fix: clean up slack threading landings (#1360) (thanks @SocialNerd42069)

- Add per-message dedup tracking in subscribeEmbeddedPiSession
- Compare both trimmed and normalized text to catch near-duplicates
- Reset dedup state on each new assistant message
- Add test for trailing whitespace edge case

Fixes duplicate Slack message delivery when the same text appears
with minor whitespace differences (e.g., trailing newline).

AGENTS.md

@@ -100,7 +100,7 @@
 - CLI progress: use `src/cli/progress.ts` (`osc-progress` + `@clack/prompts` spinner); don’t hand-roll spinners/bars.
 - Status output: keep tables + ANSI-safe wrapping (`src/terminal/table.ts`); `status --all` = read-only/pasteable, `status --deep` = probes.
 - Gateway currently runs only as the menubar app; there is no separate LaunchAgent/helper label installed. Restart via the Clawdbot Mac app or `scripts/restart-mac.sh`; to verify/kill use `launchctl print gui/$UID | grep clawdbot` rather than assuming a fixed label. **When debugging on macOS, start/stop the gateway via the app, not ad-hoc tmux sessions; kill any temporary tunnels before handoff.**
-- macOS logs: use `./scripts/clawlog.sh` (aka `vtlog`) to query unified logs for the Clawdbot subsystem; it supports follow/tail/category filters and expects passwordless sudo for `/usr/bin/log`.
+- macOS logs: use `./scripts/clawlog.sh` to query unified logs for the Clawdbot subsystem; it supports follow/tail/category filters and expects passwordless sudo for `/usr/bin/log`.
 - If shared guardrails are available locally, review them; otherwise follow this repo's guidance.
 - SwiftUI state management (iOS/macOS): prefer the `Observation` framework (`@Observable`, `@Bindable`) over `ObservableObject`/`@StateObject`; don’t introduce new `ObservableObject` unless required for compatibility, and migrate existing usages when touching related code.
 - Connection providers: when adding a new connection, update every UI surface and docs (macOS app, web UI, mobile if applicable, onboarding/overview docs) and add matching status + configuration forms so provider lists and settings stay in sync.

