fix: gate tool-error fallback replies (#1175 ) (thanks @vrknetha)

Agents: surface tool failures without assistant output
2026-01-18 14:07:34 +00:00 · 2026-01-18 14:03:08 +00:00
269 changed files with 3318 additions and 10942 deletions
@@ -1,6 +1,6 @@
 # Repository Guidelines
 - Repo: https://github.com/clawdbot/clawdbot
- GitHub issues/comments/PR comments: use literal multiline strings or `-F - <<'EOF'` (or $'...') for real newlines; never embed "\\n".
+- GitHub issues: use literal multiline strings or $'...' for newlines; avoid "\\n" escapes in `gh issue create/edit`.
 ## Project Structure & Module Organization
 - Source code: `src/` (CLI wiring in `src/cli`, commands in `src/commands`, web provider in `src/provider-web.ts`, infra in `src/infra`, media pipeline in `src/media`).
@@ -84,7 +84,6 @@
 - When answering questions, respond with high-confidence answers only: verify in code; do not guess.
 - Never update the Carbon dependency.
 - Any dependency with `pnpm.patchedDependencies` must use an exact version (no `^`/`~`).
 - Patching dependencies (pnpm patches, overrides, or vendored changes) requires explicit approval; do not do this by default.
 - CLI progress: use `src/cli/progress.ts` (`osc-progress` + `@clack/prompts` spinner); don’t hand-roll spinners/bars.
 - Status output: keep tables + ANSI-safe wrapping (`src/terminal/table.ts`); `status --all` = read-only/pasteable, `status --deep` = probes.
 - Gateway currently runs only as the menubar app; there is no separate LaunchAgent/helper label installed. Restart via the Clawdbot Mac app or `scripts/restart-mac.sh`; to verify/kill use `launchctl print gui/$UID | grep clawdbot` rather than assuming a fixed label. **When debugging on macOS, start/stop the gateway via the app, not ad-hoc tmux sessions; kill any temporary tunnels before handoff.**
@@ -2,18 +2,6 @@
 Docs: https://docs.clawd.bot
 ## 2026.1.18-5
 ### Changes
 - Dependencies: update core + plugin deps (grammy, vitest, openai, Microsoft agents hosting, etc.).
 - Agents: make inbound message envelopes configurable (timezone/timestamp/elapsed) and surface elapsed gaps. (#1150) — thanks @shiv19.
 ### Fixes
 - Configure: hide OpenRouter auto routing model from the model picker. (#1182) — thanks @zerone0x.
 - Agents: retry compaction reset once, then surface a user-facing error on repeat failure. (#1187) — thanks @fayrose.
 - macOS: load menu session previews asynchronously so items populate while the menu is open.
 - macOS: use label colors for session preview text so previews render in menu subviews.
 ## 2026.1.18-4
 ### Changes
@@ -22,20 +10,14 @@ Docs: https://docs.clawd.bot
 - Swabble: use the tagged Commander Swift package release.
 - CLI: add `clawdbot acp client` interactive ACP harness for debugging.
 - Plugins: route command detection/text chunking helpers through the plugin runtime and drop runtime exports from the SDK.
- Plugins: auto-enable bundled channel/provider plugins when configuration is present.
+- Memory: add native Gemini embeddings provider for memory search. (#1151) — thanks @gumadeiras.
 - Config: stamp last-touched metadata on write and warn if the config is newer than the running build.
 - macOS: hide usage section when usage is unavailable instead of showing provider errors.
 - Memory: add native Gemini embeddings provider for memory search. (#1151)
 - Agents: add local docs path resolution and include docs/mirror/source/community pointers in the system prompt.
 - Slack: add HTTP webhook mode via Bolt HTTP receiver for Events API deployments. (#1143) — thanks @jdrhyne.
 ### Fixes
 - Auth profiles: keep auto-pinned preference while allowing rotation on failover; user pins stay locked. (#1138) — thanks @cheeeee.
 - Agents: sanitize oversized image payloads before send and surface image-dimension errors.
 - macOS: Doctor repairs LaunchAgent bootstrap issues for Gateway + Node when listed but not loaded. (#1166) — thanks @AlexMikhalev.
 - macOS: avoid touching launchd in Remote over SSH so quitting the app no longer disables the remote gateway. (#1105)
- Memory: index atomically so failed reindex preserves the previous memory database. (#1151)
+- Memory: index atomically so failed reindex preserves the previous memory database. (#1151) — thanks @gumadeiras.
- Memory: avoid sqlite-vec unique constraint failures when reindexing duplicate chunk ids. (#1151)
+- Memory: avoid sqlite-vec unique constraint failures when reindexing duplicate chunk ids. (#1151) — thanks @gumadeiras.
 - Agents: surface tool failures when no assistant output is emitted. (#1175) — thanks @vrknetha.
 ## 2026.1.18-3
@@ -53,14 +35,6 @@ Docs: https://docs.clawd.bot
 - Docs: refresh exec/elevated/exec-approvals docs for the new flow. https://docs.clawd.bot/tools/exec-approvals
 - Docs: add node host CLI + update exec approvals/bridge protocol docs. https://docs.clawd.bot/cli/node
 - ACP: add experimental ACP support for IDE integrations (`clawdbot acp`). Thanks @visionik.
 - Tools: allow `sessions_spawn` to override thinking level for sub-agent runs.
 - Channels: unify thread/topic allowlist matching + command/mention gating helpers across core providers.
 - Models: add Qwen Portal OAuth provider support. (#1120) — thanks @mukhtharcm.
 - Memory: add `--verbose` logging for memory status + batch indexing details.
 - Memory: allow parallel OpenAI batch indexing jobs (default concurrency: 2).
 - macOS: add per-agent exec approvals with allowlists, skill CLI auto-allow, and settings UI.
 - Docs: add exec approvals guide and link from tools index. https://docs.clawd.bot/tools/exec-approvals
 - macOS: add exec-host IPC for node service `system.run` with HMAC + peer UID checks.
 ### Fixes
 - Exec approvals: enforce allowlist when ask is off; prefer raw command for node approvals/events.
@@ -73,23 +47,6 @@ Docs: https://docs.clawd.bot
 ### Fixes
 - Tests: stabilize plugin SDK resolution and embedded agent timeouts.
 ## 2026.1.18-1
 ### Changes
 - Tools: allow `sessions_spawn` to override thinking level for sub-agent runs.
 - Channels: unify thread/topic allowlist matching + command/mention gating helpers across core providers.
 - Models: add Qwen Portal OAuth provider support. (#1120) — thanks @mukhtharcm.
 - Memory: add `--verbose` logging for memory status + batch indexing details.
 - Memory: allow parallel OpenAI batch indexing jobs (default concurrency: 2).
 - macOS: add per-agent exec approvals with allowlists, skill CLI auto-allow, and settings UI.
 - Docs: add exec approvals guide and link from tools index. https://docs.clawd.bot/tools/exec-approvals
 ### Fixes
 - Memory: apply OpenAI batch defaults even without explicit remote config.
 - macOS: bundle Textual resources in packaged app builds to avoid code block crashes. (#1006)
 - Tools: return a companion-app-required message when `system.run` is requested without a supporting node.
 - Discord: only emit slow listener warnings after 30s.
 ## 2026.1.17-6
 ### Changes
@@ -474,25 +474,25 @@ Core contributors:
 Thanks to all clawtributors:
 <p align="left">
-  <a href="https://github.com/steipete"><img src="https://avatars.githubusercontent.com/u/58493?v=4&s=48" width="48" height="48" alt="steipete" title="steipete"/></a> <a href="https://github.com/bohdanpodvirnyi"><img src="https://avatars.githubusercontent.com/u/31819391?v=4&s=48" width="48" height="48" alt="bohdanpodvirnyi" title="bohdanpodvirnyi"/></a> <a href="https://github.com/joaohlisboa"><img src="https://avatars.githubusercontent.com/u/8200873?v=4&s=48" width="48" height="48" alt="joaohlisboa" title="joaohlisboa"/></a> <a href="https://github.com/mneves75"><img src="https://avatars.githubusercontent.com/u/2423436?v=4&s=48" width="48" height="48" alt="mneves75" title="mneves75"/></a> <a href="https://github.com/MatthieuBizien"><img src="https://avatars.githubusercontent.com/u/173090?v=4&s=48" width="48" height="48" alt="MatthieuBizien" title="MatthieuBizien"/></a> <a href="https://github.com/rahthakor"><img src="https://avatars.githubusercontent.com/u/8470553?v=4&s=48" width="48" height="48" alt="rahthakor" title="rahthakor"/></a> <a href="https://github.com/vrknetha"><img src="https://avatars.githubusercontent.com/u/20596261?v=4&s=48" width="48" height="48" alt="vrknetha" title="vrknetha"/></a> <a href="https://github.com/radek-paclt"><img src="https://avatars.githubusercontent.com/u/50451445?v=4&s=48" width="48" height="48" alt="radek-paclt" title="radek-paclt"/></a> <a href="https://github.com/joshp123"><img src="https://avatars.githubusercontent.com/u/1497361?v=4&s=48" width="48" height="48" alt="joshp123" title="joshp123"/></a> <a href="https://github.com/mukhtharcm"><img src="https://avatars.githubusercontent.com/u/56378562?v=4&s=48" width="48" height="48" alt="mukhtharcm" title="mukhtharcm"/></a>
+  <a href="https://github.com/steipete"><img src="https://avatars.githubusercontent.com/u/58493?v=4&s=48" width="48" height="48" alt="steipete" title="steipete"/></a> <a href="https://github.com/bohdanpodvirnyi"><img src="https://avatars.githubusercontent.com/u/31819391?v=4&s=48" width="48" height="48" alt="bohdanpodvirnyi" title="bohdanpodvirnyi"/></a> <a href="https://github.com/joaohlisboa"><img src="https://avatars.githubusercontent.com/u/8200873?v=4&s=48" width="48" height="48" alt="joaohlisboa" title="joaohlisboa"/></a> <a href="https://github.com/mneves75"><img src="https://avatars.githubusercontent.com/u/2423436?v=4&s=48" width="48" height="48" alt="mneves75" title="mneves75"/></a> <a href="https://github.com/MatthieuBizien"><img src="https://avatars.githubusercontent.com/u/173090?v=4&s=48" width="48" height="48" alt="MatthieuBizien" title="MatthieuBizien"/></a> <a href="https://github.com/rahthakor"><img src="https://avatars.githubusercontent.com/u/8470553?v=4&s=48" width="48" height="48" alt="rahthakor" title="rahthakor"/></a> <a href="https://github.com/vrknetha"><img src="https://avatars.githubusercontent.com/u/20596261?v=4&s=48" width="48" height="48" alt="vrknetha" title="vrknetha"/></a> <a href="https://github.com/joshp123"><img src="https://avatars.githubusercontent.com/u/1497361?v=4&s=48" width="48" height="48" alt="joshp123" title="joshp123"/></a> <a href="https://github.com/mukhtharcm"><img src="https://avatars.githubusercontent.com/u/56378562?v=4&s=48" width="48" height="48" alt="mukhtharcm" title="mukhtharcm"/></a> <a href="https://github.com/maxsumrall"><img src="https://avatars.githubusercontent.com/u/628843?v=4&s=48" width="48" height="48" alt="maxsumrall" title="maxsumrall"/></a>
-  <a href="https://github.com/maxsumrall"><img src="https://avatars.githubusercontent.com/u/628843?v=4&s=48" width="48" height="48" alt="maxsumrall" title="maxsumrall"/></a> <a href="https://github.com/xadenryan"><img src="https://avatars.githubusercontent.com/u/165437834?v=4&s=48" width="48" height="48" alt="xadenryan" title="xadenryan"/></a> <a href="https://github.com/tobiasbischoff"><img src="https://avatars.githubusercontent.com/u/711564?v=4&s=48" width="48" height="48" alt="Tobias Bischoff" title="Tobias Bischoff"/></a> <a href="https://github.com/juanpablodlc"><img src="https://avatars.githubusercontent.com/u/92012363?v=4&s=48" width="48" height="48" alt="juanpablodlc" title="juanpablodlc"/></a> <a href="https://github.com/hsrvc"><img src="https://avatars.githubusercontent.com/u/129702169?v=4&s=48" width="48" height="48" alt="hsrvc" title="hsrvc"/></a> <a href="https://github.com/magimetal"><img src="https://avatars.githubusercontent.com/u/36491250?v=4&s=48" width="48" height="48" alt="magimetal" title="magimetal"/></a> <a href="https://github.com/meaningfool"><img src="https://avatars.githubusercontent.com/u/2862331?v=4&s=48" width="48" height="48" alt="meaningfool" title="meaningfool"/></a> <a href="https://github.com/NicholasSpisak"><img src="https://avatars.githubusercontent.com/u/129075147?v=4&s=48" width="48" height="48" alt="NicholasSpisak" title="NicholasSpisak"/></a> <a href="https://github.com/AbhisekBasu1"><img src="https://avatars.githubusercontent.com/u/40645221?v=4&s=48" width="48" height="48" alt="abhisekbasu1" title="abhisekbasu1"/></a> <a href="https://github.com/claude"><img src="https://avatars.githubusercontent.com/u/81847?v=4&s=48" width="48" height="48" alt="claude" title="claude"/></a>
+  <a href="https://github.com/xadenryan"><img src="https://avatars.githubusercontent.com/u/165437834?v=4&s=48" width="48" height="48" alt="xadenryan" title="xadenryan"/></a> <a href="https://github.com/tobiasbischoff"><img src="https://avatars.githubusercontent.com/u/711564?v=4&s=48" width="48" height="48" alt="Tobias Bischoff" title="Tobias Bischoff"/></a> <a href="https://github.com/juanpablodlc"><img src="https://avatars.githubusercontent.com/u/92012363?v=4&s=48" width="48" height="48" alt="juanpablodlc" title="juanpablodlc"/></a> <a href="https://github.com/hsrvc"><img src="https://avatars.githubusercontent.com/u/129702169?v=4&s=48" width="48" height="48" alt="hsrvc" title="hsrvc"/></a> <a href="https://github.com/magimetal"><img src="https://avatars.githubusercontent.com/u/36491250?v=4&s=48" width="48" height="48" alt="magimetal" title="magimetal"/></a> <a href="https://github.com/meaningfool"><img src="https://avatars.githubusercontent.com/u/2862331?v=4&s=48" width="48" height="48" alt="meaningfool" title="meaningfool"/></a> <a href="https://github.com/NicholasSpisak"><img src="https://avatars.githubusercontent.com/u/129075147?v=4&s=48" width="48" height="48" alt="NicholasSpisak" title="NicholasSpisak"/></a> <a href="https://github.com/AbhisekBasu1"><img src="https://avatars.githubusercontent.com/u/40645221?v=4&s=48" width="48" height="48" alt="abhisekbasu1" title="abhisekbasu1"/></a> <a href="https://github.com/claude"><img src="https://avatars.githubusercontent.com/u/81847?v=4&s=48" width="48" height="48" alt="claude" title="claude"/></a> <a href="https://github.com/jamesgroat"><img src="https://avatars.githubusercontent.com/u/2634024?v=4&s=48" width="48" height="48" alt="jamesgroat" title="jamesgroat"/></a>
-  <a href="https://github.com/jamesgroat"><img src="https://avatars.githubusercontent.com/u/2634024?v=4&s=48" width="48" height="48" alt="jamesgroat" title="jamesgroat"/></a> <a href="https://github.com/sebslight"><img src="https://avatars.githubusercontent.com/u/19554889?v=4&s=48" width="48" height="48" alt="sebslight" title="sebslight"/></a> <a href="https://github.com/Hyaxia"><img src="https://avatars.githubusercontent.com/u/36747317?v=4&s=48" width="48" height="48" alt="Hyaxia" title="Hyaxia"/></a> <a href="https://github.com/dantelex"><img src="https://avatars.githubusercontent.com/u/631543?v=4&s=48" width="48" height="48" alt="dantelex" title="dantelex"/></a> <a href="https://github.com/daveonkels"><img src="https://avatars.githubusercontent.com/u/533642?v=4&s=48" width="48" height="48" alt="daveonkels" title="daveonkels"/></a> <a href="https://github.com/mteam88"><img src="https://avatars.githubusercontent.com/u/84196639?v=4&s=48" width="48" height="48" alt="mteam88" title="mteam88"/></a> <a href="https://github.com/omniwired"><img src="https://avatars.githubusercontent.com/u/322761?v=4&s=48" width="48" height="48" alt="Eng. Juan Combetto" title="Eng. Juan Combetto"/></a> <a href="https://github.com/dbhurley"><img src="https://avatars.githubusercontent.com/u/5251425?v=4&s=48" width="48" height="48" alt="dbhurley" title="dbhurley"/></a> <a href="https://github.com/mbelinky"><img src="https://avatars.githubusercontent.com/u/132747814?v=4&s=48" width="48" height="48" alt="Mariano Belinky" title="Mariano Belinky"/></a> <a href="https://github.com/TSavo"><img src="https://avatars.githubusercontent.com/u/877990?v=4&s=48" width="48" height="48" alt="TSavo" title="TSavo"/></a>
+  <a href="https://github.com/Hyaxia"><img src="https://avatars.githubusercontent.com/u/36747317?v=4&s=48" width="48" height="48" alt="Hyaxia" title="Hyaxia"/></a> <a href="https://github.com/dantelex"><img src="https://avatars.githubusercontent.com/u/631543?v=4&s=48" width="48" height="48" alt="dantelex" title="dantelex"/></a> <a href="https://github.com/daveonkels"><img src="https://avatars.githubusercontent.com/u/533642?v=4&s=48" width="48" height="48" alt="daveonkels" title="daveonkels"/></a> <a href="https://github.com/radek-paclt"><img src="https://avatars.githubusercontent.com/u/50451445?v=4&s=48" width="48" height="48" alt="radek-paclt" title="radek-paclt"/></a> <a href="https://github.com/mteam88"><img src="https://avatars.githubusercontent.com/u/84196639?v=4&s=48" width="48" height="48" alt="mteam88" title="mteam88"/></a> <a href="https://github.com/omniwired"><img src="https://avatars.githubusercontent.com/u/322761?v=4&s=48" width="48" height="48" alt="Eng. Juan Combetto" title="Eng. Juan Combetto"/></a> <a href="https://github.com/dbhurley"><img src="https://avatars.githubusercontent.com/u/5251425?v=4&s=48" width="48" height="48" alt="dbhurley" title="dbhurley"/></a> <a href="https://github.com/mbelinky"><img src="https://avatars.githubusercontent.com/u/132747814?v=4&s=48" width="48" height="48" alt="Mariano Belinky" title="Mariano Belinky"/></a> <a href="https://github.com/julianengel"><img src="https://avatars.githubusercontent.com/u/10634231?v=4&s=48" width="48" height="48" alt="julianengel" title="julianengel"/></a> <a href="https://github.com/benithors"><img src="https://avatars.githubusercontent.com/u/20652882?v=4&s=48" width="48" height="48" alt="benithors" title="benithors"/></a>
-  <a href="https://github.com/julianengel"><img src="https://avatars.githubusercontent.com/u/10634231?v=4&s=48" width="48" height="48" alt="julianengel" title="julianengel"/></a> <a href="https://github.com/benithors"><img src="https://avatars.githubusercontent.com/u/20652882?v=4&s=48" width="48" height="48" alt="benithors" title="benithors"/></a> <a href="https://github.com/timolins"><img src="https://avatars.githubusercontent.com/u/1440854?v=4&s=48" width="48" height="48" alt="timolins" title="timolins"/></a> <a href="https://github.com/Nachx639"><img src="https://avatars.githubusercontent.com/u/71144023?v=4&s=48" width="48" height="48" alt="nachx639" title="nachx639"/></a> <a href="https://github.com/sreekaransrinath"><img src="https://avatars.githubusercontent.com/u/50989977?v=4&s=48" width="48" height="48" alt="sreekaransrinath" title="sreekaransrinath"/></a> <a href="https://github.com/gupsammy"><img src="https://avatars.githubusercontent.com/u/20296019?v=4&s=48" width="48" height="48" alt="gupsammy" title="gupsammy"/></a> <a href="https://github.com/cristip73"><img src="https://avatars.githubusercontent.com/u/24499421?v=4&s=48" width="48" height="48" alt="cristip73" title="cristip73"/></a> <a href="https://github.com/nachoiacovino"><img src="https://avatars.githubusercontent.com/u/50103937?v=4&s=48" width="48" height="48" alt="nachoiacovino" title="nachoiacovino"/></a> <a href="https://github.com/vsabavat"><img src="https://avatars.githubusercontent.com/u/50385532?v=4&s=48" width="48" height="48" alt="Vasanth Rao Naik Sabavat" title="Vasanth Rao Naik Sabavat"/></a> <a href="https://github.com/cpojer"><img src="https://avatars.githubusercontent.com/u/13352?v=4&s=48" width="48" height="48" alt="cpojer" title="cpojer"/></a>
+  <a href="https://github.com/timolins"><img src="https://avatars.githubusercontent.com/u/1440854?v=4&s=48" width="48" height="48" alt="timolins" title="timolins"/></a> <a href="https://github.com/Nachx639"><img src="https://avatars.githubusercontent.com/u/71144023?v=4&s=48" width="48" height="48" alt="nachx639" title="nachx639"/></a> <a href="https://github.com/sreekaransrinath"><img src="https://avatars.githubusercontent.com/u/50989977?v=4&s=48" width="48" height="48" alt="sreekaransrinath" title="sreekaransrinath"/></a> <a href="https://github.com/gupsammy"><img src="https://avatars.githubusercontent.com/u/20296019?v=4&s=48" width="48" height="48" alt="gupsammy" title="gupsammy"/></a> <a href="https://github.com/cristip73"><img src="https://avatars.githubusercontent.com/u/24499421?v=4&s=48" width="48" height="48" alt="cristip73" title="cristip73"/></a> <a href="https://github.com/nachoiacovino"><img src="https://avatars.githubusercontent.com/u/50103937?v=4&s=48" width="48" height="48" alt="nachoiacovino" title="nachoiacovino"/></a> <a href="https://github.com/vsabavat"><img src="https://avatars.githubusercontent.com/u/50385532?v=4&s=48" width="48" height="48" alt="Vasanth Rao Naik Sabavat" title="Vasanth Rao Naik Sabavat"/></a> <a href="https://github.com/cpojer"><img src="https://avatars.githubusercontent.com/u/13352?v=4&s=48" width="48" height="48" alt="cpojer" title="cpojer"/></a> <a href="https://github.com/lc0rp"><img src="https://avatars.githubusercontent.com/u/2609441?v=4&s=48" width="48" height="48" alt="lc0rp" title="lc0rp"/></a> <a href="https://github.com/scald"><img src="https://avatars.githubusercontent.com/u/1215913?v=4&s=48" width="48" height="48" alt="scald" title="scald"/></a>
-  <a href="https://github.com/lc0rp"><img src="https://avatars.githubusercontent.com/u/2609441?v=4&s=48" width="48" height="48" alt="lc0rp" title="lc0rp"/></a> <a href="https://github.com/scald"><img src="https://avatars.githubusercontent.com/u/1215913?v=4&s=48" width="48" height="48" alt="scald" title="scald"/></a> <a href="https://github.com/andranik-sahakyan"><img src="https://avatars.githubusercontent.com/u/8908029?v=4&s=48" width="48" height="48" alt="andranik-sahakyan" title="andranik-sahakyan"/></a> <a href="https://github.com/davidguttman"><img src="https://avatars.githubusercontent.com/u/431696?v=4&s=48" width="48" height="48" alt="davidguttman" title="davidguttman"/></a> <a href="https://github.com/sleontenko"><img src="https://avatars.githubusercontent.com/u/7135949?v=4&s=48" width="48" height="48" alt="sleontenko" title="sleontenko"/></a> <a href="https://github.com/sircrumpet"><img src="https://avatars.githubusercontent.com/u/4436535?v=4&s=48" width="48" height="48" alt="sircrumpet" title="sircrumpet"/></a> <a href="https://github.com/peschee"><img src="https://avatars.githubusercontent.com/u/63866?v=4&s=48" width="48" height="48" alt="peschee" title="peschee"/></a> <a href="https://github.com/rafaelreis-r"><img src="https://avatars.githubusercontent.com/u/57492577?v=4&s=48" width="48" height="48" alt="rafaelreis-r" title="rafaelreis-r"/></a> <a href="https://github.com/thewilloftheshadow"><img src="https://avatars.githubusercontent.com/u/35580099?v=4&s=48" width="48" height="48" alt="thewilloftheshadow" title="thewilloftheshadow"/></a> <a href="https://github.com/ratulsarna"><img src="https://avatars.githubusercontent.com/u/105903728?v=4&s=48" width="48" height="48" alt="ratulsarna" title="ratulsarna"/></a>
+  <a href="https://github.com/andranik-sahakyan"><img src="https://avatars.githubusercontent.com/u/8908029?v=4&s=48" width="48" height="48" alt="andranik-sahakyan" title="andranik-sahakyan"/></a> <a href="https://github.com/davidguttman"><img src="https://avatars.githubusercontent.com/u/431696?v=4&s=48" width="48" height="48" alt="davidguttman" title="davidguttman"/></a> <a href="https://github.com/sleontenko"><img src="https://avatars.githubusercontent.com/u/7135949?v=4&s=48" width="48" height="48" alt="sleontenko" title="sleontenko"/></a> <a href="https://github.com/sircrumpet"><img src="https://avatars.githubusercontent.com/u/4436535?v=4&s=48" width="48" height="48" alt="sircrumpet" title="sircrumpet"/></a> <a href="https://github.com/peschee"><img src="https://avatars.githubusercontent.com/u/63866?v=4&s=48" width="48" height="48" alt="peschee" title="peschee"/></a> <a href="https://github.com/rafaelreis-r"><img src="https://avatars.githubusercontent.com/u/57492577?v=4&s=48" width="48" height="48" alt="rafaelreis-r" title="rafaelreis-r"/></a> <a href="https://github.com/ratulsarna"><img src="https://avatars.githubusercontent.com/u/105903728?v=4&s=48" width="48" height="48" alt="ratulsarna" title="ratulsarna"/></a> <a href="https://github.com/thewilloftheshadow"><img src="https://avatars.githubusercontent.com/u/35580099?v=4&s=48" width="48" height="48" alt="thewilloftheshadow" title="thewilloftheshadow"/></a> <a href="https://github.com/lutr0"><img src="https://avatars.githubusercontent.com/u/76906369?v=4&s=48" width="48" height="48" alt="lutr0" title="lutr0"/></a> <a href="https://github.com/danielz1z"><img src="https://avatars.githubusercontent.com/u/235270390?v=4&s=48" width="48" height="48" alt="danielz1z" title="danielz1z"/></a>
-  <a href="https://github.com/lutr0"><img src="https://avatars.githubusercontent.com/u/76906369?v=4&s=48" width="48" height="48" alt="lutr0" title="lutr0"/></a> <a href="https://github.com/danielz1z"><img src="https://avatars.githubusercontent.com/u/235270390?v=4&s=48" width="48" height="48" alt="danielz1z" title="danielz1z"/></a> <a href="https://github.com/gumadeiras"><img src="https://avatars.githubusercontent.com/u/5599352?v=4&s=48" width="48" height="48" alt="gumadeiras" title="gumadeiras"/></a> <a href="https://github.com/emanuelst"><img src="https://avatars.githubusercontent.com/u/9994339?v=4&s=48" width="48" height="48" alt="emanuelst" title="emanuelst"/></a> <a href="https://github.com/KristijanJovanovski"><img src="https://avatars.githubusercontent.com/u/8942284?v=4&s=48" width="48" height="48" alt="KristijanJovanovski" title="KristijanJovanovski"/></a> <a href="https://github.com/CashWilliams"><img src="https://avatars.githubusercontent.com/u/613573?v=4&s=48" width="48" height="48" alt="CashWilliams" title="CashWilliams"/></a> <a href="https://github.com/rdev"><img src="https://avatars.githubusercontent.com/u/8418866?v=4&s=48" width="48" height="48" alt="rdev" title="rdev"/></a> <a href="https://github.com/osolmaz"><img src="https://avatars.githubusercontent.com/u/2453968?v=4&s=48" width="48" height="48" alt="osolmaz" title="osolmaz"/></a> <a href="https://github.com/joshrad-dev"><img src="https://avatars.githubusercontent.com/u/62785552?v=4&s=48" width="48" height="48" alt="joshrad-dev" title="joshrad-dev"/></a> <a href="https://github.com/kiranjd"><img src="https://avatars.githubusercontent.com/u/25822851?v=4&s=48" width="48" height="48" alt="kiranjd" title="kiranjd"/></a>
+  <a href="https://github.com/gumadeiras"><img src="https://avatars.githubusercontent.com/u/5599352?v=4&s=48" width="48" height="48" alt="gumadeiras" title="gumadeiras"/></a> <a href="https://github.com/emanuelst"><img src="https://avatars.githubusercontent.com/u/9994339?v=4&s=48" width="48" height="48" alt="emanuelst" title="emanuelst"/></a> <a href="https://github.com/KristijanJovanovski"><img src="https://avatars.githubusercontent.com/u/8942284?v=4&s=48" width="48" height="48" alt="KristijanJovanovski" title="KristijanJovanovski"/></a> <a href="https://github.com/CashWilliams"><img src="https://avatars.githubusercontent.com/u/613573?v=4&s=48" width="48" height="48" alt="CashWilliams" title="CashWilliams"/></a> <a href="https://github.com/rdev"><img src="https://avatars.githubusercontent.com/u/8418866?v=4&s=48" width="48" height="48" alt="rdev" title="rdev"/></a> <a href="https://github.com/osolmaz"><img src="https://avatars.githubusercontent.com/u/2453968?v=4&s=48" width="48" height="48" alt="osolmaz" title="osolmaz"/></a> <a href="https://github.com/kiranjd"><img src="https://avatars.githubusercontent.com/u/25822851?v=4&s=48" width="48" height="48" alt="kiranjd" title="kiranjd"/></a> <a href="https://github.com/adityashaw2"><img src="https://avatars.githubusercontent.com/u/41204444?v=4&s=48" width="48" height="48" alt="adityashaw2" title="adityashaw2"/></a> <a href="https://github.com/sebslight"><img src="https://avatars.githubusercontent.com/u/19554889?v=4&s=48" width="48" height="48" alt="sebslight" title="sebslight"/></a> <a href="https://github.com/search?q=sheeek"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="sheeek" title="sheeek"/></a>
-  <a href="https://github.com/adityashaw2"><img src="https://avatars.githubusercontent.com/u/41204444?v=4&s=48" width="48" height="48" alt="adityashaw2" title="adityashaw2"/></a> <a href="https://github.com/search?q=sheeek"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="sheeek" title="sheeek"/></a> <a href="https://github.com/artuskg"><img src="https://avatars.githubusercontent.com/u/11966157?v=4&s=48" width="48" height="48" alt="artuskg" title="artuskg"/></a> <a href="https://github.com/onutc"><img src="https://avatars.githubusercontent.com/u/152018508?v=4&s=48" width="48" height="48" alt="onutc" title="onutc"/></a> <a href="https://github.com/ManuelHettich"><img src="https://avatars.githubusercontent.com/u/17690367?v=4&s=48" width="48" height="48" alt="manuelhettich" title="manuelhettich"/></a> <a href="https://github.com/minghinmatthewlam"><img src="https://avatars.githubusercontent.com/u/14224566?v=4&s=48" width="48" height="48" alt="minghinmatthewlam" title="minghinmatthewlam"/></a> <a href="https://github.com/myfunc"><img src="https://avatars.githubusercontent.com/u/19294627?v=4&s=48" width="48" height="48" alt="myfunc" title="myfunc"/></a> <a href="https://github.com/buddyh"><img src="https://avatars.githubusercontent.com/u/31752869?v=4&s=48" width="48" height="48" alt="buddyh" title="buddyh"/></a> <a href="https://github.com/connorshea"><img src="https://avatars.githubusercontent.com/u/2977353?v=4&s=48" width="48" height="48" alt="connorshea" title="connorshea"/></a> <a href="https://github.com/mcinteerj"><img src="https://avatars.githubusercontent.com/u/3613653?v=4&s=48" width="48" height="48" alt="mcinteerj" title="mcinteerj"/></a>
+  <a href="https://github.com/artuskg"><img src="https://avatars.githubusercontent.com/u/11966157?v=4&s=48" width="48" height="48" alt="artuskg" title="artuskg"/></a> <a href="https://github.com/onutc"><img src="https://avatars.githubusercontent.com/u/152018508?v=4&s=48" width="48" height="48" alt="onutc" title="onutc"/></a> <a href="https://github.com/ManuelHettich"><img src="https://avatars.githubusercontent.com/u/17690367?v=4&s=48" width="48" height="48" alt="manuelhettich" title="manuelhettich"/></a> <a href="https://github.com/minghinmatthewlam"><img src="https://avatars.githubusercontent.com/u/14224566?v=4&s=48" width="48" height="48" alt="minghinmatthewlam" title="minghinmatthewlam"/></a> <a href="https://github.com/myfunc"><img src="https://avatars.githubusercontent.com/u/19294627?v=4&s=48" width="48" height="48" alt="myfunc" title="myfunc"/></a> <a href="https://github.com/buddyh"><img src="https://avatars.githubusercontent.com/u/31752869?v=4&s=48" width="48" height="48" alt="buddyh" title="buddyh"/></a> <a href="https://github.com/connorshea"><img src="https://avatars.githubusercontent.com/u/2977353?v=4&s=48" width="48" height="48" alt="connorshea" title="connorshea"/></a> <a href="https://github.com/mcinteerj"><img src="https://avatars.githubusercontent.com/u/3613653?v=4&s=48" width="48" height="48" alt="mcinteerj" title="mcinteerj"/></a> <a href="https://github.com/timkrase"><img src="https://avatars.githubusercontent.com/u/38947626?v=4&s=48" width="48" height="48" alt="timkrase" title="timkrase"/></a> <a href="https://github.com/gerardward2007"><img src="https://avatars.githubusercontent.com/u/3002155?v=4&s=48" width="48" height="48" alt="gerardward2007" title="gerardward2007"/></a>
-  <a href="https://github.com/timkrase"><img src="https://avatars.githubusercontent.com/u/38947626?v=4&s=48" width="48" height="48" alt="timkrase" title="timkrase"/></a> <a href="https://github.com/zerone0x"><img src="https://avatars.githubusercontent.com/u/39543393?v=4&s=48" width="48" height="48" alt="zerone0x" title="zerone0x"/></a> <a href="https://github.com/gerardward2007"><img src="https://avatars.githubusercontent.com/u/3002155?v=4&s=48" width="48" height="48" alt="gerardward2007" title="gerardward2007"/></a> <a href="https://github.com/obviyus"><img src="https://avatars.githubusercontent.com/u/22031114?v=4&s=48" width="48" height="48" alt="obviyus" title="obviyus"/></a> <a href="https://github.com/tosh-hamburg"><img src="https://avatars.githubusercontent.com/u/58424326?v=4&s=48" width="48" height="48" alt="tosh-hamburg" title="tosh-hamburg"/></a> <a href="https://github.com/azade-c"><img src="https://avatars.githubusercontent.com/u/252790079?v=4&s=48" width="48" height="48" alt="azade-c" title="azade-c"/></a> <a href="https://github.com/roshanasingh4"><img src="https://avatars.githubusercontent.com/u/88576930?v=4&s=48" width="48" height="48" alt="roshanasingh4" title="roshanasingh4"/></a> <a href="https://github.com/bjesuiter"><img src="https://avatars.githubusercontent.com/u/2365676?v=4&s=48" width="48" height="48" alt="bjesuiter" title="bjesuiter"/></a> <a href="https://github.com/cheeeee"><img src="https://avatars.githubusercontent.com/u/21245729?v=4&s=48" width="48" height="48" alt="cheeeee" title="cheeeee"/></a> <a href="https://github.com/j1philli"><img src="https://avatars.githubusercontent.com/u/3744255?v=4&s=48" width="48" height="48" alt="Josh Phillips" title="Josh Phillips"/></a>
