest** model for the provider and update your config or model alias.
 - If you’re unsure which models are available, run `clawdbot models list` or
  `clawdbot models scan` and choose a supported one.
 - Check gateway logs for the detailed failure reason.
 See also: [Models CLI](/cli/models) and [Model providers](/concepts/model-providers).
 ### Messages Not Triggering
 **Check 1:** Is the sender allowlisted?
@@ -306,6 +320,139 @@ Clawdbot keeps conversation history in memory.
 }
 ```
 ## Common troubleshooting
 ### “All models failed” — what should I check first?
 - **Credentials** present for the provider(s) being tried (auth profiles + env vars).
 - **Model routing**: confirm `agents.defaults.model.primary` and fallbacks are models you can access.
 - **Gateway logs** in `/tmp/clawdbot/…` for the exact provider error.
 - **Model status**: use `/model status` (chat) or `clawdbot models status` (CLI).
 ### I’m running on my personal WhatsApp number — why is self-chat weird?
 Enable self-chat mode and allowlist your own number:
 ```json5
 {
  channels: {
    whatsapp: {
      selfChatMode: true,
      dmPolicy: "allowlist",
      allowFrom: ["+15555550123"]
    }
  }
 }
 ```
 See [WhatsApp setup](/channels/whatsapp).
 ### WhatsApp logged me out. How do I re‑auth?
 Run the login command again and scan the QR code:
 ```bash
 clawdbot channels login
 ```
 ### Build errors on `main` — what’s the standard fix path?
 1) `git pull origin main && pnpm install`
 2) `pnpm clawdbot doctor`
 3) Check GitHub issues or Discord
 4) Temporary workaround: check out an older commit
 ### npm install fails (allow-build-scripts / missing tar or yargs). What now?
 If you’re running from source, use the repo’s package manager: **pnpm** (preferred).
 The repo declares `packageManager: "pnpm@…"`, and pnpm patches are tracked in `pnpm.patchedDependencies`.
 Typical recovery:
 ```bash
 git status   # ensure you’re in the repo root
 pnpm install
 pnpm build
 pnpm clawdbot doctor
 clawdbot daemon restart
 ```
 Why: pnpm is the configured package manager for this repo, and the dependency
 patching workflow relies on it.
 ### How do I switch between git installs and npm installs?
 Use the **website installer** and select the install method with a flag. It
 upgrades in place and rewrites the gateway service to point at the new install.
 Switch **to git install**:
 ```bash
 curl -fsSL https://clawd.bot/install.sh | bash -s -- --install-method git --no-onboard
 ```
 Switch **to npm global**:
 ```bash
 curl -fsSL https://clawd.bot/install.sh | bash
 ```
 Notes:
 - The git flow only rebases if the repo is clean. Commit or stash changes first.
 - After switching, run:
  ```bash
  clawdbot doctor
  clawdbot daemon restart
  ```
 ### Telegram block streaming isn’t splitting text between tool calls. Why?
 Block streaming only sends **completed text blocks**. Common reasons you see a single message:
 - `agents.defaults.blockStreamingDefault` is still `"off"`.
 - `channels.telegram.blockStreaming` is set to `false`.
 - `channels.telegram.streamMode` is `partial` or `block` **and draft streaming is active**
  (private chat + topics). Draft streaming disables block streaming in that case.
 - Your `minChars` / coalesce settings are too high, so chunks get merged.
 - The model emits one large text block (no mid‑reply flush points).
 Fix checklist:
 1) Put block streaming settings under `agents.defaults`, not the root.
 2) Set `channels.telegram.streamMode: "off"` if you want real multi‑message block replies.
 3) Use smaller chunk/coalesce thresholds while debugging.
 See [Streaming](/concepts/streaming).
 ### Discord doesn’t reply in my server even with `requireMention: false`. Why?
 `requireMention` only controls mention‑gating **after** the channel passes allowlists.
 By default `channels.discord.groupPolicy` is **allowlist**, so guilds must be explicitly enabled.
 If you set `channels.discord.guilds.<guildId>.channels`, only the listed channels are allowed; omit it to allow all channels in the guild.
 Fix checklist:
 1) Set `channels.discord.groupPolicy: "open"` **or** add a guild allowlist entry (and optionally a channel allowlist).
 2) Use **numeric channel IDs** in `channels.discord.guilds.<guildId>.channels`.
 3) Put `requireMention: false` **under** `channels.discord.guilds` (global or per‑channel).
   Top‑level `channels.discord.requireMention` is not a supported key.
 4) Ensure the bot has **Message Content Intent** and channel permissions.
 5) Run `clawdbot channels status --probe` for audit hints.
 Docs: [Discord](/channels/discord), [Channels troubleshooting](/channels/troubleshooting).
 ### Cloud Code Assist API error: invalid tool schema (400). What now?
 This is almost always a **tool schema compatibility** issue. The Cloud Code Assist
 endpoint accepts a strict subset of JSON Schema. Clawdbot scrubs/normalizes tool
 schemas in current `main`, but the fix is not in the last release yet (as of
 January 13, 2026).
 Fix checklist:
 1) **Update Clawdbot**:
   - If you can run from source, pull `main` and restart the gateway.
   - Otherwise, wait for the next release that includes the schema scrubber.
 2) Avoid unsupported keywords like `anyOf/oneOf/allOf`, `patternProperties`,
   `additionalProperties`, `minLength`, `maxLength`, `format`, etc.
 3) If you define custom tools, keep the top‑level schema as `type: "object"` with
   `properties` and simple enums.
 See [Tools](/tools) and [TypeBox schemas](/concepts/typebox).
 ## macOS Specific Issues
 ### App Crashes when Granting Permissions (Speech/Mic)
@@ -66,7 +66,7 @@ Most operations flow through the **Gateway** (`clawdbot gateway`), a single long
 ## Network model
- **One Gateway per host**: it is the only process allowed to own the WhatsApp Web session.
+- **One Gateway per host (recommended)**: it is the only process allowed to own the WhatsApp Web session. If you need a rescue bot or strict isolation, run multiple gateways with isolated profiles and ports; see [Multiple gateways](/gateway/multiple-gateways).
 - **Loopback-first**: Gateway WS defaults to `ws://127.0.0.1:18789`.
  - The wizard now generates a gateway token by default (even for loopback).
  - For Tailnet access, run `clawdbot gateway --bind tailnet --token ...` (token is required for non-loopback binds).
@@ -163,6 +163,7 @@ Notes:
 - `system.notify` respects notification permission state on the macOS app.
 - `system.run` supports `--cwd`, `--env KEY=VAL`, `--command-timeout`, and `--needs-screen-recording`.
 - `system.notify` supports `--priority <passive|active|timeSensitive>` and `--delivery <system|overlay|auto>`.
 - `system.run` is gated by the macOS app policy (Settings → "Node Run Commands"): "Always Ask" prompts per command, "Always Allow" runs without prompts, and "Never" disables the tool. Denied prompts return `SYSTEM_RUN_DENIED`; disabled returns `SYSTEM_RUN_DISABLED`.
 ## Permissions map
@@ -187,7 +187,7 @@ services:
      [
        "node",
        "dist/index.js",
-        "gateway-daemon",
+        "gateway",
        "--bind",
        "${CLAWDBOT_GATEWAY_BIND}",
        "--port",
@@ -24,8 +24,8 @@ agent (with a session switcher for other sessions).
 ## How it’s wired
- Data plane: Gateway WS methods `chat.history`, `chat.send`, `chat.abort` and
+- Data plane: Gateway WS methods `chat.history`, `chat.send`, `chat.abort`,
-  events `chat`, `agent`, `presence`, `tick`, `health`.
+  `chat.inject` and events `chat`, `agent`, `presence`, `tick`, `health`.
 - Session: defaults to the primary session (`main`, or `global` when scope is
  global). The UI can switch between sessions.
 - Onboarding uses a dedicated session to keep first‑run setup separate.
@@ -54,6 +54,38 @@ The macOS app presents itself as a node. Common commands:
 The node reports a `permissions` map so agents can decide what’s allowed.
 ## Node run policy + allowlist
 `system.run` is controlled by the macOS app **Node Run Commands** policy:
 - `Always Ask`: prompt per command (default).
 - `Always Allow`: run without prompts.
 - `Never`: disable `system.run` (tool not advertised).
 The policy + allowlist live on the Mac in:
 ```
 ~/.clawdbot/macos-node.json
 ```
 Schema:
 ```json
 {
  "systemRun": {
    "policy": "ask",
    "allowlist": [
      "[\"/bin/echo\",\"hello\"]"
    ]
  }
 }
 ```
 Notes:
 - `allowlist` entries are JSON-encoded argv arrays.
 - Choosing “Always Allow” in the prompt adds that command to the allowlist.
 - `system.run` environment overrides are filtered (drops `PATH`, `DYLD_*`, `LD_*`, `NODE_OPTIONS`, `PYTHON*`, `PERL*`, `RUBYOPT`) and then merged with the app’s environment.
 ## Deep links
 The app registers the `clawdbot://` URL scheme for local actions.
@@ -110,6 +142,32 @@ Tip: compare against `pnpm clawdbot gateway discover --json` to see whether the
 macOS app’s discovery pipeline (NWBrowser + tailnet DNS‑SD fallback) differs from
 the Node CLI’s `dns-sd` based discovery.
 ## Remote connection plumbing (SSH tunnels)
 When the macOS app runs in **Remote** mode, it opens SSH tunnels so local UI
 components can talk to a remote Gateway as if it were on localhost. There are
 two independent tunnels:
 ### Control tunnel (Gateway control/WebSocket port)
 - **Purpose:** health checks, status, Web Chat, config, and other control-plane calls.
 - **Local port:** the Gateway port (default `18789`), always stable.
 - **Remote port:** the same Gateway port on the remote host.
 - **Behavior:** no random local port; the app reuses an existing healthy tunnel
  or restarts it if needed.
 - **SSH shape:** `ssh -N -L <local>:127.0.0.1:<remote>` with BatchMode +
  ExitOnForwardFailure + keepalive options.