CHANGELOG.md

@@ -2,63 +2,14 @@
 
 Docs: https://docs.clawd.bot
 
-## 2026.1.20
-
-### Changes
-- Deps: update workspace + memory-lancedb dependencies.
-- Repo: remove the Peekaboo git submodule now that the SPM release is used.
-- Update: sync plugin sources on channel switches and update npm-installed plugins during `clawdbot update`.
-- Plugins: share npm plugin update logic between `clawdbot update` and `clawdbot plugins update`.
-- Channels: add the Nostr plugin channel with profile management + onboarding install defaults. (#1323) — thanks @joelklabo.
-- Plugins: require manifest-embedded config schemas, validate configs without loading plugin code, and surface plugin config warnings. (#1272) — thanks @thewilloftheshadow.
-- Plugins: move channel catalog metadata into plugin manifests; align Nextcloud Talk policy helpers with core patterns. (#1290) — thanks @NicholaiVogel.
-- Discord: fall back to /skill when native command limits are exceeded; expose /skill globally. (#1287) — thanks @thewilloftheshadow.
-- Docs: refresh bird skill install metadata and usage notes. (#1302) — thanks @odysseus0.
-- Matrix: migrate to matrix-bot-sdk with E2EE support, location handling, and group allowlist upgrades. (#1298) — thanks @sibbl.
-- Plugins/UI: let channel plugin metadata drive UI labels/icons and cron channel options. (#1306) — thanks @steipete.
-- Zalouser: add channel dock metadata, config schema, setup wiring, probe, and status issues. (#1219) — thanks @suminhthanh.
-- Security: warn when <=300B models run without sandboxing and with web tools enabled.
-- Skills: add download installs with OS-filtered install options; add local sherpa-onnx-tts skill.
-- Docs: clarify WhatsApp voice notes and Windows WSL portproxy LAN access notes.
-### Fixes
-- Discovery: shorten Bonjour DNS-SD service type to `_clawdbot-gw._tcp` and update discovery clients/docs.
-- Agents: preserve subagent announce thread/topic routing + queued replies across channels. (#1241) — thanks @gnarco.
-- Agents: avoid treating timeout errors with "aborted" messages as user aborts, so model fallback still runs.
-- Diagnostics: export OTLP logs, correct queue depth tracking, and document message-flow telemetry.
-- Diagnostics: emit message-flow diagnostics across channels via shared dispatch; gate heartbeat/webhook logging. (#1244) — thanks @oscargavin.
-- Model catalog: avoid caching import failures, log transient discovery errors, and keep partial results. (#1332) — thanks @dougvk.
-- Doctor: clarify plugin auto-enable hint text in the startup banner.
-- Gateway: clarify unauthorized handshake responses with token/password mismatch guidance.
-- Gateway: preserve restart wake routing + thread replies across restarts. (#1337) — thanks @John-Rood.
-- Gateway: reschedule per-agent heartbeats on config hot reload without restarting the runner.
-- UI: keep config form enums typed, preserve empty strings, protect sensitive defaults, and deepen config search. (#1315) — thanks @MaudeBot.
-- UI: preserve ordered list numbering in chat markdown. (#1341) — thanks @bradleypriest.
-- Web search: infer Perplexity base URL from API key source (direct vs OpenRouter).
-- TUI: keep thinking blocks ordered before content during streaming and isolate per-run assembly. (#1202) — thanks @aaronveklabs.
-- TUI: align custom editor initialization with the latest pi-tui API. (#1298) — thanks @sibbl.
-- CLI: avoid duplicating --profile/--dev flags when formatting commands.
-- Status: route native `/status` to the active agent so model selection reflects the correct profile. (#1301)
-- Exec: prefer bash when fish is default shell, falling back to sh if bash is missing. (#1297) — thanks @ysqander.
-- Exec: merge login-shell PATH for host=gateway exec while keeping daemon PATH minimal. (#1304)
-- Plugins: add Nextcloud Talk manifest for plugin config validation. (#1297) — thanks @ysqander.
-- Anthropic: default API prompt caching to 1h with configurable TTL override; ignore TTL for OAuth.
-- Discord: make resolve warnings avoid raw JSON payloads on rate limits.
-- Discord: process message handlers in parallel across sessions to avoid event queue blocking. (#1295)
-- Cron: auto-deliver isolated agent output to explicit targets without tool calls. (#1285)
-
 ## 2026.1.19-3
 
 ### Changes
 - Android: remove legacy bridge transport code now that nodes use the gateway protocol.
 - Android: send structured payloads in node events/invokes and include user-agent metadata in gateway connects.
-- Gateway: expand `/v1/responses` to support file/image inputs, tool_choice, usage, and output limits. (#1229) — thanks @RyanLisse.
-- Docs: surface Amazon Bedrock in provider lists and clarify Bedrock auth env vars. (#1289) — thanks @steipete.
 
 ### Fixes
-- Gateway: strip inbound envelope headers from chat history messages to keep clients clean.
-- UI: prevent double-scroll in Control UI chat by locking chat layout to the viewport. (#1283) — thanks @bradleypriest.
-- Config: allow Perplexity as a web_search provider in config validation. (#1230)
-- Browser: register AI snapshot refs for act commands. (#1282) — thanks @John-Rood.
+- Slack: respect verbose tool summaries and keep tool notifications threaded. (#1360) — thanks @SocialNerd42069.
 
 ## 2026.1.19-2
 
@@ -77,11 +28,9 @@ Docs: https://docs.clawd.bot
 - **BREAKING:** Reject invalid/unknown config entries and refuse to start the gateway for safety; run `clawdbot doctor --fix` to repair. 
 
 ### Changes
-- Gateway: add `/v1/responses` endpoint (OpenResponses API) for agentic workflows with item-based input and semantic streaming events. Enable via `gateway.http.endpoints.responses.enabled: true`.
 - Usage: add `/usage cost` summaries and macOS menu cost submenu with daily charting.
 - Agents: clarify node_modules read-only guidance in agent instructions.
 - TUI: add syntax highlighting for code blocks. (#1200) — thanks @vignesh07.
-- TUI: session picker shows derived titles, fuzzy search, relative times, and last message preview. (#1271) — thanks @Whoaa512.
 