+  <a href="https://github.com/obviyus"><img src="https://avatars.githubusercontent.com/u/22031114?v=4&s=48" width="48" height="48" alt="obviyus" title="obviyus"/></a> <a href="https://github.com/tosh-hamburg"><img src="https://avatars.githubusercontent.com/u/58424326?v=4&s=48" width="48" height="48" alt="tosh-hamburg" title="tosh-hamburg"/></a> <a href="https://github.com/azade-c"><img src="https://avatars.githubusercontent.com/u/252790079?v=4&s=48" width="48" height="48" alt="azade-c" title="azade-c"/></a> <a href="https://github.com/roshanasingh4"><img src="https://avatars.githubusercontent.com/u/88576930?v=4&s=48" width="48" height="48" alt="roshanasingh4" title="roshanasingh4"/></a> <a href="https://github.com/bjesuiter"><img src="https://avatars.githubusercontent.com/u/2365676?v=4&s=48" width="48" height="48" alt="bjesuiter" title="bjesuiter"/></a> <a href="https://github.com/j1philli"><img src="https://avatars.githubusercontent.com/u/3744255?v=4&s=48" width="48" height="48" alt="Josh Phillips" title="Josh Phillips"/></a> <a href="https://github.com/YuriNachos"><img src="https://avatars.githubusercontent.com/u/19365375?v=4&s=48" width="48" height="48" alt="YuriNachos" title="YuriNachos"/></a> <a href="https://github.com/zerone0x"><img src="https://avatars.githubusercontent.com/u/39543393?v=4&s=48" width="48" height="48" alt="zerone0x" title="zerone0x"/></a> <a href="https://github.com/superman32432432"><img src="https://avatars.githubusercontent.com/u/7228420?v=4&s=48" width="48" height="48" alt="superman32432432" title="superman32432432"/></a> <a href="https://github.com/search?q=Yurii%20Chukhlib"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Yurii Chukhlib" title="Yurii Chukhlib"/></a>
-  <a href="https://github.com/YuriNachos"><img src="https://avatars.githubusercontent.com/u/19365375?v=4&s=48" width="48" height="48" alt="YuriNachos" title="YuriNachos"/></a> <a href="https://github.com/tyler6204"><img src="https://avatars.githubusercontent.com/u/64381258?v=4&s=48" width="48" height="48" alt="tyler6204" title="tyler6204"/></a> <a href="https://github.com/superman32432432"><img src="https://avatars.githubusercontent.com/u/7228420?v=4&s=48" width="48" height="48" alt="superman32432432" title="superman32432432"/></a> <a href="https://github.com/search?q=Yurii%20Chukhlib"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Yurii Chukhlib" title="Yurii Chukhlib"/></a> <a href="https://github.com/antons"><img src="https://avatars.githubusercontent.com/u/129705?v=4&s=48" width="48" height="48" alt="antons" title="antons"/></a> <a href="https://github.com/austinm911"><img src="https://avatars.githubusercontent.com/u/31991302?v=4&s=48" width="48" height="48" alt="austinm911" title="austinm911"/></a> <a href="https://github.com/apps/blacksmith-sh"><img src="https://avatars.githubusercontent.com/in/807020?v=4&s=48" width="48" height="48" alt="blacksmith-sh[bot]" title="blacksmith-sh[bot]"/></a> <a href="https://github.com/dan-dr"><img src="https://avatars.githubusercontent.com/u/6669808?v=4&s=48" width="48" height="48" alt="dan-dr" title="dan-dr"/></a> <a href="https://github.com/grp06"><img src="https://avatars.githubusercontent.com/u/1573959?v=4&s=48" width="48" height="48" alt="grp06" title="grp06"/></a> <a href="https://github.com/HeimdallStrategy"><img src="https://avatars.githubusercontent.com/u/223014405?v=4&s=48" width="48" height="48" alt="HeimdallStrategy" title="HeimdallStrategy"/></a>
+  <a href="https://github.com/antons"><img src="https://avatars.githubusercontent.com/u/129705?v=4&s=48" width="48" height="48" alt="antons" title="antons"/></a> <a href="https://github.com/austinm911"><img src="https://avatars.githubusercontent.com/u/31991302?v=4&s=48" width="48" height="48" alt="austinm911" title="austinm911"/></a> <a href="https://github.com/apps/blacksmith-sh"><img src="https://avatars.githubusercontent.com/in/807020?v=4&s=48" width="48" height="48" alt="blacksmith-sh[bot]" title="blacksmith-sh[bot]"/></a> <a href="https://github.com/dan-dr"><img src="https://avatars.githubusercontent.com/u/6669808?v=4&s=48" width="48" height="48" alt="dan-dr" title="dan-dr"/></a> <a href="https://github.com/grp06"><img src="https://avatars.githubusercontent.com/u/1573959?v=4&s=48" width="48" height="48" alt="grp06" title="grp06"/></a> <a href="https://github.com/HeimdallStrategy"><img src="https://avatars.githubusercontent.com/u/223014405?v=4&s=48" width="48" height="48" alt="HeimdallStrategy" title="HeimdallStrategy"/></a> <a href="https://github.com/imfing"><img src="https://avatars.githubusercontent.com/u/5097752?v=4&s=48" width="48" height="48" alt="imfing" title="imfing"/></a> <a href="https://github.com/jalehman"><img src="https://avatars.githubusercontent.com/u/550978?v=4&s=48" width="48" height="48" alt="jalehman" title="jalehman"/></a> <a href="https://github.com/jarvis-medmatic"><img src="https://avatars.githubusercontent.com/u/252428873?v=4&s=48" width="48" height="48" alt="jarvis-medmatic" title="jarvis-medmatic"/></a> <a href="https://github.com/kkarimi"><img src="https://avatars.githubusercontent.com/u/875218?v=4&s=48" width="48" height="48" alt="kkarimi" title="kkarimi"/></a>
-  <a href="https://github.com/imfing"><img src="https://avatars.githubusercontent.com/u/5097752?v=4&s=48" width="48" height="48" alt="imfing" title="imfing"/></a> <a href="https://github.com/jalehman"><img src="https://avatars.githubusercontent.com/u/550978?v=4&s=48" width="48" height="48" alt="jalehman" title="jalehman"/></a> <a href="https://github.com/jarvis-medmatic"><img src="https://avatars.githubusercontent.com/u/252428873?v=4&s=48" width="48" height="48" alt="jarvis-medmatic" title="jarvis-medmatic"/></a> <a href="https://github.com/kkarimi"><img src="https://avatars.githubusercontent.com/u/875218?v=4&s=48" width="48" height="48" alt="kkarimi" title="kkarimi"/></a> <a href="https://github.com/mahmoudashraf93"><img src="https://avatars.githubusercontent.com/u/9130129?v=4&s=48" width="48" height="48" alt="mahmoudashraf93" title="mahmoudashraf93"/></a> <a href="https://github.com/petter-b"><img src="https://avatars.githubusercontent.com/u/62076402?v=4&s=48" width="48" height="48" alt="petter-b" title="petter-b"/></a> <a href="https://github.com/pkrmf"><img src="https://avatars.githubusercontent.com/u/1714267?v=4&s=48" width="48" height="48" alt="pkrmf" title="pkrmf"/></a> <a href="https://github.com/RandyVentures"><img src="https://avatars.githubusercontent.com/u/149904821?v=4&s=48" width="48" height="48" alt="RandyVentures" title="RandyVentures"/></a> <a href="https://github.com/erikpr1994"><img src="https://avatars.githubusercontent.com/u/6299331?v=4&s=48" width="48" height="48" alt="erikpr1994" title="erikpr1994"/></a> <a href="https://github.com/jonasjancarik"><img src="https://avatars.githubusercontent.com/u/2459191?v=4&s=48" width="48" height="48" alt="jonasjancarik" title="jonasjancarik"/></a>
+  <a href="https://github.com/mahmoudashraf93"><img src="https://avatars.githubusercontent.com/u/9130129?v=4&s=48" width="48" height="48" alt="mahmoudashraf93" title="mahmoudashraf93"/></a> <a href="https://github.com/petter-b"><img src="https://avatars.githubusercontent.com/u/62076402?v=4&s=48" width="48" height="48" alt="petter-b" title="petter-b"/></a> <a href="https://github.com/pkrmf"><img src="https://avatars.githubusercontent.com/u/1714267?v=4&s=48" width="48" height="48" alt="pkrmf" title="pkrmf"/></a> <a href="https://github.com/RandyVentures"><img src="https://avatars.githubusercontent.com/u/149904821?v=4&s=48" width="48" height="48" alt="RandyVentures" title="RandyVentures"/></a> <a href="https://github.com/erikpr1994"><img src="https://avatars.githubusercontent.com/u/6299331?v=4&s=48" width="48" height="48" alt="erikpr1994" title="erikpr1994"/></a> <a href="https://github.com/jonasjancarik"><img src="https://avatars.githubusercontent.com/u/2459191?v=4&s=48" width="48" height="48" alt="jonasjancarik" title="jonasjancarik"/></a> <a href="https://github.com/search?q=Keith%20the%20Silly%20Goose"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Keith the Silly Goose" title="Keith the Silly Goose"/></a> <a href="https://github.com/search?q=L36%20Server"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="L36 Server" title="L36 Server"/></a> <a href="https://github.com/search?q=Marc"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Marc" title="Marc"/></a> <a href="https://github.com/mitschabaude-bot"><img src="https://avatars.githubusercontent.com/u/247582884?v=4&s=48" width="48" height="48" alt="mitschabaude-bot" title="mitschabaude-bot"/></a>
-  <a href="https://github.com/search?q=Keith%20the%20Silly%20Goose"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Keith the Silly Goose" title="Keith the Silly Goose"/></a> <a href="https://github.com/search?q=L36%20Server"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="L36 Server" title="L36 Server"/></a> <a href="https://github.com/search?q=Marc"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Marc" title="Marc"/></a> <a href="https://github.com/mitschabaude-bot"><img src="https://avatars.githubusercontent.com/u/247582884?v=4&s=48" width="48" height="48" alt="mitschabaude-bot" title="mitschabaude-bot"/></a> <a href="https://github.com/neist"><img src="https://avatars.githubusercontent.com/u/1029724?v=4&s=48" width="48" height="48" alt="neist" title="neist"/></a> <a href="https://github.com/ngutman"><img src="https://avatars.githubusercontent.com/u/1540134?v=4&s=48" width="48" height="48" alt="ngutman" title="ngutman"/></a> <a href="https://github.com/chrisrodz"><img src="https://avatars.githubusercontent.com/u/2967620?v=4&s=48" width="48" height="48" alt="chrisrodz" title="chrisrodz"/></a> <a href="https://github.com/search?q=Friederike%20Seiler"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Friederike Seiler" title="Friederike Seiler"/></a> <a href="https://github.com/gabriel-trigo"><img src="https://avatars.githubusercontent.com/u/38991125?v=4&s=48" width="48" height="48" alt="gabriel-trigo" title="gabriel-trigo"/></a> <a href="https://github.com/Iamadig"><img src="https://avatars.githubusercontent.com/u/102129234?v=4&s=48" width="48" height="48" alt="iamadig" title="iamadig"/></a>
+  <a href="https://github.com/neist"><img src="https://avatars.githubusercontent.com/u/1029724?v=4&s=48" width="48" height="48" alt="neist" title="neist"/></a> <a href="https://github.com/tyler6204"><img src="https://avatars.githubusercontent.com/u/64381258?v=4&s=48" width="48" height="48" alt="tyler6204" title="tyler6204"/></a> <a href="https://github.com/chrisrodz"><img src="https://avatars.githubusercontent.com/u/2967620?v=4&s=48" width="48" height="48" alt="chrisrodz" title="chrisrodz"/></a> <a href="https://github.com/search?q=Friederike%20Seiler"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Friederike Seiler" title="Friederike Seiler"/></a> <a href="https://github.com/gabriel-trigo"><img src="https://avatars.githubusercontent.com/u/38991125?v=4&s=48" width="48" height="48" alt="gabriel-trigo" title="gabriel-trigo"/></a> <a href="https://github.com/Iamadig"><img src="https://avatars.githubusercontent.com/u/102129234?v=4&s=48" width="48" height="48" alt="iamadig" title="iamadig"/></a> <a href="https://github.com/search?q=Kit"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kit" title="Kit"/></a> <a href="https://github.com/koala73"><img src="https://avatars.githubusercontent.com/u/996596?v=4&s=48" width="48" height="48" alt="koala73" title="koala73"/></a> <a href="https://github.com/manmal"><img src="https://avatars.githubusercontent.com/u/142797?v=4&s=48" width="48" height="48" alt="manmal" title="manmal"/></a> <a href="https://github.com/ngutman"><img src="https://avatars.githubusercontent.com/u/1540134?v=4&s=48" width="48" height="48" alt="ngutman" title="ngutman"/></a>
-  <a href="https://github.com/search?q=Kit"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kit" title="Kit"/></a> <a href="https://github.com/koala73"><img src="https://avatars.githubusercontent.com/u/996596?v=4&s=48" width="48" height="48" alt="koala73" title="koala73"/></a> <a href="https://github.com/manmal"><img src="https://avatars.githubusercontent.com/u/142797?v=4&s=48" width="48" height="48" alt="manmal" title="manmal"/></a> <a href="https://github.com/ogulcancelik"><img src="https://avatars.githubusercontent.com/u/7064011?v=4&s=48" width="48" height="48" alt="ogulcancelik" title="ogulcancelik"/></a> <a href="https://github.com/pasogott"><img src="https://avatars.githubusercontent.com/u/23458152?v=4&s=48" width="48" height="48" alt="pasogott" title="pasogott"/></a> <a href="https://github.com/petradonka"><img src="https://avatars.githubusercontent.com/u/7353770?v=4&s=48" width="48" height="48" alt="petradonka" title="petradonka"/></a> <a href="https://github.com/rubyrunsstuff"><img src="https://avatars.githubusercontent.com/u/246602379?v=4&s=48" width="48" height="48" alt="rubyrunsstuff" title="rubyrunsstuff"/></a> <a href="https://github.com/VACInc"><img src="https://avatars.githubusercontent.com/u/3279061?v=4&s=48" width="48" height="48" alt="VACInc" title="VACInc"/></a> <a href="https://github.com/wes-davis"><img src="https://avatars.githubusercontent.com/u/16506720?v=4&s=48" width="48" height="48" alt="wes-davis" title="wes-davis"/></a> <a href="https://github.com/zats"><img src="https://avatars.githubusercontent.com/u/2688806?v=4&s=48" width="48" height="48" alt="zats" title="zats"/></a>
+  <a href="https://github.com/ogulcancelik"><img src="https://avatars.githubusercontent.com/u/7064011?v=4&s=48" width="48" height="48" alt="ogulcancelik" title="ogulcancelik"/></a> <a href="https://github.com/pasogott"><img src="https://avatars.githubusercontent.com/u/23458152?v=4&s=48" width="48" height="48" alt="pasogott" title="pasogott"/></a> <a href="https://github.com/petradonka"><img src="https://avatars.githubusercontent.com/u/7353770?v=4&s=48" width="48" height="48" alt="petradonka" title="petradonka"/></a> <a href="https://github.com/rubyrunsstuff"><img src="https://avatars.githubusercontent.com/u/246602379?v=4&s=48" width="48" height="48" alt="rubyrunsstuff" title="rubyrunsstuff"/></a> <a href="https://github.com/VACInc"><img src="https://avatars.githubusercontent.com/u/3279061?v=4&s=48" width="48" height="48" alt="VACInc" title="VACInc"/></a> <a href="https://github.com/wes-davis"><img src="https://avatars.githubusercontent.com/u/16506720?v=4&s=48" width="48" height="48" alt="wes-davis" title="wes-davis"/></a> <a href="https://github.com/zats"><img src="https://avatars.githubusercontent.com/u/2688806?v=4&s=48" width="48" height="48" alt="zats" title="zats"/></a> <a href="https://github.com/search?q=Chris%20Taylor"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Chris Taylor" title="Chris Taylor"/></a> <a href="https://github.com/djangonavarro220"><img src="https://avatars.githubusercontent.com/u/251162586?v=4&s=48" width="48" height="48" alt="Django Navarro" title="Django Navarro"/></a> <a href="https://github.com/evalexpr"><img src="https://avatars.githubusercontent.com/u/23485511?v=4&s=48" width="48" height="48" alt="evalexpr" title="evalexpr"/></a>
-  <a href="https://github.com/search?q=Chris%20Taylor"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Chris Taylor" title="Chris Taylor"/></a> <a href="https://github.com/djangonavarro220"><img src="https://avatars.githubusercontent.com/u/251162586?v=4&s=48" width="48" height="48" alt="Django Navarro" title="Django Navarro"/></a> <a href="https://github.com/evalexpr"><img src="https://avatars.githubusercontent.com/u/23485511?v=4&s=48" width="48" height="48" alt="evalexpr" title="evalexpr"/></a> <a href="https://github.com/henrino3"><img src="https://avatars.githubusercontent.com/u/4260288?v=4&s=48" width="48" height="48" alt="henrino3" title="henrino3"/></a> <a href="https://github.com/mkbehr"><img src="https://avatars.githubusercontent.com/u/1285?v=4&s=48" width="48" height="48" alt="mkbehr" title="mkbehr"/></a> <a href="https://github.com/oswalpalash"><img src="https://avatars.githubusercontent.com/u/6431196?v=4&s=48" width="48" height="48" alt="oswalpalash" title="oswalpalash"/></a> <a href="https://github.com/pcty-nextgen-service-account"><img src="https://avatars.githubusercontent.com/u/112553441?v=4&s=48" width="48" height="48" alt="pcty-nextgen-service-account" title="pcty-nextgen-service-account"/></a> <a href="https://github.com/sibbl"><img src="https://avatars.githubusercontent.com/u/866535?v=4&s=48" width="48" height="48" alt="sibbl" title="sibbl"/></a> <a href="https://github.com/Syhids"><img src="https://avatars.githubusercontent.com/u/671202?v=4&s=48" width="48" height="48" alt="Syhids" title="Syhids"/></a> <a href="https://github.com/search?q=Aaron%20Konyer"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Aaron Konyer" title="Aaron Konyer"/></a>
+  <a href="https://github.com/henrino3"><img src="https://avatars.githubusercontent.com/u/4260288?v=4&s=48" width="48" height="48" alt="henrino3" title="henrino3"/></a> <a href="https://github.com/mkbehr"><img src="https://avatars.githubusercontent.com/u/1285?v=4&s=48" width="48" height="48" alt="mkbehr" title="mkbehr"/></a> <a href="https://github.com/oswalpalash"><img src="https://avatars.githubusercontent.com/u/6431196?v=4&s=48" width="48" height="48" alt="oswalpalash" title="oswalpalash"/></a> <a href="https://github.com/pcty-nextgen-service-account"><img src="https://avatars.githubusercontent.com/u/112553441?v=4&s=48" width="48" height="48" alt="pcty-nextgen-service-account" title="pcty-nextgen-service-account"/></a> <a href="https://github.com/Syhids"><img src="https://avatars.githubusercontent.com/u/671202?v=4&s=48" width="48" height="48" alt="Syhids" title="Syhids"/></a> <a href="https://github.com/search?q=Aaron%20Konyer"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Aaron Konyer" title="Aaron Konyer"/></a> <a href="https://github.com/adam91holt"><img src="https://avatars.githubusercontent.com/u/9592417?v=4&s=48" width="48" height="48" alt="adam91holt" title="adam91holt"/></a> <a href="https://github.com/erik-agens"><img src="https://avatars.githubusercontent.com/u/80908960?v=4&s=48" width="48" height="48" alt="erik-agens" title="erik-agens"/></a> <a href="https://github.com/fcatuhe"><img src="https://avatars.githubusercontent.com/u/17382215?v=4&s=48" width="48" height="48" alt="fcatuhe" title="fcatuhe"/></a> <a href="https://github.com/ivanrvpereira"><img src="https://avatars.githubusercontent.com/u/183991?v=4&s=48" width="48" height="48" alt="ivanrvpereira" title="ivanrvpereira"/></a>
-  <a href="https://github.com/adam91holt"><img src="https://avatars.githubusercontent.com/u/9592417?v=4&s=48" width="48" height="48" alt="adam91holt" title="adam91holt"/></a> <a href="https://github.com/erik-agens"><img src="https://avatars.githubusercontent.com/u/80908960?v=4&s=48" width="48" height="48" alt="erik-agens" title="erik-agens"/></a> <a href="https://github.com/fcatuhe"><img src="https://avatars.githubusercontent.com/u/17382215?v=4&s=48" width="48" height="48" alt="fcatuhe" title="fcatuhe"/></a> <a href="https://github.com/ivanrvpereira"><img src="https://avatars.githubusercontent.com/u/183991?v=4&s=48" width="48" height="48" alt="ivanrvpereira" title="ivanrvpereira"/></a> <a href="https://github.com/jayhickey"><img src="https://avatars.githubusercontent.com/u/1676460?v=4&s=48" width="48" height="48" alt="jayhickey" title="jayhickey"/></a> <a href="https://github.com/jeffersonwarrior"><img src="https://avatars.githubusercontent.com/u/89030989?v=4&s=48" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/search?q=jeffersonwarrior"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/jdrhyne"><img src="https://avatars.githubusercontent.com/u/7828464?v=4&s=48" width="48" height="48" alt="Jonathan D. Rhyne (DJ-D)" title="Jonathan D. Rhyne (DJ-D)"/></a> <a href="https://github.com/jverdi"><img src="https://avatars.githubusercontent.com/u/345050?v=4&s=48" width="48" height="48" alt="jverdi" title="jverdi"/></a> <a href="https://github.com/mickahouan"><img src="https://avatars.githubusercontent.com/u/31423109?v=4&s=48" width="48" height="48" alt="mickahouan" title="mickahouan"/></a>
+  <a href="https://github.com/jayhickey"><img src="https://avatars.githubusercontent.com/u/1676460?v=4&s=48" width="48" height="48" alt="jayhickey" title="jayhickey"/></a> <a href="https://github.com/jeffersonwarrior"><img src="https://avatars.githubusercontent.com/u/89030989?v=4&s=48" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/search?q=jeffersonwarrior"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/jdrhyne"><img src="https://avatars.githubusercontent.com/u/7828464?v=4&s=48" width="48" height="48" alt="Jonathan D. Rhyne (DJ-D)" title="Jonathan D. Rhyne (DJ-D)"/></a> <a href="https://github.com/jverdi"><img src="https://avatars.githubusercontent.com/u/345050?v=4&s=48" width="48" height="48" alt="jverdi" title="jverdi"/></a> <a href="https://github.com/mickahouan"><img src="https://avatars.githubusercontent.com/u/31423109?v=4&s=48" width="48" height="48" alt="mickahouan" title="mickahouan"/></a> <a href="https://github.com/mjrussell"><img src="https://avatars.githubusercontent.com/u/1641895?v=4&s=48" width="48" height="48" alt="mjrussell" title="mjrussell"/></a> <a href="https://github.com/p6l-richard"><img src="https://avatars.githubusercontent.com/u/18185649?v=4&s=48" width="48" height="48" alt="p6l-richard" title="p6l-richard"/></a> <a href="https://github.com/philipp-spiess"><img src="https://avatars.githubusercontent.com/u/458591?v=4&s=48" width="48" height="48" alt="philipp-spiess" title="philipp-spiess"/></a> <a href="https://github.com/robaxelsen"><img src="https://avatars.githubusercontent.com/u/13132899?v=4&s=48" width="48" height="48" alt="robaxelsen" title="robaxelsen"/></a>
-  <a href="https://github.com/mjrussell"><img src="https://avatars.githubusercontent.com/u/1641895?v=4&s=48" width="48" height="48" alt="mjrussell" title="mjrussell"/></a> <a href="https://github.com/p6l-richard"><img src="https://avatars.githubusercontent.com/u/18185649?v=4&s=48" width="48" height="48" alt="p6l-richard" title="p6l-richard"/></a> <a href="https://github.com/philipp-spiess"><img src="https://avatars.githubusercontent.com/u/458591?v=4&s=48" width="48" height="48" alt="philipp-spiess" title="philipp-spiess"/></a> <a href="https://github.com/robaxelsen"><img src="https://avatars.githubusercontent.com/u/13132899?v=4&s=48" width="48" height="48" alt="robaxelsen" title="robaxelsen"/></a> <a href="https://github.com/search?q=Sash%20Catanzarite"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Sash Catanzarite" title="Sash Catanzarite"/></a> <a href="https://github.com/search?q=VAC"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="VAC" title="VAC"/></a> <a href="https://github.com/zknicker"><img src="https://avatars.githubusercontent.com/u/1164085?v=4&s=48" width="48" height="48" alt="zknicker" title="zknicker"/></a> <a href="https://github.com/search?q=alejandro%20maza"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="alejandro maza" title="alejandro maza"/></a> <a href="https://github.com/andrewting19"><img src="https://avatars.githubusercontent.com/u/10536704?v=4&s=48" width="48" height="48" alt="andrewting19" title="andrewting19"/></a> <a href="https://github.com/anpoirier"><img src="https://avatars.githubusercontent.com/u/1245729?v=4&s=48" width="48" height="48" alt="anpoirier" title="anpoirier"/></a>
+  <a href="https://github.com/search?q=Sash%20Catanzarite"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Sash Catanzarite" title="Sash Catanzarite"/></a> <a href="https://github.com/sibbl"><img src="https://avatars.githubusercontent.com/u/866535?v=4&s=48" width="48" height="48" alt="sibbl" title="sibbl"/></a> <a href="https://github.com/search?q=VAC"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="VAC" title="VAC"/></a> <a href="https://github.com/zknicker"><img src="https://avatars.githubusercontent.com/u/1164085?v=4&s=48" width="48" height="48" alt="zknicker" title="zknicker"/></a> <a href="https://github.com/search?q=alejandro%20maza"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="alejandro maza" title="alejandro maza"/></a> <a href="https://github.com/andrewting19"><img src="https://avatars.githubusercontent.com/u/10536704?v=4&s=48" width="48" height="48" alt="andrewting19" title="andrewting19"/></a> <a href="https://github.com/Asleep123"><img src="https://avatars.githubusercontent.com/u/122379135?v=4&s=48" width="48" height="48" alt="Asleep123" title="Asleep123"/></a> <a href="https://github.com/bolismauro"><img src="https://avatars.githubusercontent.com/u/771999?v=4&s=48" width="48" height="48" alt="bolismauro" title="bolismauro"/></a> <a href="https://github.com/cash-echo-bot"><img src="https://avatars.githubusercontent.com/u/252747386?v=4&s=48" width="48" height="48" alt="cash-echo-bot" title="cash-echo-bot"/></a> <a href="https://github.com/search?q=Clawd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Clawd" title="Clawd"/></a>
-  <a href="https://github.com/Asleep123"><img src="https://avatars.githubusercontent.com/u/122379135?v=4&s=48" width="48" height="48" alt="Asleep123" title="Asleep123"/></a> <a href="https://github.com/bolismauro"><img src="https://avatars.githubusercontent.com/u/771999?v=4&s=48" width="48" height="48" alt="bolismauro" title="bolismauro"/></a> <a href="https://github.com/cash-echo-bot"><img src="https://avatars.githubusercontent.com/u/252747386?v=4&s=48" width="48" height="48" alt="cash-echo-bot" title="cash-echo-bot"/></a> <a href="https://github.com/search?q=Clawd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Clawd" title="Clawd"/></a> <a href="https://github.com/conhecendocontato"><img src="https://avatars.githubusercontent.com/u/82890727?v=4&s=48" width="48" height="48" alt="conhecendocontato" title="conhecendocontato"/></a> <a href="https://github.com/search?q=Dimitrios%20Ploutarchos"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Dimitrios Ploutarchos" title="Dimitrios Ploutarchos"/></a> <a href="https://github.com/search?q=Drake%20Thomsen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Drake Thomsen" title="Drake Thomsen"/></a> <a href="https://github.com/search?q=Ghost"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ghost" title="Ghost"/></a> <a href="https://github.com/gtsifrikas"><img src="https://avatars.githubusercontent.com/u/8904378?v=4&s=48" width="48" height="48" alt="gtsifrikas" title="gtsifrikas"/></a> <a href="https://github.com/HazAT"><img src="https://avatars.githubusercontent.com/u/363802?v=4&s=48" width="48" height="48" alt="HazAT" title="HazAT"/></a>
+  <a href="https://github.com/conhecendocontato"><img src="https://avatars.githubusercontent.com/u/82890727?v=4&s=48" width="48" height="48" alt="conhecendocontato" title="conhecendocontato"/></a> <a href="https://github.com/search?q=Dimitrios%20Ploutarchos"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Dimitrios Ploutarchos" title="Dimitrios Ploutarchos"/></a> <a href="https://github.com/search?q=Drake%20Thomsen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Drake Thomsen" title="Drake Thomsen"/></a> <a href="https://github.com/gtsifrikas"><img src="https://avatars.githubusercontent.com/u/8904378?v=4&s=48" width="48" height="48" alt="gtsifrikas" title="gtsifrikas"/></a> <a href="https://github.com/HazAT"><img src="https://avatars.githubusercontent.com/u/363802?v=4&s=48" width="48" height="48" alt="HazAT" title="HazAT"/></a> <a href="https://github.com/hrdwdmrbl"><img src="https://avatars.githubusercontent.com/u/554881?v=4&s=48" width="48" height="48" alt="hrdwdmrbl" title="hrdwdmrbl"/></a> <a href="https://github.com/hugobarauna"><img src="https://avatars.githubusercontent.com/u/2719?v=4&s=48" width="48" height="48" alt="hugobarauna" title="hugobarauna"/></a> <a href="https://github.com/search?q=Jamie%20Openshaw"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jamie Openshaw" title="Jamie Openshaw"/></a> <a href="https://github.com/search?q=Jarvis"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jarvis" title="Jarvis"/></a> <a href="https://github.com/search?q=Jefferson%20Nunn"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jefferson Nunn" title="Jefferson Nunn"/></a>
-  <a href="https://github.com/hrdwdmrbl"><img src="https://avatars.githubusercontent.com/u/554881?v=4&s=48" width="48" height="48" alt="hrdwdmrbl" title="hrdwdmrbl"/></a> <a href="https://github.com/hugobarauna"><img src="https://avatars.githubusercontent.com/u/2719?v=4&s=48" width="48" height="48" alt="hugobarauna" title="hugobarauna"/></a> <a href="https://github.com/search?q=Jamie%20Openshaw"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jamie Openshaw" title="Jamie Openshaw"/></a> <a href="https://github.com/search?q=Jarvis"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jarvis" title="Jarvis"/></a> <a href="https://github.com/search?q=Jefferson%20Nunn"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jefferson Nunn" title="Jefferson Nunn"/></a> <a href="https://github.com/search?q=Kevin%20Lin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kevin Lin" title="Kevin Lin"/></a> <a href="https://github.com/kitze"><img src="https://avatars.githubusercontent.com/u/1160594?v=4&s=48" width="48" height="48" alt="kitze" title="kitze"/></a> <a href="https://github.com/levifig"><img src="https://avatars.githubusercontent.com/u/1605?v=4&s=48" width="48" height="48" alt="levifig" title="levifig"/></a> <a href="https://github.com/search?q=Lloyd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Lloyd" title="Lloyd"/></a> <a href="https://github.com/longmaba"><img src="https://avatars.githubusercontent.com/u/9361500?v=4&s=48" width="48" height="48" alt="longmaba" title="longmaba"/></a>
+  <a href="https://github.com/kitze"><img src="https://avatars.githubusercontent.com/u/1160594?v=4&s=48" width="48" height="48" alt="kitze" title="kitze"/></a> <a href="https://github.com/levifig"><img src="https://avatars.githubusercontent.com/u/1605?v=4&s=48" width="48" height="48" alt="levifig" title="levifig"/></a> <a href="https://github.com/search?q=Lloyd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Lloyd" title="Lloyd"/></a> <a href="https://github.com/longmaba"><img src="https://avatars.githubusercontent.com/u/9361500?v=4&s=48" width="48" height="48" alt="longmaba" title="longmaba"/></a> <a href="https://github.com/loukotal"><img src="https://avatars.githubusercontent.com/u/18210858?v=4&s=48" width="48" height="48" alt="loukotal" title="loukotal"/></a> <a href="https://github.com/martinpucik"><img src="https://avatars.githubusercontent.com/u/5503097?v=4&s=48" width="48" height="48" alt="martinpucik" title="martinpucik"/></a> <a href="https://github.com/search?q=Miles"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Miles" title="Miles"/></a> <a href="https://github.com/mrdbstn"><img src="https://avatars.githubusercontent.com/u/58957632?v=4&s=48" width="48" height="48" alt="mrdbstn" title="mrdbstn"/></a> <a href="https://github.com/MSch"><img src="https://avatars.githubusercontent.com/u/7475?v=4&s=48" width="48" height="48" alt="MSch" title="MSch"/></a> <a href="https://github.com/search?q=Mustafa%20Tag%20Eldeen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mustafa Tag Eldeen" title="Mustafa Tag Eldeen"/></a>
-  <a href="https://github.com/loukotal"><img src="https://avatars.githubusercontent.com/u/18210858?v=4&s=48" width="48" height="48" alt="loukotal" title="loukotal"/></a> <a href="https://github.com/martinpucik"><img src="https://avatars.githubusercontent.com/u/5503097?v=4&s=48" width="48" height="48" alt="martinpucik" title="martinpucik"/></a> <a href="https://github.com/search?q=Miles"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Miles" title="Miles"/></a> <a href="https://github.com/mrdbstn"><img src="https://avatars.githubusercontent.com/u/58957632?v=4&s=48" width="48" height="48" alt="mrdbstn" title="mrdbstn"/></a> <a href="https://github.com/MSch"><img src="https://avatars.githubusercontent.com/u/7475?v=4&s=48" width="48" height="48" alt="MSch" title="MSch"/></a> <a href="https://github.com/search?q=Mustafa%20Tag%20Eldeen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mustafa Tag Eldeen" title="Mustafa Tag Eldeen"/></a> <a href="https://github.com/ndraiman"><img src="https://avatars.githubusercontent.com/u/12609607?v=4&s=48" width="48" height="48" alt="ndraiman" title="ndraiman"/></a> <a href="https://github.com/nexty5870"><img src="https://avatars.githubusercontent.com/u/3869659?v=4&s=48" width="48" height="48" alt="nexty5870" title="nexty5870"/></a> <a href="https://github.com/prathamdby"><img src="https://avatars.githubusercontent.com/u/134331217?v=4&s=48" width="48" height="48" alt="prathamdby" title="prathamdby"/></a> <a href="https://github.com/reeltimeapps"><img src="https://avatars.githubusercontent.com/u/637338?v=4&s=48" width="48" height="48" alt="reeltimeapps" title="reeltimeapps"/></a>