 ### Node bridge tunnel (macOS node mode)
 - **Purpose:** connect the macOS node to the Gateway **Bridge** protocol (TCP JSONL).
 - **Remote port:** `gatewayPort + 1` (default `18790`), derived from the Gateway port.
 - **Local port preference:** `CLAWDBOT_BRIDGE_PORT` or the default `18790`.
 - **Behavior:** prefer the default bridge port for consistency; fall back to a
  random local port if the preferred one is busy. The node then connects to the
  resolved local port.
 For setup steps, see [macOS remote access](/platforms/mac/remote). For protocol
 details, see [Bridge protocol](/gateway/bridge-protocol).
 ## Related docs
 - [Gateway runbook](/gateway)
@@ -35,9 +35,11 @@ See [Voice Call](/plugins/voice-call) for a concrete example plugin.
 ## Available plugins (official)
 - Microsoft Teams is plugin-only as of 2026.1.15; install `@clawdbot/msteams` if you use Teams.
 - [Voice Call](/plugins/voice-call) — `@clawdbot/voice-call`
 - [Matrix](/channels/matrix) — `@clawdbot/matrix`
 - [Zalo](/channels/zalo) — `@clawdbot/zalo`
 - [Microsoft Teams](/channels/msteams) — `@clawdbot/msteams`
 Clawdbot plugins are **TypeScript modules** loaded at runtime via jiti. They can
 register:
@@ -158,11 +160,15 @@ clawdbot plugins install <path>              # add a local file/dir to plugins.l
 clawdbot plugins install ./extensions/voice-call # relative path ok
 clawdbot plugins install ./plugin.tgz        # install from a local tarball
 clawdbot plugins install @clawdbot/voice-call # install from npm
 clawdbot plugins update <id>
 clawdbot plugins update --all
 clawdbot plugins enable <id>
 clawdbot plugins disable <id>
 clawdbot plugins doctor
 ```
 `plugins update` only works for npm installs tracked under `plugins.installs`.
 Plugins may also register their own top‑level commands (example: `clawdbot voicecall`).
 ## Plugin API (overview)
@@ -172,6 +178,56 @@ Plugins export either:
 - A function: `(api) => { ... }`
 - An object: `{ id, name, configSchema, register(api) { ... } }`
 ## Provider plugins (model auth)
 Plugins can register **model provider auth** flows so users can run OAuth or
 API-key setup inside Clawdbot (no external scripts needed).
 Register a provider via `api.registerProvider(...)`. Each provider exposes one
 or more auth methods (OAuth, API key, device code, etc.). These methods power:
 - `clawdbot models auth login --provider <id> [--method <id>]`
 Example:
 ```ts
 api.registerProvider({
  id: "acme",
  label: "AcmeAI",
  auth: [
    {
      id: "oauth",
      label: "OAuth",
      kind: "oauth",
      run: async (ctx) => {
        // Run OAuth flow and return auth profiles.
        return {
          profiles: [
            {
              profileId: "acme:default",
              credential: {
                type: "oauth",
                provider: "acme",
                access: "...",
                refresh: "...",
                expires: Date.now() + 3600 * 1000,
              },
            },
          ],
          defaultModel: "acme/opus-1",
        };
      },
    },
  ],
 });
 ```
 Notes:
 - `run` receives a `ProviderAuthContext` with `prompter`, `runtime`,
  `openUrl`, and `oauth.createVpsAwareHandlers` helpers.
 - Return `configPatch` when you need to add default models or provider config.
 - Return `defaultModel` so `--set-default` can update agent defaults.
 ### Register a messaging channel
 Plugins can register **channel plugins** that behave like built‑in channels
@@ -38,10 +38,32 @@ clawdbot onboard --anthropic-api-key "$ANTHROPIC_API_KEY"
 **Best for:** using your Claude subscription or existing Claude Code CLI login.
 ### Where to get a setup-token
 Setup-tokens are created by the **Claude Code CLI**, not the Anthropic Console. You can run this on **any machine**:
 ```bash
 claude setup-token
 ```
 Paste the token into Clawdbot (wizard: **Anthropic token (paste setup-token)**), or let Clawdbot run the command locally:
 ```bash
 clawdbot onboard --auth-choice setup-token
 # or
 clawdbot models auth setup-token --provider anthropic
 ```
 If you generated the token on a different machine, paste it:
 ```bash
 clawdbot models auth paste-token --provider anthropic
 ```
 ### CLI setup
 ```bash
-# Run setup-token on the gateway host (wizard can run it for you)
+# Run setup-token locally (wizard can run it for you)
 clawdbot onboard --auth-choice setup-token
 # Reuse Claude Code CLI OAuth credentials if already logged in
@@ -58,7 +80,7 @@ clawdbot onboard --auth-choice claude-cli
 ## Notes
- The wizard can run `claude setup-token` on the gateway host and store the token.
+- The wizard can run `claude setup-token` locally and store the token, or you can paste a token generated elsewhere.
 - Clawdbot writes `auth.profiles["anthropic:claude-cli"].mode` as `"oauth"` so the profile
  accepts both OAuth and setup-token credentials. Older configs using `"token"` are
  auto-migrated on load.
@@ -12,6 +12,7 @@ Use `pnpm` (Node 22+) from the repo root. Keep the working tree clean before tag
 1) **Version & metadata**
 - [ ] Bump `package.json` version (e.g., `1.1.0`).
 - [ ] Run `pnpm plugins:sync` to align extension package versions + changelogs.
 - [ ] Update CLI/version strings: [`src/cli/program.ts`](https://github.com/clawdbot/clawdbot/blob/main/src/cli/program.ts) and the Baileys user agent in [`src/provider-web.ts`](https://github.com/clawdbot/clawdbot/blob/main/src/provider-web.ts).
 - [ ] Confirm package metadata (name, description, repository, keywords, license) and `bin` map points to [`dist/entry.js`](https://github.com/clawdbot/clawdbot/blob/main/dist/entry.js) for `clawdbot`.
 - [ ] If dependencies changed, run `pnpm install` so `pnpm-lock.yaml` is current.
@@ -63,7 +64,7 @@ Use `pnpm` (Node 22+) from the repo root. Keep the working tree clean before tag
 7) **GitHub release + appcast**
 - [ ] Tag and push: `git tag vX.Y.Z && git push origin vX.Y.Z` (or `git push --tags`).
- [ ] Create/refresh the GitHub release for `vX.Y.Z` with **title `clawdbot X.Y.Z`** (not just the tag); body should inline the product-facing bullets from the changelog (no bare links) **and must not repeat the title inside the body**.
+- [ ] Create/refresh the GitHub release for `vX.Y.Z` with **title `clawdbot X.Y.Z`** (not just the tag); body should include the **full** changelog section for that version (Highlights + Changes + Fixes), inline (no bare links), and **must not repeat the title inside the body**.
 - [ ] Attach artifacts: `npm pack` tarball (optional), `Clawdbot-X.Y.Z.zip`, and `Clawdbot-X.Y.Z.dSYM.zip` (if generated).
 - [ ] Commit the updated `appcast.xml` and push it (Sparkle feeds from main).
 - [ ] From a clean temp directory (no `package.json`), run `npx -y clawdbot@X.Y.Z send --help` to confirm install/CLI entrypoints work.
@@ -108,7 +108,7 @@ Skills provide your tools. When you need one, check its `SKILL.md`. Keep local n
 When you receive a heartbeat poll (message matches the configured heartbeat prompt), don't just reply `HEARTBEAT_OK` every time. Use heartbeats productively!
 Default heartbeat prompt:
-`Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.`
+`Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`
 You are free to edit `HEARTBEAT.md` with a short checklist or reminders. Keep it small to limit token burn.
@@ -175,7 +175,7 @@ Example:
 ## Heartbeats (proactive mode)
 By default, Clawdbot runs a heartbeat every 30 minutes with the prompt:
-`Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.`
+`Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`
 Set `agents.defaults.heartbeat.every: "0m"` to disable.
 - If the agent replies with `HEARTBEAT_OK` (optionally with short padding; see `agents.defaults.heartbeat.ackMaxChars`), Clawdbot suppresses outbound delivery for that heartbeat.