 ### Fixes
 - UI: enable shell mode for sync Windows spawns to avoid `pnpm ui:build` EINVAL. (#1212) — thanks @longmaba.
@@ -90,11 +39,9 @@ Docs: https://docs.clawd.bot
 - Agents: propagate accountId into embedded runs so sub-agent announce routing honors the originating account. (#1058)
 - Compaction: include tool failure summaries in safeguard compaction to prevent retry loops. (#1084)
 - Daemon: include HOME in service environments to avoid missing HOME errors. (#1214) — thanks @ameno-.
-- Memory: show total file counts + scan issues in `clawdbot memory status`; fall back to non-batch embeddings after repeated batch failures.
 - TUI: show generic empty-state text for searchable pickers. (#1201) — thanks @vignesh07.
 - Doctor: canonicalize legacy session keys in session stores to prevent stale metadata. (#1169)
 - CLI: centralize CLI command registration to keep fast-path routing and program wiring in sync. (#1207) — thanks @gumadeiras.
-- Config: allow custom fields under `skills.entries.<name>.config` for skill credentials/config. (#1226) — thanks @VACInc. (fixes #1225)
 
 ## 2026.1.18-5
 
@@ -120,8 +67,8 @@ Docs: https://docs.clawd.bot
 ## 2026.1.18-4
 
 ### Changes
-- macOS: switch PeekabooBridge integration to the tagged Swift Package Manager release.
-- macOS: stop syncing Peekaboo in postinstall.
+- macOS: switch PeekabooBridge integration to the tagged Swift Package Manager release (no submodule).
+- macOS: stop syncing Peekaboo as a git submodule in postinstall.
 - Swabble: use the tagged Commander Swift package release.
 - CLI: add `clawdbot acp client` interactive ACP harness for debugging.
 - Plugins: route command detection/text chunking helpers through the plugin runtime and drop runtime exports from the SDK.

README.md

@@ -479,27 +479,27 @@ Core contributors:
 Thanks to all clawtributors:
 