+  <a href="https://github.com/ndraiman"><img src="https://avatars.githubusercontent.com/u/12609607?v=4&s=48" width="48" height="48" alt="ndraiman" title="ndraiman"/></a> <a href="https://github.com/nexty5870"><img src="https://avatars.githubusercontent.com/u/3869659?v=4&s=48" width="48" height="48" alt="nexty5870" title="nexty5870"/></a> <a href="https://github.com/prathamdby"><img src="https://avatars.githubusercontent.com/u/134331217?v=4&s=48" width="48" height="48" alt="prathamdby" title="prathamdby"/></a> <a href="https://github.com/reeltimeapps"><img src="https://avatars.githubusercontent.com/u/637338?v=4&s=48" width="48" height="48" alt="reeltimeapps" title="reeltimeapps"/></a> <a href="https://github.com/RLTCmpe"><img src="https://avatars.githubusercontent.com/u/10762242?v=4&s=48" width="48" height="48" alt="RLTCmpe" title="RLTCmpe"/></a> <a href="https://github.com/search?q=Rolf%20Fredheim"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rolf Fredheim" title="Rolf Fredheim"/></a> <a href="https://github.com/search?q=Rony%20Kelner"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rony Kelner" title="Rony Kelner"/></a> <a href="https://github.com/search?q=Samrat%20Jha"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Samrat Jha" title="Samrat Jha"/></a> <a href="https://github.com/siraht"><img src="https://avatars.githubusercontent.com/u/73152895?v=4&s=48" width="48" height="48" alt="siraht" title="siraht"/></a> <a href="https://github.com/snopoke"><img src="https://avatars.githubusercontent.com/u/249606?v=4&s=48" width="48" height="48" alt="snopoke" title="snopoke"/></a>
-  <a href="https://github.com/RLTCmpe"><img src="https://avatars.githubusercontent.com/u/10762242?v=4&s=48" width="48" height="48" alt="RLTCmpe" title="RLTCmpe"/></a> <a href="https://github.com/rodrigouroz"><img src="https://avatars.githubusercontent.com/u/384037?v=4&s=48" width="48" height="48" alt="rodrigouroz" title="rodrigouroz"/></a> <a href="https://github.com/search?q=Rolf%20Fredheim"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rolf Fredheim" title="Rolf Fredheim"/></a> <a href="https://github.com/search?q=Rony%20Kelner"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rony Kelner" title="Rony Kelner"/></a> <a href="https://github.com/search?q=Samrat%20Jha"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Samrat Jha" title="Samrat Jha"/></a> <a href="https://github.com/siraht"><img src="https://avatars.githubusercontent.com/u/73152895?v=4&s=48" width="48" height="48" alt="siraht" title="siraht"/></a> <a href="https://github.com/snopoke"><img src="https://avatars.githubusercontent.com/u/249606?v=4&s=48" width="48" height="48" alt="snopoke" title="snopoke"/></a> <a href="https://github.com/suminhthanh"><img src="https://avatars.githubusercontent.com/u/2907636?v=4&s=48" width="48" height="48" alt="suminhthanh" title="suminhthanh"/></a> <a href="https://github.com/search?q=The%20Admiral"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="The Admiral" title="The Admiral"/></a> <a href="https://github.com/thesash"><img src="https://avatars.githubusercontent.com/u/1166151?v=4&s=48" width="48" height="48" alt="thesash" title="thesash"/></a>
+  <a href="https://github.com/suminhthanh"><img src="https://avatars.githubusercontent.com/u/2907636?v=4&s=48" width="48" height="48" alt="suminhthanh" title="suminhthanh"/></a> <a href="https://github.com/search?q=The%20Admiral"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="The Admiral" title="The Admiral"/></a> <a href="https://github.com/thesash"><img src="https://avatars.githubusercontent.com/u/1166151?v=4&s=48" width="48" height="48" alt="thesash" title="thesash"/></a> <a href="https://github.com/search?q=Ubuntu"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ubuntu" title="Ubuntu"/></a> <a href="https://github.com/voidserf"><img src="https://avatars.githubusercontent.com/u/477673?v=4&s=48" width="48" height="48" alt="voidserf" title="voidserf"/></a> <a href="https://github.com/wstock"><img src="https://avatars.githubusercontent.com/u/1394687?v=4&s=48" width="48" height="48" alt="wstock" title="wstock"/></a> <a href="https://github.com/search?q=Zach%20Knickerbocker"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Zach Knickerbocker" title="Zach Knickerbocker"/></a> <a href="https://github.com/Alphonse-arianee"><img src="https://avatars.githubusercontent.com/u/254457365?v=4&s=48" width="48" height="48" alt="Alphonse-arianee" title="Alphonse-arianee"/></a> <a href="https://github.com/search?q=Azade"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Azade" title="Azade"/></a> <a href="https://github.com/carlulsoe"><img src="https://avatars.githubusercontent.com/u/34673973?v=4&s=48" width="48" height="48" alt="carlulsoe" title="carlulsoe"/></a>
-  <a href="https://github.com/search?q=Ubuntu"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ubuntu" title="Ubuntu"/></a> <a href="https://github.com/voidserf"><img src="https://avatars.githubusercontent.com/u/477673?v=4&s=48" width="48" height="48" alt="voidserf" title="voidserf"/></a> <a href="https://github.com/wstock"><img src="https://avatars.githubusercontent.com/u/1394687?v=4&s=48" width="48" height="48" alt="wstock" title="wstock"/></a> <a href="https://github.com/search?q=Zach%20Knickerbocker"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Zach Knickerbocker" title="Zach Knickerbocker"/></a> <a href="https://github.com/Alphonse-arianee"><img src="https://avatars.githubusercontent.com/u/254457365?v=4&s=48" width="48" height="48" alt="Alphonse-arianee" title="Alphonse-arianee"/></a> <a href="https://github.com/search?q=Azade"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Azade" title="Azade"/></a> <a href="https://github.com/carlulsoe"><img src="https://avatars.githubusercontent.com/u/34673973?v=4&s=48" width="48" height="48" alt="carlulsoe" title="carlulsoe"/></a> <a href="https://github.com/search?q=ddyo"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ddyo" title="ddyo"/></a> <a href="https://github.com/search?q=Erik"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Erik" title="Erik"/></a> <a href="https://github.com/latitudeki5223"><img src="https://avatars.githubusercontent.com/u/119656367?v=4&s=48" width="48" height="48" alt="latitudeki5223" title="latitudeki5223"/></a>
+  <a href="https://github.com/search?q=ddyo"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ddyo" title="ddyo"/></a> <a href="https://github.com/search?q=Erik"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Erik" title="Erik"/></a> <a href="https://github.com/latitudeki5223"><img src="https://avatars.githubusercontent.com/u/119656367?v=4&s=48" width="48" height="48" alt="latitudeki5223" title="latitudeki5223"/></a> <a href="https://github.com/search?q=Manuel%20Maly"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Manuel Maly" title="Manuel Maly"/></a> <a href="https://github.com/search?q=Mourad%20Boustani"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mourad Boustani" title="Mourad Boustani"/></a> <a href="https://github.com/pcty-nextgen-ios-builder"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="pcty-nextgen-ios-builder" title="pcty-nextgen-ios-builder"/></a> <a href="https://github.com/search?q=Quentin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Quentin" title="Quentin"/></a> <a href="https://github.com/search?q=Randy%20Torres"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Randy Torres" title="Randy Torres"/></a> <a href="https://github.com/rhjoh"><img src="https://avatars.githubusercontent.com/u/105699450?v=4&s=48" width="48" height="48" alt="rhjoh" title="rhjoh"/></a> <a href="https://github.com/ronak-guliani"><img src="https://avatars.githubusercontent.com/u/23518228?v=4&s=48" width="48" height="48" alt="ronak-guliani" title="ronak-guliani"/></a>
-  <a href="https://github.com/search?q=Manuel%20Maly"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Manuel Maly" title="Manuel Maly"/></a> <a href="https://github.com/search?q=Mourad%20Boustani"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mourad Boustani" title="Mourad Boustani"/></a> <a href="https://github.com/pcty-nextgen-ios-builder"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="pcty-nextgen-ios-builder" title="pcty-nextgen-ios-builder"/></a> <a href="https://github.com/search?q=Quentin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Quentin" title="Quentin"/></a> <a href="https://github.com/search?q=Randy%20Torres"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Randy Torres" title="Randy Torres"/></a> <a href="https://github.com/rhjoh"><img src="https://avatars.githubusercontent.com/u/105699450?v=4&s=48" width="48" height="48" alt="rhjoh" title="rhjoh"/></a> <a href="https://github.com/ronak-guliani"><img src="https://avatars.githubusercontent.com/u/23518228?v=4&s=48" width="48" height="48" alt="ronak-guliani" title="ronak-guliani"/></a> <a href="https://github.com/search?q=William%20Stock"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="William Stock" title="William Stock"/></a>
+  <a href="https://github.com/search?q=William%20Stock"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="William Stock" title="William Stock"/></a>
 </p>
@@ -43,7 +43,7 @@
      "location" : "https://github.com/steipete/Peekaboo.git",
      "state" : {
        "branch" : "main",
-        "revision" : "bace59f90bb276f1c6fb613acfda3935ec4a7a90"
+        "revision" : "b2d0384d9f0f45b945d5f718f8a865bd574d83c2"
      }
    },
    {
@@ -1,64 +0,0 @@
 # Clawdbot macOS app (dev + signing)
 ## Quick dev run
 ```bash
 # from repo root
 scripts/restart-mac.sh
 ```
 Options:
 ```bash
 scripts/restart-mac.sh --no-sign   # fastest dev; ad-hoc signing (TCC permissions do not stick)
 scripts/restart-mac.sh --sign      # force code signing (requires cert)
 ```
 ## Packaging flow
 ```bash
 scripts/package-mac-app.sh
 ```
 Creates `dist/Clawdbot.app` and signs it via `scripts/codesign-mac-app.sh`.
 ## Signing behavior
 Auto-selects identity (first match):
 1) Developer ID Application
 2) Apple Distribution
 3) Apple Development
 4) first available identity
 If none found:
 - errors by default
 - set `ALLOW_ADHOC_SIGNING=1` or `SIGN_IDENTITY="-"` to ad-hoc sign
 ## Team ID audit (Sparkle mismatch guard)
 After signing, we read the app bundle Team ID and compare every Mach-O inside the app.
 If any embedded binary has a different Team ID, signing fails.
 Skip the audit:
 ```bash
 SKIP_TEAM_ID_CHECK=1 scripts/package-mac-app.sh
 ```
 ## Library validation workaround (dev only)
 If Sparkle Team ID mismatch blocks loading (common with Apple Development certs), opt in:
 ```bash
 DISABLE_LIBRARY_VALIDATION=1 scripts/package-mac-app.sh
 ```
 This adds `com.apple.security.cs.disable-library-validation` to app entitlements.
 Use for local dev only; keep off for release builds.
 ## Useful env flags
 - `SIGN_IDENTITY="Apple Development: Your Name (TEAMID)"`
 - `ALLOW_ADHOC_SIGNING=1` (ad-hoc, TCC permissions do not persist)
 - `CODESIGN_TIMESTAMP=off` (offline debug)
 - `DISABLE_LIBRARY_VALIDATION=1` (dev-only Sparkle workaround)
 - `SKIP_TEAM_ID_CHECK=1` (bypass audit)
@@ -8,8 +8,6 @@ struct BridgeNodeInfo: Sendable {
    var displayName: String?
    var platform: String?
    var version: String?
    var coreVersion: String?
    var uiVersion: String?
    var deviceFamily: String?
    var modelIdentifier: String?
    var remoteAddress: String?
@@ -149,8 +147,6 @@ actor BridgeConnectionHandler {
                        displayName: hello.displayName,
                        platform: hello.platform,
                        version: hello.version,
                        coreVersion: hello.coreVersion,
                        uiVersion: hello.uiVersion,
                        deviceFamily: hello.deviceFamily,
                        modelIdentifier: hello.modelIdentifier,
                        remoteAddress: self.remoteAddressString(),
@@ -175,8 +171,6 @@ actor BridgeConnectionHandler {
                displayName: req.displayName,
                platform: req.platform,
                version: req.version,
                coreVersion: req.coreVersion,
                uiVersion: req.uiVersion,
                deviceFamily: req.deviceFamily,
                modelIdentifier: req.modelIdentifier,
                caps: req.caps,
@@ -192,8 +186,6 @@ actor BridgeConnectionHandler {
                        displayName: enriched.displayName,
                        platform: enriched.platform,
                        version: enriched.version,
                        coreVersion: enriched.coreVersion,
                        uiVersion: enriched.uiVersion,
                        deviceFamily: enriched.deviceFamily,
                        modelIdentifier: enriched.modelIdentifier,
                        remoteAddress: enriched.remoteAddress,
@@ -1,4 +1,3 @@
 import CryptoKit
 import Foundation
 import OSLog
 import Security
@@ -122,13 +121,6 @@ struct ExecApprovalsFile: Codable {
    var agents: [String: ExecApprovalsAgent]?
 }
 struct ExecApprovalsSnapshot: Codable {
    var path: String
    var exists: Bool
    var hash: String
    var file: ExecApprovalsFile
 }
 struct ExecApprovalsResolved {
    let url: URL
    let socketPath: String
@@ -161,58 +153,6 @@ enum ExecApprovalsStore {
        ClawdbotPaths.stateDirURL.appendingPathComponent("exec-approvals.sock").path
    }
    static func normalizeIncoming(_ file: ExecApprovalsFile) -> ExecApprovalsFile {
        let socketPath = file.socket?.path?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
        let token = file.socket?.token?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
        return ExecApprovalsFile(
            version: 1,
            socket: ExecApprovalsSocketConfig(
                path: socketPath.isEmpty ? nil : socketPath,
                token: token.isEmpty ? nil : token),
            defaults: file.defaults,
            agents: file.agents)
    }
    static func readSnapshot() -> ExecApprovalsSnapshot {
        let url = self.fileURL()
        guard FileManager.default.fileExists(atPath: url.path) else {
            return ExecApprovalsSnapshot(
                path: url.path,
                exists: false,
                hash: self.hashRaw(nil),
                file: ExecApprovalsFile(version: 1, socket: nil, defaults: nil, agents: [:]))
        }
        let raw = try? String(contentsOf: url, encoding: .utf8)
        let data = raw.flatMap { $0.data(using: .utf8) }
        let decoded: ExecApprovalsFile = {
            if let data, let file = try? JSONDecoder().decode(ExecApprovalsFile.self, from: data), file.version == 1 {
                return file
            }
            return ExecApprovalsFile(version: 1, socket: nil, defaults: nil, agents: [:])
        }()
        return ExecApprovalsSnapshot(
            path: url.path,
            exists: true,
            hash: self.hashRaw(raw),
            file: decoded)
    }
    static func redactForSnapshot(_ file: ExecApprovalsFile) -> ExecApprovalsFile {
        let socketPath = file.socket?.path?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
        if socketPath.isEmpty {
            return ExecApprovalsFile(
                version: file.version,
                socket: nil,
                defaults: file.defaults,
                agents: file.agents)
        }
        return ExecApprovalsFile(
            version: file.version,
            socket: ExecApprovalsSocketConfig(path: socketPath, token: nil),
            defaults: file.defaults,
            agents: file.agents)
    }
    static func loadFile() -> ExecApprovalsFile {
        let url = self.fileURL()
        guard FileManager.default.fileExists(atPath: url.path) else {
@@ -432,12 +372,6 @@ enum ExecApprovalsStore {
        return UUID().uuidString
    }
    private static func hashRaw(_ raw: String?) -> String {
        let data = Data((raw ?? "").utf8)
        let digest = SHA256.hash(data: data)
        return digest.map { String(format: "%02x", $0) }.joined()
    }
    private static func expandPath(_ raw: String) -> String {
        let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
        if trimmed == "~" {
@@ -1,6 +1,5 @@
 import AppKit
 import ClawdbotKit
 import CryptoKit
 import Darwin
 import Foundation
 import OSLog
@@ -28,49 +27,6 @@ private struct ExecApprovalSocketDecision: Codable {
    var decision: ExecApprovalDecision
 }
 fileprivate struct ExecHostSocketRequest: Codable {
    var type: String
    var id: String
    var nonce: String
    var ts: Int
    var hmac: String
    var requestJson: String
 }
 fileprivate struct ExecHostRequest: Codable {
    var command: [String]
    var rawCommand: String?
    var cwd: String?
    var env: [String: String]?
    var timeoutMs: Int?
    var needsScreenRecording: Bool?
    var agentId: String?
    var sessionKey: String?
 }
 fileprivate struct ExecHostRunResult: Codable {
    var exitCode: Int?
    var timedOut: Bool
    var success: Bool
    var stdout: String
    var stderr: String
    var error: String?
 }
 fileprivate struct ExecHostError: Codable {
    var code: String
    var message: String
    var reason: String?
 }
 fileprivate struct ExecHostResponse: Codable {
    var type: String
    var id: String
    var ok: Bool
    var payload: ExecHostRunResult?
    var error: ExecHostError?
 }
 enum ExecApprovalsSocketClient {
    private struct TimeoutError: LocalizedError {
        var message: String
@@ -190,9 +146,6 @@ final class ExecApprovalsPromptServer {
            token: approvals.token,
            onPrompt: { request in
                await ExecApprovalsPromptPresenter.prompt(request)
            },
            onExec: { request in
                await ExecHostExecutor.handle(request)
            })
        server.start()
        self.server = server
@@ -253,182 +206,11 @@ enum ExecApprovalsPromptPresenter {
    }
 }
@MainActor
 fileprivate enum ExecHostExecutor {
    private static let blockedEnvKeys: Set<String> = [
        "PATH",
        "NODE_OPTIONS",
        "PYTHONHOME",
        "PYTHONPATH",
        "PERL5LIB",
        "PERL5OPT",
        "RUBYOPT",
    ]
    private static let blockedEnvPrefixes: [String] = [
        "DYLD_",
        "LD_",
    ]
    static func handle(_ request: ExecHostRequest) async -> ExecHostResponse {
        let command = request.command.map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
        guard !command.isEmpty else {
            return ExecHostResponse(
                type: "exec-res",
                id: UUID().uuidString,
                ok: false,
                payload: nil,
                error: ExecHostError(code: "INVALID_REQUEST", message: "command required", reason: "invalid"))
        }
        let displayCommand = ExecCommandFormatter.displayString(
            for: command,
            rawCommand: request.rawCommand)
        let agentId = request.agentId?.trimmingCharacters(in: .whitespacesAndNewlines)
        let trimmedAgent = (agentId?.isEmpty == false) ? agentId : nil
        let approvals = ExecApprovalsStore.resolve(agentId: trimmedAgent)
        let security = approvals.agent.security
        let ask = approvals.agent.ask
        let autoAllowSkills = approvals.agent.autoAllowSkills
        let env = self.sanitizedEnv(request.env)
        let resolution = ExecCommandResolution.resolve(
            command: command,
            rawCommand: request.rawCommand,
            cwd: request.cwd,
            env: env)
        let allowlistMatch = security == .allowlist
            ? ExecAllowlistMatcher.match(entries: approvals.allowlist, resolution: resolution)
            : nil
        let skillAllow: Bool
        if autoAllowSkills, let name = resolution?.executableName {
            let bins = await SkillBinsCache.shared.currentBins()
            skillAllow = bins.contains(name)
        } else {
            skillAllow = false
        }
        if security == .deny {
            return ExecHostResponse(
                type: "exec-res",
                id: UUID().uuidString,
                ok: false,
                payload: nil,
                error: ExecHostError(code: "UNAVAILABLE", message: "SYSTEM_RUN_DISABLED: security=deny", reason: "security=deny"))
        }
        let requiresAsk: Bool = {
            if ask == .always { return true }
            if ask == .onMiss && security == .allowlist && allowlistMatch == nil && !skillAllow { return true }
            return false
        }()
        var approvedByAsk = false
        if requiresAsk {
            let decision = ExecApprovalsPromptPresenter.prompt(
                ExecApprovalPromptRequest(
                    command: displayCommand,
                    cwd: request.cwd,
                    host: "node",
                    security: security.rawValue,
                    ask: ask.rawValue,
                    agentId: trimmedAgent,
                    resolvedPath: resolution?.resolvedPath))
            switch decision {
            case .deny:
                return ExecHostResponse(
                    type: "exec-res",
                    id: UUID().uuidString,
                    ok: false,
                    payload: nil,
                    error: ExecHostError(code: "UNAVAILABLE", message: "SYSTEM_RUN_DENIED: user denied", reason: "user-denied"))
            case .allowAlways:
                approvedByAsk = true
                if security == .allowlist {
                    let pattern = resolution?.resolvedPath ?? resolution?.rawExecutable ?? command.first ?? ""
                    if !pattern.isEmpty {
                        ExecApprovalsStore.addAllowlistEntry(agentId: trimmedAgent, pattern: pattern)
                    }
                }
            case .allowOnce:
                approvedByAsk = true
            }
        }
        if security == .allowlist && allowlistMatch == nil && !skillAllow && !approvedByAsk {
            return ExecHostResponse(
                type: "exec-res",
                id: UUID().uuidString,
                ok: false,
                payload: nil,
                error: ExecHostError(code: "UNAVAILABLE", message: "SYSTEM_RUN_DENIED: allowlist miss", reason: "allowlist-miss"))
        }
        if let match = allowlistMatch {
            ExecApprovalsStore.recordAllowlistUse(
                agentId: trimmedAgent,
                pattern: match.pattern,
                command: displayCommand,
                resolvedPath: resolution?.resolvedPath)
        }
        if request.needsScreenRecording == true {
            let authorized = await PermissionManager
                .status([.screenRecording])[.screenRecording] ?? false
            if !authorized {
                return ExecHostResponse(
                    type: "exec-res",
                    id: UUID().uuidString,
                    ok: false,
                    payload: nil,
                    error: ExecHostError(code: "UNAVAILABLE", message: "PERMISSION_MISSING: screenRecording", reason: "permission:screenRecording"))
            }
        }
        let timeoutSec = request.timeoutMs.flatMap { Double($0) / 1000.0 }
        let result = await Task.detached { () -> ShellExecutor.ShellResult in
            await ShellExecutor.runDetailed(
                command: command,
                cwd: request.cwd,
                env: env,
                timeout: timeoutSec)
        }.value
        let payload = ExecHostRunResult(
            exitCode: result.exitCode,
            timedOut: result.timedOut,
            success: result.success,
            stdout: result.stdout,
            stderr: result.stderr,
            error: result.errorMessage)
        return ExecHostResponse(
            type: "exec-res",
            id: UUID().uuidString,
            ok: true,
            payload: payload,
            error: nil)
    }
    private static func sanitizedEnv(_ overrides: [String: String]?) -> [String: String]? {
        guard let overrides else { return nil }
        var merged = ProcessInfo.processInfo.environment
        for (rawKey, value) in overrides {
            let key = rawKey.trimmingCharacters(in: .whitespacesAndNewlines)
            guard !key.isEmpty else { continue }
            let upper = key.uppercased()
            if self.blockedEnvKeys.contains(upper) { continue }
            if self.blockedEnvPrefixes.contains(where: { upper.hasPrefix($0) }) { continue }
            merged[key] = value
        }
        return merged
    }
 }
 private final class ExecApprovalsSocketServer: @unchecked Sendable {
    private let logger = Logger(subsystem: "com.clawdbot", category: "exec-approvals.socket")
    private let socketPath: String
    private let token: String
    private let onPrompt: @Sendable (ExecApprovalPromptRequest) async -> ExecApprovalDecision
    private let onExec: @Sendable (ExecHostRequest) async -> ExecHostResponse
    private var socketFD: Int32 = -1
    private var acceptTask: Task<Void, Never>?
    private var isRunning = false
@@ -436,13 +218,11 @@ private final class ExecApprovalsSocketServer: @unchecked Sendable {
    init(
        socketPath: String,
        token: String,
-        onPrompt: @escaping @Sendable (ExecApprovalPromptRequest) async -> ExecApprovalDecision,
+        onPrompt: @escaping @Sendable (ExecApprovalPromptRequest) async -> ExecApprovalDecision)
        onExec: @escaping @Sendable (ExecHostRequest) async -> ExecHostResponse)
    {
        self.socketPath = socketPath
        self.token = token
        self.onPrompt = onPrompt
        self.onExec = onExec
    }
    func start() {
@@ -537,39 +317,26 @@ private final class ExecApprovalsSocketServer: @unchecked Sendable {
    private func handleClient(fd: Int32) async {
        let handle = FileHandle(fileDescriptor: fd, closeOnDealloc: true)
        do {
            guard self.isAllowedPeer(fd: fd) else {
                try self.sendApprovalResponse(handle: handle, id: UUID().uuidString, decision: .deny)
                return
            }
            guard let line = try self.readLine(from: handle, maxBytes: 256_000),
                  let data = line.data(using: .utf8)
            else {
                return
            }
-            guard
+            let request = try JSONDecoder().decode(ExecApprovalSocketRequest.self, from: data)
-                let envelope = try JSONSerialization.jsonObject(with: data) as? [String: Any],
+            guard request.type == "request", request.token == self.token else {
-                let type = envelope["type"] as? String
+                let response = ExecApprovalSocketDecision(type: "decision", id: request.id, decision: .deny)
-            else {
+                let data = try JSONEncoder().encode(response)
-                return
+                var payload = data
-            }
+                payload.append(0x0A)
-
+                try handle.write(contentsOf: payload)
            if type == "request" {
                let request = try JSONDecoder().decode(ExecApprovalSocketRequest.self, from: data)
                guard request.token == self.token else {
                    try self.sendApprovalResponse(handle: handle, id: request.id, decision: .deny)
                    return
                }
                let decision = await self.onPrompt(request.request)
                try self.sendApprovalResponse(handle: handle, id: request.id, decision: decision)
                return
            }
            if type == "exec" {
                let request = try JSONDecoder().decode(ExecHostSocketRequest.self, from: data)
                let response = await self.handleExecRequest(request)
                try self.sendExecResponse(handle: handle, response: response)
                return
            }
            let decision = await self.onPrompt(request.request)
            let response = ExecApprovalSocketDecision(type: "decision", id: request.id, decision: decision)
            let responseData = try JSONEncoder().encode(response)
            var payload = responseData
            payload.append(0x0A)
            try handle.write(contentsOf: payload)
        } catch {
            self.logger.error("exec approvals socket handling failed: \(error.localizedDescription, privacy: .public)")
        }
@@ -590,77 +357,4 @@ private final class ExecApprovalsSocketServer: @unchecked Sendable {
        let lineData = buffer.subdata(in: 0..<newlineIndex)
        return String(data: lineData, encoding: .utf8)
    }
    private func sendApprovalResponse(
        handle: FileHandle,
        id: String,
        decision: ExecApprovalDecision) throws
    {
        let response = ExecApprovalSocketDecision(type: "decision", id: id, decision: decision)
        let data = try JSONEncoder().encode(response)
        var payload = data
        payload.append(0x0A)
        try handle.write(contentsOf: payload)
    }
    private func sendExecResponse(handle: FileHandle, response: ExecHostResponse) throws {
        let data = try JSONEncoder().encode(response)
        var payload = data
        payload.append(0x0A)
        try handle.write(contentsOf: payload)
    }
    private func isAllowedPeer(fd: Int32) -> Bool {
        var uid = uid_t(0)
        var gid = gid_t(0)
        if getpeereid(fd, &uid, &gid) != 0 {
            return false
        }
        return uid == geteuid()
    }
    private func handleExecRequest(_ request: ExecHostSocketRequest) async -> ExecHostResponse {
        let nowMs = Int(Date().timeIntervalSince1970 * 1000)
        if abs(nowMs - request.ts) > 10_000 {
            return ExecHostResponse(
                type: "exec-res",
                id: request.id,
                ok: false,
                payload: nil,
                error: ExecHostError(code: "INVALID_REQUEST", message: "expired request", reason: "ttl"))
        }
        let expected = self.hmacHex(nonce: request.nonce, ts: request.ts, requestJson: request.requestJson)
        if expected != request.hmac {
            return ExecHostResponse(
                type: "exec-res",
                id: request.id,
                ok: false,
                payload: nil,
                error: ExecHostError(code: "INVALID_REQUEST", message: "invalid auth", reason: "hmac"))
        }
        guard let requestData = request.requestJson.data(using: .utf8),
              let payload = try? JSONDecoder().decode(ExecHostRequest.self, from: requestData)
        else {
            return ExecHostResponse(
                type: "exec-res",
                id: request.id,
                ok: false,
                payload: nil,
                error: ExecHostError(code: "INVALID_REQUEST", message: "invalid payload", reason: "json"))
        }
        let response = await self.onExec(payload)
        return ExecHostResponse(
            type: "exec-res",
            id: request.id,
            ok: response.ok,
            payload: response.payload,
            error: response.error)
    }
    private func hmacHex(nonce: String, ts: Int, requestJson: String) -> String {
        let key = SymmetricKey(data: Data(self.token.utf8))
        let message = "\(nonce):\(ts):\(requestJson)"
        let mac = HMAC<SHA256>.authenticationCode(for: Data(message.utf8), using: key)
        return mac.map { String(format: "%02x", $0) }.joined()
    }
 }
@@ -249,13 +249,6 @@ actor GatewayConnection {
        return trimmed.isEmpty ? nil : trimmed
    }
    func cachedGatewayVersion() -> String? {
        guard let snapshot = self.lastSnapshot else { return nil }
        let raw = snapshot.server["version"]?.value as? String
        let trimmed = raw?.trimmingCharacters(in: CharacterSet.whitespacesAndNewlines) ?? ""
        return trimmed.isEmpty ? nil : trimmed
    }
    func snapshotPaths() -> (configPath: String?, stateDir: String?) {
        guard let snapshot = self.lastSnapshot else { return (nil, nil) }
        let configPath = snapshot.snapshot.configpath?.trimmingCharacters(in: .whitespacesAndNewlines)
@@ -14,7 +14,6 @@ final class MenuSessionsInjector: NSObject, NSMenuDelegate {
    private weak var statusItem: NSStatusItem?
    private var loadTask: Task<Void, Never>?
    private var nodesLoadTask: Task<Void, Never>?
    private var previewTasks: [Task<Void, Never>] = []
    private var isMenuOpen = false
    private var lastKnownMenuWidth: CGFloat?
    private var menuOpenWidth: CGFloat?