@@ -16,6 +16,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
  - [What runtime do I need?](#what-runtime-do-i-need)
  - [What does the onboarding wizard actually do?](#what-does-the-onboarding-wizard-actually-do)
  - [How does Anthropic "setup-token" auth work?](#how-does-anthropic-setup-token-auth-work)
  - [Where do I find an Anthropic setup-token?](#where-do-i-find-an-anthropic-setup-token)
  - [Do you support Claude subscription auth (Claude Code OAuth)?](#do-you-support-claude-subscription-auth-claude-code-oauth)
  - [Is AWS Bedrock supported?](#is-aws-bedrock-supported)
  - [How does Codex auth work?](#how-does-codex-auth-work)
@@ -33,6 +34,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
  - [Can I load skills from a custom folder?](#can-i-load-skills-from-a-custom-folder)
  - [How can I use different models for different tasks?](#how-can-i-use-different-models-for-different-tasks)
  - [How do I install skills on Linux?](#how-do-i-install-skills-on-linux)
  - [Can I run Apple/macOS-only skills from Linux?](#can-i-run-applemacos-only-skills-from-linux)
  - [Do you have a Notion or HeyGen integration?](#do-you-have-a-notion-or-heygen-integration)
  - [How do I install the Chrome extension for browser takeover?](#how-do-i-install-the-chrome-extension-for-browser-takeover)
 - [Sandboxing and memory](#sandboxing-and-memory)
@@ -54,6 +56,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
  - [How do I enable web search (and web fetch)?](#how-do-i-enable-web-search-and-web-fetch)
  - [How do I run a central Gateway with specialized workers across devices?](#how-do-i-run-a-central-gateway-with-specialized-workers-across-devices)
  - [Can the Clawdbot browser run headless?](#can-the-clawdbot-browser-run-headless)
  - [How do I use Brave for browser control?](#how-do-i-use-brave-for-browser-control)
 - [Remote gateways + nodes](#remote-gateways-nodes)
  - [How do commands propagate between Telegram, the gateway, and nodes?](#how-do-commands-propagate-between-telegram-the-gateway-and-nodes)
  - [Do nodes run a gateway daemon?](#do-nodes-run-a-gateway-daemon)
@@ -67,11 +70,14 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
  - [I set `COPILOT_GITHUB_TOKEN`, but models status shows “Shell env: off.” Why?](#i-set-copilot_github_token-but-models-status-shows-shell-env-off-why)
 - [Sessions & multiple chats](#sessions-multiple-chats)
  - [How do I start a fresh conversation?](#how-do-i-start-a-fresh-conversation)
-  - [How do I completely reset Clawdbot (but keep it installed)?](#how-do-i-completely-reset-clawdbot-but-keep-it-installed)
+  - [Do sessions reset automatically if I never send `/new`?](#do-sessions-reset-automatically-if-i-never-send-new)
  - [How do I completely reset Clawdbot but keep it installed?](#how-do-i-completely-reset-clawdbot-but-keep-it-installed)
  - [I’m getting “context too large” errors — how do I reset or compact?](#im-getting-context-too-large-errors-how-do-i-reset-or-compact)
  - [Why am I getting heartbeat messages every 30 minutes?](#why-am-i-getting-heartbeat-messages-every-30-minutes)
  - [Do I need to add a “bot account” to a WhatsApp group?](#do-i-need-to-add-a-bot-account-to-a-whatsapp-group)
  - [Why doesn’t Clawdbot reply in a group?](#why-doesnt-clawdbot-reply-in-a-group)
  - [Do groups/threads share context with DMs?](#do-groupsthreads-share-context-with-dms)
  - [How many workspaces and agents can I create?](#how-many-workspaces-and-agents-can-i-create)
 - [Models: defaults, selection, aliases, switching](#models-defaults-selection-aliases-switching)
  - [What is the “default model”?](#what-is-the-default-model)
  - [How do I switch models on the fly (without restarting)?](#how-do-i-switch-models-on-the-fly-without-restarting)
@@ -104,25 +110,17 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
 - [Logging and debugging](#logging-and-debugging)
  - [Where are logs?](#where-are-logs)
  - [How do I start/stop/restart the Gateway daemon?](#how-do-i-startstoprestart-the-gateway-daemon)
  - [ELI5: `clawdbot daemon restart` vs `clawdbot gateway`](#eli5-clawdbot-daemon-restart-vs-clawdbot-gateway)
  - [What’s the fastest way to get more details when something fails?](#whats-the-fastest-way-to-get-more-details-when-something-fails)
 - [Media & attachments](#media-attachments)
  - [My skill generated an image/PDF, but nothing was sent](#my-skill-generated-an-imagepdf-but-nothing-was-sent)
 - [Security and access control](#security-and-access-control)
  - [Is it safe to expose Clawdbot to inbound DMs?](#is-it-safe-to-expose-clawdbot-to-inbound-dms)
  - [I ran `/start` in Telegram but didn’t get a pairing code](#i-ran-start-in-telegram-but-didnt-get-a-pairing-code)
  - [WhatsApp: will it message my contacts? How does pairing work?](#whatsapp-will-it-message-my-contacts-how-does-pairing-work)
 - [Chat commands, aborting tasks, and “it won’t stop”](#chat-commands-aborting-tasks-and-it-wont-stop)
  - [How do I stop/cancel a running task?](#how-do-i-stopcancel-a-running-task)
  - [Why does it feel like the bot “ignores” rapid‑fire messages?](#why-does-it-feel-like-the-bot-ignores-rapidfire-messages)
 - [Common troubleshooting](#common-troubleshooting)
  - [“All models failed” — what should I check first?](#all-models-failed-what-should-i-check-first)
  - [I’m running on my personal WhatsApp number — why is self-chat weird?](#im-running-on-my-personal-whatsapp-number-why-is-self-chat-weird)
  - [WhatsApp logged me out. How do I re‑auth?](#whatsapp-logged-me-out-how-do-i-reauth)
  - [Build errors on `main` — what’s the standard fix path?](#build-errors-on-main-whats-the-standard-fix-path)
  - [npm install fails (allow-build-scripts / missing tar or yargs). What now?](#npm-install-fails-allow-build-scripts--missing-tar-or-yargs-what-now)
  - [How do I switch between git installs and npm installs?](#how-do-i-switch-between-git-installs-and-npm-installs)
  - [Telegram block streaming isn’t splitting text between tool calls. Why?](#telegram-block-streaming-isnt-splitting-text-between-tool-calls-why)
  - [Discord doesn’t reply in my server even with `requireMention: false`. Why?](#discord-doesnt-reply-in-my-server-even-with-requiremention-false-why)
  - [Cloud Code Assist API error: invalid tool schema (400). What now?](#cloud-code-assist-api-error-invalid-tool-schema-400-what-now)
 ## First 60 seconds if something's broken
@@ -239,15 +237,25 @@ It also warns if your configured model is unknown or missing auth.
 ### How does Anthropic "setup-token" auth work?
-The wizard can run `claude setup-token` on the gateway host (or you run it yourself), then stores the token as an auth profile for the **anthropic** provider. That profile is used for model calls the same way an API key or OAuth profile would be. If you already ran `claude setup-token`, pick **Anthropic token (paste setup-token)** and paste it. More detail: [OAuth](/concepts/oauth).
+`claude setup-token` generates a **token string** via the Claude Code CLI (it is not available in the web console). You can run it on **any machine**. If you run it on the gateway host, the wizard can auto-detect the CLI credentials. If you run it elsewhere, choose **Anthropic token (paste setup-token)** and paste the string. The token is stored as an auth profile for the **anthropic** provider and used like an API key or OAuth profile. More detail: [OAuth](/concepts/oauth).
 Clawdbot keeps `auth.profiles["anthropic:claude-cli"].mode` set to `"oauth"` so
 the profile accepts both OAuth and setup-token credentials; older `"token"` mode
 entries auto-migrate.
 ### Where do I find an Anthropic setup-token?
 It is **not** in the Anthropic Console. The setup-token is generated by the **Claude Code CLI** on **any machine**:
 ```bash
 claude setup-token
 ```
 Copy the token it prints, then choose **Anthropic token (paste setup-token)** in the wizard. If you want Clawdbot to run the command for you, use `clawdbot onboard --auth-choice setup-token` or `clawdbot models auth setup-token --provider anthropic`. If you ran `claude setup-token` elsewhere, paste it on the gateway host with `clawdbot models auth paste-token --provider anthropic`. See [Anthropic](/providers/anthropic).
 ### Do you support Claude subscription auth (Claude Code OAuth)?
-Yes. Clawdbot can **reuse Claude Code CLI credentials** (OAuth) and also supports **setup-token**. If you have a Claude subscription, we recommend **setup-token** on the gateway host for the most reliable long‑running setup (requires Claude Pro/Max + the `claude` CLI). OAuth reuse is supported, but avoid logging in separately via Clawdbot and Claude Code to prevent token conflicts. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).
+Yes. Clawdbot can **reuse Claude Code CLI credentials** (OAuth) and also supports **setup-token**. If you have a Claude subscription, we recommend **setup-token** for long‑running setups (requires Claude Pro/Max + the `claude` CLI). You can generate it anywhere and paste it on the gateway host, or run it locally on the gateway so it auto-syncs. OAuth reuse is supported, but avoid logging in separately via Clawdbot and Claude Code to prevent token conflicts. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).
 Note: Claude subscription access is governed by Anthropic’s terms. For production or multi‑user workloads, API keys are usually the safer choice.
@@ -387,6 +395,40 @@ npm i -g clawdhub
 pnpm add -g clawdhub
 ```
 ### Is there a way to run Apple/macOS-only skills if my Gateway runs on Linux?
 Not directly. macOS skills are gated by `metadata.clawdbot.os` plus required binaries, and skills only appear in the system prompt when they are eligible on the **Gateway host**. On Linux, `darwin`-only skills (like `imsg`, `apple-notes`, `apple-reminders`) will not load unless you override the gating.
 You have three supported patterns:
 **Option A - run the Gateway on a Mac (simplest).**  
 Run the Gateway where the macOS binaries exist, then connect from Linux in [remote mode](#how-do-i-run-clawdbot-in-remote-mode-client-connects-to-a-gateway-elsewhere) or over Tailscale. The skills load normally because the Gateway host is macOS.
 **Option B - use a macOS node (no SSH).**  
 Run the Gateway on Linux, pair a macOS node (menubar app), and set **Node Run Commands** to "Always Ask" or "Always Allow" on the Mac. Clawdbot can treat macOS-only skills as eligible when the required binaries exist on the node. The agent runs those skills via the `nodes` tool. If you choose "Always Ask", approving "Always Allow" in the prompt adds that command to the allowlist.
 **Option C - proxy macOS binaries over SSH (advanced).**  
 Keep the Gateway on Linux, but make the required CLI binaries resolve to SSH wrappers that run on a Mac. Then override the skill to allow Linux so it stays eligible.
 1) Create an SSH wrapper for the binary (example: `imsg`):
   ```bash
   #!/usr/bin/env bash
   set -euo pipefail
   exec ssh -T user@mac-host /opt/homebrew/bin/imsg "$@"
   ```
 2) Put the wrapper on `PATH` on the Linux host (for example `~/bin/imsg`).
 3) Override the skill metadata (workspace or `~/.clawdbot/skills`) to allow Linux:
   ```markdown
   ---
   name: imsg
   description: iMessage/SMS CLI for listing chats, history, watch, and sending.
   metadata: {"clawdbot":{"os":["darwin","linux"],"requires":{"bins":["imsg"]}}}
   ---
   ```
 4) Start a new session so the skills snapshot refreshes.
 For iMessage specifically, you can also point `channels.imessage.cliPath` at an SSH wrapper (Clawdbot only needs stdio). See [iMessage](/channels/imessage).
 ### Do you have a Notion or HeyGen integration?
 Not built‑in today.
@@ -652,6 +694,11 @@ Headless uses the **same Chromium engine** and works for most automation (forms,
 - Some sites are stricter about automation in headless mode (CAPTCHAs, anti‑bot).