 <p align="left">
-  <a href="https://github.com/steipete"><img src="https://avatars.githubusercontent.com/u/58493?v=4&s=48" width="48" height="48" alt="steipete" title="steipete"/></a> <a href="https://github.com/bohdanpodvirnyi"><img src="https://avatars.githubusercontent.com/u/31819391?v=4&s=48" width="48" height="48" alt="bohdanpodvirnyi" title="bohdanpodvirnyi"/></a> <a href="https://github.com/joaohlisboa"><img src="https://avatars.githubusercontent.com/u/8200873?v=4&s=48" width="48" height="48" alt="joaohlisboa" title="joaohlisboa"/></a> <a href="https://github.com/mneves75"><img src="https://avatars.githubusercontent.com/u/2423436?v=4&s=48" width="48" height="48" alt="mneves75" title="mneves75"/></a> <a href="https://github.com/MatthieuBizien"><img src="https://avatars.githubusercontent.com/u/173090?v=4&s=48" width="48" height="48" alt="MatthieuBizien" title="MatthieuBizien"/></a> <a href="https://github.com/rahthakor"><img src="https://avatars.githubusercontent.com/u/8470553?v=4&s=48" width="48" height="48" alt="rahthakor" title="rahthakor"/></a> <a href="https://github.com/vrknetha"><img src="https://avatars.githubusercontent.com/u/20596261?v=4&s=48" width="48" height="48" alt="vrknetha" title="vrknetha"/></a> <a href="https://github.com/radek-paclt"><img src="https://avatars.githubusercontent.com/u/50451445?v=4&s=48" width="48" height="48" alt="radek-paclt" title="radek-paclt"/></a> <a href="https://github.com/joshp123"><img src="https://avatars.githubusercontent.com/u/1497361?v=4&s=48" width="48" height="48" alt="joshp123" title="joshp123"/></a> <a href="https://github.com/mukhtharcm"><img src="https://avatars.githubusercontent.com/u/56378562?v=4&s=48" width="48" height="48" alt="mukhtharcm" title="mukhtharcm"/></a>
-  <a href="https://github.com/maxsumrall"><img src="https://avatars.githubusercontent.com/u/628843?v=4&s=48" width="48" height="48" alt="maxsumrall" title="maxsumrall"/></a> <a href="https://github.com/xadenryan"><img src="https://avatars.githubusercontent.com/u/165437834?v=4&s=48" width="48" height="48" alt="xadenryan" title="xadenryan"/></a> <a href="https://github.com/tobiasbischoff"><img src="https://avatars.githubusercontent.com/u/711564?v=4&s=48" width="48" height="48" alt="Tobias Bischoff" title="Tobias Bischoff"/></a> <a href="https://github.com/juanpablodlc"><img src="https://avatars.githubusercontent.com/u/92012363?v=4&s=48" width="48" height="48" alt="juanpablodlc" title="juanpablodlc"/></a> <a href="https://github.com/hsrvc"><img src="https://avatars.githubusercontent.com/u/129702169?v=4&s=48" width="48" height="48" alt="hsrvc" title="hsrvc"/></a> <a href="https://github.com/magimetal"><img src="https://avatars.githubusercontent.com/u/36491250?v=4&s=48" width="48" height="48" alt="magimetal" title="magimetal"/></a> <a href="https://github.com/meaningfool"><img src="https://avatars.githubusercontent.com/u/2862331?v=4&s=48" width="48" height="48" alt="meaningfool" title="meaningfool"/></a> <a href="https://github.com/NicholasSpisak"><img src="https://avatars.githubusercontent.com/u/129075147?v=4&s=48" width="48" height="48" alt="NicholasSpisak" title="NicholasSpisak"/></a> <a href="https://github.com/AbhisekBasu1"><img src="https://avatars.githubusercontent.com/u/40645221?v=4&s=48" width="48" height="48" alt="abhisekbasu1" title="abhisekbasu1"/></a> <a href="https://github.com/sebslight"><img src="https://avatars.githubusercontent.com/u/19554889?v=4&s=48" width="48" height="48" alt="sebslight" title="sebslight"/></a>