@@ -88,7 +87,6 @@ final class MenuSessionsInjector: NSObject, NSMenuDelegate {
        self.menuOpenWidth = nil
        self.loadTask?.cancel()
        self.nodesLoadTask?.cancel()
        self.cancelPreviewTasks()
    }
    func menuNeedsUpdate(_ menu: NSMenu) {
@@ -109,7 +107,6 @@ extension MenuSessionsInjector {
    private var mainSessionKey: String { WorkActivityStore.shared.mainSessionKey }
    private func inject(into menu: NSMenu) {
        self.cancelPreviewTasks()
        // Remove any previous injected items.
        for item in menu.items where item.tag == self.tag {
            menu.removeItem(item)
@@ -283,7 +280,9 @@ extension MenuSessionsInjector {
    private func insertUsageSection(into menu: NSMenu, at cursor: Int, width: CGFloat) -> Int {
        let rows = self.usageRows
-        if rows.isEmpty {
+        let errorText = self.cachedUsageErrorText
        if rows.isEmpty, errorText == nil {
            return cursor
        }
@@ -307,6 +306,25 @@ extension MenuSessionsInjector {
        menu.insertItem(headerItem, at: cursor)
        cursor += 1
        if let errorText = errorText?.nonEmpty, !rows.isEmpty {
            menu.insertItem(
                self.makeMessageItem(
                    text: errorText,
                    symbolName: "exclamationmark.triangle",
                    width: width,
                    maxLines: 2),
                at: cursor)
            cursor += 1
        }
        if rows.isEmpty {
            menu.insertItem(
                self.makeMessageItem(text: errorText ?? "No usage available", symbolName: "minus", width: width),
                at: cursor)
            cursor += 1
            return cursor
        }
        if let selectedProvider = self.selectedUsageProviderId,
           let primary = rows.first(where: { $0.providerId.lowercased() == selectedProvider }),
           rows.count > 1
@@ -422,8 +440,6 @@ extension MenuSessionsInjector {
            displayName: "Gateway",
            platform: platform,
            version: nil,
            coreVersion: nil,
            uiVersion: nil,
            deviceFamily: nil,
            modelIdentifier: nil,
            remoteIp: host,
@@ -457,46 +473,15 @@ extension MenuSessionsInjector {
        item.tag = self.tag
        item.isEnabled = false
        let view = AnyView(SessionMenuPreviewView(
            sessionKey: sessionKey,
            width: width,
            maxItems: 10,
            maxLines: maxLines,
-            title: title,
+            title: title))
-            items: [],
+        item.view = self.makeHostedView(rootView: view, width: width, highlighted: false)
            status: .loading))
        let hosting = NSHostingView(rootView: view)
        hosting.frame.size.width = max(1, width)
        let size = hosting.fittingSize
        hosting.frame = NSRect(origin: .zero, size: NSSize(width: width, height: size.height))
        item.view = hosting
        let task = Task { [weak hosting] in
            let snapshot = await SessionMenuPreviewLoader.load(sessionKey: sessionKey, maxItems: 10)
            guard !Task.isCancelled else { return }
            await MainActor.run {
                guard let hosting else { return }
                let nextView = AnyView(SessionMenuPreviewView(
                    width: width,
                    maxLines: maxLines,
                    title: title,
                    items: snapshot.items,
                    status: snapshot.status))
                hosting.rootView = nextView
                hosting.invalidateIntrinsicContentSize()
                hosting.frame.size.width = max(1, width)
                let size = hosting.fittingSize
                hosting.frame.size.height = size.height
            }
        }
        self.previewTasks.append(task)
        return item
    }
    private func cancelPreviewTasks() {
        for task in self.previewTasks {
            task.cancel()
        }
        self.previewTasks.removeAll()
    }
    private func makeMessageItem(text: String, symbolName: String, width: CGFloat, maxLines: Int? = 2) -> NSMenuItem {
        let view = AnyView(
            HStack(alignment: .top, spacing: 8) {
@@ -574,11 +559,14 @@ extension MenuSessionsInjector {
        do {
            self.cachedUsageSummary = try await UsageLoader.loadSummary()
        } catch {
            self.cachedUsageSummary = nil
            self.cachedUsageErrorText = nil
            self.usageCacheUpdatedAt = Date()
        } catch {
            if self.cachedUsageSummary == nil {
                self.cachedUsageErrorText = self.compactUsageError(error)
            }
            self.usageCacheUpdatedAt = Date()
        }
        self.usageCacheUpdatedAt = Date()
    }
    private func compactUsageError(_ error: Error) -> String {
@@ -759,8 +747,8 @@ extension MenuSessionsInjector {
            menu.addItem(self.makeNodeCopyItem(label: "Platform", value: platform))
        }
-        if let version = NodeMenuEntryFormatter.detailRightVersion(entry)?.nonEmpty {
+        if let version = entry.version?.nonEmpty {
-            menu.addItem(self.makeNodeCopyItem(label: "Version", value: version))
+            menu.addItem(self.makeNodeCopyItem(label: "Version", value: self.formatVersionLabel(version)))
        }
        menu.addItem(self.makeNodeDetailItem(label: "Connected", value: entry.isConnected ? "Yes" : "No"))
@@ -95,8 +95,6 @@ actor MacNodeBridgePairingClient {
                    displayName: hello.displayName,
                    platform: hello.platform,
                    version: hello.version,
                    coreVersion: hello.coreVersion,
                    uiVersion: hello.uiVersion,
                    deviceFamily: hello.deviceFamily,
                    modelIdentifier: hello.modelIdentifier,
                    caps: hello.caps,
@@ -114,19 +114,12 @@ final class MacNodeModeCoordinator {
        let caps = self.currentCaps()
        let commands = self.currentCommands(caps: caps)
        let permissions = await self.currentPermissions()
        let uiVersion = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String
        let liveGatewayVersion = await GatewayConnection.shared.cachedGatewayVersion()
        let fallbackGatewayVersion = GatewayProcessManager.shared.environmentStatus.gatewayVersion
        let coreVersion = (liveGatewayVersion ?? fallbackGatewayVersion)?
            .trimmingCharacters(in: .whitespacesAndNewlines)
        return BridgeHello(
            nodeId: Self.nodeId(),
            displayName: InstanceIdentity.displayName,
            token: token,
            platform: "macos",
-            version: uiVersion,
+            version: Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String,
            coreVersion: coreVersion?.isEmpty == false ? coreVersion : nil,
            uiVersion: uiVersion,
            deviceFamily: "Mac",
            modelIdentifier: InstanceIdentity.modelIdentifier,
            caps: caps,
@@ -165,8 +158,6 @@ final class MacNodeModeCoordinator {
            ClawdbotSystemCommand.notify.rawValue,
            ClawdbotSystemCommand.which.rawValue,
            ClawdbotSystemCommand.run.rawValue,
            ClawdbotSystemCommand.execApprovalsGet.rawValue,
            ClawdbotSystemCommand.execApprovalsSet.rawValue,
        ]
        let capsSet = Set(caps)
@@ -64,10 +64,6 @@ actor MacNodeRuntime {
                return try await self.handleSystemWhich(req)
            case ClawdbotSystemCommand.notify.rawValue:
                return try await self.handleSystemNotify(req)
            case ClawdbotSystemCommand.execApprovalsGet.rawValue:
                return try await self.handleSystemExecApprovalsGet(req)
            case ClawdbotSystemCommand.execApprovalsSet.rawValue:
                return try await self.handleSystemExecApprovalsSet(req)
            default:
                return Self.errorResponse(req, code: .invalidRequest, message: "INVALID_REQUEST: unknown command")
            }
@@ -680,72 +676,6 @@ actor MacNodeRuntime {
        return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: payload)
    }
    private func handleSystemExecApprovalsGet(_ req: BridgeInvokeRequest) async throws -> BridgeInvokeResponse {
        _ = ExecApprovalsStore.ensureFile()
        let snapshot = ExecApprovalsStore.readSnapshot()
        let redacted = ExecApprovalsSnapshot(
            path: snapshot.path,
            exists: snapshot.exists,
            hash: snapshot.hash,
            file: ExecApprovalsStore.redactForSnapshot(snapshot.file))
        let payload = try Self.encodePayload(redacted)
        return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: payload)
    }
    private func handleSystemExecApprovalsSet(_ req: BridgeInvokeRequest) async throws -> BridgeInvokeResponse {
        struct SetParams: Decodable {
            var file: ExecApprovalsFile
            var baseHash: String?
        }
        let params = try Self.decodeParams(SetParams.self, from: req.paramsJSON)
        let current = ExecApprovalsStore.ensureFile()
        let snapshot = ExecApprovalsStore.readSnapshot()
        if snapshot.exists {
            if snapshot.hash.isEmpty {
                return Self.errorResponse(
                    req,
                    code: .invalidRequest,
                    message: "INVALID_REQUEST: exec approvals base hash unavailable; reload and retry")
            }
            let baseHash = params.baseHash?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
            if baseHash.isEmpty {
                return Self.errorResponse(
                    req,
                    code: .invalidRequest,
                    message: "INVALID_REQUEST: exec approvals base hash required; reload and retry")
            }
            if baseHash != snapshot.hash {
                return Self.errorResponse(
                    req,
                    code: .invalidRequest,
                    message: "INVALID_REQUEST: exec approvals changed; reload and retry")
            }
        }
        var normalized = ExecApprovalsStore.normalizeIncoming(params.file)
        let socketPath = normalized.socket?.path?.trimmingCharacters(in: .whitespacesAndNewlines)
        let token = normalized.socket?.token?.trimmingCharacters(in: .whitespacesAndNewlines)
        let resolvedPath = (socketPath?.isEmpty == false)
            ? socketPath!
            : current.socket?.path?.trimmingCharacters(in: .whitespacesAndNewlines) ??
                ExecApprovalsStore.socketPath()
        let resolvedToken = (token?.isEmpty == false)
            ? token!
            : current.socket?.token?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
        normalized.socket = ExecApprovalsSocketConfig(path: resolvedPath, token: resolvedToken)
        ExecApprovalsStore.saveFile(normalized)
        let nextSnapshot = ExecApprovalsStore.readSnapshot()
        let redacted = ExecApprovalsSnapshot(
            path: nextSnapshot.path,
            exists: nextSnapshot.exists,
            hash: nextSnapshot.hash,
            file: ExecApprovalsStore.redactForSnapshot(nextSnapshot.file))
        let payload = try Self.encodePayload(redacted)
        return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: payload)
    }
    private func emitExecEvent(_ event: String, payload: ExecEventPayload) async {
        guard let sender = self.eventSender else { return }
        guard let data = try? JSONEncoder().encode(payload),
@@ -35,9 +35,8 @@ struct NodeMenuEntryFormatter {
        if let platform = self.platformText(entry) {
            parts.append("platform \(platform)")
        }
-        let versionLabels = self.versionLabels(entry)
+        if let version = entry.version?.nonEmpty {
-        if !versionLabels.isEmpty {
+            parts.append("app \(self.compactVersion(version))")
            parts.append(versionLabels.joined(separator: " · "))
        }
        parts.append("status \(self.roleText(entry))")
        return parts.joined(separator: " · ")
@@ -61,9 +60,8 @@ struct NodeMenuEntryFormatter {
    }
    static func detailRightVersion(_ entry: NodeInfo) -> String? {
-        let labels = self.versionLabels(entry, compact: false)
+        guard let version = entry.version?.nonEmpty else { return nil }
-        if labels.isEmpty { return nil }
+        return self.shortVersionLabel(version)
        return labels.joined(separator: " · ")
    }
    static func platformText(_ entry: NodeInfo) -> String? {
@@ -129,39 +127,6 @@ struct NodeMenuEntryFormatter {
        return compact
    }
    private static func versionLabels(_ entry: NodeInfo, compact: Bool = true) -> [String] {
        let (core, ui) = self.resolveVersions(entry)
        var labels: [String] = []
        if let core {
            let label = compact ? self.compactVersion(core) : self.shortVersionLabel(core)
            labels.append("core \(label)")
        }
        if let ui {
            let label = compact ? self.compactVersion(ui) : self.shortVersionLabel(ui)
            labels.append("ui \(label)")
        }
        return labels
    }
    private static func resolveVersions(_ entry: NodeInfo) -> (core: String?, ui: String?) {
        let core = entry.coreVersion?.nonEmpty
        let ui = entry.uiVersion?.nonEmpty
        if core != nil || ui != nil {
            return (core, ui)
        }
        guard let legacy = entry.version?.nonEmpty else { return (nil, nil) }
        if self.isHeadlessPlatform(entry) {
            return (legacy, nil)
        }
        return (nil, legacy)
    }
    private static func isHeadlessPlatform(_ entry: NodeInfo) -> Bool {
        let raw = entry.platform?.trimmingCharacters(in: .whitespacesAndNewlines).lowercased() ?? ""
        if raw == "darwin" || raw == "linux" || raw == "win32" || raw == "windows" { return true }
        return false
    }
    static func leadingSymbol(_ entry: NodeInfo) -> String {
        if self.isGateway(entry) {
            return self.safeSystemSymbol(
@@ -7,8 +7,6 @@ struct NodeInfo: Identifiable, Codable {
    let displayName: String?
    let platform: String?
    let version: String?
    let coreVersion: String?
    let uiVersion: String?
    let deviceFamily: String?
    let modelIdentifier: String?
    let remoteIp: String?
@@ -3,13 +3,13 @@ import ClawdbotKit
 import OSLog
 import SwiftUI
-struct SessionPreviewItem: Identifiable, Sendable {
+private struct SessionPreviewItem: Identifiable, Sendable {
    let id: String
    let role: PreviewRole
    let text: String
 }
-enum PreviewRole: String, Sendable {
+private enum PreviewRole: String, Sendable {
    case user
    case assistant
    case tool
@@ -27,7 +27,7 @@ enum PreviewRole: String, Sendable {
    }
 }
-actor SessionPreviewCache {
+private actor SessionPreviewCache {
    static let shared = SessionPreviewCache()
    private struct CacheEntry {
@@ -52,33 +52,25 @@ actor SessionPreviewCache {
    }
 }
 #if DEBUG
 extension SessionPreviewCache {
    func _testSet(items: [SessionPreviewItem], for sessionKey: String, updatedAt: Date = Date()) {
        self.entries[sessionKey] = CacheEntry(items: items, updatedAt: updatedAt)
    }
    func _testReset() {
        self.entries = [:]
    }
 }
 #endif
 struct SessionMenuPreviewSnapshot: Sendable {
    let items: [SessionPreviewItem]
    let status: SessionMenuPreviewView.LoadStatus
 }
 struct SessionMenuPreviewView: View {
    private static let logger = Logger(subsystem: "com.clawdbot", category: "SessionPreview")
    private static let previewTimeoutSeconds: Double = 4
    let sessionKey: String
    let width: CGFloat
    let maxItems: Int
    let maxLines: Int
    let title: String
    let items: [SessionPreviewItem]
    let status: LoadStatus
    @Environment(\.menuItemHighlighted) private var isHighlighted
    @State private var items: [SessionPreviewItem] = []
    @State private var status: LoadStatus = .loading
-    enum LoadStatus: Equatable {
+    private struct PreviewTimeoutError: LocalizedError {
        var errorDescription: String? { "preview timeout" }
    }
    private enum LoadStatus: Equatable {
        case loading
        case ready
        case empty
@@ -86,17 +78,15 @@ struct SessionMenuPreviewView: View {
    }
    private var primaryColor: Color {
-        if self.isHighlighted {
+        self.isHighlighted ? Color(nsColor: .selectedMenuItemTextColor) : .primary
            return Color(nsColor: .selectedMenuItemTextColor)
        }
        return Color(nsColor: .labelColor)
    }
    private var secondaryColor: Color {
-        if self.isHighlighted {
+        self.isHighlighted ? Color(nsColor: .selectedMenuItemTextColor).opacity(0.85) : .secondary
-            return Color(nsColor: .selectedMenuItemTextColor).opacity(0.85)
+    }
-        }
+
-        return Color(nsColor: .secondaryLabelColor)
+    private var previewLimit: Int {
        min(max(self.maxItems * 3, 20), 120)
    }
    var body: some View {
@@ -110,19 +100,21 @@ struct SessionMenuPreviewView: View {
            switch self.status {
            case .loading:
-                self.placeholder("Loading preview…")
+                Text("Loading preview…")
                    .font(.caption)
                    .foregroundStyle(self.secondaryColor)
            case .empty:
-                self.placeholder("No recent messages")
+                Text("No recent messages")
                    .font(.caption)
                    .foregroundStyle(self.secondaryColor)
            case let .error(message):
-                self.placeholder(message)
+                Text(message)
                    .font(.caption)
                    .foregroundStyle(self.secondaryColor)
            case .ready:
-                if self.items.isEmpty {
+                VStack(alignment: .leading, spacing: 6) {
-                    self.placeholder("No recent messages")
+                    ForEach(self.items) { item in
-                } else {
+                        self.previewRow(item)
                    VStack(alignment: .leading, spacing: 6) {
                        ForEach(self.items) { item in
                            self.previewRow(item)
                        }
                    }
                }
            }
@@ -131,6 +123,9 @@ struct SessionMenuPreviewView: View {
        .padding(.leading, 16)
        .padding(.trailing, 11)
        .frame(width: max(1, self.width), alignment: .leading)
        .task(id: self.sessionKey) {
            await self.loadPreview()
        }
    }
    @ViewBuilder
@@ -162,66 +157,55 @@ struct SessionMenuPreviewView: View {
        }
    }
-    @ViewBuilder
+    private func loadPreview() async {
-    private func placeholder(_ text: String) -> some View {
+        if let cached = await SessionPreviewCache.shared.cachedItems(for: self.sessionKey, maxAge: 12) {
-        Text(text)
+            await MainActor.run {
-            .font(.caption)
+                self.items = cached
-            .foregroundStyle(self.primaryColor)
+                self.status = cached.isEmpty ? .empty : .ready
-    }
+            }
            return
        }
-}
+        await MainActor.run {
-
+            self.status = .loading
 enum SessionMenuPreviewLoader {
    private static let logger = Logger(subsystem: "com.clawdbot", category: "SessionPreview")
    private static let previewTimeoutSeconds: Double = 4
    private static let cacheMaxAgeSeconds: TimeInterval = 30
    private struct PreviewTimeoutError: LocalizedError {
        var errorDescription: String? { "preview timeout" }
    }
    static func load(sessionKey: String, maxItems: Int) async -> SessionMenuPreviewSnapshot {
        if let cached = await SessionPreviewCache.shared.cachedItems(for: sessionKey, maxAge: cacheMaxAgeSeconds) {
            return Self.snapshot(from: cached)
        }
        do {
-            let timeoutMs = Int(self.previewTimeoutSeconds * 1000)
+            let timeoutMs = Int(Self.previewTimeoutSeconds * 1000)
            let payload = try await AsyncTimeout.withTimeout(
-                seconds: self.previewTimeoutSeconds,
+                seconds: Self.previewTimeoutSeconds,
                onTimeout: { PreviewTimeoutError() },
                operation: {
                    try await GatewayConnection.shared.chatHistory(
-                        sessionKey: sessionKey,
+                        sessionKey: self.sessionKey,
-                        limit: self.previewLimit(for: maxItems),
+                        limit: self.previewLimit,
                        timeoutMs: timeoutMs)
                })
-            let built = Self.previewItems(from: payload, maxItems: maxItems)
+            let built = Self.previewItems(from: payload, maxItems: self.maxItems)
-            await SessionPreviewCache.shared.store(items: built, for: sessionKey)
+            await SessionPreviewCache.shared.store(items: built, for: self.sessionKey)
-            return Self.snapshot(from: built)
+            await MainActor.run {
                self.items = built
                self.status = built.isEmpty ? .empty : .ready
            }
        } catch is CancellationError {
-            return SessionMenuPreviewSnapshot(items: [], status: .loading)
+            return
        } catch {
-            let fallback = await SessionPreviewCache.shared.lastItems(for: sessionKey)
+            let fallback = await SessionPreviewCache.shared.lastItems(for: self.sessionKey)
-            if let fallback {
+            await MainActor.run {
-                return Self.snapshot(from: fallback)
+                if let fallback {
                    self.items = fallback
                    self.status = fallback.isEmpty ? .empty : .ready
                } else {
                    self.status = .error("Preview unavailable")
                }
            }
            let errorDescription = String(describing: error)
            Self.logger.warning(
-                "Session preview failed session=\(sessionKey, privacy: .public) " +
+                "Session preview failed session=\(self.sessionKey, privacy: .public) " +
                    "error=\(errorDescription, privacy: .public)")
            return SessionMenuPreviewSnapshot(items: [], status: .error("Preview unavailable"))
        }
    }
    private static func snapshot(from items: [SessionPreviewItem]) -> SessionMenuPreviewSnapshot {
        SessionMenuPreviewSnapshot(items: items, status: items.isEmpty ? .empty : .ready)
    }
    private static func previewLimit(for maxItems: Int) -> Int {
        min(max(maxItems * 3, 20), 120)
    }
    private static func previewItems(
        from payload: ClawdbotChatHistoryPayload,
        maxItems: Int) -> [SessionPreviewItem]
@@ -530,8 +530,6 @@ public struct NodePairRequestParams: Codable, Sendable {
    public let displayname: String?
    public let platform: String?
    public let version: String?
    public let coreversion: String?
    public let uiversion: String?
    public let devicefamily: String?
    public let modelidentifier: String?
    public let caps: [String]?
@@ -544,8 +542,6 @@ public struct NodePairRequestParams: Codable, Sendable {
        displayname: String?,
        platform: String?,
        version: String?,
        coreversion: String?,
        uiversion: String?,
        devicefamily: String?,
        modelidentifier: String?,
        caps: [String]?,
@@ -557,8 +553,6 @@ public struct NodePairRequestParams: Codable, Sendable {
        self.displayname = displayname
        self.platform = platform
        self.version = version
        self.coreversion = coreversion
        self.uiversion = uiversion
        self.devicefamily = devicefamily
        self.modelidentifier = modelidentifier
        self.caps = caps
@@ -571,8 +565,6 @@ public struct NodePairRequestParams: Codable, Sendable {
        case displayname = "displayName"
        case platform
        case version
        case coreversion = "coreVersion"
        case uiversion = "uiVersion"
        case devicefamily = "deviceFamily"
        case modelidentifier = "modelIdentifier"
        case caps
@@ -1660,40 +1652,6 @@ public struct ExecApprovalsSetParams: Codable, Sendable {
    }
 }
 public struct ExecApprovalsNodeGetParams: Codable, Sendable {
    public let nodeid: String
    public init(
        nodeid: String
    ) {
        self.nodeid = nodeid
    }
    private enum CodingKeys: String, CodingKey {
        case nodeid = "nodeId"
    }
 }
 public struct ExecApprovalsNodeSetParams: Codable, Sendable {
    public let nodeid: String
    public let file: [String: AnyCodable]
    public let basehash: String?
    public init(
        nodeid: String,
        file: [String: AnyCodable],
        basehash: String?
    ) {
        self.nodeid = nodeid
        self.file = file
        self.basehash = basehash
    }
    private enum CodingKeys: String, CodingKey {
        case nodeid = "nodeId"
        case file
        case basehash = "baseHash"
    }
 }
 public struct ExecApprovalsSnapshot: Codable, Sendable {
    public let path: String
    public let exists: Bool
@@ -1,26 +0,0 @@
 import Foundation
 import Testing
@testable import Clawdbot
@Suite(.serialized)
 struct SessionMenuPreviewTests {
    @Test func loaderReturnsCachedItems() async {
        await SessionPreviewCache.shared._testReset()
        let items = [SessionPreviewItem(id: "1", role: .user, text: "Hi")]
        await SessionPreviewCache.shared._testSet(items: items, for: "main")
        let snapshot = await SessionMenuPreviewLoader.load(sessionKey: "main", maxItems: 10)
        #expect(snapshot.status == .ready)
        #expect(snapshot.items.count == 1)
        #expect(snapshot.items.first?.text == "Hi")
    }
    @Test func loaderReturnsEmptyWhenCachedEmpty() async {
        await SessionPreviewCache.shared._testReset()
        await SessionPreviewCache.shared._testSet(items: [], for: "main")
        let snapshot = await SessionMenuPreviewLoader.load(sessionKey: "main", maxItems: 10)
        #expect(snapshot.status == .empty)
        #expect(snapshot.items.isEmpty)
    }
 }
@@ -63,8 +63,6 @@ public struct BridgeHello: Codable, Sendable {
    public let token: String?
    public let platform: String?
    public let version: String?
    public let coreVersion: String?
    public let uiVersion: String?
    public let deviceFamily: String?
    public let modelIdentifier: String?
    public let caps: [String]?
@@ -78,8 +76,6 @@ public struct BridgeHello: Codable, Sendable {
        token: String?,
        platform: String?,
        version: String?,
        coreVersion: String? = nil,
        uiVersion: String? = nil,
        deviceFamily: String? = nil,
        modelIdentifier: String? = nil,
        caps: [String]? = nil,
@@ -92,8 +88,6 @@ public struct BridgeHello: Codable, Sendable {
        self.token = token
        self.platform = platform
        self.version = version
        self.coreVersion = coreVersion
        self.uiVersion = uiVersion
        self.deviceFamily = deviceFamily
        self.modelIdentifier = modelIdentifier
        self.caps = caps
@@ -127,8 +121,6 @@ public struct BridgePairRequest: Codable, Sendable {
    public let displayName: String?
    public let platform: String?
    public let version: String?
    public let coreVersion: String?
    public let uiVersion: String?
    public let deviceFamily: String?
    public let modelIdentifier: String?
    public let caps: [String]?
@@ -143,8 +135,6 @@ public struct BridgePairRequest: Codable, Sendable {
        displayName: String?,
        platform: String?,
        version: String?,
        coreVersion: String? = nil,
        uiVersion: String? = nil,
        deviceFamily: String? = nil,
        modelIdentifier: String? = nil,
        caps: [String]? = nil,
@@ -158,8 +148,6 @@ public struct BridgePairRequest: Codable, Sendable {
        self.displayName = displayName
        self.platform = platform
        self.version = version
        self.coreVersion = coreVersion
        self.uiVersion = uiVersion
        self.deviceFamily = deviceFamily
        self.modelIdentifier = modelIdentifier
        self.caps = caps
@@ -4,8 +4,6 @@ public enum ClawdbotSystemCommand: String, Codable, Sendable {
    case run = "system.run"
    case which = "system.which"
    case notify = "system.notify"
    case execApprovalsGet = "system.execApprovals.get"
    case execApprovalsSet = "system.execApprovals.set"
 }
 public enum ClawdbotNotificationPriority: String, Codable, Sendable {
@@ -1,13 +1,11 @@
 ---
-summary: "Slack setup for socket or HTTP webhook mode"
+summary: "Slack socket mode setup and Clawdbot config"
-read_when: "Setting up Slack or debugging Slack socket/HTTP mode"
+read_when: "Setting up Slack or debugging Slack socket mode"
 ---
-# Slack
+# Slack (socket mode)
-## Socket mode (default)
+## Quick setup (beginner)
 ### Quick setup (beginner)
 1) Create a Slack app and enable **Socket Mode**.
 2) Create an **App Token** (`xapp-...`) and **Bot Token** (`xoxb-...`).
 3) Set tokens for Clawdbot and start the gateway.
@@ -25,7 +23,7 @@ Minimal config:
 }
 ```
-### Setup
+## Setup
 1) Create a Slack app (From scratch) in https://api.channels.slack.com/apps.
 2) **Socket Mode** → toggle on. Then go to **Basic Information** → **App-Level Tokens** → **Generate Token and Scopes** with scope `connections:write`. Copy the **App Token** (`xapp-...`).
 3) **OAuth & Permissions** → add bot token scopes (use the manifest below). Click **Install to Workspace**. Copy the **Bot User OAuth Token** (`xoxb-...`).
@@ -45,7 +43,7 @@ Use the manifest below so scopes and events stay in sync.
 Multi-account support: use `channels.slack.accounts` with per-account tokens and optional `name`. See [`gateway/configuration`](/gateway/configuration#telegramaccounts--discordaccounts--slackaccounts--signalaccounts--imessageaccounts) for the shared pattern.
-### Clawdbot config (minimal)
+## Clawdbot config (minimal)
 Set tokens via env vars (recommended):
 - `SLACK_APP_TOKEN=xapp-...`
@@ -65,7 +63,7 @@ Or via config:
 }
 ```
-### User token (optional)
+## User token (optional)
 Clawdbot can use a Slack user token (`xoxp-...`) for read operations (history,
 pins, reactions, emoji, member info). By default this stays read-only: reads
 prefer the user token when present, and writes still use the bot token unless
@@ -104,51 +102,18 @@ Example with userTokenReadOnly explicitly set (allow user token writes):
 }
 ```
-#### Token usage
+### Token usage
 - Read operations (history, reactions list, pins list, emoji list, member info,
  search) prefer the user token when configured, otherwise the bot token.
 - Write operations (send/edit/delete messages, add/remove reactions, pin/unpin,
  file uploads) use the bot token by default. If `userTokenReadOnly: false` and
  no bot token is available, Clawdbot falls back to the user token.
-### History context
+## History context
 - `channels.slack.historyLimit` (or `channels.slack.accounts.*.historyLimit`) controls how many recent channel/group messages are wrapped into the prompt.
 - Falls back to `messages.groupChat.historyLimit`. Set `0` to disable (default 50).
-## HTTP mode (Events API)
+## Manifest (optional)
 Use HTTP webhook mode when your Gateway is reachable by Slack over HTTPS (typical for server deployments).
 HTTP mode uses the Events API + Interactivity + Slash Commands with a shared request URL.
 ### Setup
 1) Create a Slack app and **disable Socket Mode** (optional if you only use HTTP).
 2) **Basic Information** → copy the **Signing Secret**.
 3) **OAuth & Permissions** → install the app and copy the **Bot User OAuth Token** (`xoxb-...`).
 4) **Event Subscriptions** → enable events and set the **Request URL** to your gateway webhook path (default `/slack/events`).
 5) **Interactivity & Shortcuts** → enable and set the same **Request URL**.
 6) **Slash Commands** → set the same **Request URL** for your command(s).
 Example request URL:
 `https://gateway-host/slack/events`
 ### Clawdbot config (minimal)
 ```json5
 {
  channels: {
    slack: {
      enabled: true,
      mode: "http",
      botToken: "xoxb-...",
      signingSecret: "your-signing-secret",
      webhookPath: "/slack/events"
    }
  }
 }
 ```
 Multi-account HTTP mode: set `channels.slack.accounts.<id>.mode = "http"` and provide a unique
 `webhookPath` per account so each Slack app can point to its own URL.
 ### Manifest (optional)
 Use this Slack app manifest to create the app quickly (adjust the name/command if you want). Include the
 user scopes if you plan to configure a user token.
@@ -1,44 +0,0 @@
 ---
 summary: "CLI reference for `clawdbot approvals` (exec approvals for gateway or node hosts)"
 read_when:
  - You want to edit exec approvals from the CLI
  - You need to manage allowlists on gateway or node hosts
 ---
 # `clawdbot approvals`
 Manage exec approvals for the **gateway host** or a **node host**.
 By default, commands target the gateway. Use `--node` to edit a node’s approvals.
 Related:
 - Exec approvals: [Exec approvals](/tools/exec-approvals)
 - Nodes: [Nodes](/nodes)
 ## Common commands
 ```bash
 clawdbot approvals get
 clawdbot approvals get --node <id|name|ip>
 ```
 ## Replace approvals from a file
 ```bash
 clawdbot approvals set --file ./exec-approvals.json
 clawdbot approvals set --node <id|name|ip> --file ./exec-approvals.json
 ```
 ## Allowlist helpers
 ```bash
 clawdbot approvals allowlist add "~/Projects/**/bin/rg"
 clawdbot approvals allowlist add --agent main --node <id|name|ip> "/usr/bin/uptime"
 clawdbot approvals allowlist remove "~/Projects/**/bin/rg"
 ```
 ## Notes
 - `--node` uses the same resolver as `clawdbot nodes` (id, name, ip, or id prefix).
 - The node host must advertise `system.execApprovals.get/set` (macOS app or headless node host).
 - Approvals files are stored per host at `~/.clawdbot/exec-approvals.json`.
@@ -9,9 +9,6 @@ read_when:
 Manage the Gateway daemon (background service).
 Note: `clawdbot service gateway …` is the preferred surface; `daemon` remains
 as a legacy alias for compatibility.
 Related:
 - Gateway CLI: [Gateway](/cli/gateway)
 - macOS platform notes: [macOS](/platforms/macos)
@@ -7,7 +7,7 @@ read_when:
 # `clawdbot hooks`
-Manage agent hooks (event-driven automations for commands like `/new`, `/reset`, and gateway startup).
+Manage agent hooks (event-driven automations for commands like `/new`, `/reset`, etc.).
 Related:
 - Hooks: [Hooks](/hooks)
@@ -29,10 +29,9 @@ List all discovered hooks from workspace, managed, and bundled directories.
 **Example output:**
 ```
-Hooks (4/4 ready)
+Hooks (3/3 ready)
 Ready:
  🚀 boot-md ✓ - Run BOOT.md on gateway startup
  📝 command-logger ✓ - Log all command events to a centralized audit file
  💾 session-memory ✓ - Save session context to memory when /new command is issued
  😈 soul-evil ✓ - Swap injected SOUL content during a purge window or by random chance
@@ -108,8 +107,8 @@ Show summary of hook eligibility status (how many are ready vs. not ready).
 ```
 Hooks Status
-Total hooks: 4
+Total hooks: 2
-Ready: 4
+Ready: 2
 Not ready: 0
 ```
@@ -274,17 +273,3 @@ clawdbot hooks enable soul-evil
 ```
 **See:** [SOUL Evil Hook](/hooks/soul-evil)
 ### boot-md
 Runs `BOOT.md` when the gateway starts (after channels start).