  For example, X/Twitter often blocks headless sessions.
 ### How do I use Brave for browser control?
 Set `browser.executablePath` to your Brave binary (or any Chromium-based browser) and restart the Gateway.
 See the full config examples in [Browser](/tools/browser#use-brave-or-another-chromium-based-browser).
 ## Remote gateways + nodes
 ### How do commands propagate between Telegram, the gateway, and nodes?
@@ -665,7 +712,7 @@ Nodes don’t see inbound provider traffic; they only receive bridge RPC calls.
 ### Do nodes run a gateway daemon?
-No. Only **one gateway** should run per host. Nodes are peripherals that connect
+No. Only **one gateway** should run per host unless you intentionally run isolated profiles (see [Multiple gateways](/gateway/multiple-gateways)). Nodes are peripherals that connect
 to the gateway (iOS/Android nodes, or macOS “node mode” in the menubar app).
 A full restart is required for `gateway`, `bridge`, `discovery`, and `canvasHost` changes.
@@ -806,7 +853,21 @@ See [/concepts/model-providers](/concepts/model-providers) and [/environment](/e
 Send `/new` or `/reset` as a standalone message. See [Session management](/concepts/session).
-### How do I completely reset Clawdbot (but keep it installed)?
+### Do sessions reset automatically if I never send `/new`?
 Yes. Sessions expire after `session.idleMinutes` (default **60**). The **next**
 message starts a fresh session id for that chat key. This does not delete
 transcripts — it just starts a new session.
 ```json5
 {
  session: {
    idleMinutes: 240
  }
 }
 ```
 ### How do I completely reset Clawdbot but keep it installed?
 Use the reset command:
@@ -853,6 +914,24 @@ If it keeps happening:
 Docs: [Compaction](/concepts/compaction), [Session pruning](/concepts/session-pruning), [Session management](/concepts/session).
 ### Why am I getting heartbeat messages every 30 minutes?
 Heartbeats run every **30m** by default. Tune or disable them:
 ```json5
 {
  agents: {
    defaults: {
      heartbeat: {
        every: "2h"   // or "0m" to disable
      }
    }
  }
 }
 ```
 Per-agent overrides use `agents.list[].heartbeat`. Docs: [Heartbeat](/gateway/heartbeat).
 ### Do I need to add a “bot account” to a WhatsApp group?
 No. Clawdbot runs on **your own account**, so if you’re in the group, Clawdbot can see it.
@@ -883,6 +962,19 @@ See [Groups](/concepts/groups) and [Group messages](/concepts/group-messages).
 Direct chats collapse to the main session by default. Groups/channels have their own session keys, and Telegram topics / Discord threads are separate sessions. See [Groups](/concepts/groups) and [Group messages](/concepts/group-messages).
 ### How many workspaces and agents can I create?
 No hard limits. Dozens (even hundreds) are fine, but watch for:
 - **Disk growth:** sessions + transcripts live under `~/.clawdbot/agents/<agentId>/sessions/`.
 - **Token cost:** more agents means more concurrent model usage.
 - **Ops overhead:** per-agent auth profiles, workspaces, and channel routing.
 Tips:
 - Keep one **active** workspace per agent (`agents.defaults.workspace`).
 - Prune old sessions (delete JSONL or store entries) if disk grows.
 - Use `clawdbot doctor` to spot stray workspaces and profile mismatches.
 ## Models: defaults, selection, aliases, switching
 ### What is the “default model”?
@@ -1112,6 +1204,10 @@ can’t find that profile in its auth store.
 - **Sync the Claude Code CLI token on the gateway host**
  - Run `clawdbot models status` (it loads + syncs Claude Code CLI credentials).
  - If it still says missing: run `claude setup-token` (or `clawdbot models auth setup-token --provider anthropic`) and retry.
 - **If the token was created on another machine**
  - Paste it into the gateway host with `clawdbot models auth paste-token --provider anthropic`.
 - **Check the profile mode**
  - `auth.profiles["anthropic:claude-cli"].mode` must be `"oauth"` (token mode rejects OAuth credentials).
 - **If you want to use an API key instead**
  - Put `ANTHROPIC_API_KEY` in `~/.clawdbot/.env` on the **gateway host**.
  - Clear any pinned order that forces `anthropic:claude-cli`:
@@ -1351,6 +1447,14 @@ clawdbot daemon restart
 If you run the gateway manually, `clawdbot gateway --force` can reclaim the port. See [Gateway](/gateway).
 ### ELI5: `clawdbot daemon restart` vs `clawdbot gateway`
 - `clawdbot daemon restart`: restarts the **background service** (launchd/systemd).
 - `clawdbot gateway`: runs the gateway **in the foreground** for this terminal session.
 If you installed the daemon, use the daemon commands. Use `clawdbot gateway` when
 you want a one-off, foreground run.
 ### What’s the fastest way to get more details when something fails?
 Start the Gateway with `--verbose` to get more console detail. Then inspect the log file for channel auth, model routing, and RPC errors.
@@ -1367,7 +1471,11 @@ CLI sending:
 clawdbot message send --to +15555550123 --message "Here you go" --media /path/to/file.png
 ```
-Note: images are resized/recompressed (max side 2048px) to hit size limits. See [Images](/nodes/images).
+Also check:
 - The target channel supports outbound media and isn’t blocked by allowlists.
 - The file is within the provider’s size limits (images are resized to max 2048px).
 See [Images](/nodes/images).
 ## Security and access control
@@ -1383,6 +1491,19 @@ Treat inbound DMs as untrusted input. Defaults are designed to reduce risk:
 Run `clawdbot doctor` to surface risky DM policies.
 ### I ran `/start` in Telegram but didn’t get a pairing code
 Pairing codes are sent **only** when an unknown sender messages the bot and
 `dmPolicy: "pairing"` is enabled. `/start` by itself doesn’t generate a code.
 Check pending requests:
 ```bash
 clawdbot pairing list telegram
 ```
 If you want immediate access, allowlist your sender id or set `dmPolicy: "open"`
 for that account.
 ### WhatsApp: will it message my contacts? How does pairing work?
 No. Default WhatsApp DM policy is **pairing**. Unknown senders only get a pairing code and their message is **not processed**. Clawdbot only replies to chats it receives or to explicit sends you trigger.
@@ -1440,138 +1561,6 @@ Queue mode controls how new messages interact with an in‑flight run. Use `/que
 You can add options like `debounce:2s cap:25 drop:summarize` for followup modes.
 ## Common troubleshooting
 ### “All models failed” — what should I check first?
 - **Credentials** present for the provider(s) being tried (auth profiles + env vars).
 - **Model routing**: confirm `agents.defaults.model.primary` and fallbacks are models you can access.
 - **Gateway logs** in `/tmp/clawdbot/…` for the exact provider error.
 - **`/model status`** to see current configured models + shorthands.
 ### I’m running on my personal WhatsApp number — why is self-chat weird?
 Enable self-chat mode and allowlist your own number:
 ```json5
 {
  channels: {
    whatsapp: {
      selfChatMode: true,
      dmPolicy: "allowlist",
      allowFrom: ["+15555550123"]
    }
  }
 }
 ```
 See [WhatsApp setup](/channels/whatsapp).
 ### WhatsApp logged me out. How do I re‑auth?
 Run the login command again and scan the QR code:
 ```bash
 clawdbot channels login
 ```
 ### Build errors on `main` — what’s the standard fix path?
 1) `git pull origin main && pnpm install`
 2) `pnpm clawdbot doctor`
 3) Check GitHub issues or Discord
 4) Temporary workaround: check out an older commit
 ### npm install fails (allow-build-scripts / missing tar or yargs). What now?
 If you’re running from source, use the repo’s package manager: **pnpm** (preferred).
 The repo declares `packageManager: "pnpm@…"`, and pnpm patches are tracked in `pnpm.patchedDependencies`.
 Typical recovery:
 ```bash
 git status   # ensure you’re in the repo root
 pnpm install
 pnpm build
 pnpm clawdbot doctor
 clawdbot daemon restart
 ```
 Why: pnpm is the configured package manager for this repo, and the dependency
 patching workflow relies on it.
 ### How do I switch between git installs and npm installs?
 Use the **website installer** and select the install method with a flag. It
 upgrades in place and rewrites the gateway service to point at the new install.
 Switch **to git install**:
 ```bash
 curl -fsSL https://clawd.bot/install.sh | bash -s -- --install-method git --no-onboard
 ```
 Switch **to npm global**:
 ```bash
 curl -fsSL https://clawd.bot/install.sh | bash
 ```
 Notes:
 - The git flow only rebases if the repo is clean. Commit or stash changes first.
 - After switching, run:
  ```bash
  clawdbot doctor
  clawdbot daemon restart
  ```
 ### Telegram block streaming isn’t splitting text between tool calls. Why?
 Block streaming only sends **completed text blocks**. Common reasons you see a single message:
 - `agents.defaults.blockStreamingDefault` is still `"off"`.
 - `channels.telegram.blockStreaming` is set to `false`.
 - `channels.telegram.streamMode` is `partial` or `block` **and draft streaming is active**
  (private chat + topics). Draft streaming disables block streaming in that case.
 - Your `minChars` / coalesce settings are too high, so chunks get merged.
 - The model emits one large text block (no mid‑reply flush points).
 Fix checklist:
 1) Put block streaming settings under `agents.defaults`, not the root.
 2) Set `channels.telegram.streamMode: "off"` if you want real multi‑message block replies.
 3) Use smaller chunk/coalesce thresholds while debugging.
 See [Streaming](/concepts/streaming).
 ### Discord doesn’t reply in my server even with `requireMention: false`. Why?
 `requireMention` only controls mention‑gating **after** the channel passes allowlists.
 By default `channels.discord.groupPolicy` is **allowlist**, so guild channels must be explicitly enabled.
 Fix checklist:
 1) Set `channels.discord.groupPolicy: "open"` **or** add the guild/channel allowlist.
 2) Use **numeric channel IDs** in `channels.discord.guilds.<guildId>.channels`.
 3) Put `requireMention: false` **under** `channels.discord.guilds` (global or per‑channel).