-  <a href="https://github.com/claude"><img src="https://avatars.githubusercontent.com/u/81847?v=4&s=48" width="48" height="48" alt="claude" title="claude"/></a> <a href="https://github.com/jamesgroat"><img src="https://avatars.githubusercontent.com/u/2634024?v=4&s=48" width="48" height="48" alt="jamesgroat" title="jamesgroat"/></a> <a href="https://github.com/Hyaxia"><img src="https://avatars.githubusercontent.com/u/36747317?v=4&s=48" width="48" height="48" alt="Hyaxia" title="Hyaxia"/></a> <a href="https://github.com/dantelex"><img src="https://avatars.githubusercontent.com/u/631543?v=4&s=48" width="48" height="48" alt="dantelex" title="dantelex"/></a> <a href="https://github.com/daveonkels"><img src="https://avatars.githubusercontent.com/u/533642?v=4&s=48" width="48" height="48" alt="daveonkels" title="daveonkels"/></a> <a href="https://github.com/mteam88"><img src="https://avatars.githubusercontent.com/u/84196639?v=4&s=48" width="48" height="48" alt="mteam88" title="mteam88"/></a> <a href="https://github.com/omniwired"><img src="https://avatars.githubusercontent.com/u/322761?v=4&s=48" width="48" height="48" alt="Eng. Juan Combetto" title="Eng. Juan Combetto"/></a> <a href="https://github.com/dbhurley"><img src="https://avatars.githubusercontent.com/u/5251425?v=4&s=48" width="48" height="48" alt="dbhurley" title="dbhurley"/></a> <a href="https://github.com/mbelinky"><img src="https://avatars.githubusercontent.com/u/132747814?v=4&s=48" width="48" height="48" alt="Mariano Belinky" title="Mariano Belinky"/></a> <a href="https://github.com/TSavo"><img src="https://avatars.githubusercontent.com/u/877990?v=4&s=48" width="48" height="48" alt="TSavo" title="TSavo"/></a>
-  <a href="https://github.com/julianengel"><img src="https://avatars.githubusercontent.com/u/10634231?v=4&s=48" width="48" height="48" alt="julianengel" title="julianengel"/></a> <a href="https://github.com/benithors"><img src="https://avatars.githubusercontent.com/u/20652882?v=4&s=48" width="48" height="48" alt="benithors" title="benithors"/></a> <a href="https://github.com/bradleypriest"><img src="https://avatars.githubusercontent.com/u/167215?v=4&s=48" width="48" height="48" alt="bradleypriest" title="bradleypriest"/></a> <a href="https://github.com/timolins"><img src="https://avatars.githubusercontent.com/u/1440854?v=4&s=48" width="48" height="48" alt="timolins" title="timolins"/></a> <a href="https://github.com/Nachx639"><img src="https://avatars.githubusercontent.com/u/71144023?v=4&s=48" width="48" height="48" alt="nachx639" title="nachx639"/></a> <a href="https://github.com/sreekaransrinath"><img src="https://avatars.githubusercontent.com/u/50989977?v=4&s=48" width="48" height="48" alt="sreekaransrinath" title="sreekaransrinath"/></a> <a href="https://github.com/gupsammy"><img src="https://avatars.githubusercontent.com/u/20296019?v=4&s=48" width="48" height="48" alt="gupsammy" title="gupsammy"/></a> <a href="https://github.com/cristip73"><img src="https://avatars.githubusercontent.com/u/24499421?v=4&s=48" width="48" height="48" alt="cristip73" title="cristip73"/></a> <a href="https://github.com/nachoiacovino"><img src="https://avatars.githubusercontent.com/u/50103937?v=4&s=48" width="48" height="48" alt="nachoiacovino" title="nachoiacovino"/></a> <a href="https://github.com/vsabavat"><img src="https://avatars.githubusercontent.com/u/50385532?v=4&s=48" width="48" height="48" alt="Vasanth Rao Naik Sabavat" title="Vasanth Rao Naik Sabavat"/></a>
-  <a href="https://github.com/cpojer"><img src="https://avatars.githubusercontent.com/u/13352?v=4&s=48" width="48" height="48" alt="cpojer" title="cpojer"/></a> <a href="https://github.com/lc0rp"><img src="https://avatars.githubusercontent.com/u/2609441?v=4&s=48" width="48" height="48" alt="lc0rp" title="lc0rp"/></a> <a href="https://github.com/scald"><img src="https://avatars.githubusercontent.com/u/1215913?v=4&s=48" width="48" height="48" alt="scald" title="scald"/></a> <a href="https://github.com/gumadeiras"><img src="https://avatars.githubusercontent.com/u/5599352?v=4&s=48" width="48" height="48" alt="gumadeiras" title="gumadeiras"/></a> <a href="https://github.com/andranik-sahakyan"><img src="https://avatars.githubusercontent.com/u/8908029?v=4&s=48" width="48" height="48" alt="andranik-sahakyan" title="andranik-sahakyan"/></a> <a