 **Events**: `gateway:startup`
 **Enable**:
 ```bash
 clawdbot hooks enable boot-md
 ```
 **See:** [boot-md documentation](/hooks#boot-md)
@@ -29,13 +29,11 @@ This page describes the current CLI behavior. If commands change, update this do
 - [`sessions`](/cli/sessions)
 - [`gateway`](/cli/gateway)
 - [`daemon`](/cli/daemon)
 - [`service`](/cli/service)
 - [`logs`](/cli/logs)
 - [`models`](/cli/models)
 - [`memory`](/cli/memory)
 - [`nodes`](/cli/nodes)
 - [`node`](/cli/node)
 - [`approvals`](/cli/approvals)
 - [`sandbox`](/cli/sandbox)
 - [`tui`](/cli/tui)
 - [`browser`](/cli/browser)
@@ -145,21 +143,6 @@ clawdbot [--dev] [--profile <name>] <command>
    start
    stop
    restart
  service
    gateway
      status
      install
      uninstall
      start
      stop
      restart
    node
      status
      install
      uninstall
      start
      stop
      restart
  logs
  models
    list
@@ -197,10 +180,6 @@ clawdbot [--dev] [--profile <name>] <command>
      start
      stop
      restart
  approvals
    get
    set
    allowlist add|remove
  browser
    status
    start
@@ -541,9 +520,6 @@ Options:
 - `--verbose`
 - `--debug` (alias for `--verbose`)
 Notes:
 - Overview includes Gateway + Node service status when available.
 ### Usage tracking
 Clawdbot can surface provider usage/quota when OAuth/API creds are available.
@@ -805,15 +781,12 @@ All `cron` commands accept `--url`, `--token`, `--timeout`, `--expect-final`.
 Subcommands:
 - `node start --host <gateway-host> --port 18790`
- `node service status`
+- `node daemon status`
- `node service install [--host <gateway-host>] [--port <port>] [--tls] [--tls-fingerprint <sha256>] [--node-id <id>] [--display-name <name>] [--runtime <node|bun>] [--force]`
+- `node daemon install [--host <gateway-host>] [--port <port>] [--tls] [--tls-fingerprint <sha256>] [--node-id <id>] [--display-name <name>] [--runtime <node|bun>] [--force]`
- `node service uninstall`
+- `node daemon uninstall`
- `node service start`
+- `node daemon start`
- `node service stop`
+- `node daemon stop`
- `node service restart`
+- `node daemon restart`
 Legacy alias:
 - `node daemon …` (same as `node service …`)
 ## Nodes
@@ -7,8 +7,8 @@ read_when:
 # `clawdbot memory`
-Manage semantic memory indexing and search.
+Memory search tools (semantic memory status/index/search).
-Provided by the active memory plugin (default: `memory-core`; set `plugins.slots.memory = "none"` to disable).
+Provided by the active memory plugin (default: `memory-core`; use `plugins.slots.memory = "none"` to disable).
 Related:
 - Memory concept: [Memory](/concepts/memory)
@@ -22,20 +22,11 @@ clawdbot memory status --deep
 clawdbot memory status --deep --index
 clawdbot memory status --deep --index --verbose
 clawdbot memory index
 clawdbot memory index --verbose
 clawdbot memory search "release checklist"
 clawdbot memory status --agent main
 clawdbot memory index --agent main --verbose
 ```
 ## Options
-Common:
+- `--verbose`: emit debug logs during memory probes and indexing.
-
+- `--index-mode auto|batch|direct`: override batch usage when indexing (`direct` favors speed; `batch` favors OpenAI Batch pricing).
- `--agent <id>`: scope to a single agent (default: all configured agents).
+- `--progress auto|line|log|none`: progress output mode (`log` prints updates even without a TTY).
 - `--verbose`: emit detailed logs during probes and indexing.
 Notes:
 - `memory status --deep` probes vector + embedding availability.
 - `memory status --deep --index` runs a reindex if the store is dirty.
 - `memory index --verbose` prints per-phase details (provider, model, sources, batch activity).
@@ -37,14 +37,12 @@ Options:
 - `--node-id <id>`: Override node id (clears pairing token)
 - `--display-name <name>`: Override the node display name
-## Service (background)
+## Daemon (background service)
 Install a headless node host as a user service.
 ```bash
-clawdbot node service install --host <gateway-host> --port 18790
+clawdbot node daemon install --host <gateway-host> --port 18790
 # or
 clawdbot service node install --host <gateway-host> --port 18790
 ```
 Options:
@@ -59,20 +57,12 @@ Options:
 Manage the service:
 ```bash
 clawdbot node status
 clawdbot service node status
 clawdbot node service status
 clawdbot node service start
 clawdbot node service stop
 clawdbot node service restart
 clawdbot node service uninstall
 ```
 Legacy alias:
 ```bash
 clawdbot node daemon status
 clawdbot node daemon start
 clawdbot node daemon stop
 clawdbot node daemon restart
 clawdbot node daemon uninstall
 ```
 ## Pairing
@@ -93,4 +83,3 @@ The node host stores its node id + token in `~/.clawdbot/node.json`.
 - `~/.clawdbot/exec-approvals.json`
 - [Exec approvals](/tools/exec-approvals)
 - `clawdbot approvals --node <id|name|ip>` (edit from the Gateway)
@@ -1,51 +0,0 @@
 ---
 summary: "CLI reference for `clawdbot service` (manage gateway + node services)"
 read_when:
  - You want to manage Gateway or node services cross-platform
  - You want a single surface for start/stop/install/uninstall
 ---
 # `clawdbot service`
 Manage the **Gateway** service and **node host** services.
 Related:
 - Gateway daemon (legacy alias): [Daemon](/cli/daemon)
 - Node host: [Node](/cli/node)
 ## Gateway service
 ```bash
 clawdbot service gateway status
 clawdbot service gateway install --port 18789
 clawdbot service gateway start
 clawdbot service gateway stop
 clawdbot service gateway restart
 clawdbot service gateway uninstall
 ```
 Notes:
 - `service gateway status` supports `--json` and `--deep` for system checks.
 - `service gateway install` supports `--runtime node|bun` and `--token`.
 ## Node host service
 ```bash
 clawdbot service node status
 clawdbot service node install --host <gateway-host> --port 18790
 clawdbot service node start
 clawdbot service node stop
 clawdbot service node restart
 clawdbot service node uninstall
 ```
 Notes:
 - `service node install` supports `--runtime node|bun`, `--node-id`, `--display-name`,
  and TLS options (`--tls`, `--tls-fingerprint`).
 ## Aliases
 - `clawdbot daemon …` → `clawdbot service gateway …`
 - `clawdbot node service …` → `clawdbot service node …`
 - `clawdbot node status` → `clawdbot service node status`
 - `clawdbot node daemon …` → `clawdbot service node …` (legacy)
@@ -19,5 +19,4 @@ clawdbot status --usage
 Notes:
 - `--deep` runs live probes (WhatsApp Web + Telegram + Discord + Slack + Signal).
 - Output includes per-agent session stores when multiple agents are configured.
 - Overview includes Gateway + Node service install/runtime status when available.
 - Update info surfaces in the Overview; if an update is available, status prints a hint to run `clawdbot update` (see [Updating](/install/updating)).
@@ -5,19 +5,13 @@ read_when:
 ---
 # Agent Loop (Clawdbot)
-An agentic loop is the full “real” run of an agent: intake → context assembly → model inference →
+Short, exact flow of one agent run.
 tool execution → streaming replies → persistence. It’s the authoritative path that turns a message
 into actions and a final reply, while keeping session state consistent.
 In Clawdbot, a loop is a single, serialized run per session that emits lifecycle and stream events
 as the model thinks, calls tools, and streams output. This doc explains how that authentic loop is
 wired end-to-end.
 ## Entry points
 - Gateway RPC: `agent` and `agent.wait`.
 - CLI: `agent` command.
-## How it works (high-level)
+## High-level flow
 1) `agent` RPC validates params, resolves session (sessionKey/sessionId), persists session metadata, returns `{ runId, acceptedAt }` immediately.
 2) `agentCommand` runs the agent:
   - resolves model + thinking/verbose defaults
@@ -25,9 +19,8 @@ wired end-to-end.
   - calls `runEmbeddedPiAgent` (pi-agent-core runtime)
   - emits **lifecycle end/error** if the embedded loop does not emit one
 3) `runEmbeddedPiAgent`:
-   - serializes runs via per-session + global queues
+   - builds `AgentSession` and subscribes to pi events
-   - resolves model + auth profile and builds the pi session
+   - streams assistant deltas + tool events
   - subscribes to pi events and streams assistant/tool deltas
   - enforces timeout -> aborts run if exceeded
   - returns payloads + usage metadata
 4) `subscribeEmbeddedPiSession` bridges pi-agent-core events to Clawdbot `agent` stream:
@@ -38,73 +31,6 @@ wired end-to-end.
   - waits for **lifecycle end/error** for `runId`
   - returns `{ status: ok|error|timeout, startedAt, endedAt, error? }`
 ## Queueing + concurrency
 - Runs are serialized per session key (session lane) and optionally through a global lane.
 - This prevents tool/session races and keeps session history consistent.
 - Messaging channels can choose queue modes (collect/steer/followup) that feed this lane system.
  See [Command Queue](/concepts/queue).
 ## Session + workspace preparation
 - Workspace is resolved and created; sandboxed runs may redirect to a sandbox workspace root.
 - Skills are loaded (or reused from a snapshot) and injected into env and prompt.
 - Bootstrap/context files are resolved and injected into the system prompt report.
 - A session write lock is acquired; `SessionManager` is opened and prepared before streaming.
 ## Prompt assembly + system prompt
 - System prompt is built from Clawdbot’s base prompt, skills prompt, bootstrap context, and per-run overrides.
 - Model-specific limits and compaction reserve tokens are enforced.
 - See [System prompt](/concepts/system-prompt) for what the model sees.
 ## Hook points (where you can intercept)
 Clawdbot has two hook systems:
 - **Internal hooks** (Gateway hooks): event-driven scripts for commands and lifecycle events.
 - **Plugin hooks**: extension points inside the agent/tool lifecycle and gateway pipeline.
 ### Internal hooks (Gateway hooks)
 - **`agent:bootstrap`**: runs while building bootstrap files before the system prompt is finalized.
  Use this to add/remove bootstrap context files.
 - **Command hooks**: `/new`, `/reset`, `/stop`, and other command events (see Hooks doc).
 See [Hooks](/hooks) for setup and examples.
 ### Plugin hooks (agent + gateway lifecycle)
 These run inside the agent loop or gateway pipeline:
 - **`before_agent_start`**: inject context or override system prompt before the run starts.
 - **`agent_end`**: inspect the final message list and run metadata after completion.
 - **`before_compaction` / `after_compaction`**: observe or annotate compaction cycles.
 - **`before_tool_call` / `after_tool_call`**: intercept tool params/results.
 - **`message_received` / `message_sending` / `message_sent`**: inbound + outbound message hooks.
 - **`session_start` / `session_end`**: session lifecycle boundaries.
 - **`gateway_start` / `gateway_stop`**: gateway lifecycle events.
 See [Plugins](/plugin#plugin-hooks) for the hook API and registration details.
 ## Streaming + partial replies
 - Assistant deltas are streamed from pi-agent-core and emitted as `assistant` events.
 - Block streaming can emit partial replies either on `text_end` or `message_end`.
 - Reasoning streaming can be emitted as a separate stream or as block replies.
 - See [Streaming](/concepts/streaming) for chunking and block reply behavior.
 ## Tool execution + messaging tools
 - Tool start/update/end events are emitted on the `tool` stream.
 - Tool results are sanitized for size and image payloads before logging/emitting.
 - Messaging tool sends are tracked to suppress duplicate assistant confirmations.
 ## Reply shaping + suppression
 - Final payloads are assembled from:
  - assistant text (and optional reasoning)
  - inline tool summaries (when verbose + allowed)
  - assistant error text when the model errors
 - `NO_REPLY` is treated as a silent token and filtered from outgoing payloads.
 - Messaging tool duplicates are removed from the final payload list.
 - If no renderable payloads remain and a tool errored, a fallback tool error reply is emitted
  (unless a messaging tool already sent a user-visible reply).
 ## Compaction + retries
 - Auto-compaction emits `compaction` stream events and can trigger a retry.
 - On retry, in-memory buffers and tool summaries are reset to avoid duplicate output.
 - See [Compaction](/concepts/compaction) for the compaction pipeline.
 ## Event streams (today)
 - `lifecycle`: emitted by `subscribeEmbeddedPiSession` (and as a fallback by `agentCommand`)
 - `assistant`: streamed deltas from pi-agent-core
@@ -86,10 +86,6 @@ These are the standard files Clawdbot expects inside the workspace:
  - Optional tiny checklist for heartbeat runs.
  - Keep it short to avoid token burn.
 - `BOOT.md`
  - Optional startup checklist executed on gateway restart when internal hooks are enabled.
  - Keep it short; use the message tool for outbound sends.
 - `BOOTSTRAP.md`
  - One-time first-run ritual.
  - Only created for a brand-new workspace.
@@ -79,46 +79,37 @@ semantic queries can find related notes even when wording differs.
 Defaults:
 - Enabled by default.
 - Watches memory files for changes (debounced).
- Uses remote embeddings by default. If `memorySearch.provider` is not set, Clawdbot auto-selects:
+- Uses remote embeddings (OpenAI) unless configured for local.
  1. `local` if a `memorySearch.local.modelPath` is configured and the file exists.
  2. `openai` if an OpenAI key can be resolved.
  3. `gemini` if a Gemini key can be resolved.
  4. Otherwise memory search stays disabled until configured.
 - Local mode uses node-llama-cpp and may require `pnpm approve-builds`.
 - Uses sqlite-vec (when available) to accelerate vector search inside SQLite.
-Remote embeddings **require** an API key for the embedding provider. Clawdbot
+Remote embeddings **require** an API key for the embedding provider. By default
-resolves keys from auth profiles, `models.providers.*.apiKey`, or environment
+this is OpenAI (`OPENAI_API_KEY` or `models.providers.openai.apiKey`). Codex
-variables. Codex OAuth only covers chat/completions and does **not** satisfy
+OAuth only covers chat/completions and does **not** satisfy embeddings for
-embeddings for memory search. For Gemini, use `GEMINI_API_KEY` or
+memory search. When using a custom OpenAI-compatible endpoint, set
-`models.providers.google.apiKey`. When using a custom OpenAI-compatible endpoint,
+`memorySearch.remote.apiKey` (and optional `memorySearch.remote.headers`).
 set `memorySearch.remote.apiKey` (and optional `memorySearch.remote.headers`).
-### Gemini embeddings (native)
+If you want to use **Gemini embeddings** directly, set the provider to `gemini`:
 Set the provider to `gemini` to use the Gemini embeddings API directly:
 ```json5
 agents: {
  defaults: {
    memorySearch: {
      provider: "gemini",
-      model: "gemini-embedding-001",
+      model: "gemini-embedding-001", // default
      remote: {
-        apiKey: "YOUR_GEMINI_API_KEY"
+        apiKey: "${GEMINI_API_KEY}"
      }
    }
  }
 }
 ```
-Notes:
+Gemini uses `GEMINI_API_KEY` (or `models.providers.google.apiKey`). Override
- `remote.baseUrl` is optional (defaults to the Gemini API base URL).
+`memorySearch.remote.baseUrl` to point at a custom Gemini-compatible endpoint.
 - `remote.headers` lets you add extra headers if needed.
 - Default model: `gemini-embedding-001`.
-If you want to use a **custom OpenAI-compatible endpoint** (OpenRouter, vLLM, or a proxy),
+If you want to use a **custom OpenAI-compatible endpoint** (like OpenRouter or a proxy),
-you can use the `remote` configuration with the OpenAI provider:
+you can use the `remote` configuration:
 ```json5
 agents: {
@@ -127,8 +118,8 @@ agents: {
      provider: "openai",
      model: "text-embedding-3-small",
      remote: {
-        baseUrl: "https://api.example.com/v1/",
+        baseUrl: "https://proxy.example/v1",
-        apiKey: "YOUR_OPENAI_COMPAT_API_KEY",
+        apiKey: "YOUR_PROXY_KEY",
        headers: { "X-Custom-Header": "value" }
      }
    }
@@ -139,16 +130,11 @@ agents: {
 If you don't want to set an API key, use `memorySearch.provider = "local"` or set
 `memorySearch.fallback = "none"`.
-Fallbacks:
+Batch indexing (OpenAI only):
- `memorySearch.fallback` can be `openai`, `gemini`, `local`, or `none`.
+- Enabled by default for OpenAI embeddings. Set `agents.defaults.memorySearch.remote.batch.enabled = false` to disable.
 - The fallback provider is only used when the primary embedding provider fails.
 Batch indexing (OpenAI + Gemini):
 - Enabled by default for OpenAI and Gemini embeddings. Set `agents.defaults.memorySearch.remote.batch.enabled = false` to disable.
 - Default behavior waits for batch completion; tune `remote.batch.wait`, `remote.batch.pollIntervalMs`, and `remote.batch.timeoutMinutes` if needed.
 - Set `remote.batch.concurrency` to control how many batch jobs we submit in parallel (default: 2).
- Batch mode applies when `memorySearch.provider = "openai"` or `"gemini"` and uses the corresponding API key.
+- Batch mode currently applies only when `memorySearch.provider = "openai"` and uses your OpenAI API key.
 - Gemini batch jobs use the async embeddings batch endpoint and require Gemini Batch API availability.
 Why OpenAI batch is fast + cheap:
 - For large backfills, OpenAI is typically the fastest option we support because we can submit many embedding requests in a single batch job and let OpenAI process them asynchronously.
@@ -18,7 +18,6 @@ The prompt is intentionally compact and uses fixed sections:
 - **Skills** (when available): tells the model how to load skill instructions on demand.
 - **Clawdbot Self-Update**: how to run `config.apply` and `update.run`.
 - **Workspace**: working directory (`agents.defaults.workspace`).
 - **Documentation**: local path to Clawdbot docs (repo or npm package) and when to read them.
 - **Workspace Files (injected)**: indicates bootstrap files are included below.
 - **Sandbox** (when enabled): indicates sandboxed runtime, sandbox paths, and whether elevated exec is available.
 - **Current Date & Time**: user-local time, timezone, and time format.
@@ -99,12 +98,3 @@ Skills section is omitted.
 ```
 This keeps the base prompt small while still enabling targeted skill usage.
 ## Documentation
 When available, the system prompt includes a **Documentation** section that points to the
 local Clawdbot docs directory (either `docs/` in the repo workspace or the bundled npm
 package docs) and also notes the public mirror, source repo, community Discord, and
 ClawdHub (https://clawdhub.com) for skills discovery. The prompt instructs the model to consult local docs first
 for Clawdbot behavior, commands, configuration, or architecture, and to run
 `clawdbot status` itself when possible (asking the user only when it lacks access).
@@ -9,7 +9,7 @@ read_when:
 Clawdbot standardizes timestamps so the model sees a **single reference time**.
-## Message envelopes (UTC by default)
+## Message envelopes (UTC)
 Inbound messages are wrapped in an envelope like:
@@ -17,46 +17,7 @@ Inbound messages are wrapped in an envelope like:
 [Provider ... 2026-01-05T21:26Z] message text
 ```
-The timestamp in the envelope is **UTC by default**, with minutes precision.
+The timestamp in the envelope is **always UTC**, with minutes precision.
 You can override this with:
 ```json5
 {
  agents: {
    defaults: {
      envelopeTimezone: "user", // "utc" | "local" | "user" | IANA timezone
      envelopeTimestamp: "on", // "on" | "off"
      envelopeElapsed: "on" // "on" | "off"
    }
  }
 }
 ```
 - `envelopeTimezone: "user"` uses `agents.defaults.userTimezone` (falls back to host timezone).
 - Use an explicit IANA timezone (e.g., `"Europe/Vienna"`) for a fixed offset.
 - `envelopeTimestamp: "off"` removes absolute timestamps from envelope headers.
 - `envelopeElapsed: "off"` removes elapsed time suffixes (the `+2m` style).
 ### Examples
 **UTC (default):**
 ```
 [Signal Alice +1555 2026-01-18T05:19Z] hello
 ```
 **Fixed timezone:**
 ```
 [Signal Alice +1555 2026-01-18 06:19 GMT+1] hello
 ```
 **Elapsed time:**
 ```
 [Signal Alice +1555 +2m 2026-01-18T05:19Z] follow-up
 ```
 ## Tool payloads (raw provider data + normalized fields)
@@ -7,10 +7,10 @@ read_when:
 # Date & Time
-Clawdbot defaults to **UTC for transport timestamps** and **user-local time only in the system prompt**.
+Clawdbot uses **UTC for transport timestamps** and **user-local time only in the system prompt**.
-Provider timestamps are preserved so tools keep their native semantics.
+We avoid rewriting provider timestamps so tools keep their native semantics.
-## Message envelopes (UTC by default)
+## Message envelopes (UTC)
 Inbound messages are wrapped with a UTC timestamp (minute precision):
@@ -18,47 +18,7 @@ Inbound messages are wrapped with a UTC timestamp (minute precision):
 [Provider ... 2026-01-05T21:26Z] message text
 ```
-This envelope timestamp is **UTC by default**, regardless of the host timezone.
+This envelope timestamp is **always UTC**, regardless of the host timezone.
 You can override this behavior:
 ```json5
 {
  agents: {
    defaults: {
      envelopeTimezone: "utc", // "utc" | "local" | "user" | IANA timezone
      envelopeTimestamp: "on", // "on" | "off"
      envelopeElapsed: "on" // "on" | "off"
    }
  }
 }
 ```
 - `envelopeTimezone: "local"` uses the host timezone.
 - `envelopeTimezone: "user"` uses `agents.defaults.userTimezone` (falls back to host timezone).
 - Use an explicit IANA timezone (e.g., `"America/Chicago"`) for a fixed zone.
 - `envelopeTimestamp: "off"` removes absolute timestamps from envelope headers.
 - `envelopeElapsed: "off"` removes elapsed time suffixes (the `+2m` style).
 ### Examples
 **UTC (default):**
 ```
 [WhatsApp +1555 2026-01-18T05:19Z] hello
 ```
 **User timezone:**
 ```
 [WhatsApp +1555 2026-01-18 00:19 CST] hello
 ```
 **Elapsed time enabled:**
 ```
 [WhatsApp +1555 +30s 2026-01-18T05:19Z] follow-up
 ```
 ## System prompt: Current Date & Time
@@ -1,72 +0,0 @@
 ---
 summary: Node + tsx "__name is not a function" crash notes and workarounds
 read_when:
  - Debugging Node-only dev scripts or watch mode failures
  - Investigating tsx/esbuild loader crashes in Clawdbot
 ---
 # Node + tsx "__name is not a function" crash
 ## Summary
 Running Clawdbot via Node with `tsx` fails at startup with:
 ```
 [clawdbot] Failed to start CLI: TypeError: __name is not a function
    at createSubsystemLogger (.../src/logging/subsystem.ts:203:25)
    at .../src/agents/auth-profiles/constants.ts:25:20
 ```
 This began after switching dev scripts from Bun to `tsx` (commit `2871657e`, 2026-01-06). The same runtime path worked with Bun.
 ## Environment
 - Node: v25.x (observed on v25.3.0)
 - tsx: 4.21.0
 - OS: macOS (repro also likely on other platforms that run Node 25)
 ## Repro (Node-only)
 ```bash
 # in repo root
 node --version
 pnpm install
 node --import tsx src/entry.ts status
 ```
 ## Minimal repro in repo
 ```bash
 node --import tsx scripts/repro/tsx-name-repro.ts
 ```
 ## Node version check
 - Node 25.3.0: fails
 - Node 22.22.0 (Homebrew `node@22`): fails
 - Node 24: not installed here yet; needs verification
 ## Notes / hypothesis
 - `tsx` uses esbuild to transform TS/ESM. esbuild’s `keepNames` emits a `__name` helper and wraps function definitions with `__name(...)`.
 - The crash indicates `__name` exists but is not a function at runtime, which implies the helper is missing or overwritten for this module in the Node 25 loader path.
 - Similar `__name` helper issues have been reported in other esbuild consumers when the helper is missing or rewritten.
 ## Regression history
 - `2871657e` (2026-01-06): scripts changed from Bun to tsx to make Bun optional.
 - Before that (Bun path), `pnpm clawdbot status` and `gateway:watch` worked.
 ## Workarounds
 - Use Bun for dev scripts (current temporary revert).
 - Use Node + tsc watch, then run compiled output:
  ```bash
  pnpm exec tsc --watch --preserveWatchOutput
  node --watch dist/entry.js status
  ```
 - Confirmed locally: `pnpm exec tsc -p tsconfig.json` + `node dist/entry.js status` works on Node 25.
 - Disable esbuild keepNames in the TS loader if possible (prevents `__name` helper insertion); tsx does not currently expose this.
 - Test Node LTS (22/24) with `tsx` to see if the issue is Node 25–specific.
 ## References
 - https://opennext.js.org/cloudflare/howtos/keep_names
 - https://esbuild.github.io/api/#keep-names
 - https://github.com/evanw/esbuild/issues/1031
 ## Next steps
 - Repro on Node 22/24 to confirm Node 25 regression.
 - Test `tsx` nightly or pin to earlier version if a known regression exists.
 - If reproduces on Node LTS, file a minimal repro upstream with the `__name` stack trace.
@@ -657,10 +657,6 @@
      "source": "/templates/AGENTS",
      "destination": "/reference/templates/AGENTS"
    },
    {
      "source": "/templates/BOOT",
      "destination": "/reference/templates/BOOT"
    },
    {
      "source": "/templates/BOOTSTRAP",
      "destination": "/reference/templates/BOOTSTRAP"
@@ -826,10 +822,8 @@
          "cli/models",
          "cli/logs",
          "cli/nodes",
          "cli/approvals",
          "cli/gateway",
          "cli/daemon",
          "cli/service",
          "cli/tui",
          "cli/voicecall",
          "cli/wake",
@@ -1057,7 +1051,6 @@
          "reference/RELEASING",
          "reference/AGENTS.default",
          "reference/templates/AGENTS",
          "reference/templates/BOOT",
          "reference/templates/BOOTSTRAP",
          "reference/templates/HEARTBEAT",
          "reference/templates/IDENTITY",
@@ -37,11 +37,10 @@ The hooks system allows you to:
 ### Bundled Hooks
-Clawdbot ships with four bundled hooks that are automatically discovered:
+Clawdbot ships with three bundled hooks that are automatically discovered:
 - **💾 session-memory**: Saves session context to your agent workspace (default `~/clawd/memory/`) when you issue `/new`
 - **📝 command-logger**: Logs all command events to `~/.clawdbot/logs/commands.log`
 - **🚀 boot-md**: Runs `BOOT.md` when the gateway starts (requires internal hooks enabled)
 - **😈 soul-evil**: Swaps injected `SOUL.md` content with `SOUL_EVIL.md` during a purge window or by random chance
 List available hooks:
@@ -196,7 +195,7 @@ Each event includes:
 ```typescript
 {
-  type: 'command' | 'session' | 'agent' | 'gateway',
+  type: 'command' | 'session' | 'agent',
  action: string,              // e.g., 'new', 'reset', 'stop'
  sessionKey: string,          // Session identifier
  timestamp: Date,             // When the event occurred
@@ -229,12 +228,6 @@ Triggered when agent commands are issued:
 - **`agent:bootstrap`**: Before workspace bootstrap files are injected (hooks may mutate `context.bootstrapFiles`)
 ### Gateway Events
 Triggered when the gateway starts:
 - **`gateway:startup`**: After channels start and hooks are loaded
 ### Future Events
 Planned event types:
@@ -549,26 +542,6 @@ clawdbot hooks enable soul-evil
 }
 ```
 ### boot-md
 Runs `BOOT.md` when the gateway starts (after channels start).
 Internal hooks must be enabled for this to run.
 **Events**: `gateway:startup`
 **Requirements**: `workspace.dir` must be configured
 **What it does**:
 1. Reads `BOOT.md` from your workspace
 2. Runs the instructions via the agent runner
 3. Sends any requested outbound messages via the message tool
 **Enable**:
 ```bash
 clawdbot hooks enable boot-md
 ```
 ## Best Practices
 ### Keep Handlers Fast
@@ -641,7 +614,6 @@ The gateway logs hook loading at startup:
 ```
 Registered hook: session-memory -> command:new
 Registered hook: command-logger -> command
 Registered hook: boot-md -> gateway:startup
 ```
 ### Check Discovery
@@ -12,7 +12,6 @@ Clawdbot ships two installer scripts (served from `clawd.bot`):
 - `https://clawd.bot/install.sh` — “recommended” installer (global npm install by default; can also install from a GitHub checkout)
 - `https://clawd.bot/install-cli.sh` — non-root-friendly CLI installer (installs into a prefix with its own Node)
 - `https://clawd.bot/install.ps1` — Windows PowerShell installer (npm by default; optional git install)
 To see the current flags/behavior, run:
@@ -20,12 +19,6 @@ To see the current flags/behavior, run:
 curl -fsSL https://clawd.bot/install.sh | bash -s -- --help
 ```
 Windows (PowerShell) help:
 ```powershell
 & ([scriptblock]::Create((iwr -useb https://clawd.bot/install.ps1))) -?
 ```
 If the installer completes but `clawdbot` is not found in a new terminal, it’s usually a Node/npm PATH issue. See: [Install](/install#nodejs--npm-path-sanity).
 ## install.sh (recommended)
@@ -80,37 +73,3 @@ Help:
 ```bash
 curl -fsSL https://clawd.bot/install-cli.sh | bash -s -- --help
 ```
 ## install.ps1 (Windows PowerShell)
 What it does (high level):
 - Ensure Node.js **22+** (winget/Chocolatey/Scoop or manual).
 - Choose install method:
  - `npm` (default): `npm install -g clawdbot@latest`
  - `git`: clone/build a source checkout and install a wrapper script
 - Runs `clawdbot doctor --non-interactive` on upgrades and git installs (best effort).
 Examples:
 ```powershell
 iwr -useb https://clawd.bot/install.ps1 | iex
 ```
 ```powershell
 iwr -useb https://clawd.bot/install.ps1 | iex -InstallMethod git
 ```
 ```powershell
 iwr -useb https://clawd.bot/install.ps1 | iex -InstallMethod git -GitDir "C:\\clawdbot"
 ```
 Environment variables:
 - `CLAWDBOT_INSTALL_METHOD=git|npm`
 - `CLAWDBOT_GIT_DIR=...`
 Git requirement:
 If you choose `-InstallMethod git` and Git is missing, the installer will print the
 Git for Windows link (`https://git-scm.com/download/win`) and exit.
@@ -149,8 +149,8 @@ Notes:
 ## System commands (node host / mac node)
-The macOS node exposes `system.run`, `system.notify`, and `system.execApprovals.get/set`.
+The macOS node exposes `system.run` and `system.notify`. The headless node host
-The headless node host exposes `system.run`, `system.which`, and `system.execApprovals.get/set`.
+exposes `system.run` and `system.which`.
 Examples:
@@ -104,29 +104,6 @@ Rules:
 - If `<capability>.enabled: true` but no models are configured, Clawdbot tries the
  **active reply model** when its provider supports the capability.
 ### Auto-enable audio (when keys exist)
 If `tools.media.audio.enabled` is **not** set to `false` and you have any supported
 audio provider keys configured, Clawdbot will **auto-enable audio transcription**
 even when you haven’t listed models explicitly.
 Providers checked (in order):
 1) OpenAI
 2) Groq
 3) Deepgram
 To disable this behavior, set:
 ```json5
 {
  tools: {
    media: {
      audio: {
        enabled: false
      }
    }
  }
 }
 ```
 ## Capabilities (optional)
 If you set `capabilities`, the entry only runs for those media types. For shared
 lists, Clawdbot can infer defaults:
@@ -9,9 +9,8 @@ read_when:
 # Gateway on macOS (external launchd)
 Clawdbot.app no longer bundles Node/Bun or the Gateway runtime. The macOS app
-expects an **external** `clawdbot` CLI install, does not spawn the Gateway as a
+expects an **external** `clawdbot` CLI install and manages a per‑user launchd
-child process, and manages a per‑user launchd service to keep the Gateway
+service to keep the Gateway running.
 running (or attaches to an existing local Gateway if one is already running).
 ## Install the CLI (required for local mode)
@@ -39,8 +38,6 @@ Manager:
 Behavior:
 - “Clawdbot Active” enables/disables the LaunchAgent.
 - App quit does **not** stop the gateway (launchd keeps it alive).
 - If a Gateway is already running on the configured port, the app attaches to
  it instead of starting a new one.
 Logging:
 - launchd stdout/err: `/tmp/clawdbot/clawdbot-gateway.log`
@@ -5,11 +5,9 @@ read_when:
 ---
 # Gateway lifecycle on macOS
-The macOS app **manages the Gateway via launchd** by default and does not spawn
+The macOS app **manages the Gateway via launchd** by default. The launchd job
-the Gateway as a child process. It first tries to attach to an already‑running
+uses the external `clawdbot` CLI (no embedded runtime). This gives you reliable
-Gateway on the configured port; if none is reachable, it enables the launchd
+auto‑start at login and restart on crashes.
 service via the external `clawdbot` CLI (no embedded runtime). This gives you
 reliable auto‑start at login and restart on crashes.
 Child‑process mode (Gateway spawned directly by the app) is **not in use** today.
 If you need tighter coupling to the UI, run the Gateway manually in a terminal.
@@ -32,9 +32,6 @@ To build the macOS app and package it into `dist/Clawdbot.app`, run:
 If you don't have an Apple Developer ID certificate, the script will automatically use **ad-hoc signing** (`-`). 