   Top‑level `channels.discord.requireMention` is not a supported key.
 4) Ensure the bot has **Message Content Intent** and channel permissions.
 5) Run `clawdbot channels status --probe` for audit hints.
 Docs: [Discord](/channels/discord), [Channels troubleshooting](/channels/troubleshooting).
 ### Cloud Code Assist API error: invalid tool schema (400). What now?
 This is almost always a **tool schema compatibility** issue. The Cloud Code Assist
 endpoint accepts a strict subset of JSON Schema. Clawdbot scrubs/normalizes tool
 schemas in current `main`, but the fix is not in the last release yet (as of
 January 13, 2026).
 Fix checklist:
 1) **Update Clawdbot**:
   - If you can run from source, pull `main` and restart the gateway.
   - Otherwise, wait for the next release that includes the schema scrubber.
 2) Avoid unsupported keywords like `anyOf/oneOf/allOf`, `patternProperties`,
   `additionalProperties`, `minLength`, `maxLength`, `format`, etc.
 3) If you define custom tools, keep the top‑level schema as `type: "object"` with
   `properties` and simple enums.
 See [Tools](/tools) and [TypeBox schemas](/concepts/typebox).
 ## Answer the exact question from the screenshot/chat log
 **Q: “What’s the default model for Anthropic with an API key?”**
@@ -141,10 +141,10 @@ Full setup walkthrough (28m) by VelvetShark.
  <img src="/assets/showcase/oura-health.png" alt="Oura ring health assistant" />
 </Card>
-<Card title="Multi-Agent Swarm (14+ Agents)" icon="robot" href="https://github.com/adam91holt/clawdspace">
+<Card title="Kev's Dream Team (14+ Agents)" icon="robot" href="https://github.com/adam91holt/orchestrated-ai-articles">
-  **@adam91holt** • `multi-agent` `slack` `orchestration` `swarm`
+  **@adam91holt** • `multi-agent` `orchestration` `architecture` `manifesto`
-  14+ Clawdbot agents under one gateway. Opus 4.5 orchestrator delegates to Codex workers. Self-maintaining agents that continuously improve. Open-sourced clawdspace for agent sandboxing.
+  14+ agents under one gateway with Opus 4.5 orchestrator delegating to Codex workers. Comprehensive [technical write-up](https://github.com/adam91holt/orchestrated-ai-articles) covering the Dream Team roster, model selection, sandboxing, webhooks, heartbeats, and delegation flows. [Clawdspace](https://github.com/adam91holt/clawdspace) for agent sandboxing. [Blog post](https://adams-ai-journey.ghost.io/2026-the-year-of-the-orchestrator/).
 </Card>
 </CardGroup>
@@ -68,6 +68,8 @@ Tip: `--json` does **not** imply non-interactive mode. Use `--non-interactive` (
 1) **Existing config detection**
   - If `~/.clawdbot/clawdbot.json` exists, choose **Keep / Modify / Reset**.
   - Re-running the wizard does **not** wipe anything unless you explicitly choose **Reset**
     (or pass `--reset`).
   - If the config is invalid or contains legacy keys, the wizard stops and asks
     you to run `clawdbot doctor` before continuing.
   - Reset uses `trash` (never `rm`) and offers scopes:
@@ -77,7 +79,7 @@ Tip: `--json` does **not** imply non-interactive mode. Use `--non-interactive` (
 2) **Model/Auth**
   - **Anthropic API key (recommended)**: uses `ANTHROPIC_API_KEY` if present or prompts for a key, then saves it for daemon use.
-   - **Anthropic token (setup-token)**: run `claude setup-token` on the gateway host (the wizard can run it for you and reuse the token).
+   - **Anthropic token (setup-token)**: run `claude setup-token` locally (the wizard can run it for you and reuse the token) or run it elsewhere and paste the token.
   - **Anthropic OAuth (Claude Code CLI)**: on macOS the wizard checks Keychain item "Claude Code-credentials" (choose "Always Allow" so launchd starts don't block); on Linux/Windows it reuses `~/.claude/.credentials.json` if present.
   - **Anthropic token (paste setup-token)**: run `claude setup-token` in your terminal, then paste the token (you can name it; blank = default).
   - **OpenAI Code (Codex) subscription (Codex CLI)**: if `~/.codex/auth.json` exists, the wizard can reuse it.
@@ -1,5 +1,5 @@
 ---
-summary: "Fix Chrome/Chromium CDP startup issues for Clawdbot browser control on Linux"
+summary: "Fix Chrome/Brave/Edge/Chromium CDP startup issues for Clawdbot browser control on Linux"
 read_when: "Browser control fails on Linux, especially with snap Chromium"
 ---
@@ -7,7 +7,7 @@ read_when: "Browser control fails on Linux, especially with snap Chromium"
 ## Problem: "Failed to start Chrome CDP on port 18800"
-Clawdbot's browser control server fails to launch Chrome/Chromium with the error:
+Clawdbot's browser control server fails to launch Chrome/Brave/Edge/Chromium with the error:
 ```
 {"error":"Error: Failed to start Chrome CDP on port 18800 for profile \"clawd\"."}
 ```
@@ -107,8 +107,23 @@ curl -s http://127.0.0.1:18791/tabs
 | Option | Description | Default |
 |--------|-------------|---------|
 | `browser.enabled` | Enable browser control | `true` |
-| `browser.executablePath` | Path to Chrome/Chromium binary | auto-detected |
+| `browser.executablePath` | Path to a Chromium-based browser binary (Chrome/Brave/Edge/Chromium) | auto-detected (prefers default browser when Chromium-based) |
 | `browser.headless` | Run without GUI | `false` |
 | `browser.noSandbox` | Add `--no-sandbox` flag (needed for some Linux setups) | `false` |
 | `browser.attachOnly` | Don't launch browser, only attach to existing | `false` |
 | `browser.cdpPort` | Chrome DevTools Protocol port | `18800` |
 ### Problem: "Chrome extension relay is running, but no tab is connected"
 You’re using the `chrome` profile (extension relay). It expects the Clawdbot
 browser extension to be attached to a live tab.
 Fix options:
 1. **Use the managed browser:** `clawdbot browser start --browser-profile clawd`
   (or set `browser.defaultProfile: "clawd"`).
 2. **Use the extension relay:** install the extension, open a tab, and click the
   Clawdbot extension icon to attach it.
 Notes:
 - The `chrome` profile uses your **system default Chromium browser** when possible.
 - Local `clawd` profiles auto-assign `cdpPort`/`cdpUrl`; only set those for remote CDP.
@@ -8,14 +8,16 @@ read_when:
 # Browser (clawd-managed)
-Clawdbot can run a **dedicated Chrome/Chromium profile** that the agent controls.
+Clawdbot can run a **dedicated Chrome/Brave/Edge/Chromium profile** that the agent controls.
 It is isolated from your personal browser and is managed through a small local
 control server.
 Beginner view:
 - Think of it as a **separate, agent-only browser**.
- It does **not** touch your personal Chrome profile.
+- The `clawd` profile does **not** touch your personal browser profile.
 - The agent can **open tabs, read pages, click, and type** in a safe lane.
 - The default `chrome` profile uses the **system default Chromium browser** via the
  extension relay; switch to `clawd` for the isolated managed browser.
 ## What you get
@@ -39,6 +41,14 @@ clawdbot browser --browser-profile clawd snapshot
 If you get “Browser disabled”, enable it in config (see below) and restart the
 Gateway.
 ## Profiles: `clawd` vs `chrome`
 - `clawd`: managed, isolated browser (no extension required).
 - `chrome`: extension relay to your **system browser** (requires the Clawdbot
  extension to be attached to a tab).
 Set `browser.defaultProfile: "clawd"` if you want managed mode by default.
 ## Configuration
 Browser settings live in `~/.clawdbot/clawdbot.json`.
@@ -54,7 +64,7 @@ Browser settings live in `~/.clawdbot/clawdbot.json`.
    headless: false,
    noSandbox: false,
    attachOnly: false,
-    executablePath: "/Applications/Chromium.app/Contents/MacOS/Chromium",
+    executablePath: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
    profiles: {
      clawd: { cdpPort: 18800, color: "#FF4500" },
      work: { cdpPort: 18801, color: "#0066CC" },
@@ -69,17 +79,55 @@ Notes:
 - If you override the Gateway port (`gateway.port` or `CLAWDBOT_GATEWAY_PORT`),
  the default browser ports shift to stay in the same “family” (control = gateway + 2).
 - `cdpUrl` defaults to `controlUrl + 1` when unset.
- `attachOnly: true` means “never launch Chrome; only attach if it is already running.”
+- `attachOnly: true` means “never launch a local browser; only attach if it is already running.”
 - `color` + per-profile `color` tint the browser UI so you can see which profile is active.
 - Default profile is `chrome` (extension relay). Use `defaultProfile: "clawd"` for the managed browser.
 - Auto-detect order: system default browser if Chromium-based; otherwise Chrome → Brave → Edge → Chromium → Chrome Canary.
 - Local `clawd` profiles auto-assign `cdpPort`/`cdpUrl` — set those only for remote CDP.
 ## Use Brave (or another Chromium-based browser)
 If your **system default** browser is Chromium-based (Chrome/Brave/Edge/etc),
 Clawdbot uses it automatically. Set `browser.executablePath` to override
 auto-detection:
 CLI example:
 ```bash
 clawdbot config set browser.executablePath "/usr/bin/google-chrome"
 ```
 ```json5
 // macOS
 {
  browser: {
    executablePath: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"
  }
 }
 // Windows
 {
  browser: {
    executablePath: "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"
  }
 }
 // Linux
 {
  browser: {
    executablePath: "/usr/bin/brave-browser"
  }
 }
 ```
 ## Local vs remote control
 - **Local control (default):** `controlUrl` is loopback (`127.0.0.1`/`localhost`).
-  The Gateway starts the control server and can launch Chrome.
+  The Gateway starts the control server and can launch a local browser.
 - **Remote control:** `controlUrl` is non-loopback. The Gateway **does not** start
  a local server; it assumes you are pointing at an existing server elsewhere.