href="https://github.com/davidguttman"><img src="https://avatars.githubusercontent.com/u/431696?v=4&s=48" width="48" height="48" alt="davidguttman" title="davidguttman"/></a> <a href="https://github.com/sleontenko"><img src="https://avatars.githubusercontent.com/u/7135949?v=4&s=48" width="48" height="48" alt="sleontenko" title="sleontenko"/></a> <a href="https://github.com/sircrumpet"><img src="https://avatars.githubusercontent.com/u/4436535?v=4&s=48" width="48" height="48" alt="sircrumpet" title="sircrumpet"/></a> <a href="https://github.com/peschee"><img src="https://avatars.githubusercontent.com/u/63866?v=4&s=48" width="48" height="48" alt="peschee" title="peschee"/></a> <a href="https://github.com/rafaelreis-r"><img src="https://avatars.githubusercontent.com/u/57492577?v=4&s=48" width="48" height="48" alt="rafaelreis-r" title="rafaelreis-r"/></a>
-  <a href="https://github.com/thewilloftheshadow"><img src="https://avatars.githubusercontent.com/u/35580099?v=4&s=48" width="48" height="48" alt="thewilloftheshadow" title="thewilloftheshadow"/></a> <a href="https://github.com/ratulsarna"><img src="https://avatars.githubusercontent.com/u/105903728?v=4&s=48" width="48" height="48" alt="ratulsarna" title="ratulsarna"/></a> <a href="https://github.com/lutr0"><img src="https://avatars.githubusercontent.com/u/76906369?v=4&s=48" width="48" height="48" alt="lutr0" title="lutr0"/></a> <a href="https://github.com/danielz1z"><img src="https://avatars.githubusercontent.com/u/235270390?v=4&s=48" width="48" height="48" alt="danielz1z" title="danielz1z"/></a> <a href="https://github.com/emanuelst"><img src="https://avatars.githubusercontent.com/u/9994339?v=4&s=48" width="48" height="48" alt="emanuelst" title="emanuelst"/></a> <a href="https://github.com/KristijanJovanovski"><img src="https://avatars.githubusercontent.com/u/8942284?v=4&s=48" width="48" height="48" alt="KristijanJovanovski" title="KristijanJovanovski"/></a> <a href="https://github.com/CashWilliams"><img src="https://avatars.githubusercontent.com/u/613573?v=4&s=48" width="48" height="48" alt="CashWilliams" title="CashWilliams"/></a> <a href="https://github.com/rdev"><img src="https://avatars.githubusercontent.com/u/8418866?v=4&s=48" width="48" height="48" alt="rdev" title="rdev"/></a> <a href="https://github.com/osolmaz"><img src="https://avatars.githubusercontent.com/u/2453968?v=4&s=48" width="48" height="48" alt="osolmaz" title="osolmaz"/></a> <a href="https://github.com/joshrad-dev"><img src="https://avatars.githubusercontent.com/u/62785552?v=4&s=48" width="48" height="48" alt="joshrad-dev" title="joshrad-dev"/></a>
-  <a href="https://github.com/kiranjd"><img src="https://avatars.githubusercontent.com/u/25822851?v=4&s=48" width="48" height="48" alt="kiranjd" title="kiranjd"/></a> <a href="https://github.com/adityashaw2"><img src="https://avatars.githubusercontent.com/u/41204444?v=4&s=48" width="48" height="48" alt="adityashaw2" title="adityashaw2"/></a> <a href="https://github.com/search?q=sheeek"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="sheeek" title="sheeek"/></a> <a href="https://github.com/artuskg"><img src="https://avatars.githubusercontent.com/u/11966157?v=4&s=48" width="48" height="48" alt="artuskg" title="artuskg"/></a> <a href="https://github.com/onutc"><img src="https://avatars.githubusercontent.com/u/152018508?v=4&s=48" width="48" height="48" alt="onutc" title="onutc"/></a> <a href="https://github.com/tyler6204"><img src="https://avatars.githubusercontent.com/u/64381258?v=4&s=48" width="48" height="48" alt="tyler6204" title="tyler6204"/></a> <a href="https://github.com/ManuelHettich"><img src="https://avatars.githubusercontent.com/u/17690367?v=4&s=48" width="48" height="48" alt="manuelhettich" title="manuelhettich"/></a> <a href="https://github.com/minghinmatthewlam"><img src="https://avatars.githubusercontent.com/u/14224566?v=4&s=48" width="48" height="48" alt="minghinmatthewlam" title="minghinmatthewlam"/></a> <a href="https://github.com/myfunc"><img src="https://avatars.githubusercontent.com/u/19294627?v=4&s=48" width="48" height="48" alt="myfunc" title="myfunc"/></a> <a href="https://github.com/buddyh"><img src="https://avatars.githubusercontent.com/u/31752869?v=4&s=48" width="48" height="48" alt="buddyh" title="buddyh"/></a>