 For dev run modes, signing flags, and Team ID troubleshooting, see the macOS app README:
 https://github.com/clawdbot/clawdbot/blob/main/apps/macos/README.md
 > **Note**: Ad-hoc signed apps may trigger security prompts. If the app crashes immediately with "Abort trap 6", see the [Troubleshooting](#troubleshooting) section.
 ## 3. Install the CLI
@@ -14,7 +14,6 @@ This app is usually built from [`scripts/package-mac-app.sh`](https://github.com
 - inject build metadata into Info.plist: `ClawdbotBuildTimestamp` (UTC) and `ClawdbotGitCommit` (short hash) so the About pane can show build, git, and debug/release channel.
 - **Packaging requires Node 22+**: the script runs TS builds and the Control UI build.
 - reads `SIGN_IDENTITY` from the environment. Add `export SIGN_IDENTITY="Apple Development: Your Name (TEAMID)"` (or your Developer ID Application cert) to your shell rc to always sign with your cert. Ad-hoc signing requires explicit opt-in via `ALLOW_ADHOC_SIGNING=1` or `SIGN_IDENTITY="-"` (not recommended for permission testing).
 - runs a Team ID audit after signing and fails if any Mach-O inside the app bundle is signed by a different Team ID. Set `SKIP_TEAM_ID_CHECK=1` to bypass.
 ## Usage
@@ -24,7 +23,6 @@ scripts/package-mac-app.sh               # auto-selects identity; errors if none
 SIGN_IDENTITY="Developer ID Application: Your Name" scripts/package-mac-app.sh   # real cert
 ALLOW_ADHOC_SIGNING=1 scripts/package-mac-app.sh    # ad-hoc (permissions will not stick)
 SIGN_IDENTITY="-" scripts/package-mac-app.sh        # explicit ad-hoc (same caveat)
 DISABLE_LIBRARY_VALIDATION=1 scripts/package-mac-app.sh   # dev-only Sparkle Team ID mismatch workaround
 ```
 ### Ad-hoc Signing Note
@@ -7,8 +7,6 @@ read_when:
 **Current model:** there is **no local control socket** and no `clawdbot-mac` CLI. All agent actions go through the Gateway WebSocket and `node.invoke`. UI automation still uses PeekabooBridge.
 **Planned model:** add a local Unix socket between the **node service** and the **macOS app**. The app owns `system.run` (UI/TCC context); the node service forwards exec requests over IPC.
 ## Goals
 - Single GUI app instance that owns all TCC-facing work (notifications, screen recording, mic, speech, AppleScript).
 - A small surface for automation: Gateway + node commands, plus PeekabooBridge for UI automation.
@@ -19,19 +17,6 @@ read_when:
 - The app runs the Gateway (local mode) and connects to it as a node.
 - Agent actions are performed via `node.invoke` (e.g. `system.run`, `system.notify`, `canvas.*`).
 ### Node service + app IPC (planned)
 - A headless node service connects to the Gateway bridge.
 - `system.run` requests are forwarded to the macOS app over a local Unix socket.
 - The app performs the exec in UI context, prompts if needed, and returns output.
 Diagram (SCI):
 ```
 Agent -> Gateway -> Bridge -> Node Service (TS)
                         |  IPC (UDS + token + HMAC + TTL)
                         v
                     Mac App (UI + TCC + system.run)
 ```
 ### PeekabooBridge (UI automation)
 - UI automation uses a separate UNIX socket named `bridge.sock` and the PeekabooBridge JSON protocol.
 - Host preference order (client-side): Peekaboo.app → Claude.app → Clawdbot.app → local execution.
@@ -40,7 +25,6 @@ Agent -> Gateway -> Bridge -> Node Service (TS)
 ### Mach/XPC
 - Not required for automation; `node.invoke` + PeekabooBridge cover current needs.
 - Planned IPC keeps Unix sockets (no XPC helper).
 ## Operational flows
 - Restart/rebuild: `SIGN_IDENTITY="Apple Development: <Developer Name> (<TEAMID>)" scripts/restart-mac.sh`
@@ -54,4 +38,3 @@ Agent -> Gateway -> Bridge -> Node Service (TS)
 - PeekabooBridge: `PEEKABOO_ALLOW_UNSIGNED_SOCKET_CLIENTS=1` (DEBUG-only) may allow same-UID callers for local development.
 - All communication remains local-only; no network sockets are exposed.
 - TCC prompts originate only from the GUI app bundle; keep the signed bundle ID stable across rebuilds.
 - Planned IPC hardening: socket mode `0600`, token, peer-UID checks, HMAC challenge/response, short TTL.
@@ -7,8 +7,8 @@ read_when:
 # Clawdbot macOS Companion (menu bar + gateway broker)
 The macOS app is the **menu‑bar companion** for Clawdbot. It owns permissions,
-manages/attaches to the Gateway locally (launchd or manual), and exposes macOS
+manages the Gateway locally, and exposes macOS capabilities to the agent as a
-capabilities to the agent as a node.
+node.
 ## What it does
@@ -20,17 +20,13 @@ capabilities to the agent as a node.
 - Optionally hosts **PeekabooBridge** for UI automation.
 - Installs the global CLI (`clawdbot`) via npm/pnpm on request (bun not recommended for the Gateway runtime).
 Planned:
 - Run a headless **node service** locally (launchd).
 - Keep `system.run` in the app (UI/TCC context), with the node service forwarding via IPC.
 ## Local vs remote mode
- **Local** (default): the app attaches to a running local Gateway if present;
+- **Local** (default): the app ensures a local Gateway is running via launchd.
  otherwise it enables the launchd service via `clawdbot daemon`.
 - **Remote**: the app connects to a Gateway over SSH/Tailscale and never starts
  a local process.
-The app does not spawn the Gateway as a child process.
+- **Attach‑only** (debug): the app connects to an already‑running local Gateway
  and never spawns its own.
 ## Launchd control
@@ -58,18 +54,6 @@ The macOS app presents itself as a node. Common commands:
 The node reports a `permissions` map so agents can decide what’s allowed.
 Planned split:
 - Node service advertises the node surface to the Gateway.
 - macOS app performs `system.run` in UI context over IPC.
 Diagram (SCI):
 ```
 Gateway -> Bridge -> Node Service (TS)
                 |  IPC (UDS + token + HMAC + TTL)
                 v
             Mac App (UI + TCC + system.run)
 ```
 ## Exec approvals (system.run)
 `system.run` is controlled by **Exec approvals** in the macOS app (Settings → Exec approvals).
@@ -37,7 +37,6 @@ See [Voice Call](/plugins/voice-call) for a concrete example plugin.
 - Microsoft Teams is plugin-only as of 2026.1.15; install `@clawdbot/msteams` if you use Teams.
 - Memory (Core) — bundled memory search plugin (enabled by default via `plugins.slots.memory`)
 - Memory (LanceDB) — bundled long-term memory plugin (auto-recall/capture; set `plugins.slots.memory = "memory-lancedb"`)
 - [Voice Call](/plugins/voice-call) — `@clawdbot/voice-call`
 - [Zalo Personal](/plugins/zalouser) — `@clawdbot/zalouser`
 - [Matrix](/channels/matrix) — `@clawdbot/matrix`
@@ -46,7 +45,7 @@ See [Voice Call](/plugins/voice-call) for a concrete example plugin.
 - Google Antigravity OAuth (provider auth) — bundled as `google-antigravity-auth` (disabled by default)
 - Gemini CLI OAuth (provider auth) — bundled as `google-gemini-cli-auth` (disabled by default)
 - Qwen OAuth (provider auth) — bundled as `qwen-portal-auth` (disabled by default)
- Copilot Proxy (provider auth) — local VS Code Copilot Proxy bridge; distinct from built-in `github-copilot` device login (bundled, disabled by default)
+- Copilot Proxy (provider auth) — bundled as `copilot-proxy` (disabled by default)
 Clawdbot plugins are **TypeScript modules** loaded at runtime via jiti. They can
 register:
@@ -6,27 +6,6 @@ read_when:
 ---
 # Github Copilot
 ## What is GitHub Copilot?
 GitHub Copilot is GitHub's AI coding assistant. It provides access to Copilot
 models for your GitHub account and plan. Clawdbot can use Copilot as a model
 provider in two different ways.
 ## Two ways to use Copilot in Clawdbot
 ### 1) Built-in GitHub Copilot provider (`github-copilot`)
 Use the native device-login flow to obtain a GitHub token, then exchange it for
 Copilot API tokens when Clawdbot runs. This is the **default** and simplest path
 because it does not require VS Code.
 ### 2) Copilot Proxy plugin (`copilot-proxy`)
 Use the **Copilot Proxy** VS Code extension as a local bridge. Clawdbot talks to
 the proxy’s `/v1` endpoint and uses the model list you configure there. Choose
 this when you already run Copilot Proxy in VS Code or need to route through it.
 You must enable the plugin and keep the VS Code extension running.
 Use GitHub Copilot as a model provider (`github-copilot`). The login command runs
 the GitHub device flow, saves an auth profile, and updates your config to use that
 profile.
@@ -30,8 +30,6 @@ read_when:
 - **Node identity:** use existing `nodeId`.
 - **Socket auth:** Unix socket + token (cross-platform); split later if needed.
 - **Node host state:** `~/.clawdbot/node.json` (node id + pairing token).
 - **macOS exec host:** run `system.run` inside the macOS app; node service forwards requests over local IPC.
 - **No XPC helper:** stick to Unix socket + token + peer checks.
 ## Key concepts
 ### Host
@@ -141,30 +139,19 @@ Notes:
 ## UI integration (macOS app)
 ### IPC
- Unix socket at `~/.clawdbot/exec-approvals.sock` (0600).
+- Unix socket at `~/.clawdbot/exec-approvals.sock`.
- Token stored in `exec-approvals.json` (0600).
+- Runner connects and sends an approval request; UI responds with a decision.
- Peer checks: same-UID only.
+- Token stored in `exec-approvals.json`.
 - Challenge/response: nonce + HMAC(token, request-hash) to prevent replay.
 - Short TTL (e.g., 10s) + max payload + rate limit.
-### Ask flow (macOS app exec host)
+### Ask flow
-1) Node service receives `system.run` from gateway.
+1) Runner receives `system.run` from gateway.
-2) Node service connects to the local socket and sends the prompt/exec request.
+2) If ask required, runner connects to the socket and sends a prompt request.
-3) App validates peer + token + HMAC + TTL, then shows dialog if needed.
+3) UI shows dialog; returns decision.
-4) App executes the command in UI context and returns output.
+4) Runner enforces decision and proceeds.
 5) Node service returns output to gateway.
 If UI missing:
 - Apply `askFallback` (`deny|allowlist|full`).
 ### Diagram (SCI)
 ```
 Agent -> Gateway -> Bridge -> Node Service (TS)
                         |  IPC (UDS + token + HMAC + TTL)
                         v
                     Mac App (UI + TCC + system.run)
 ```
 ## Node identity + binding
 - Use existing `nodeId` from Bridge pairing.
 - Binding model:
@@ -1,116 +0,0 @@
 ---
 summary: "Audit what can spend money, which keys are used, and how to view usage"
 read_when:
  - You want to understand which features may call paid APIs
  - You need to audit keys, costs, and usage visibility
  - You’re explaining /status or /usage cost reporting
 ---
 # API usage & costs
 This doc lists **features that can invoke API keys** and where their costs show up. It focuses on
 Clawdbot features that can generate provider usage or paid API calls.
 ## Where costs show up (chat + CLI)
 **Per-session cost snapshot**
 - `/status` shows the current session model, context usage, and last response tokens.
 - If the model uses **API-key auth**, `/status` also shows **estimated cost** for the last reply.
 **Per-message cost footer**
 - `/usage full` appends a usage footer to every reply, including **estimated cost** (API-key only).
 - `/usage tokens` shows tokens only; OAuth flows hide dollar cost.
 **CLI usage windows (provider quotas)**
 - `clawdbot status --usage` and `clawdbot channels list` show provider **usage windows**
  (quota snapshots, not per-message costs).
 See [Token use & costs](/token-use) for details and examples.
 ## How keys are discovered
 Clawdbot can pick up credentials from:
 - **Auth profiles** (per-agent, stored in `auth-profiles.json`).
 - **Environment variables** (e.g. `OPENAI_API_KEY`, `BRAVE_API_KEY`, `FIRECRAWL_API_KEY`).
 - **Config** (`models.providers.*.apiKey`, `tools.web.search.*`, `tools.web.fetch.firecrawl.*`,
  `memorySearch.*`, `talk.apiKey`).
 - **Skills** (`skills.entries.<name>.apiKey`) which may export keys to the skill process env.
 ## Features that can spend keys
 ### 1) Core model responses (chat + tools)
 Every reply or tool call uses the **current model provider** (OpenAI, Anthropic, etc). This is the
 primary source of usage and cost.
 See [Models](/providers/models) for pricing config and [Token use & costs](/token-use) for display.
 ### 2) Media understanding (audio/image/video)
 Inbound media can be summarized/transcribed before the reply runs. This uses model/provider APIs.
 - Audio: OpenAI / Groq / Deepgram (now **auto-enabled** when keys exist).
 - Image: OpenAI / Anthropic / Google.
 - Video: Google.
 See [Media understanding](/nodes/media-understanding).
 ### 3) Memory embeddings + semantic search
 Semantic memory search uses **embedding APIs** when configured for remote providers:
 - `memorySearch.provider = "openai"` → OpenAI embeddings
 - `memorySearch.provider = "gemini"` → Gemini embeddings
 - Optional fallback to OpenAI if local embeddings fail
 You can keep it local with `memorySearch.provider = "local"` (no API usage).
 See [Memory](/concepts/memory).
 ### 4) Web search tool (Brave / Perplexity via OpenRouter)
 `web_search` uses API keys and may incur usage charges:
 - **Brave Search API**: `BRAVE_API_KEY` or `tools.web.search.apiKey`
 - **Perplexity** (via OpenRouter): `PERPLEXITY_API_KEY` or `OPENROUTER_API_KEY`
 **Brave free tier (generous):**
 - **2,000 requests/month**
 - **1 request/second**
 - **Credit card required** for verification (no charge unless you upgrade)
 See [Web tools](/tools/web).
 ### 5) Web fetch tool (Firecrawl)
 `web_fetch` can call **Firecrawl** when an API key is present:
 - `FIRECRAWL_API_KEY` or `tools.web.fetch.firecrawl.apiKey`
 If Firecrawl isn’t configured, the tool falls back to direct fetch + readability (no paid API).
 See [Web tools](/tools/web).
 ### 6) Provider usage snapshots (status/health)
 Some status commands call **provider usage endpoints** to display quota windows or auth health.
 These are typically low-volume calls but still hit provider APIs:
 - `clawdbot status --usage`
 - `clawdbot models status --json`
 See [Models CLI](/cli/models).
 ### 7) Compaction safeguard summarization
 The compaction safeguard can summarize session history using the **current model**, which
 invokes provider APIs when it runs.
 See [Session management + compaction](/reference/session-management-compaction).
 ### 8) Model scan / probe
 `clawdbot models scan` can probe OpenRouter models and uses `OPENROUTER_API_KEY` when
 probing is enabled.
 See [Models CLI](/cli/models).
 ### 9) Talk (speech)
 Talk mode can invoke **ElevenLabs** when configured:
 - `ELEVENLABS_API_KEY` or `talk.apiKey`
 See [Talk mode](/nodes/talk).
 ### 10) Skills (third-party APIs)
 Skills can store `apiKey` in `skills.entries.<name>.apiKey`. If a skill uses that key for external
 APIs, it can incur costs according to the skill’s provider.
 See [Skills](/tools/skills).
@@ -1,9 +0,0 @@
 ---
 summary: "Workspace template for BOOT.md"
 read_when:
  - Adding a BOOT.md checklist
 ---
 # BOOT.md
 Add short, explicit instructions for what Clawdbot should do on startup (enable `hooks.internal.enabled`).
 If the task sends a message, use the message tool and then reply with NO_REPLY.
@@ -60,6 +60,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
 - [Remote gateways + nodes](#remote-gateways-nodes)
  - [How do commands propagate between Telegram, the gateway, and nodes?](#how-do-commands-propagate-between-telegram-the-gateway-and-nodes)
  - [Do nodes run a gateway daemon?](#do-nodes-run-a-gateway-daemon)
  - [Can I run a headless node host without the macOS app?](#can-i-run-a-headless-node-host-without-the-macos-app)
  - [Is there an API / RPC way to apply config?](#is-there-an-api-rpc-way-to-apply-config)
  - [What’s a minimal “sane” config for a first install?](#whats-a-minimal-sane-config-for-a-first-install)
  - [How do I set up Tailscale on a VPS and connect from my Mac?](#how-do-i-set-up-tailscale-on-a-vps-and-connect-from-my-mac)
@@ -405,7 +406,7 @@ You have three supported patterns:
 Run the Gateway where the macOS binaries exist, then connect from Linux in [remote mode](#how-do-i-run-clawdbot-in-remote-mode-client-connects-to-a-gateway-elsewhere) or over Tailscale. The skills load normally because the Gateway host is macOS.
 **Option B - use a macOS node (no SSH).**  
-Run the Gateway on Linux, pair a macOS node (menubar app), and set **Node Run Commands** to "Always Ask" or "Always Allow" on the Mac. Clawdbot can treat macOS-only skills as eligible when the required binaries exist on the node. The agent runs those skills via the `nodes` tool. If you choose "Always Ask", approving "Always Allow" in the prompt adds that command to the allowlist.
+Run the Gateway on Linux, pair a macOS node (menubar app), and configure **Exec approvals** (Settings → Exec approvals) to "Ask" or "Always Allow". Clawdbot can treat macOS-only skills as eligible when the required binaries exist on the node. The agent runs those skills via the `nodes` tool. If you choose "Ask", selecting "Always Allow" in the prompt adds that command to the allowlist.
 **Option C - proxy macOS binaries over SSH (advanced).**  
 Keep the Gateway on Linux, but make the required CLI binaries resolve to SSH wrappers that run on a Mac. Then override the skill to allow Linux so it stays eligible.
@@ -501,23 +502,14 @@ is writable (read-only sandboxes skip it). See [Memory](/concepts/memory).
 ### Does semantic memory search require an OpenAI API key?
-Only if you use **OpenAI embeddings**. Codex OAuth covers chat/completions and
+Only if you use **remote embeddings** (OpenAI). Codex OAuth covers
-does **not** grant embeddings access, so **signing in with Codex (OAuth or the
+chat/completions and does **not** grant embeddings access, so **signing in with
-Codex CLI login)** does not help for semantic memory search. OpenAI embeddings
+Codex (OAuth or the Codex CLI login)** does not help for semantic memory search.
-still need a real API key (`OPENAI_API_KEY` or `models.providers.openai.apiKey`).
+Remote memory search still needs a real OpenAI API key (`OPENAI_API_KEY` or
-
+`models.providers.openai.apiKey`). If you’d rather stay local, set
-If you don’t set a provider explicitly, Clawdbot auto-selects a provider when it
+`memorySearch.provider = "local"` (and optionally `memorySearch.fallback =
-can resolve an API key (auth profiles, `models.providers.*.apiKey`, or env vars).
+"none"`). We support **remote or local embedding models** — see [Memory](/concepts/memory)
-It prefers OpenAI if an OpenAI key resolves, otherwise Gemini if a Gemini key
+for the setup details.
 resolves. If neither key is available, memory search stays disabled until you
 configure it. If you have a local model path configured and present, Clawdbot
 prefers `local`.
 If you’d rather stay local, set `memorySearch.provider = "local"` (and optionally
 `memorySearch.fallback = "none"`). If you want Gemini embeddings, set
 `memorySearch.provider = "gemini"` and provide `GEMINI_API_KEY` (or
 `memorySearch.remote.apiKey`). We support **OpenAI, Gemini, or local** embedding
 models — see [Memory](/concepts/memory) for the setup details.
 ## Where things live on disk
@@ -751,6 +743,23 @@ to the gateway (iOS/Android nodes, or macOS “node mode” in the menubar app).
 A full restart is required for `gateway`, `bridge`, `discovery`, and `canvasHost` changes.
 ### Can I run a headless node host without the macOS app?
 Yes. The headless node host is a **command-only** node that exposes `system.run` / `system.which`
 without any UI. It has no screen/camera/notify support (use the macOS app for those).
 Start it:
 ```bash
 clawdbot node start --host <gateway-host> --port 18790
 ```
 Notes:
 - Pairing is still required (`clawdbot nodes pending` → `clawdbot nodes approve <requestId>`).
 - Exec approvals still apply via `~/.clawdbot/exec-approvals.json`.
 - If prompts are enabled but no companion UI is reachable, `askFallback` decides (default: deny).
 Docs: [Node CLI](/cli/node), [Nodes](/nodes), [Exec approvals](/tools/exec-approvals).
 ### Is there an API / RPC way to apply config?
 Yes. `config.apply` validates + writes the full config and restarts the Gateway as part of the operation.
@@ -889,14 +898,19 @@ Send `/new` or `/reset` as a standalone message. See [Session management](/conce
 ### Do sessions reset automatically if I never send `/new`?
-Yes. Sessions expire after `session.idleMinutes` (default **60**). The **next**
+Yes. By default sessions reset daily at **4:00 AM local time** on the gateway host.
-message starts a fresh session id for that chat key. This does not delete
+You can also add an idle window; when both daily and idle resets are configured,
-transcripts — it just starts a new session.
+whichever expires first starts a new session id on the next message. This does
 not delete transcripts — it just starts a new session.
 ```json5
 {
  session: {
-    idleMinutes: 240
+    reset: {
      mode: "daily",
      atHour: 4,
      idleMinutes: 240
    }
  }
 }
 ```
@@ -22,10 +22,6 @@ Exec approvals are enforced locally on the execution host:
 - **gateway host** → `clawdbot` process on the gateway machine
 - **node host** → node runner (macOS companion app or headless node host)
 Planned macOS split:
 - **node service** forwards `system.run` to the **macOS app** over local IPC.
 - **macOS app** enforces approvals + executes the command in UI context.
 ## Settings and storage
 Approvals live in a local JSON file on the execution host:
@@ -111,12 +107,8 @@ overrides, and allowlists. Pick a scope (Defaults or an agent), tweak the policy
 add/remove allowlist patterns, then **Save**. The UI shows **last used** metadata
 per pattern so you can keep the list tidy.
-The target selector chooses **Gateway** (local approvals) or a **Node**. Nodes
+Note: the Control UI edits the approvals file on the **Gateway host**. For a
-must advertise `system.execApprovals.get/set` (macOS app or headless node host).
+headless node host, edit its local `~/.clawdbot/exec-approvals.json` directly.
 If a node does not advertise exec approvals yet, edit its local
 `~/.clawdbot/exec-approvals.json` directly.
 CLI: `clawdbot approvals` supports gateway or node editing (see [Approvals CLI](/cli/approvals)).
 ## Approval flow
@@ -132,19 +124,6 @@ Actions:
 - **Always allow** → add to allowlist + run
 - **Deny** → block
 ### macOS IPC flow (planned)
 ```
 Gateway -> Bridge -> Node Service (TS)
                    |  IPC (UDS + token + HMAC + TTL)
                    v
                Mac App (UI + approvals + system.run)
 ```
 Security notes:
 - Unix socket mode `0600`, token stored in `exec-approvals.json`.
 - Same-UID peer check.
 - Challenge/response (nonce + HMAC token + request hash) + short TTL.
 ## System events
 Exec lifecycle is surfaced as system messages:
@@ -36,7 +36,7 @@ The onboarding wizard generates a gateway token by default, so paste it here on
 - Cron jobs: list/add/run/enable/disable + run history (`cron.*`)
 - Skills: status, enable/disable, install, API key updates (`skills.*`)
 - Nodes: list + caps (`node.list`)
- Exec approvals: edit gateway or node allowlists + ask policy for `exec host=gateway/node` (`exec.approvals.*`)
+- Exec approvals: edit allowlists + ask policy for `exec host=gateway/node` (`exec.approvals.*`)
 - Config: view/edit `~/.clawdbot/clawdbot.json` (`config.get`, `config.set`)
 - Config: apply + restart with validation (`config.apply`) and wake the last active session
 - Config writes include a base-hash guard to prevent clobbering concurrent edits
@@ -836,20 +836,10 @@ async function processMessage(
  const fromLabel = message.isGroup
    ? `group:${peerId}`
    : message.senderName || `user:${message.senderId}`;
  const storePath = core.channel.session.resolveStorePath(config.session?.store, {
    agentId: route.agentId,
  });
  const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(config);
  const previousTimestamp = core.channel.session.readSessionUpdatedAt({
    storePath,
    sessionKey: route.sessionKey,
  });
  const body = core.channel.reply.formatAgentEnvelope({
    channel: "BlueBubbles",
    from: fromLabel,
    timestamp: message.timestamp,
    previousTimestamp,
    envelope: envelopeOptions,
    body: rawBody,
  });
  let chatGuidForActions = chatGuid;
@@ -1,4 +1,5 @@
 import os from "node:os";
 import { beforeEach, describe, expect, it } from "vitest";
 import type { PluginRuntime } from "clawdbot/plugin-sdk";
@@ -466,34 +466,25 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
 	        isThreadRoot: event.isThreadRoot,
 	      });
 	      const route = core.channel.routing.resolveAgentRoute({
 	        cfg,
 	        channel: "matrix",
 	        peer: {
 	          kind: isDirectMessage ? "dm" : "channel",
 	          id: isDirectMessage ? senderId : roomId,
 	        },
 	      });
 	      const envelopeFrom = isDirectMessage ? senderName : (roomName ?? roomId);
 	      const textWithId = `${bodyText}\n[matrix event id: ${messageId} room: ${roomId}]`;
 	      const storePath = core.channel.session.resolveStorePath(cfg.session?.store, {
 	        agentId: route.agentId,
 	      });
 	      const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);
 	      const previousTimestamp = core.channel.session.readSessionUpdatedAt({
 	        storePath,
 	        sessionKey: route.sessionKey,
 	      });
 	      const body = core.channel.reply.formatAgentEnvelope({
 	        channel: "Matrix",
 	        from: envelopeFrom,
 	        timestamp: event.getTs() ?? undefined,
 	        previousTimestamp,
 	        envelope: envelopeOptions,
 	        body: textWithId,
 	      });
-	      const groupSystemPrompt = roomConfigInfo.config?.systemPrompt?.trim() || undefined;
+      const route = core.channel.routing.resolveAgentRoute({
        cfg,
        channel: "matrix",
        peer: {
          kind: isDirectMessage ? "dm" : "channel",
          id: isDirectMessage ? senderId : roomId,
        },
      });
      const groupSystemPrompt = roomConfigInfo.config?.systemPrompt?.trim() || undefined;
      const ctxPayload = core.channel.reply.finalizeInboundContext({
 	        Body: body,
 	        RawBody: bodyText,
@@ -526,10 +517,13 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
 	        OriginatingTo: `room:${roomId}`,
 	      });
-	      void core.channel.session.recordSessionMetaFromInbound({
+      const storePath = core.channel.session.resolveStorePath(cfg.session?.store, {
-	        storePath,
+        agentId: route.agentId,
-	        sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
+      });
-	        ctx: ctxPayload,
+      void core.channel.session.recordSessionMetaFromInbound({
        storePath,
        sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
        ctx: ctxPayload,
      }).catch((err) => {
        logger.warn(
          { error: String(err), storePath, sessionKey: ctxPayload.SessionKey ?? route.sessionKey },
@@ -37,8 +37,8 @@ describeWithKey("memory plugin e2e", () => {
    // Dynamic import to avoid loading LanceDB when not testing
    const { default: memoryPlugin } = await import("./index.js");
-    expect(memoryPlugin.id).toBe("memory-lancedb");
+    expect(memoryPlugin.id).toBe("memory");
-    expect(memoryPlugin.name).toBe("Memory (LanceDB)");
+    expect(memoryPlugin.name).toBe("Memory (Vector)");
    expect(memoryPlugin.kind).toBe("memory");
    expect(memoryPlugin.configSchema).toBeDefined();
    expect(memoryPlugin.register).toBeInstanceOf(Function);
@@ -185,8 +185,8 @@ describeWithKey("memory plugin live tests", () => {
    const logs: string[] = [];
    const mockApi = {
-      id: "memory-lancedb",
+      id: "memory",
-      name: "Memory (LanceDB)",
+      name: "Memory (Vector)",
      source: "test",
      config: {},
      pluginConfig: {
@@ -1,5 +1,5 @@
 /**
- * Clawdbot Memory (LanceDB) Plugin
+ * Clawdbot Memory Plugin
 *
 * Long-term memory with vector search for AI conversations.
 * Uses LanceDB for storage and OpenAI for embeddings.
@@ -214,9 +214,9 @@ function detectCategory(text: string): MemoryCategory {
 // ============================================================================
 const memoryPlugin = {
-  id: "memory-lancedb",
+  id: "memory",
-  name: "Memory (LanceDB)",
+  name: "Memory (Vector)",
-  description: "LanceDB-backed long-term memory with auto-recall/capture",
+  description: "Long-term memory with vector search and seamless auto-recall/capture",
  kind: "memory" as const,
  configSchema: memoryConfigSchema,
@@ -227,9 +227,7 @@ const memoryPlugin = {
    const db = new MemoryDB(resolvedDbPath, vectorDim);
    const embeddings = new Embeddings(cfg.embedding.apiKey, cfg.embedding.model!);
-    api.logger.info(
+    api.logger.info(`memory: plugin registered (db: ${resolvedDbPath}, lazy init)`);
      `memory-lancedb: plugin registered (db: ${resolvedDbPath}, lazy init)`,
    );
    // ========================================================================
    // Tools
@@ -419,7 +417,7 @@ const memoryPlugin = {
      ({ program }) => {
        const memory = program
          .command("ltm")
-          .description("LanceDB memory plugin commands");
+          .description("Long-term memory plugin commands");
        memory
          .command("list")
@@ -479,14 +477,14 @@ const memoryPlugin = {
            .join("\n");
          api.logger.info?.(
-            `memory-lancedb: injecting ${results.length} memories into context`,
+            `memory: injecting ${results.length} memories into context`,
          );
          return {
            prependContext: `<relevant-memories>\nThe following memories may be relevant to this conversation:\n${memoryContext}\n</relevant-memories>`,
          };
        } catch (err) {
-          api.logger.warn(`memory-lancedb: recall failed: ${String(err)}`);
+          api.logger.warn(`memory: recall failed: ${String(err)}`);
        }
      });
    }
@@ -561,10 +559,10 @@ const memoryPlugin = {
          }
          if (stored > 0) {
-            api.logger.info(`memory-lancedb: auto-captured ${stored} memories`);
+            api.logger.info(`memory: auto-captured ${stored} memories`);
          }
        } catch (err) {
-          api.logger.warn(`memory-lancedb: capture failed: ${String(err)}`);
+          api.logger.warn(`memory: capture failed: ${String(err)}`);
        }
      });
    }
@@ -574,14 +572,14 @@ const memoryPlugin = {
    // ========================================================================
    api.registerService({
-      id: "memory-lancedb",
+      id: "memory",
      start: () => {
        api.logger.info(
-          `memory-lancedb: initialized (db: ${resolvedDbPath}, model: ${cfg.embedding.model})`,
+          `memory: initialized (db: ${resolvedDbPath}, model: ${cfg.embedding.model})`,
        );
      },
      stop: () => {
-        api.logger.info("memory-lancedb: stopped");
+        api.logger.info("memory: stopped");
      },
    });
  },
@@ -1,16 +1,14 @@
 {
-  "name": "@clawdbot/memory-lancedb",
+  "name": "@clawdbot/memory",
  "version": "0.0.1",
  "type": "module",
-  "description": "Clawdbot LanceDB-backed long-term memory plugin with auto-recall/capture",
+  "description": "Clawdbot long-term memory plugin with vector search and seamless auto-recall/capture",
  "dependencies": {
    "@lancedb/lancedb": "^0.15.0",
    "@sinclair/typebox": "0.34.47",
-    "openai": "^4.104.0"
+    "@lancedb/lancedb": "^0.15.0",
    "openai": "^4.77.0"
  },
  "clawdbot": {
-    "extensions": [
+    "extensions": ["./index.ts"]
      "./index.ts"
    ]
  }
 }
@@ -9,10 +9,10 @@
    ]
  },
  "dependencies": {
    "@microsoft/agents-hosting": "^1.2.2",
    "@microsoft/agents-hosting-express": "^1.2.2",
    "@microsoft/agents-hosting-extensions-teams": "^1.2.2",
    "clawdbot": "workspace:*",
    "@microsoft/agents-hosting": "^1.1.1",
    "@microsoft/agents-hosting-express": "^1.1.1",
    "@microsoft/agents-hosting-extensions-teams": "^1.1.1",
    "express": "^5.2.1",
    "proper-lockfile": "^4.1.2"
  }
@@ -406,20 +406,10 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
 	    const mediaPayload = buildMSTeamsMediaPayload(mediaList);
 	    const envelopeFrom = isDirectMessage ? senderName : conversationType;
 	    const storePath = core.channel.session.resolveStorePath(cfg.session?.store, {
 	      agentId: route.agentId,
 	    });
 	    const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);
 	    const previousTimestamp = core.channel.session.readSessionUpdatedAt({
 	      storePath,
 	      sessionKey: route.sessionKey,
 	    });
 	    const body = core.channel.reply.formatAgentEnvelope({
 	      channel: "Teams",
 	      from: envelopeFrom,
 	      timestamp,
 	      previousTimestamp,
 	      envelope: envelopeOptions,
 	      body: rawBody,
 	    });
    let combinedBody = body;
@@ -431,16 +421,15 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
        historyKey,
        limit: historyLimit,
        currentMessage: combinedBody,
-	        formatEntry: (entry) =>
+        formatEntry: (entry) =>
-	          core.channel.reply.formatAgentEnvelope({
+          core.channel.reply.formatAgentEnvelope({
-	            channel: "Teams",
+            channel: "Teams",
-	            from: conversationType,
+            from: conversationType,
-	            timestamp: entry.timestamp,
+            timestamp: entry.timestamp,
-	            body: `${entry.sender}: ${entry.body}${entry.messageId ? ` [id:${entry.messageId}]` : ""}`,
+            body: `${entry.sender}: ${entry.body}${entry.messageId ? ` [id:${entry.messageId}]` : ""}`,
-	            envelope: envelopeOptions,
+          }),
-	          }),
+      });
-	      });
+    }
 	    }
 	    const ctxPayload = core.channel.reply.finalizeInboundContext({
 	      Body: combinedBody,
@@ -466,8 +455,11 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
 	      ...mediaPayload,
 	    });
-	    void core.channel.session.recordSessionMetaFromInbound({
+    const storePath = core.channel.session.resolveStorePath(cfg.session?.store, {
-	      storePath,
+      agentId: route.agentId,
    });
    void core.channel.session.recordSessionMetaFromInbound({
      storePath,
      sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
      ctx: ctxPayload,
    }).catch((err) => {
@@ -62,34 +62,6 @@ export class TwilioProvider implements VoiceCallProvider {
  /** Map of call SID to stream SID for media streams */
  private callStreamMap = new Map<string, string>();
  /** Storage for TwiML content (for notify mode with URL-based TwiML) */
  private readonly twimlStorage = new Map<string, string>();
  /**
   * Delete stored TwiML for a given `callId`.