 - **Remote CDP:** set `browser.profiles.<name>.cdpUrl` (or `browser.cdpUrl`) to
-  attach to a remote Chrome. In this case, Clawdbot will not launch a local browser.
+  attach to a remote Chromium-based browser. In this case, Clawdbot will not launch a local browser.
 ## Remote browser (control server)
@@ -88,7 +136,7 @@ Gateway at it with a remote `controlUrl`. This lets the agent drive a browser
 outside the host (lab box, VM, remote desktop, etc.).
 Key points:
- The **control server** speaks to Chrome/Chromium via **CDP**.
+- The **control server** speaks to Chromium-based browsers (Chrome/Brave/Edge/Chromium) via **CDP**.
 - The **Gateway** only needs the HTTP control URL.
 - Profiles are resolved on the **control server** side.
@@ -104,14 +152,14 @@ Example:
 ```
 Use `profiles.<name>.cdpUrl` for **remote CDP** if you want the Gateway to talk
-directly to a Chrome instance without a remote control server.
+directly to a Chromium-based browser instance without a remote control server.
 ### Running the control server on the browser machine
 Run a standalone browser control server (recommended when your Gateway is remote):
 ```bash
-# on the machine that runs Chrome
+# on the machine that runs Chrome/Brave/Edge
 clawdbot browser serve --bind <browser-host> --port 18791 --token <token>
 ```
@@ -198,8 +246,8 @@ Notes:
 ## Profiles (multi-browser)
 Clawdbot supports multiple named profiles (routing configs). Profiles can be:
- **clawd-managed**: a dedicated Chrome instance with its own user data directory + CDP port
+- **clawd-managed**: a dedicated Chromium-based browser instance with its own user data directory + CDP port
- **remote**: an explicit CDP URL (Chrome running elsewhere)
+- **remote**: an explicit CDP URL (Chromium-based browser running elsewhere)
 - **extension relay**: your existing Chrome tab(s) via the local relay + Chrome extension
 Defaults:
@@ -264,22 +312,24 @@ Notes:
 ## Isolation guarantees
- **Dedicated user data dir**: never touches your personal Chrome profile.
+- **Dedicated user data dir**: never touches your personal browser profile.
 - **Dedicated ports**: avoids `9222` to prevent collisions with dev workflows.
 - **Deterministic tab control**: target tabs by `targetId`, not “last tab”.
 ## Browser selection
 When launching locally, Clawdbot picks the first available:
-1. Chrome Canary
+1. Chrome
-2. Chromium
+2. Brave
-3. Chrome
+3. Edge
 4. Chromium
 5. Chrome Canary
 You can override with `browser.executablePath`.
 Platforms:
 - macOS: checks `/Applications` and `~/Applications`.
- Linux: looks for `google-chrome`, `chromium`, etc.
+- Linux: looks for `google-chrome`, `brave`, `microsoft-edge`, `chromium`, etc.
 - Windows: checks common install locations.
 ## Control API (optional)
@@ -309,11 +359,15 @@ Playwright. If Playwright isn’t installed, those endpoints return a clear 501
 error. ARIA snapshots and basic screenshots still work for clawd-managed Chrome.
 For the Chrome extension relay driver, ARIA snapshots and screenshots require Playwright.
 If you see `Playwright is not available in this gateway build`, install the full
 Playwright package (not `playwright-core`) and restart the gateway, or reinstall
 Clawdbot with browser support.
 ## How it works (internal)
 High-level flow:
 - A small **control server** accepts HTTP requests.
- It connects to Chrome/Chromium via **CDP**.
+- It connects to Chromium-based browsers (Chrome/Brave/Edge/Chromium) via **CDP**.
 - For advanced actions (click/type/snapshot/PDF), it uses **Playwright** on top
  of CDP.
 - When Playwright is missing, only non-Playwright operations are available.
@@ -16,7 +16,9 @@ All skills-related configuration lives under `skills` in `~/.clawdbot/clawdbot.j
      extraDirs: [
        "~/Projects/agent-scripts/skills",
        "~/Projects/oss/some-skill-pack/skills"
-      ]
+      ],
      watch: true,
      watchDebounceMs: 250
    },
    install: {
      preferBrew: true,
@@ -42,6 +44,8 @@ All skills-related configuration lives under `skills` in `~/.clawdbot/clawdbot.j
 - `allowBundled`: optional allowlist for **bundled** skills only. When set, only
  bundled skills in the list are eligible (managed/workspace skills unaffected).
 - `load.extraDirs`: additional skill directories to scan (lowest precedence).
 - `load.watch`: watch skill folders and refresh the skills snapshot (default: true).
 - `load.watchDebounceMs`: debounce for skill watcher events in milliseconds (default: 250).
 - `install.preferBrew`: prefer brew installers when available (default: true).
 - `install.nodeManager`: node installer preference (`npm` | `pnpm` | `yarn` | `bun`, default: npm).
  This only affects **skill installs**; the Gateway runtime should still be Node
@@ -57,4 +61,4 @@ Per-skill fields:
 - Keys under `entries` map to the skill name by default. If a skill defines
  `metadata.clawdbot.skillKey`, use that key instead.
- Changes to skills are picked up on the next new session.
+- Changes to skills are picked up on the next agent turn when the watcher is enabled.
@@ -181,6 +181,29 @@ This is **scoped to the agent run**, not a global shell environment.
 Clawdbot snapshots the eligible skills **when a session starts** and reuses that list for subsequent turns in the same session. Changes to skills or config take effect on the next new session.
 Skills can also refresh mid-session when the skills watcher is enabled or when a new eligible remote node appears (see below). Think of this as a **hot reload**: the refreshed list is picked up on the next agent turn.
 ## Remote macOS nodes (Linux gateway)
 If the Gateway is running on Linux but a **macOS node** is connected **with `system.run` allowed** (Node Run Commands policy not set to "Never"), Clawdbot can treat macOS-only skills as eligible when the required binaries are present on that node. The agent should execute those skills via the `nodes` tool (typically `nodes.run`).
 This relies on the node reporting its command support and on a bin probe via `system.run`. If the macOS node goes offline later, the skills remain visible; invocations may fail until the node reconnects.
 ## Skills watcher (auto-refresh)
 By default, Clawdbot watches skill folders and bumps the skills snapshot when `SKILL.md` files change. Configure this under `skills.load`:
 ```json5
 {
  skills: {
    load: {
      watch: true,
      watchDebounceMs: 250
    }
  }
 }
 ```
 ## Token impact (skills list)
 When skills are eligible, Clawdbot injects a compact XML list of available skills into the system prompt (via `formatSkillsForPrompt` in `pi-coding-agent`). The cost is deterministic:
@@ -54,7 +54,7 @@ They run immediately, are stripped before the model sees the message, and the re
 Text + native (when enabled):
 - `/help`
 - `/commands`
- `/status` (show current status; includes a short provider usage/quota line when available)
+- `/status` (show current status; includes provider usage/quota when available, plus OAuth/token status block when OAuth profiles exist)
 - `/context [list|detail|json]` (explain “context”; `detail` shows per-file + per-tool + per-skill + system prompt size)
 - `/usage` (alias: `/status`)
 - `/whoami` (show your sender id; alias: `/id`)
@@ -50,8 +50,8 @@ read_when:
 - Elevated mode docs live in [Elevated mode](/tools/elevated).
 ## Heartbeats
- Heartbeat probe body is the configured heartbeat prompt (default: `Read HEARTBEAT.md if exists. Consider outstanding tasks. Checkup sometimes on your human during (user local) day time.`). Inline directives in a heartbeat message apply as usual (but avoid changing session defaults from heartbeats).
+- Heartbeat probe body is the configured heartbeat prompt (default: `Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.`). Inline directives in a heartbeat message apply as usual (but avoid changing session defaults from heartbeats).
- Heartbeat delivery defaults to the final payload only. To also send the separate `Reasoning:` message (when available), set `agents.defaults.heartbeat.includeReasoning: true`.
+- Heartbeat delivery defaults to the final payload only. To also send the separate `Reasoning:` message (when available), set `agents.defaults.heartbeat.includeReasoning: true` or per-agent `agents.list[].heartbeat.includeReasoning: true`.
 ## Web chat UI
 - The web chat thinking selector mirrors the session's stored level from the inbound session store/config when the page loads.
Author	SHA1	Message	Date
Peter SteinbergerandWes	f975ebf91b	fix: keep mac gateway attached (#982 ) (thanks @wes-davis) Co-authored-by: Wes <wesleydavis@me.com>	2026-01-16 07:36:27 +00:00
Peter Steinberger	f2db894685	Merge pull request #992 from tyler6204/fix/tool-typing-race-condition fix: send text between tool calls to channel immediately	2026-01-16 07:26:10 +00:00
Peter Steinberger	4f03283126	docs: add npm 1password publish steps	2026-01-16 07:08:07 +00:00
Peter Steinberger	ed7dec0975	feat: use dropdowns for access controls	2026-01-16 07:00:05 +00:00
Peter Steinberger	fbb3da506f	docs: clarify onboarding + sessions + heartbeats	2026-01-16 06:57:54 +00:00
Peter Steinberger	dfa6c5c2b3	fix(google): scrub tool schemas for gemini	2026-01-16 06:57:54 +00:00
Peter Steinberger	028eed5fe8	fix(browser): surface detection details and docs	2026-01-16 06:57:54 +00:00
Peter Steinberger	2b16a87f04	feat: add config get/set/unset helpers	2026-01-16 06:57:54 +00:00
Peter Steinberger	731049936d	Merge pull request #870 from JDIVE/fix/discord-actions-schema fix(config): allow discord action flags in schema	2026-01-16 06:50:50 +00:00
Peter Steinberger	5a5b058ba0	fix: update discord action defaults (#870 ) (thanks @JDIVE)	2026-01-16 06:50:27 +00:00
Jamie OpenshawandClaude	72f28be648	fix(config): allow discord action flags in schema Ensure discord action flags survive config validation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2026-01-16 06:48:25 +00:00
Peter Steinberger	ff645524d8	docs: move troubleshooting items from faq	2026-01-16 06:35:13 +00:00
Peter Steinberger	c534390bc0	chore: update a2ui bundle	2026-01-16 06:35:05 +00:00
Peter Steinberger	c5003e5441	fix: clear lint blockers	2026-01-16 06:35:05 +00:00
Peter Steinberger	0b3ebb0c63	test: stabilize slow and flaky tests	2026-01-16 06:24:58 +00:00
Peter Steinberger	23981496f9	fix: resolve bridge warnings	2026-01-16 06:15:45 +00:00
Peter Steinberger	f2e425dc2b	Merge pull request #995 from roshanasingh4/fix/systemd-execstart-whitespace Fix systemd ExecStart whitespace parsing	2026-01-16 06:03:35 +00:00
Peter Steinberger	e48d68bbc7	Merge pull request #993 from cpojer/reminder-improvement Improve reminder text generation.	2026-01-16 06:03:04 +00:00
Peter Steinberger	842fc8d08b	fix: repair launchd status parsing	2026-01-16 06:01:28 +00:00
Peter Steinberger	54ec14262b	feat: add plugin update tracking	2026-01-16 05:55:05 +00:00
Peter Steinberger	d0c70178e0	docs: fix FAQ reset anchor	2026-01-16 05:54:56 +00:00
Peter Steinberger	3bc9c330eb	fix: unblock mac node bridge TLS	2026-01-16 05:50:55 +00:00
Peter Steinberger	b7fcc8584f	style: apply swiftformat fixes	2026-01-16 05:42:18 +00:00
Peter Steinberger	2b8ce3f06b	feat: add json output for daemon lifecycle	2026-01-16 05:40:47 +00:00
Peter Steinberger	41d44021e7	feat(browser): prefer default chromium browser	2026-01-16 05:37:53 +00:00
Peter Steinberger	1ab1e312b2	feat: add TLS for node bridge	2026-01-16 05:28:40 +00:00
Roshan Singh	fa9aafce83	Fix systemd ExecStart parsing whitespace	2026-01-16 05:25:13 +00:00
Tyler Yust	0d5dec4c66	fix: handle async tool start handler rejections Add .catch() to handleToolExecutionStart call to prevent unhandled promise rejections when onAgentEvent or typing signaling fails.	2026-01-15 21:10:52 -08:00
cpojer	b2d5889f6e	Improve reminder text generation.	2026-01-16 14:03:17 +09:00
Tyler Yust	2ee71e4154	fix: send text between tool calls to channel immediately Previously, when block streaming was disabled (the default), text generated between tool calls would only appear after all tools completed. This was because onBlockReply wasn't passed to the subscription when block streaming was off, so flushBlockReplyBuffer() before tool execution did nothing. Now onBlockReply is always passed, and when block streaming is disabled, block replies are sent directly during tool flush. Directly sent payloads are tracked to avoid duplicates in final payloads. Also fixes a race condition where tool summaries could be emitted before the typing indicator started by awaiting onAgentEvent in tool handlers.	2026-01-15 20:55:52 -08:00
Peter Steinberger	1656f491fd	fix: normalize pairing aliases and webhook guard (#991 ) (thanks @longmaba)	2026-01-16 04:55:16 +00:00
Peter Steinberger	a057b3c9e8	Merge pull request #991 from longmaba/fix/zalo-pairing-and-webhook fix(zalo): fix pairing channel detection and webhook payload format	2026-01-16 04:54:08 +00:00
Peter Steinberger	236b27cb3a	docs: align plugin changelogs	2026-01-16 04:15:48 +00:00
Peter Steinberger	1634abf293	docs: expand msteams plugin changelog	2026-01-16 04:15:48 +00:00
UbuntuandAlphonse-arianee	ca9688b5cc	feat(session): add dmScope for multi-user DM isolation Co-authored-by: Alphonse-arianee <Alphonse-arianee@users.noreply.github.com>	2026-01-16 04:13:10 +00:00
Peter Steinberger	e6364d031d	fix: stabilize windows queue + pairing tests	2026-01-16 04:02:43 +00:00
Peter Steinberger	01c8d099ad	fix: repair CI formatting + launchd test	2026-01-16 03:52:47 +00:00
Peter Steinberger	f6e619f078	fix: normalize daemon unit paths	2026-01-16 03:47:26 +00:00
Peter Steinberger	b2b331230b	feat: mac node exec policy + remote skills hot reload	2026-01-16 03:45:06 +00:00
LongandAmp	c0c9742e44	fix(zalo): fix pairing channel detection and webhook payload format Amp-Thread-ID: https://ampcode.com/threads/T-019bc4e0-fcb1-77be-b0b5-0d498f0c7197 Co-authored-by: Amp <amp@ampcode.com>	2026-01-16 10:43:14 +07:00
Peter Steinberger	abcca86e4e	chore: format and sync protocol outputs	2026-01-16 03:30:56 +00:00
Peter SteinbergerandChristoph Nakazawa	a5d8f89b53	feat(browser): prefer Chrome default + add Brave/Edge fallbacks Co-authored-by: Christoph Nakazawa <christoph.pojer@gmail.com>	2026-01-16 03:28:56 +00:00
Peter Steinberger	a0d2a7232e	fix: allow media-only sends	2026-01-16 03:15:26 +00:00
Peter Steinberger	f449115ec5	test: extend vitest timeouts	2026-01-16 03:11:16 +00:00
Peter Steinberger	16bc4cdef3	chore: drop legacy Relay signing	2026-01-16 03:11:16 +00:00
Peter SteinbergerandDrake Thomsen	23e4ba845c	fix: sanitize user-facing errors and strip final tags Co-authored-by: Drake Thomsen <drake.thomsen@example.com>	2026-01-16 03:01:23 +00:00
Peter Steinberger	d9f9e93dee	feat!: move msteams to plugin	2026-01-16 02:59:43 +00:00
Peter Steinberger	dae34f3a61	docs: clarify setup-token location	2026-01-16 02:53:40 +00:00
Adam HoltandClaude Opus 4.5	af61b353a4	docs(showcase): update Dream Team card with architecture articles Combine Multi-Agent Swarm card with new technical write-ups: - Link to orchestrated-ai-articles repo (manifesto + architecture) - Keep clawdspace link for agent sandboxing - Add blog post link Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-16 02:52:27 +00:00
Peter Steinberger	29476b222d	fix: restore status usage summary output	2026-01-16 02:49:18 +00:00
Peter Steinberger	e7c16cc0e6	docs: clarify setup-token flows	2026-01-16 02:36:32 +00:00
Peter Steinberger	3dddbe1053	fix: ignore properties in google tool schema warnings	2026-01-16 02:35:55 +00:00
Peter SteinbergerandJohn Young	2dea6bfa7e	docs: clarify gog body-file usage Co-authored-by: John Young <johntheyoung@users.noreply.github.com>	2026-01-16 02:23:41 +00:00
Peter Steinberger	04e3bfed35	docs: clarify Anthropic setup-token	2026-01-16 02:19:57 +00:00
Peter Steinberger	3e32050601	fix: correct final tag strip typing	2026-01-16 02:16:17 +00:00
Peter Steinberger	7fb45ed9b8	fix: strip final tags from session messages	2026-01-16 02:16:17 +00:00
Peter SteinbergerandMax	b7ba94f0c1	fix: harden antigravity claude support (#968 ) Co-authored-by: Max <rdev@users.noreply.github.com>	2026-01-16 02:16:17 +00:00
Peter Steinberger	5b827528f8	fix: show oauth usage in /status	2026-01-16 02:06:27 +00:00
Peter Steinberger	409e33d9c2	Merge pull request #960 from kkarimi/fix/mac-node-bridge-tunnel-865 macOS: prefer bridge tunnel port in remote mode	2026-01-16 02:00:23 +00:00
Peter Steinberger	747277d914	fix: document macOS remote tunnels (#960 ) (thanks @kkarimi)	2026-01-16 01:59:14 +00:00
Nima Karimi	068dca3366	Tests: apply suite timeout in node bridge test	2026-01-16 01:56:23 +00:00
Nima Karimi	336a1ad9cf	Tests: extend node bridge server timeout	2026-01-16 01:56:23 +00:00
Nima Karimi	d42f767d0c	SwiftFormat: format macOS sources	2026-01-16 01:56:23 +00:00
Nima Karimi	9b8ae62399	macOS: prefer bridge tunnel port in remote mode	2026-01-16 01:56:06 +00:00
Gustavo Madeira Santana	7c38b535f6	Document inline buttons configuration for Telegram (#984 )	2026-01-15 19:55:03 -06:00
Peter Steinberger	af370ab23e	fix: align config types after upstream changes	2026-01-16 01:49:07 +00:00
Peter Steinberger	1210657fda	chore: bump Peekaboo submodule	2026-01-16 01:44:12 +00:00
Peter Steinberger	12afec953f	test: stabilize sandbox config tests	2026-01-16 01:44:12 +00:00
Peter Steinberger	8e2707e232	fix: cleanup suspended CLI processes (#978 ) (thanks @Nachx639)	2026-01-16 01:39:33 +00:00
Tu Nombre RealandClaude Opus 4.5	8befe7f8a7	fix: cleanup suspended Clawdbot CLI processes Add cleanupSuspendedCliProcesses() to kill accumulated suspended processes from isolated sessions that don't share sessionIds (e.g., cron jobs). - Only targets Clawdbot processes (--session-id pattern) - Only kills suspended processes (state T) - Only triggers when >10 processes accumulated - Does not affect user's Claude Code sessions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-16 01:38:03 +00:00
Peter Steinberger	a70fcc8ae0	chore(cli): set process title	2026-01-16 01:33:28 +00:00