   *
   * We keep TwiML in-memory only long enough to satisfy the initial Twilio
   * webhook request (notify mode). Subsequent webhooks should not reuse it.
   */
  private deleteStoredTwiml(callId: string): void {
    this.twimlStorage.delete(callId);
  }
  /**
   * Delete stored TwiML for a call, addressed by Twilio's provider call SID.
   *
   * This is used when we only have `providerCallId` (e.g. hangup).
   */
  private deleteStoredTwimlForProviderCall(providerCallId: string): void {
    const webhookUrl = this.callWebhookUrls.get(providerCallId);
    if (!webhookUrl) return;
    const callIdMatch = webhookUrl.match(/callId=([^&]+)/);
    if (!callIdMatch) return;
    this.deleteStoredTwiml(callIdMatch[1]);
  }
  constructor(config: TwilioConfig, options: TwilioProviderOptions = {}) {
    if (!config.accountSid) {
      throw new Error("Twilio Account SID is required");
@@ -256,14 +228,8 @@ export class TwilioProvider implements VoiceCallProvider {
      case "busy":
      case "no-answer":
      case "failed":
        if (callIdOverride) {
          this.deleteStoredTwiml(callIdOverride);
        }
        return { ...baseEvent, type: "call.ended", reason: callStatus };
      case "canceled":
        if (callIdOverride) {
          this.deleteStoredTwiml(callIdOverride);
        }
        return { ...baseEvent, type: "call.ended", reason: "hangup-bot" };
      default:
        return null;
@@ -288,25 +254,11 @@ export class TwilioProvider implements VoiceCallProvider {
    const params = new URLSearchParams(ctx.rawBody);
    const callStatus = params.get("CallStatus");
    const direction = params.get("Direction");
    const callIdFromQuery =
      typeof ctx.query?.callId === "string" && ctx.query.callId.trim()
        ? ctx.query.callId.trim()
        : undefined;
-    // Avoid logging webhook params/TwiML (may contain PII).
+    console.log(
      `[voice-call] generateTwimlResponse: status=${callStatus} direction=${direction}`,
    );
    // Handle initial TwiML request (when Twilio first initiates the call)
    // Check if we have stored TwiML for this call (notify mode)
    if (callIdFromQuery) {
      const storedTwiml = this.twimlStorage.get(callIdFromQuery);
      if (storedTwiml) {
        // Clean up after serving (one-time use)
        this.deleteStoredTwiml(callIdFromQuery);
        return storedTwiml;
      }
    }
    // Handle subsequent webhook requests (status callbacks, etc.)
    // For inbound calls, answer immediately with stream
    if (direction === "inbound") {
      const streamUrl = this.getStreamUrl();
@@ -376,28 +328,22 @@ export class TwilioProvider implements VoiceCallProvider {
    const url = new URL(input.webhookUrl);
    url.searchParams.set("callId", input.callId);
-    // Create separate URL for status callbacks (required by Twilio)
+    // Build request params
    const statusUrl = new URL(input.webhookUrl);
    statusUrl.searchParams.set("callId", input.callId);
    statusUrl.searchParams.set("type", "status"); // Differentiate from TwiML requests
    // Store TwiML content if provided (for notify mode)
    // We now serve it from the webhook endpoint instead of sending inline
    if (input.inlineTwiml) {
      this.twimlStorage.set(input.callId, input.inlineTwiml);
    }
    // Build request params - always use URL-based TwiML.
    // Twilio silently ignores `StatusCallback` when using the inline `Twiml` parameter.
    const params: Record<string, string> = {
      To: input.to,
      From: input.from,
-      Url: url.toString(), // TwiML serving endpoint
+      StatusCallback: url.toString(),
      StatusCallback: statusUrl.toString(), // Separate status callback endpoint
      StatusCallbackEvent: "initiated ringing answered completed",
      Timeout: "30",
    };
    // Use inline TwiML for notify mode (simpler, no webhook needed)
    if (input.inlineTwiml) {
      params.Twiml = input.inlineTwiml;
    } else {
      params.Url = url.toString();
    }
    const result = await this.apiRequest<TwilioCallResponse>(
      "/Calls.json",
      params,
@@ -415,8 +361,6 @@ export class TwilioProvider implements VoiceCallProvider {
   * Hang up a call via Twilio API.
   */
  async hangupCall(input: HangupCallInput): Promise<void> {
    this.deleteStoredTwimlForProviderCall(input.providerCallId);
    this.callWebhookUrls.delete(input.providerCallId);
    await this.apiRequest(
@@ -530,20 +530,10 @@ async function processMessageWithPipeline(params: {
  }
  const fromLabel = isGroup ? `group:${chatId}` : senderName || `user:${senderId}`;
  const storePath = core.channel.session.resolveStorePath(config.session?.store, {
    agentId: route.agentId,
  });
  const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(config);
  const previousTimestamp = core.channel.session.readSessionUpdatedAt({
    storePath,
    sessionKey: route.sessionKey,
  });
  const body = core.channel.reply.formatAgentEnvelope({
    channel: "Zalo",
    from: fromLabel,
    timestamp: date ? date * 1000 : undefined,
    previousTimestamp,
    envelope: envelopeOptions,
    body: rawBody,
  });
@@ -570,6 +560,9 @@ async function processMessageWithPipeline(params: {
    OriginatingTo: `zalo:${chatId}`,
  });
  const storePath = core.channel.session.resolveStorePath(config.session?.store, {
    agentId: route.agentId,
  });
  void core.channel.session.recordSessionMetaFromInbound({
    storePath,
    sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
@@ -274,20 +274,10 @@ async function processMessage(
  });
  const fromLabel = isGroup ? `group:${chatId}` : senderName || `user:${senderId}`;
  const storePath = core.channel.session.resolveStorePath(config.session?.store, {
    agentId: route.agentId,
  });
  const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(config);
  const previousTimestamp = core.channel.session.readSessionUpdatedAt({
    storePath,
    sessionKey: route.sessionKey,
  });
  const body = core.channel.reply.formatAgentEnvelope({
    channel: "Zalo Personal",
    from: fromLabel,
    timestamp: timestamp ? timestamp * 1000 : undefined,
    previousTimestamp,
    envelope: envelopeOptions,
    body: rawBody,
  });
@@ -311,6 +301,9 @@ async function processMessage(
    OriginatingTo: `zalouser:${chatId}`,
  });
  const storePath = core.channel.session.resolveStorePath(config.session?.store, {
    agentId: route.agentId,
  });
  void core.channel.session.recordSessionMetaFromInbound({
    storePath,
    sessionKey: ctxPayload.SessionKey ?? route.sessionKey,
@@ -65,27 +65,27 @@
    "dist/whatsapp/**"
  ],
  "scripts": {
-    "dev": "node scripts/run-node.mjs",
+    "dev": "tsx src/entry.ts",
    "postinstall": "node scripts/postinstall.js",
    "prepack": "pnpm build",
-    "docs:list": "node scripts/docs-list.js",
+    "docs:list": "tsx scripts/docs-list.ts",
-    "docs:bin": "node scripts/build-docs-list.mjs",
+    "docs:bin": "bun build scripts/docs-list.ts --compile --outfile bin/docs-list",
    "docs:dev": "cd docs && mint dev",
    "docs:build": "cd docs && pnpm dlx --reporter append-only mint broken-links",
-    "build": "tsc -p tsconfig.json && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts",
+    "build": "tsc -p tsconfig.json && tsx scripts/canvas-a2ui-copy.ts && tsx scripts/copy-hook-metadata.ts && tsx scripts/write-build-info.ts",
-    "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",
+    "plugins:sync": "tsx scripts/sync-plugin-versions.ts",
-    "release:check": "node --import tsx scripts/release-check.ts",
+    "release:check": "tsx scripts/release-check.ts",
    "ui:install": "node scripts/ui.js install",
    "ui:dev": "node scripts/ui.js dev",
    "ui:build": "node scripts/ui.js build",
-    "start": "node scripts/run-node.mjs",
+    "start": "tsx src/entry.ts",
-    "clawdbot": "node scripts/run-node.mjs",
+    "clawdbot": "tsx src/entry.ts",
-    "gateway:watch": "node scripts/watch-node.mjs gateway --force",
+    "gateway:watch": "tsx watch src/entry.ts gateway --force",
-    "gateway:dev": "CLAWDBOT_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway",
+    "gateway:dev": "CLAWDBOT_SKIP_CHANNELS=1 tsx src/entry.ts --dev gateway",
-    "gateway:dev:reset": "CLAWDBOT_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway --reset",
+    "gateway:dev:reset": "CLAWDBOT_SKIP_CHANNELS=1 tsx src/entry.ts --dev gateway --reset",
-    "tui": "node scripts/run-node.mjs tui",
+    "tui": "tsx src/entry.ts tui",
-    "tui:dev": "CLAWDBOT_PROFILE=dev node scripts/run-node.mjs tui",
+    "tui:dev": "CLAWDBOT_PROFILE=dev tsx src/entry.ts tui",
-    "clawdbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",
+    "clawdbot:rpc": "tsx src/entry.ts agent --mode rpc --json",
    "ios:gen": "cd apps/ios && xcodegen generate",
    "ios:open": "cd apps/ios && xcodegen generate && open Clawdbot.xcodeproj",
    "ios:build": "bash -lc 'cd apps/ios && xcodegen generate && xcodebuild -project Clawdbot.xcodeproj -scheme Clawdbot -destination \"${IOS_DEST:-platform=iOS Simulator,name=iPhone 17}\" -configuration Debug build'",
@@ -108,7 +108,7 @@
    "test": "vitest run",
    "test:watch": "vitest",
    "test:ui": "pnpm --dir ui test",
-    "test:force": "node --import tsx scripts/test-force.ts",
+    "test:force": "tsx scripts/test-force.ts",
    "test:coverage": "vitest run --coverage",
    "test:e2e": "vitest run --config vitest.e2e.config.ts",
    "test:live": "CLAWDBOT_LIVE_TEST=1 vitest run --config vitest.live.config.ts",
@@ -126,11 +126,11 @@
    "test:install:smoke": "bash scripts/test-install-sh-docker.sh",
    "test:install:e2e:openai": "CLAWDBOT_E2E_MODELS=openai bash scripts/test-install-sh-e2e-docker.sh",
    "test:install:e2e:anthropic": "CLAWDBOT_E2E_MODELS=anthropic bash scripts/test-install-sh-e2e-docker.sh",
-    "protocol:gen": "node --import tsx scripts/protocol-gen.ts",
+    "protocol:gen": "tsx scripts/protocol-gen.ts",
-    "protocol:gen:swift": "node --import tsx scripts/protocol-gen-swift.ts",
+    "protocol:gen:swift": "tsx scripts/protocol-gen-swift.ts",
    "protocol:check": "pnpm protocol:gen && pnpm protocol:gen:swift && git diff --exit-code -- dist/protocol.schema.json apps/macos/Sources/ClawdbotProtocol/GatewayModels.swift",
    "canvas:a2ui:bundle": "bash scripts/bundle-a2ui.sh",
-    "check:loc": "node --import tsx scripts/check-ts-max-loc.ts --max 500"
+    "check:loc": "tsx scripts/check-ts-max-loc.ts --max 500"
  },
  "keywords": [],
  "author": "",
@@ -168,7 +168,7 @@
    "dotenv": "^17.2.3",
    "express": "^5.2.1",
    "file-type": "^21.3.0",
-    "grammy": "^1.39.3",
+    "grammy": "^1.39.2",
    "hono": "4.11.4",
    "jiti": "^2.6.1",
    "json5": "^2.2.3",
@@ -182,7 +182,7 @@
    "qrcode-terminal": "^0.12.0",
    "sharp": "^0.34.5",
    "sqlite-vec": "0.1.7-alpha.2",
-    "tar": "7.5.3",
+    "tar": "^7.5.3",
    "tslog": "^4.10.2",
    "undici": "^7.18.2",
    "ws": "^8.19.0",
@@ -200,24 +200,24 @@
    "@types/body-parser": "^1.19.6",
    "@types/express": "^5.0.6",
    "@types/markdown-it": "^14.1.2",
-    "@types/node": "^25.0.9",
+    "@types/node": "^25.0.6",
    "@types/proper-lockfile": "^4.1.4",
    "@types/qrcode-terminal": "^0.12.2",
    "@types/ws": "^8.18.1",
-    "@vitest/coverage-v8": "^4.0.17",
+    "@vitest/coverage-v8": "^4.0.16",
    "docx-preview": "^0.3.7",
    "lit": "^3.3.2",
    "lucide": "^0.562.0",
    "ollama": "^0.6.3",
    "oxfmt": "0.24.0",
    "oxlint": "^1.39.0",
-    "oxlint-tsgolint": "^0.11.1",
+    "oxlint-tsgolint": "^0.11.0",
    "quicktype-core": "^23.2.6",
    "rolldown": "1.0.0-beta.59",
    "signal-utils": "^0.21.1",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3",
-    "vitest": "^4.0.17",
+    "vitest": "^4.0.16",
    "wireit": "^0.14.12"
  },
  "pnpm": {
@@ -1,15 +0,0 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const binDir = path.join(root, "bin");
 const scriptPath = path.join(root, "scripts", "docs-list.js");
 const binPath = path.join(binDir, "docs-list");
 fs.mkdirSync(binDir, { recursive: true });
 const wrapper = `#!/usr/bin/env node\nimport { spawnSync } from "node:child_process";\nimport path from "node:path";\nimport { fileURLToPath } from "node:url";\n\nconst here = path.dirname(fileURLToPath(import.meta.url));\nconst script = path.join(here, "..", "scripts", "docs-list.js");\n\nconst result = spawnSync(process.execPath, [script], { stdio: "inherit" });\nprocess.exit(result.status ?? 1);\n`;
 fs.writeFileSync(binPath, wrapper, { mode: 0o755 });
@@ -4,28 +4,11 @@ set -euo pipefail
 APP_BUNDLE="${1:-dist/Clawdbot.app}"
 IDENTITY="${SIGN_IDENTITY:-}"
 TIMESTAMP_MODE="${CODESIGN_TIMESTAMP:-auto}"
 DISABLE_LIBRARY_VALIDATION="${DISABLE_LIBRARY_VALIDATION:-0}"
 SKIP_TEAM_ID_CHECK="${SKIP_TEAM_ID_CHECK:-0}"
 ENT_TMP_BASE=$(mktemp -t clawdbot-entitlements-base.XXXXXX)
 ENT_TMP_APP=$(mktemp -t clawdbot-entitlements-app.XXXXXX)
 ENT_TMP_APP_BASE=$(mktemp -t clawdbot-entitlements-app-base.XXXXXX)
 ENT_TMP_RUNTIME=$(mktemp -t clawdbot-entitlements-runtime.XXXXXX)
 if [[ "${APP_BUNDLE}" == "--help" || "${APP_BUNDLE}" == "-h" ]]; then
  cat <<'HELP'
 Usage: scripts/codesign-mac-app.sh [app-bundle]
 Env:
  SIGN_IDENTITY="Apple Development: Your Name (TEAMID)"
  ALLOW_ADHOC_SIGNING=1
  CODESIGN_TIMESTAMP=auto|on|off
  DISABLE_LIBRARY_VALIDATION=1      # dev-only Sparkle Team ID workaround
  SKIP_TEAM_ID_CHECK=1              # bypass Team ID audit
  ENABLE_TIME_SENSITIVE_NOTIFICATIONS=1
 HELP
  exit 0
 fi
 if [ ! -d "$APP_BUNDLE" ]; then
  echo "App bundle not found: $APP_BUNDLE" >&2
  exit 1
@@ -201,14 +184,6 @@ cat > "$ENT_TMP_APP" <<'PLIST'
 </plist>
 PLIST
 if [[ "$DISABLE_LIBRARY_VALIDATION" == "1" ]]; then
  /usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$ENT_TMP_APP_BASE" >/dev/null 2>&1 || \
    /usr/libexec/PlistBuddy -c "Set :com.apple.security.cs.disable-library-validation true" "$ENT_TMP_APP_BASE"
  /usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$ENT_TMP_APP" >/dev/null 2>&1 || \
    /usr/libexec/PlistBuddy -c "Set :com.apple.security.cs.disable-library-validation true" "$ENT_TMP_APP"
  echo "Note: disable-library-validation entitlement enabled (DISABLE_LIBRARY_VALIDATION=1)."
 fi
 # The time-sensitive entitlement is restricted and requires explicit enablement
 # (and typically a matching provisioning profile). It is *not* safe to enable
 # unconditionally for local debug packaging since AMFI will refuse to launch.
@@ -234,51 +209,6 @@ sign_plain_item() {
  codesign --force ${options_args+"${options_args[@]}"} "${timestamp_args[@]}" --sign "$IDENTITY" "$target"
 }
 team_id_for() {
  codesign -dv --verbose=4 "$1" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2; exit}'
 }
 verify_team_ids() {
  if [[ "$SKIP_TEAM_ID_CHECK" == "1" ]]; then
    echo "Note: skipping Team ID audit (SKIP_TEAM_ID_CHECK=1)."
    return 0
  fi
  local expected
  expected="$(team_id_for "$APP_BUNDLE" || true)"
  if [[ -z "$expected" ]]; then
    echo "WARN: TeamIdentifier missing on app bundle; skipping Team ID audit."
    return 0
  fi
  local mismatches=()
  while IFS= read -r -d '' f; do
    if /usr/bin/file "$f" | /usr/bin/grep -q "Mach-O"; then
      local team
      team="$(team_id_for "$f" || true)"
      if [[ -z "$team" ]]; then
        team="not set"
      fi
      if [[ "$expected" == "not set" ]]; then
        if [[ "$team" != "not set" ]]; then
          mismatches+=("$f (TeamIdentifier=$team)")
        fi
      elif [[ "$team" != "$expected" ]]; then
        mismatches+=("$f (TeamIdentifier=$team)")
      fi
    fi
  done < <(find "$APP_BUNDLE" -type f -print0)
  if [[ "${#mismatches[@]}" -gt 0 ]]; then
    echo "ERROR: Team ID mismatch detected (expected: $expected)"
    for entry in "${mismatches[@]}"; do
      echo " - $entry"
    done
    echo "Hint: re-sign embedded frameworks or set DISABLE_LIBRARY_VALIDATION=1 for dev builds."
    exit 1
  fi
 }
 # Sign main binary
 if [ -f "$APP_BUNDLE/Contents/MacOS/Clawdbot" ]; then
  echo "Signing main binary"; sign_item "$APP_BUNDLE/Contents/MacOS/Clawdbot" "$APP_ENTITLEMENTS"
@@ -288,11 +218,6 @@ fi
 SPARKLE="$APP_BUNDLE/Contents/Frameworks/Sparkle.framework"
 if [ -d "$SPARKLE" ]; then
  echo "Signing Sparkle framework and helpers"
  find "$SPARKLE" -type f -print0 | while IFS= read -r -d '' f; do
    if /usr/bin/file "$f" | /usr/bin/grep -q "Mach-O"; then
      sign_plain_item "$f"
    fi
  done
  sign_plain_item "$SPARKLE/Versions/B/Sparkle"
  sign_plain_item "$SPARKLE/Versions/B/Autoupdate"
  sign_plain_item "$SPARKLE/Versions/B/Updater.app/Contents/MacOS/Updater"
@@ -315,7 +240,5 @@ fi
 # Finally sign the bundle
 sign_item "$APP_BUNDLE" "$APP_ENTITLEMENTS"
 verify_team_ids
 rm -f "$ENT_TMP_BASE" "$ENT_TMP_APP_BASE" "$ENT_TMP_APP" "$ENT_TMP_RUNTIME"
 echo "Codesign complete for $APP_BUNDLE"
@@ -1,10 +1,10 @@
-#!/usr/bin/env node
+#!/usr/bin/env bun
 import { readdirSync, readFileSync } from 'node:fs';
 import { join, relative } from 'node:path';
 process.stdout.on('error', (error) => {
-  if (error?.code === 'EPIPE') {
+  if ((error as NodeJS.ErrnoException).code === 'EPIPE') {
    process.exit(0);
  }
  throw error;
@@ -14,12 +14,8 @@ const DOCS_DIR = join(process.cwd(), 'docs');
 const EXCLUDED_DIRS = new Set(['archive', 'research']);
-/**
+function compactStrings(values: unknown[]): string[] {
- * @param {unknown[]} values
+  const result: string[] = [];
 * @returns {string[]}
 */
 function compactStrings(values) {
  const result = [];
  for (const value of values) {
    if (value === null || value === undefined) {
      continue;
@@ -32,14 +28,9 @@ function compactStrings(values) {
  return result;
 }
-/**
+function walkMarkdownFiles(dir: string, base: string = dir): string[] {
 * @param {string} dir
 * @param {string} base
 * @returns {string[]}
 */
 function walkMarkdownFiles(dir, base = dir) {
  const entries = readdirSync(dir, { withFileTypes: true });
-  const files = [];
+  const files: string[] = [];
  for (const entry of entries) {
    if (entry.name.startsWith('.')) {
      continue;
@@ -57,11 +48,11 @@ function walkMarkdownFiles(dir, base = dir) {
  return files.sort((a, b) => a.localeCompare(b));
 }
-/**
+function extractMetadata(fullPath: string): {
- * @param {string} fullPath
+  summary: string | null;
- * @returns {{ summary: string | null; readWhen: string[]; error?: string }}
+  readWhen: string[];
- */
+  error?: string;
-function extractMetadata(fullPath) {
+} {
  const content = readFileSync(fullPath, 'utf8');
  if (!content.startsWith('---')) {
@@ -76,9 +67,9 @@ function extractMetadata(fullPath) {
  const frontMatter = content.slice(3, endIndex).trim();
  const lines = frontMatter.split('\n');
-  let summaryLine = null;
+  let summaryLine: string | null = null;
-  const readWhen = [];
+  const readWhen: string[] = [];
-  let collectingField = null;
+  let collectingField: 'read_when' | null = null;
  for (const rawLine of lines) {
    const line = rawLine.trim();
@@ -94,7 +85,7 @@ function extractMetadata(fullPath) {
      const inline = line.slice('read_when:'.length).trim();
      if (inline.startsWith('[') && inline.endsWith(']')) {
        try {
-          const parsed = JSON.parse(inline.replace(/'/g, '"'));
+          const parsed = JSON.parse(inline.replace(/'/g, '"')) as unknown;
          if (Array.isArray(parsed)) {
            readWhen.push(...compactStrings(parsed));
          }
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S node --import tsx
+#!/usr/bin/env bun
 import { execSync } from "node:child_process";
 import { readdirSync, readFileSync } from "node:fs";
@@ -1,3 +0,0 @@
 import "../../src/logging/subsystem.js";
 console.log("tsx-name-repro: loaded logging/subsystem");
@@ -1,38 +0,0 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
 import process from "node:process";
 const args = process.argv.slice(2);
 const env = { ...process.env };
 const cwd = process.cwd();
 const build = spawn("pnpm", ["exec", "tsc", "-p", "tsconfig.json"], {
  cwd,
  env,
  stdio: "inherit",
 });
 build.on("exit", (code, signal) => {
  if (signal) {
    process.exit(1);
    return;
  }
  if (code !== 0 && code !== null) {
    process.exit(code);
    return;
  }
  const nodeProcess = spawn(process.execPath, ["dist/entry.js", ...args], {
    cwd,
    env,
    stdio: "inherit",
  });
  nodeProcess.on("exit", (exitCode, exitSignal) => {
    if (exitSignal) {
      process.exit(1);
      return;
    }
    process.exit(exitCode ?? 1);
  });
 });
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S node --import tsx
+#!/usr/bin/env bun
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -45,8 +45,19 @@ function which(cmd) {
 }
 function resolveRunner() {
  // CLAWDBOT_PREFER_PNPM=1 forces pnpm (useful in Docker on architectures where Bun fails)
  const preferPnpm = process.env.CLAWDBOT_PREFER_PNPM === "1";
  if (!preferPnpm) {
    const bun = which("bun");
    if (bun) return { cmd: bun, kind: "bun" };
  }
  const pnpm = which("pnpm");
  if (pnpm) return { cmd: pnpm, kind: "pnpm" };
  if (preferPnpm) {
    // Fallback to bun if pnpm not found even when preferring pnpm
    const bun = which("bun");
    if (bun) return { cmd: bun, kind: "bun" };
  }
  return null;
 }
@@ -96,7 +107,9 @@ if (!action) {
 const runner = resolveRunner();
 if (!runner) {
-  process.stderr.write("Missing UI runner: install pnpm, then retry.\n");
+  process.stderr.write(
    "Missing UI runner: install bun or pnpm, then retry.\n",
  );
  process.exit(1);
 }
@@ -116,16 +129,32 @@ if (action !== "install" && !script) {
  process.exit(2);
 }
-if (action === "install") run(runner.cmd, ["install", ...rest]);
+if (runner.kind === "bun") {
-else {
+  if (action === "install") run(runner.cmd, ["install", ...rest]);
-  if (!depsInstalled(action === "test" ? "test" : "build")) {
+  else {
-    const installEnv =
+    if (!depsInstalled(action === "test" ? "test" : "build")) {
-      action === "build"
+      const installEnv =
-        ? { ...process.env, NODE_ENV: "production" }
+        action === "build"
-        : process.env;
+          ? { ...process.env, NODE_ENV: "production" }
-    const installArgs =
+          : process.env;
-      action === "build" ? ["install", "--prod"] : ["install"];
+      const installArgs =
-    runSync(runner.cmd, installArgs, installEnv);
+        action === "build" ? ["install", "--production"] : ["install"];
      runSync(runner.cmd, installArgs, installEnv);
    }
    run(runner.cmd, ["run", script, ...rest]);
  }
 } else {
  if (action === "install") run(runner.cmd, ["install", ...rest]);
  else {
    if (!depsInstalled(action === "test" ? "test" : "build")) {
      const installEnv =
        action === "build"
          ? { ...process.env, NODE_ENV: "production" }
          : process.env;
      const installArgs =
        action === "build" ? ["install", "--prod"] : ["install"];
      runSync(runner.cmd, installArgs, installEnv);
    }
    run(runner.cmd, ["run", script, ...rest]);
  }
  run(runner.cmd, ["run", script, ...rest]);
 }
@@ -1,52 +0,0 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
 import process from "node:process";
 const args = process.argv.slice(2);
 const env = { ...process.env };
 const cwd = process.cwd();
 const initialBuild = spawnSync("pnpm", ["exec", "tsc", "-p", "tsconfig.json"], {
  cwd,
  env,
  stdio: "inherit",
 });
 if (initialBuild.status !== 0) {
  process.exit(initialBuild.status ?? 1);
 }
 const tsc = spawn("pnpm", ["exec", "tsc", "--watch", "--preserveWatchOutput"], {
  cwd,
  env,
  stdio: "inherit",
 });
 const nodeProcess = spawn(process.execPath, ["--watch", "dist/entry.js", ...args], {
  cwd,
  env,
  stdio: "inherit",
 });
 let exiting = false;
 function cleanup(code = 0) {
  if (exiting) return;
  exiting = true;
  nodeProcess.kill("SIGTERM");
  tsc.kill("SIGTERM");
  process.exit(code);
 }
 process.on("SIGINT", () => cleanup(130));
 process.on("SIGTERM", () => cleanup(143));
 tsc.on("exit", (code) => {
  if (exiting) return;
  cleanup(code ?? 1);
 });
 nodeProcess.on("exit", (code, signal) => {
  if (signal || exiting) return;
  cleanup(code ?? 1);
 });
@@ -1,4 +1,4 @@
-import { createSubsystemLogger } from "../../logging/subsystem.js";
+import { createSubsystemLogger } from "../../logging.js";
 export const AUTH_STORE_VERSION = 1;
 export const AUTH_PROFILE_FILENAME = "auth-profiles.json";
@@ -50,15 +50,15 @@ import { buildCursorPositionResponse, stripDsrRequests } from "./pty-dsr.js";
 const DEFAULT_MAX_OUTPUT = clampNumber(
  readEnvInt("PI_BASH_MAX_OUTPUT_CHARS"),
-  200_000,
+  30_000,
  1_000,
-  200_000,
+  150_000,
 );
 const DEFAULT_PENDING_MAX_OUTPUT = clampNumber(
  readEnvInt("CLAWDBOT_BASH_PENDING_MAX_OUTPUT_CHARS"),
-  200_000,
+  30_000,
  1_000,
-  200_000,
+  150_000,
 );
 const DEFAULT_PATH =
  process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
@@ -4,20 +4,22 @@ import path from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-const execSyncMock = vi.fn();
+const execSyncMock = vi.hoisted(() => vi.fn());
 vi.mock("node:child_process", () => ({
  execSync: execSyncMock,
 }));
 describe("cli credentials", () => {
  beforeEach(() => {
    vi.resetModules();
    vi.useFakeTimers();
  });
-  afterEach(async () => {
+  afterEach(() => {
    vi.useRealTimers();
    vi.resetModules();
    execSyncMock.mockReset();
    delete process.env.CODEX_HOME;
    const { resetCliCredentialCachesForTest } = await import("./cli-credentials.js");
    resetCliCredentialCachesForTest();
  });
  it("updates the Claude Code keychain item in place", async () => {
@@ -42,14 +44,11 @@ describe("cli credentials", () => {
    const { writeClaudeCliKeychainCredentials } = await import("./cli-credentials.js");
-    const ok = writeClaudeCliKeychainCredentials(
+    const ok = writeClaudeCliKeychainCredentials({
-      {
+      access: "new-access",
-        access: "new-access",
+      refresh: "new-refresh",
-        refresh: "new-refresh",
+      expires: Date.now() + 60_000,
-        expires: Date.now() + 60_000,
+    });
      },
      { execSync: execSyncMock },
    );
    expect(ok).toBe(true);
    expect(commands.some((cmd) => cmd.includes("delete-generic-password"))).toBe(false);
@@ -131,13 +130,11 @@ describe("cli credentials", () => {
      allowKeychainPrompt: true,
      ttlMs: 15 * 60 * 1000,
      platform: "darwin",
      execSync: execSyncMock,
    });
    const second = readClaudeCliCredentialsCached({
      allowKeychainPrompt: false,
      ttlMs: 15 * 60 * 1000,
      platform: "darwin",
      execSync: execSyncMock,
    });
    expect(first).toBeTruthy();
@@ -164,7 +161,6 @@ describe("cli credentials", () => {
      allowKeychainPrompt: true,
      ttlMs: 15 * 60 * 1000,
      platform: "darwin",
      execSync: execSyncMock,
    });
    vi.advanceTimersByTime(15 * 60 * 1000 + 1);
@@ -173,7 +169,6 @@ describe("cli credentials", () => {
      allowKeychainPrompt: true,
      ttlMs: 15 * 60 * 1000,
      platform: "darwin",
      execSync: execSyncMock,
    });
    expect(first).toBeTruthy();
@@ -201,7 +196,7 @@ describe("cli credentials", () => {
    });
    const { readCodexCliCredentials } = await import("./cli-credentials.js");
-    const creds = readCodexCliCredentials({ platform: "darwin", execSync: execSyncMock });
+    const creds = readCodexCliCredentials({ platform: "darwin" });
    expect(creds).toMatchObject({
      access: "keychain-access",
@@ -231,7 +226,7 @@ describe("cli credentials", () => {
    );
    const { readCodexCliCredentials } = await import("./cli-credentials.js");
-    const creds = readCodexCliCredentials({ execSync: execSyncMock });
+    const creds = readCodexCliCredentials();
    expect(creds).toMatchObject({
      access: "file-access",
@@ -6,7 +6,7 @@ import path from "node:path";
 import type { OAuthCredentials, OAuthProvider } from "@mariozechner/pi-ai";
 import { loadJsonFile, saveJsonFile } from "../infra/json-file.js";
-import { createSubsystemLogger } from "../logging/subsystem.js";
+import { createSubsystemLogger } from "../logging.js";
 import { resolveUserPath } from "../utils.js";
 const log = createSubsystemLogger("agents/auth-profiles");
@@ -28,12 +28,6 @@ let claudeCliCache: CachedValue<ClaudeCliCredential> | null = null;
 let codexCliCache: CachedValue<CodexCliCredential> | null = null;
 let qwenCliCache: CachedValue<QwenCliCredential> | null = null;
 export function resetCliCredentialCachesForTest(): void {
  claudeCliCache = null;
  codexCliCache = null;
  qwenCliCache = null;
 }
 export type ClaudeCliCredential =
  | {
      type: "oauth";
@@ -75,8 +69,6 @@ type ClaudeCliWriteOptions = ClaudeCliFileOptions & {
  writeFile?: (credentials: OAuthCredentials, options?: ClaudeCliFileOptions) => boolean;
 };
 type ExecSyncFn = typeof execSync;
 function resolveClaudeCliCredentialsPath(homeDir?: string) {
  const baseDir = homeDir ?? resolveUserPath("~");
  return path.join(baseDir, CLAUDE_CLI_CREDENTIALS_RELATIVE_PATH);
@@ -108,24 +100,19 @@ function computeCodexKeychainAccount(codexHome: string) {
 function readCodexKeychainCredentials(options?: {
  platform?: NodeJS.Platform;
  execSync?: ExecSyncFn;
 }): CodexCliCredential | null {
  const platform = options?.platform ?? process.platform;
  if (platform !== "darwin") return null;
  const execSyncImpl = options?.execSync ?? execSync;
  const codexHome = resolveCodexHomePath();
  const account = computeCodexKeychainAccount(codexHome);
  try {
-    const secret = execSyncImpl(
+    const secret = execSync(`security find-generic-password -s "Codex Auth" -a "${account}" -w`, {