Peter Steinberger	fa521154ff	fix: show disabled channels in onboarding picker	2026-01-16 01:29:25 +00:00
Peter Steinberger	dffc1a4dcd	fix: switch channel onboarding to single-select loop	2026-01-16 01:21:17 +00:00
Peter Steinberger	61e385b331	feat: add per-agent heartbeat config	2026-01-16 01:17:34 +00:00
Peter Steinberger	f8f319713f	fix: show provider/model labels in TUI	2026-01-16 01:13:14 +00:00
Peter Steinberger	bb665bf22c	fix: persist local gateway mode in configure wizard	2026-01-16 01:05:55 +00:00
Peter Steinberger	f17dcb6213	fix: refine channel onboarding selection flow	2026-01-16 01:05:50 +00:00
Peter Steinberger	d54c101100	docs: update release checklist	2026-01-16 00:42:48 +00:00
Peter Steinberger	96daa51d45	docs: document provider auth plugins	2026-01-16 00:42:48 +00:00
Peter Steinberger	6084421ec6	feat: add provider auth plugins	2026-01-16 00:42:28 +00:00
Peter Steinberger	bca5c0d569	refactor: system prompt sections + docs/tests	2026-01-16 00:28:43 +00:00
Peter Steinberger	8c3cdba21c	feat: sticky auth profile rotation + usage headers	2026-01-16 00:25:49 +00:00
voidandvoid	e274b5a040	fix: heartbeat prompt + dedupe (#980 ) (thanks @voidserf) - tighten default heartbeat prompt guidance - suppress duplicate heartbeat alerts within 24h Co-authored-by: void <voidserf@users.noreply.github.com>	2026-01-16 00:24:52 +00:00
Josh Lehman	a139d35fa2	feat(slack): add userToken for read-only access to DMs and private channels (#981 ) - Add userToken and userTokenReadOnly (default: true) config fields - Implement token routing: reads prefer user token, writes use bot token - Add tests for token routing logic - Update documentation with required OAuth scopes User tokens enable reading DMs and private channels without requiring bot membership. The userTokenReadOnly flag (true by default) ensures the user token can only be used for reads, preventing accidental sends as the user. Required user token scopes: - channels:history, channels:read - groups:history, groups:read - im:history, im:read - mpim:history, mpim:read - users:read, reactions:read, pins:read, emoji:read, search:read	2026-01-16 00:11:33 +00:00
Peter Steinberger	8312a19f02	fix: handle Telegram General topic thread params (#848 ) (thanks @azade-c)	2026-01-16 00:08:56 +00:00
Peter Steinberger	fe8b28cdd9	Merge pull request #848 from azade-c/fix/telegram-general-topic-messages fix(telegram): skip message_thread_id for General topic messages	2026-01-16 00:08:07 +00:00
Peter SteinbergerandTyler Yust	10eb1beccf	fix: tighten session entry updates Co-authored-by: Tyler Yust <tyler6204@users.noreply.github.com>	2026-01-15 23:44:32 +00:00
Peter SteinbergerandTyler Yust	a4b347b454	feat: refine subagents + add chat.inject Co-authored-by: Tyler Yust <tyler6204@users.noreply.github.com>	2026-01-15 23:44:31 +00:00
Peter SteinbergerandTyler Yust	688a0ce439	refactor: harden session store updates Co-authored-by: Tyler Yust <tyler6204@users.noreply.github.com>	2026-01-15 23:41:34 +00:00
Azade	6146acbb69	fix(telegram): separate thread params for typing vs messages Telegram General topic (id=1) has inconsistent API behavior: - sendMessage: rejects explicit message_thread_id=1 - sendChatAction: requires message_thread_id=1 for typing to show Split into two helper functions: - buildTelegramThreadParams: excludes General topic for messages - buildTypingThreadParams: includes General topic for typing	2026-01-15 23:32:30 +00:00
Peter Steinberger	35492f8513	docs: add inbound debounce config example	2026-01-15 23:20:14 +00:00
Peter Steinberger	db9be87d94	refactor: centralize daemon path resolution	2026-01-15 23:19:52 +00:00
juanpablodlcandPeter Steinberger	4a99b9b651	feat(whatsapp): add debounceMs for batching rapid messages (#971 ) * feat(whatsapp): add debounceMs for batching rapid messages Add a `debounceMs` configuration option to WhatsApp channel settings that batches rapid consecutive messages from the same sender into a single response. This prevents triggering separate agent runs for each message when a user sends multiple short messages in quick succession (e.g., "Hey!", "how are you?", "I was wondering..."). Changes: - Add `debounceMs` config to WhatsAppConfig and WhatsAppAccountConfig - Implement message buffering in `monitorWebInbox` with: - Map-based buffer keyed by sender (DM) or chat ID (groups) - Debounce timer that resets on each new message - Message combination with newline separator - Single message optimization (no modification if only one message) - Wire `debounceMs` through account resolution and monitor tuning - Add UI hints and schema documentation Usage example: { "channels": { "whatsapp": { "debounceMs": 5000 // 5 second window } } } Default behavior: `debounceMs: 0` (disabled by default) Verified: All existing tests pass (3204 tests), TypeScript compilation succeeds with no errors. Implemented with assistance from AI coding tools. Closes #967 * chore: wip inbound debounce * fix: debounce inbound messages across channels (#971) (thanks @juanpablodlc) --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>	2026-01-15 23:07:19 +00:00
Peter Steinberger	7dea403302	chore: purge DS_Store files	2026-01-15 22:59:16 +00:00
Peter Steinberger	10731dfee3	docs: add sync up shorthand	2026-01-15 22:58:34 +00:00
Peter Steinberger	d00f2d9c0c	test: cover model picker ordering and openrouter index	2026-01-15 22:56:11 +00:00
Peter Steinberger	8b89980a89	feat(date-time): standardize time context and tool timestamps	2026-01-15 22:27:06 +00:00
Jake Keith the Silly Goose Peter Steinberger	634a429c50	fix(model-picker): list each provider/model combo separately (#970 ) * fix(model-picker): list each provider/model combo separately Previously, /model grouped models by name and showed all providers that offer the same model (e.g. 'claude-sonnet-4-5 — anthropic, google-antigravity'). This was confusing because: 1. Users couldn't tell which provider would be used when selecting by number 2. The display implied choice between providers but selection was automatic Now each provider/model combination is listed separately so users can explicitly select the exact provider they want. - Remove model grouping in buildModelPickerItems - Display format changed from 'model — providers' to 'provider/model' - pickProviderForModel now returns the single provider directly - Updated tests to reflect new behavior * fix: simplify model picker entries (#970) (thanks @mcinteerj) --------- Co-authored-by: Keith the Silly Goose <keith@42bolton.macnet.nz> Co-authored-by: Peter Steinberger <steipete@gmail.com>	2026-01-15 22:20:11 +00:00
Peter Steinberger	bf90815b9e	Merge pull request #969 from bjesuiter/fix/launchd-label-resolution fix: unify daemon service label resolution with env parameter	2026-01-15 22:12:12 +00:00
Peter Steinberger	2b113c4d6c	chore: update changelog (#969 ) (thanks @bjesuiter)	2026-01-15 22:10:27 +00:00
Benjamin Jesuiter	7f6a288bd3	docs: clarify multi-gateway rescue bot guidance	2026-01-15 22:10:27 +00:00
Benjamin Jesuiter	daf471c450	fix: unify daemon service label resolution with env	2026-01-15 22:10:27 +00:00
Peter Steinberger	cb78fa46a1	fix: make node-llama-cpp optional	2026-01-15 18:37:02 +00:00
Shadow	316e8b2eb2	Discord: fix allowlist gating. Closes #961	2026-01-15 11:53:13 -06:00
Peter Steinberger	4de81ed6c4	docs(changelog): move browser relay fixes to 2026.1.15	2026-01-15 17:26:54 +00:00
Peter Steinberger	b6fb24f6d2	Merge pull request #964 from bohdanpodvirnyi/feat/telegram-reactions feat(telegram): add bidirectional emoji reactions support	2026-01-15 17:21:51 +00:00
Peter Steinberger	2b1c26f900	fix: refine telegram reactions (#964 ) (thanks @bohdanpodvirnyi)	2026-01-15 17:20:17 +00:00
Peter Steinberger	47ea9356d1	Merge pull request #959 from rdev/rdev/finally-fix-antigravity-claude Fix antigravity claude	2026-01-15 17:10:04 +00:00
Bohdan Podvirnyi	f12c1b391f	fix: lint errors	2026-01-15 17:08:31 +00:00
Peter Steinberger	05658b6609	fix: tighten command arg value types	2026-01-15 17:08:09 +00:00
Bohdan Podvirnyi	dfb6630de1	fix: remove dup definitions + add reaction config	2026-01-15 17:07:38 +00:00
Bohdan Podvirnyi	eb7656d68c	fix: lint errors	2026-01-15 17:07:38 +00:00
Bohdan Podvirnyi	0e1dcf9cb4	feat: added capability for clawdbot to react	2026-01-15 17:07:38 +00:00
Bohdan Podvirnyi	d05c3d0659	feat: make telegram reactions visible to clawdbot	2026-01-15 17:07:38 +00:00
Peter Steinberger	36292d3fbb	fix: preserve Antigravity Claude signatures (#959 ) (thanks @rdev)	2026-01-15 17:06:39 +00:00
Max	1ae344d8a6	Fix antigravity claude	2026-01-15 17:06:39 +00:00
Peter Steinberger	01c43b0b0c	fix: avoid base string coercion in auto-reply formatting	2026-01-15 17:03:34 +00:00
Peter Steinberger	fc4aa9a683	Merge pull request #954 from roshanasingh4/fix/946-openai-completions-trim Fix model fallback crash on undefined provider/model (#946)	2026-01-15 16:59:19 +00:00
Peter Steinberger	c043e9767f	fix: default model fallback when provider/model missing (#954 ) (thanks @roshanasingh4)	2026-01-15 16:58:41 +00:00
Peter Steinberger	8b48299d8f	Merge pull request #953 from roshanasingh4/fix/cli-quick-reference-system-prompt Fix system prompt: prevent invented CLI commands	2026-01-15 16:55:52 +00:00
Roshan Singh	0f27cff247	Fix model fallback crash on undefined provider/model (#946 )	2026-01-15 16:50:46 +00:00
Roshan Singh	d0455f2683	fix(system-prompt): add CLI quick reference to prevent invented commands	2026-01-15 11:43:22 +00:00