-      `security find-generic-password -s "Codex Auth" -a "${account}" -w`,
+      encoding: "utf8",
-      {
+      timeout: 5000,
-        encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
-        timeout: 5000,
+    }).trim();
        stdio: ["pipe", "pipe", "pipe"],
      },
    ).trim();
    const parsed = JSON.parse(secret) as Record<string, unknown>;
    const tokens = parsed.tokens as Record<string, unknown> | undefined;
@@ -183,11 +170,9 @@ function readQwenCliCredentials(options?: { homeDir?: string }): QwenCliCredenti
  };
 }
-function readClaudeCliKeychainCredentials(
+function readClaudeCliKeychainCredentials(): ClaudeCliCredential | null {
  execSyncImpl: ExecSyncFn = execSync,
 ): ClaudeCliCredential | null {
  try {
-    const result = execSyncImpl(
+    const result = execSync(
      `security find-generic-password -s "${CLAUDE_CLI_KEYCHAIN_SERVICE}" -w`,
      { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] },
    );
@@ -228,11 +213,10 @@ export function readClaudeCliCredentials(options?: {
  allowKeychainPrompt?: boolean;
  platform?: NodeJS.Platform;
  homeDir?: string;
  execSync?: ExecSyncFn;
 }): ClaudeCliCredential | null {
  const platform = options?.platform ?? process.platform;
  if (platform === "darwin" && options?.allowKeychainPrompt !== false) {
-    const keychainCreds = readClaudeCliKeychainCredentials(options?.execSync);
+    const keychainCreds = readClaudeCliKeychainCredentials();
    if (keychainCreds) {
      log.info("read anthropic credentials from claude cli keychain", {
        type: keychainCreds.type,
@@ -279,7 +263,6 @@ export function readClaudeCliCredentialsCached(options?: {
  ttlMs?: number;
  platform?: NodeJS.Platform;
  homeDir?: string;
  execSync?: ExecSyncFn;
 }): ClaudeCliCredential | null {
  const ttlMs = options?.ttlMs ?? 0;
  const now = Date.now();
@@ -296,7 +279,6 @@ export function readClaudeCliCredentialsCached(options?: {
    allowKeychainPrompt: options?.allowKeychainPrompt,
    platform: options?.platform,
    homeDir: options?.homeDir,
    execSync: options?.execSync,
  });
  if (ttlMs > 0) {
    claudeCliCache = { value, readAt: now, cacheKey };
@@ -304,13 +286,9 @@ export function readClaudeCliCredentialsCached(options?: {
  return value;
 }
-export function writeClaudeCliKeychainCredentials(
+export function writeClaudeCliKeychainCredentials(newCredentials: OAuthCredentials): boolean {
  newCredentials: OAuthCredentials,
  options?: { execSync?: ExecSyncFn },
 ): boolean {
  const execSyncImpl = options?.execSync ?? execSync;
  try {
-    const existingResult = execSyncImpl(
+    const existingResult = execSync(
      `security find-generic-password -s "${CLAUDE_CLI_KEYCHAIN_SERVICE}" -w 2>/dev/null`,
      { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] },
    );
@@ -330,7 +308,7 @@ export function writeClaudeCliKeychainCredentials(
    const newValue = JSON.stringify(existingData);
-    execSyncImpl(
+    execSync(
      `security add-generic-password -U -s "${CLAUDE_CLI_KEYCHAIN_SERVICE}" -a "${CLAUDE_CLI_KEYCHAIN_ACCOUNT}" -w '${newValue.replace(/'/g, "'\"'\"'")}'`,
      { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] },
    );
@@ -407,11 +385,9 @@ export function writeClaudeCliCredentials(
 export function readCodexCliCredentials(options?: {
  platform?: NodeJS.Platform;
  execSync?: ExecSyncFn;
 }): CodexCliCredential | null {
  const keychain = readCodexKeychainCredentials({
    platform: options?.platform,
    execSync: options?.execSync,
  });
  if (keychain) return keychain;
@@ -449,7 +425,6 @@ export function readCodexCliCredentials(options?: {
 export function readCodexCliCredentialsCached(options?: {
  ttlMs?: number;
  platform?: NodeJS.Platform;
  execSync?: ExecSyncFn;
 }): CodexCliCredential | null {
  const ttlMs = options?.ttlMs ?? 0;
  const now = Date.now();
@@ -462,10 +437,7 @@ export function readCodexCliCredentialsCached(options?: {
  ) {
    return codexCliCache.value;
  }
-  const value = readCodexCliCredentials({
+  const value = readCodexCliCredentials({ platform: options?.platform });
    platform: options?.platform,
    execSync: options?.execSync,
  });
  if (ttlMs > 0) {
    codexCliCache = { value, readAt: now, cacheKey };
  }
@@ -6,7 +6,6 @@ import { shouldLogVerbose } from "../globals.js";
 import { createSubsystemLogger } from "../logging.js";
 import { runCommandWithTimeout } from "../process/exec.js";
 import { resolveUserPath } from "../utils.js";
 import { resolveClawdbotDocsPath } from "./docs-path.js";
 import { resolveSessionAgentIds } from "./agent-scope.js";
 import { makeBootstrapWarn, resolveBootstrapContextForRun } from "./bootstrap-files.js";
 import { resolveCliBackendConfig } from "./cli-backends.js";
@@ -84,12 +83,6 @@ export async function runCliAgent(params: {
    sessionAgentId === defaultAgentId
      ? resolveHeartbeatPrompt(params.config?.agents?.defaults?.heartbeat?.prompt)
      : undefined;
  const docsPath = await resolveClawdbotDocsPath({
    workspaceDir,
    argv1: process.argv[1],
    cwd: process.cwd(),
    moduleUrl: import.meta.url,
  });
  const systemPrompt = buildSystemPrompt({
    workspaceDir,
    config: params.config,
@@ -97,7 +90,6 @@ export async function runCliAgent(params: {
    extraSystemPrompt,
    ownerNumbers: params.ownerNumbers,
    heartbeatPrompt,
    docsPath: docsPath ?? undefined,
    tools: [],
    contextFiles,
    modelDisplay,
@@ -168,7 +168,6 @@ export function buildSystemPrompt(params: {
  extraSystemPrompt?: string;
  ownerNumbers?: string[];
  heartbeatPrompt?: string;
  docsPath?: string;
  tools: AgentTool[];
  contextFiles?: EmbeddedContextFile[];
  modelDisplay: string;
@@ -183,7 +182,6 @@ export function buildSystemPrompt(params: {
    ownerNumbers: params.ownerNumbers,
    reasoningTagHint: false,
    heartbeatPrompt: params.heartbeatPrompt,
    docsPath: params.docsPath,
    runtimeInfo: {
      host: "clawdbot",
      os: `${os.type()} ${os.release()}`,
@@ -1,27 +0,0 @@
 import fs from "node:fs";
 import path from "node:path";
 import { resolveClawdbotPackageRoot } from "../infra/clawdbot-root.js";
 export async function resolveClawdbotDocsPath(params: {
  workspaceDir?: string;
  argv1?: string;
  cwd?: string;
  moduleUrl?: string;
 }): Promise<string | null> {
  const workspaceDir = params.workspaceDir?.trim();
  if (workspaceDir) {
    const workspaceDocs = path.join(workspaceDir, "docs");
    if (fs.existsSync(workspaceDocs)) return workspaceDocs;
  }
  const packageRoot = await resolveClawdbotPackageRoot({
    cwd: params.cwd,
    argv1: params.argv1,
    moduleUrl: params.moduleUrl,
  });
  if (!packageRoot) return null;
  const packageDocs = path.join(packageRoot, "docs");
  return fs.existsSync(packageDocs) ? packageDocs : null;
 }
@@ -22,21 +22,6 @@ describe("memory search config", () => {
    expect(resolved).toBeNull();
  });
  it("defaults provider to auto when unspecified", () => {
    const cfg = {
      agents: {
        defaults: {
          memorySearch: {
            enabled: true,
          },
        },
      },
    };
    const resolved = resolveMemorySearchConfig(cfg, "main");
    expect(resolved?.provider).toBe("auto");
    expect(resolved?.fallback).toBe("none");
  });
  it("merges defaults and overrides", () => {
    const cfg = {
      agents: {
@@ -141,7 +126,6 @@ describe("memory search config", () => {
      agents: {
        defaults: {
          memorySearch: {
            provider: "openai",
            remote: {
              baseUrl: "https://default.example/v1",
              apiKey: "default-key",
@@ -182,7 +166,6 @@ describe("memory search config", () => {
      agents: {
        defaults: {
          memorySearch: {
            provider: "openai",
            sources: ["memory", "sessions"],
          },
        },
@@ -206,7 +189,6 @@ describe("memory search config", () => {
      agents: {
        defaults: {
          memorySearch: {
            provider: "openai",
            sources: ["memory", "sessions"],
            experimental: { sessionMemory: true },
          },
@@ -3,13 +3,13 @@ import path from "node:path";
 import type { ClawdbotConfig, MemorySearchConfig } from "../config/config.js";
 import { resolveStateDir } from "../config/paths.js";
-import { clampInt, clampNumber, resolveUserPath } from "../utils.js";
+import { resolveUserPath } from "../utils.js";
 import { resolveAgentConfig } from "./agent-scope.js";
 export type ResolvedMemorySearchConfig = {
  enabled: boolean;
  sources: Array<"memory" | "sessions">;
-  provider: "openai" | "local" | "gemini" | "auto";
+  provider: "openai" | "gemini" | "local";
  remote?: {
    baseUrl?: string;
    apiKey?: string;
@@ -25,7 +25,7 @@ export type ResolvedMemorySearchConfig = {
  experimental: {
    sessionMemory: boolean;
  };
-  fallback: "openai" | "gemini" | "local" | "none";
+  fallback: "openai" | "none";
  model: string;
  local: {
    modelPath?: string;
@@ -110,40 +110,34 @@ function mergeConfig(
  const enabled = overrides?.enabled ?? defaults?.enabled ?? true;
  const sessionMemory =
    overrides?.experimental?.sessionMemory ?? defaults?.experimental?.sessionMemory ?? false;
-  const provider = overrides?.provider ?? defaults?.provider ?? "auto";
+  const provider = overrides?.provider ?? defaults?.provider ?? "openai";
-  const defaultRemote = defaults?.remote;
+  const hasRemote = Boolean(defaults?.remote || overrides?.remote);
-  const overrideRemote = overrides?.remote;
+  const includeRemote = hasRemote || provider === "openai" || provider === "gemini";
  const hasRemote = Boolean(defaultRemote || overrideRemote);
  const includeRemote =
    hasRemote || provider === "openai" || provider === "gemini" || provider === "auto";
  const batch = {
-    enabled: overrideRemote?.batch?.enabled ?? defaultRemote?.batch?.enabled ?? true,
+    enabled: overrides?.remote?.batch?.enabled ?? defaults?.remote?.batch?.enabled ?? true,
-    wait: overrideRemote?.batch?.wait ?? defaultRemote?.batch?.wait ?? true,
+    wait: overrides?.remote?.batch?.wait ?? defaults?.remote?.batch?.wait ?? true,
    concurrency: Math.max(
      1,
-      overrideRemote?.batch?.concurrency ?? defaultRemote?.batch?.concurrency ?? 2,
+      overrides?.remote?.batch?.concurrency ?? defaults?.remote?.batch?.concurrency ?? 2,
    ),
    pollIntervalMs:
-      overrideRemote?.batch?.pollIntervalMs ?? defaultRemote?.batch?.pollIntervalMs ?? 2000,
+      overrides?.remote?.batch?.pollIntervalMs ?? defaults?.remote?.batch?.pollIntervalMs ?? 2000,
    timeoutMinutes:
-      overrideRemote?.batch?.timeoutMinutes ?? defaultRemote?.batch?.timeoutMinutes ?? 60,
+      overrides?.remote?.batch?.timeoutMinutes ?? defaults?.remote?.batch?.timeoutMinutes ?? 60,
  };
  const remote = includeRemote
    ? {
-        baseUrl: overrideRemote?.baseUrl ?? defaultRemote?.baseUrl,
+        baseUrl: overrides?.remote?.baseUrl ?? defaults?.remote?.baseUrl,
-        apiKey: overrideRemote?.apiKey ?? defaultRemote?.apiKey,
+        apiKey: overrides?.remote?.apiKey ?? defaults?.remote?.apiKey,
-        headers: overrideRemote?.headers ?? defaultRemote?.headers,
+        headers: overrides?.remote?.headers ?? defaults?.remote?.headers,
        batch,
      }
    : undefined;
-  const fallback = overrides?.fallback ?? defaults?.fallback ?? "none";
+  const fallback = overrides?.fallback ?? defaults?.fallback ?? "openai";
-  const modelDefault =
+  const model =
-    provider === "gemini"
+    overrides?.model ??
-      ? DEFAULT_GEMINI_MODEL
+    defaults?.model ??
-      : provider === "openai"
+    (provider === "gemini" ? DEFAULT_GEMINI_MODEL : DEFAULT_OPENAI_MODEL);
        ? DEFAULT_OPENAI_MODEL
        : undefined;
  const model = overrides?.model ?? defaults?.model ?? modelDefault ?? "";
  const local = {
    modelPath: overrides?.local?.modelPath ?? defaults?.local?.modelPath,
    modelCacheDir: overrides?.local?.modelCacheDir ?? defaults?.local?.modelCacheDir,
@@ -200,14 +194,14 @@ function mergeConfig(
    maxEntries: overrides?.cache?.maxEntries ?? defaults?.cache?.maxEntries,
  };
-  const overlap = clampNumber(chunking.overlap, 0, Math.max(0, chunking.tokens - 1));
+  const overlap = Math.max(0, Math.min(chunking.overlap, chunking.tokens - 1));
-  const minScore = clampNumber(query.minScore, 0, 1);
+  const minScore = Math.max(0, Math.min(1, query.minScore));
-  const vectorWeight = clampNumber(hybrid.vectorWeight, 0, 1);
+  const vectorWeight = Math.max(0, Math.min(1, hybrid.vectorWeight));
-  const textWeight = clampNumber(hybrid.textWeight, 0, 1);
+  const textWeight = Math.max(0, Math.min(1, hybrid.textWeight));
  const sum = vectorWeight + textWeight;
  const normalizedVectorWeight = sum > 0 ? vectorWeight / sum : DEFAULT_HYBRID_VECTOR_WEIGHT;
  const normalizedTextWeight = sum > 0 ? textWeight / sum : DEFAULT_HYBRID_TEXT_WEIGHT;
-  const candidateMultiplier = clampInt(hybrid.candidateMultiplier, 1, 20);
+  const candidateMultiplier = Math.max(1, Math.min(20, Math.floor(hybrid.candidateMultiplier)));
  return {
    enabled,
    sources,
@@ -26,11 +26,6 @@ describe("classifyFailoverReason", () => {
    expect(classifyFailoverReason("deadline exceeded")).toBe("timeout");
    expect(classifyFailoverReason("string should match pattern")).toBe("format");
    expect(classifyFailoverReason("bad request")).toBeNull();
    expect(
      classifyFailoverReason(
        "messages.84.content.1.image.source.base64.data: At least one of the image dimensions exceed max allowed size for many-image requests: 2000 pixels",
      ),
    ).toBeNull();
  });
  it("classifies OpenAI usage limit errors as rate_limit", () => {
    expect(classifyFailoverReason("You have hit your ChatGPT usage limit (plus plan)")).toBe(
@@ -1,16 +0,0 @@
 import { describe, expect, it } from "vitest";
 import { isImageDimensionErrorMessage, parseImageDimensionError } from "./pi-embedded-helpers.js";
 describe("image dimension errors", () => {
  it("parses anthropic image dimension errors", () => {
    const raw =
      '400 {"type":"error","error":{"type":"invalid_request_error","message":"messages.84.content.1.image.source.base64.data: At least one of the image dimensions exceed max allowed size for many-image requests: 2000 pixels"}}';
    const parsed = parseImageDimensionError(raw);
    expect(parsed).not.toBeNull();
    expect(parsed?.maxDimensionPx).toBe(2000);
    expect(parsed?.messageIndex).toBe(84);
    expect(parsed?.contentIndex).toBe(1);
    expect(isImageDimensionErrorMessage(raw)).toBe(true);
  });
 });
@@ -23,10 +23,5 @@ describe("isCloudCodeAssistFormatError", () => {
  });
  it("ignores unrelated errors", () => {
    expect(isCloudCodeAssistFormatError("rate limit exceeded")).toBe(false);
    expect(
      isCloudCodeAssistFormatError(
        '400 {"type":"error","error":{"type":"invalid_request_error","message":"messages.84.content.1.image.source.base64.data: At least one of the image dimensions exceed max allowed size for many-image requests: 2000 pixels"}}',
      ),
    ).toBe(false);
  });
 });
@@ -21,13 +21,11 @@ export {
  isContextOverflowError,
  isFailoverAssistantError,
  isFailoverErrorMessage,
  isImageDimensionErrorMessage,
  isOverloadedErrorMessage,
  isRawApiErrorPayload,
  isRateLimitAssistantError,
  isRateLimitErrorMessage,
  isTimeoutErrorMessage,
  parseImageDimensionError,
 } from "./pi-embedded-helpers/errors.js";
 export {
  downgradeGeminiHistory,
@@ -339,6 +339,7 @@ const ERROR_PATTERNS = {
    "no api key found",
  ],
  format: [
    "invalid_request_error",
    "string should match pattern",
    "tool_use.id",
    "tool_use_id",
@@ -347,10 +348,6 @@ const ERROR_PATTERNS = {
  ],
 } as const;
 const IMAGE_DIMENSION_ERROR_RE =
  /image dimensions exceed max allowed size for many-image requests:\s*(\d+)\s*pixels/i;
 const IMAGE_DIMENSION_PATH_RE = /messages\.(\d+)\.content\.(\d+)\.image/i;
 function matchesErrorPatterns(raw: string, patterns: readonly ErrorPattern[]): boolean {
  if (!raw) return false;
  const value = raw.toLowerCase();
@@ -393,31 +390,8 @@ export function isOverloadedErrorMessage(raw: string): boolean {
  return matchesErrorPatterns(raw, ERROR_PATTERNS.overloaded);
 }
 export function parseImageDimensionError(raw: string): {
  maxDimensionPx?: number;
  messageIndex?: number;
  contentIndex?: number;
  raw: string;
 } | null {
  if (!raw) return null;
  const lower = raw.toLowerCase();
  if (!lower.includes("image dimensions exceed max allowed size")) return null;
  const limitMatch = raw.match(IMAGE_DIMENSION_ERROR_RE);
  const pathMatch = raw.match(IMAGE_DIMENSION_PATH_RE);
  return {
    maxDimensionPx: limitMatch?.[1] ? Number.parseInt(limitMatch[1], 10) : undefined,
    messageIndex: pathMatch?.[1] ? Number.parseInt(pathMatch[1], 10) : undefined,
    contentIndex: pathMatch?.[2] ? Number.parseInt(pathMatch[2], 10) : undefined,
    raw,
  };
 }
 export function isImageDimensionErrorMessage(raw: string): boolean {
  return Boolean(parseImageDimensionError(raw));
 }
 export function isCloudCodeAssistFormatError(raw: string): boolean {
-  return !isImageDimensionErrorMessage(raw) && matchesErrorPatterns(raw, ERROR_PATTERNS.format);
+  return matchesErrorPatterns(raw, ERROR_PATTERNS.format);
 }
 export function isAuthAssistantError(msg: AssistantMessage | undefined): boolean {
@@ -426,7 +400,6 @@ export function isAuthAssistantError(msg: AssistantMessage | undefined): boolean
 }
 export function classifyFailoverReason(raw: string): FailoverReason | null {
  if (isImageDimensionErrorMessage(raw)) return null;
  if (isRateLimitErrorMessage(raw)) return "rate_limit";
  if (isOverloadedErrorMessage(raw)) return "rate_limit";
  if (isCloudCodeAssistFormatError(raw)) return "format";
@@ -89,6 +89,7 @@ let runEmbeddedPiAgent: typeof import("./pi-embedded-runner.js").runEmbeddedPiAg
 beforeEach(async () => {
  vi.useRealTimers();
  vi.resetModules();
  ({ runEmbeddedPiAgent } = await import("./pi-embedded-runner.js"));
 });
@@ -91,6 +91,7 @@ let runEmbeddedPiAgent: typeof import("./pi-embedded-runner.js").runEmbeddedPiAg
 beforeAll(async () => {
  vi.useRealTimers();
  vi.resetModules();
  mockPiAi();
  ({ runEmbeddedPiAgent } = await import("./pi-embedded-runner.js"));
 }, 20_000);
@@ -17,7 +17,6 @@ import { resolveUserPath } from "../../utils.js";
 import { resolveClawdbotAgentDir } from "../agent-paths.js";
 import { resolveSessionAgentIds } from "../agent-scope.js";
 import { makeBootstrapWarn, resolveBootstrapContextForRun } from "../bootstrap-files.js";
 import { resolveClawdbotDocsPath } from "../docs-path.js";
 import type { ExecElevatedDefaults } from "../bash-tools.js";
 import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../defaults.js";
 import { getApiKeyForModel, resolveModelAuthMode } from "../model-auth.js";
@@ -251,12 +250,6 @@ export async function compactEmbeddedPiSession(params: {
        });
        const isDefaultAgent = sessionAgentId === defaultAgentId;
        const promptMode = isSubagentSessionKey(params.sessionKey) ? "minimal" : "full";
        const docsPath = await resolveClawdbotDocsPath({
          workspaceDir: effectiveWorkspace,
          argv1: process.argv[1],
          cwd: process.cwd(),
          moduleUrl: import.meta.url,
        });
        const appendPrompt = buildEmbeddedSystemPrompt({
          workspaceDir: effectiveWorkspace,
          defaultThinkLevel: params.thinkLevel,
@@ -268,7 +261,6 @@ export async function compactEmbeddedPiSession(params: {
            ? resolveHeartbeatPrompt(params.config?.agents?.defaults?.heartbeat?.prompt)
            : undefined,
          skillsPrompt,
          docsPath: docsPath ?? undefined,
          promptMode,
          runtimeInfo,
          sandboxInfo,
@@ -31,7 +31,6 @@ import {
  isContextOverflowError,
  isFailoverAssistantError,
  isFailoverErrorMessage,
  parseImageDimensionError,
  isRateLimitAssistantError,
  isTimeoutErrorMessage,
  pickFallbackThinkingLevel,
@@ -358,26 +357,6 @@ export async function runEmbeddedPiAgent(
          const failoverFailure = isFailoverAssistantError(lastAssistant);
          const assistantFailoverReason = classifyFailoverReason(lastAssistant?.errorMessage ?? "");
          const cloudCodeAssistFormatError = attempt.cloudCodeAssistFormatError;
          const imageDimensionError = parseImageDimensionError(lastAssistant?.errorMessage ?? "");
          if (imageDimensionError && lastProfileId) {
            const details = [
              imageDimensionError.messageIndex !== undefined
                ? `message=${imageDimensionError.messageIndex}`
                : null,
              imageDimensionError.contentIndex !== undefined
                ? `content=${imageDimensionError.contentIndex}`
                : null,
              imageDimensionError.maxDimensionPx !== undefined
                ? `limit=${imageDimensionError.maxDimensionPx}px`
                : null,
            ]
              .filter(Boolean)
              .join(" ");
            log.warn(
              `Profile ${lastProfileId} rejected image payload${details ? ` (${details})` : ""}.`,
            );
          }
          // Treat timeout as potential rate limit (Antigravity hangs on rate limit)
          const shouldRotate = (!aborted && failoverFailure) || timedOut;
@@ -453,6 +432,7 @@ export async function runEmbeddedPiAgent(
            toolMetas: attempt.toolMetas,
            lastAssistant: attempt.lastAssistant,
            lastToolError: attempt.lastToolError,
            didSendViaMessagingTool: attempt.didSendViaMessagingTool,
            config: params.config,
            sessionKey: params.sessionKey ?? params.sessionId,
            verboseLevel: params.verboseLevel,
@@ -18,7 +18,6 @@ import { resolveUserPath } from "../../../utils.js";
 import { resolveClawdbotAgentDir } from "../../agent-paths.js";
 import { resolveSessionAgentIds } from "../../agent-scope.js";
 import { makeBootstrapWarn, resolveBootstrapContextForRun } from "../../bootstrap-files.js";
 import { resolveClawdbotDocsPath } from "../../docs-path.js";
 import { resolveModelAuthMode } from "../../model-auth.js";
 import {
  isCloudCodeAssistFormatError,
@@ -217,12 +216,6 @@ export async function runEmbeddedAttempt(
    });
    const isDefaultAgent = sessionAgentId === defaultAgentId;
    const promptMode = isSubagentSessionKey(params.sessionKey) ? "minimal" : "full";
    const docsPath = await resolveClawdbotDocsPath({
      workspaceDir: effectiveWorkspace,
      argv1: process.argv[1],
      cwd: process.cwd(),
      moduleUrl: import.meta.url,
    });
    const appendPrompt = buildEmbeddedSystemPrompt({
      workspaceDir: effectiveWorkspace,
@@ -235,7 +228,6 @@ export async function runEmbeddedAttempt(
        ? resolveHeartbeatPrompt(params.config?.agents?.defaults?.heartbeat?.prompt)
        : undefined,
      skillsPrompt,
      docsPath: docsPath ?? undefined,
      reactionGuidance,
      promptMode,
      runtimeInfo,
@@ -41,7 +41,7 @@ describe("detectImageReferences", () => {
    expect(refs[0]?.raw).toBe("~/Pictures/vacation.png");
    expect(refs[0]?.type).toBe("path");
    // Resolved path should expand ~
-    expect(refs[0]?.resolved?.startsWith("~")).toBe(false);
+    expect(refs[0]?.resolved).not.toContain("~");
  });
  it("detects multiple image references in a prompt", () => {
@@ -5,7 +5,6 @@ import { fileURLToPath } from "node:url";
 import type { ImageContent } from "@mariozechner/pi-ai";
 import { assertSandboxPath } from "../../sandbox-paths.js";
 import { sanitizeImageBlocks } from "../../tool-images.js";
 import { extractTextFromMessage } from "../../../tui/tui-formatters.js";
 import { loadWebMedia } from "../../../web/media.js";
 import { resolveUserPath } from "../../../utils.js";
@@ -49,17 +48,6 @@ function isImageExtension(filePath: string): boolean {
  return IMAGE_EXTENSIONS.has(ext);
 }
 async function sanitizeImagesWithLog(
  images: ImageContent[],
  label: string,
 ): Promise<ImageContent[]> {
  const { images: sanitized, dropped } = await sanitizeImageBlocks(images, label);
  if (dropped > 0) {
    log.warn(`Native image: dropped ${dropped} image(s) after sanitization (${label}).`);
  }
  return sanitized;
 }
 /**
 * Detects image references in a user prompt.
 *
@@ -404,18 +392,9 @@ export async function detectAndLoadPromptImages(params: {
    }
  }
  const sanitizedPromptImages = await sanitizeImagesWithLog(promptImages, "prompt:images");
  const sanitizedHistoryImagesByIndex = new Map<number, ImageContent[]>();
  for (const [index, images] of historyImagesByIndex) {
    const sanitized = await sanitizeImagesWithLog(images, `history:images:${index}`);
    if (sanitized.length > 0) {
      sanitizedHistoryImagesByIndex.set(index, sanitized);
    }
  }
  return {
-    images: sanitizedPromptImages,
+    images: promptImages,
-    historyImagesByIndex: sanitizedHistoryImagesByIndex,
+    historyImagesByIndex,
    detectedRefs: allRefs,
    loadedCount,
    skippedCount,
@@ -147,4 +147,40 @@ describe("buildEmbeddedRunPayloads", () => {
    expect(payloads).toHaveLength(1);
    expect(payloads[0]?.text).toBe("All good");
  });
  it("adds tool error fallback when assistant output is NO_REPLY", () => {
    const payloads = buildEmbeddedRunPayloads({
      assistantTexts: ["NO_REPLY"],
      toolMetas: [],
      lastAssistant: { stopReason: "end_turn" } as AssistantMessage,
      lastToolError: { toolName: "browser", error: "tab not found" },
      sessionKey: "session:telegram",
      inlineToolResultsAllowed: false,
      verboseLevel: "off",
      reasoningLevel: "off",
      toolResultFormat: "plain",
    });
    expect(payloads).toHaveLength(1);
    expect(payloads[0]?.isError).toBe(true);
    expect(payloads[0]?.text).toContain("browser");
    expect(payloads[0]?.text).toContain("tab not found");
  });
  it("skips tool error fallback when messaging tool already sent", () => {
    const payloads = buildEmbeddedRunPayloads({
      assistantTexts: [],
      toolMetas: [],
      lastAssistant: undefined,
      lastToolError: { toolName: "browser", error: "tab not found" },
      didSendViaMessagingTool: true,
      sessionKey: "session:telegram",
      inlineToolResultsAllowed: false,
      verboseLevel: "off",
      reasoningLevel: "off",
      toolResultFormat: "plain",
    });
    expect(payloads).toHaveLength(0);
  });
 });
@@ -24,6 +24,7 @@ export function buildEmbeddedRunPayloads(params: {
  toolMetas: ToolMetaEntry[];
  lastAssistant: AssistantMessage | undefined;
  lastToolError?: { toolName: string; meta?: string; error?: string };
  didSendViaMessagingTool?: boolean;
  config?: ClawdbotConfig;
  sessionKey: string;
  verboseLevel?: VerboseLevel;
@@ -156,34 +157,46 @@ export function buildEmbeddedRunPayloads(params: {
    });
  }
-  if (replyItems.length === 0 && params.lastToolError) {
+  const buildPayloads = (items: typeof replyItems) => {
    const hasAudioAsVoiceTag = items.some((item) => item.audioAsVoice);
    return items
      .map((item) => ({
        text: item.text?.trim() ? item.text.trim() : undefined,
        mediaUrls: item.media?.length ? item.media : undefined,
        mediaUrl: item.media?.[0],
        isError: item.isError,
        replyToId: item.replyToId,
        replyToTag: item.replyToTag,
        replyToCurrent: item.replyToCurrent,
        audioAsVoice: item.audioAsVoice || Boolean(hasAudioAsVoiceTag && item.media?.length),
      }))
      .filter((p) => {
        if (!p.text && !p.mediaUrl && (!p.mediaUrls || p.mediaUrls.length === 0)) return false;
        if (p.text && isSilentReplyText(p.text, SILENT_REPLY_TOKEN)) return false;
        return true;
      });
  };
  let payloads = buildPayloads(replyItems);
  if (
    payloads.length === 0 &&
    params.lastToolError &&
    params.didSendViaMessagingTool !== true
  ) {
    const toolSummary = formatToolAggregate(
      params.lastToolError.toolName,
      params.lastToolError.meta ? [params.lastToolError.meta] : undefined,
      { markdown: useMarkdown },
    );
    const errorSuffix = params.lastToolError.error ? `: ${params.lastToolError.error}` : "";
-    replyItems.push({
+    payloads = buildPayloads([
-      text: `⚠️ ${toolSummary} failed${errorSuffix}`,
+      {
-      isError: true,
+        text: `⚠️ ${toolSummary} failed${errorSuffix}`,
-    });
+        isError: true,
      },
    ]);
  }
-  const hasAudioAsVoiceTag = replyItems.some((item) => item.audioAsVoice);
+  return payloads;
  return replyItems
    .map((item) => ({
      text: item.text?.trim() ? item.text.trim() : undefined,
      mediaUrls: item.media?.length ? item.media : undefined,
      mediaUrl: item.media?.[0],
      isError: item.isError,
      replyToId: item.replyToId,
      replyToTag: item.replyToTag,
      replyToCurrent: item.replyToCurrent,
      audioAsVoice: item.audioAsVoice || Boolean(hasAudioAsVoiceTag && item.media?.length),
    }))
    .filter((p) => {
      if (!p.text && !p.mediaUrl && (!p.mediaUrls || p.mediaUrls.length === 0)) return false;
      if (p.text && isSilentReplyText(p.text, SILENT_REPLY_TOKEN)) return false;
      return true;
    });
 }
Author	SHA1	Message	Date
Peter Steinberger	ace906539f	fix: gate tool-error fallback replies (#1175 ) (thanks @vrknetha)	2026-01-18 14:07:34 +00:00
vrknetha	f039fdf8e9	Agents: surface tool failures without assistant output	2026-01-18 14:03:08 +00:00
		`@@ -1,3 +0,0 @@`
			`import "../../src/logging/subsystem.js";`

			`console.log("tsx-name-repro: loaded logging/subsystem");`