-  <a href="https://github.com/connorshea"><img src="https://avatars.githubusercontent.com/u/2977353?v=4&s=48" width="48" height="48" alt="connorshea" title="connorshea"/></a> <a href="https://github.com/mcinteerj"><img src="https://avatars.githubusercontent.com/u/3613653?v=4&s=48" width="48" height="48" alt="mcinteerj" title="mcinteerj"/></a> <a href="https://github.com/John-Rood"><img src="https://avatars.githubusercontent.com/u/62669593?v=4&s=48" width="48" height="48" alt="John-Rood" title="John-Rood"/></a> <a href="https://github.com/timkrase"><img src="https://avatars.githubusercontent.com/u/38947626?v=4&s=48" width="48" height="48" alt="timkrase" title="timkrase"/></a> <a href="https://github.com/zerone0x"><img src="https://avatars.githubusercontent.com/u/39543393?v=4&s=48" width="48" height="48" alt="zerone0x" title="zerone0x"/></a> <a href="https://github.com/gerardward2007"><img src="https://avatars.githubusercontent.com/u/3002155?v=4&s=48" width="48" height="48" alt="gerardward2007" title="gerardward2007"/></a> <a href="https://github.com/obviyus"><img src="https://avatars.githubusercontent.com/u/22031114?v=4&s=48" width="48" height="48" alt="obviyus" title="obviyus"/></a> <a href="https://github.com/tosh-hamburg"><img src="https://avatars.githubusercontent.com/u/58424326?v=4&s=48" width="48" height="48" alt="tosh-hamburg" title="tosh-hamburg"/></a> <a href="https://github.com/azade-c"><img src="https://avatars.githubusercontent.com/u/252790079?v=4&s=48" width="48" height="48" alt="azade-c" title="azade-c"/></a> <a href="https://github.com/roshanasingh4"><img src="https://avatars.githubusercontent.com/u/88576930?v=4&s=48" width="48" height="48" alt="roshanasingh4" title="roshanasingh4"/></a>
-  <a href="https://github.com/bjesuiter"><img src="https://avatars.githubusercontent.com/u/2365676?v=4&s=48" width="48" height="48" alt="bjesuiter" title="bjesuiter"/></a> <a href="https://github.com/cheeeee"><img src="https://avatars.githubusercontent.com/u/21245729?v=4&s=48" width="48" height="48" alt="cheeeee" title="cheeeee"/></a> <a href="https://github.com/j1philli"><img src="https://avatars.githubusercontent.com/u/3744255?v=4&s=48" width="48" height="48" alt="Josh Phillips" title="Josh Phillips"/></a> <a href="https://github.com/Whoaa512"><img src="https://avatars.githubusercontent.com/u/1581943?v=4&s=48" width="48" height="48" alt="Whoaa512" title="Whoaa512"/></a> <a href="https://github.com/YuriNachos"><img src="https://avatars.githubusercontent.com/u/19365375?v=4&s=48" width="48" height="48" alt="YuriNachos" title="YuriNachos"/></a> <a href="https://github.com/chriseidhof"><img src="https://avatars.githubusercontent.com/u/5382?v=4&s=48" width="48" height="48" alt="chriseidhof" title="chriseidhof"/></a> <a href="https://github.com/ysqander"><img src="https://avatars.githubusercontent.com/u/80843820?v=4&s=48" width="48" height="48" alt="ysqander" title="ysqander"/></a> <a href="https://github.com/superman32432432"><img src="https://avatars.githubusercontent.com/u/7228420?v=4&s=48" width="48" height="48" alt="superman32432432" title="superman32432432"/></a> <a href="https://github.com/vignesh07"><img src="https://avatars.githubusercontent.com/u/1436853?v=4&s=48" width="48" height="48" alt="vignesh07" title="vignesh07"/></a> <a href="https://github.com/search?q=Yurii%20Chukhlib"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Yurii Chukhlib" title="Yurii Chukhlib"/></a>
-  <a href="https://github.com/grp06"><img src="https://avatars.githubusercontent.com/u/1573959?v=4&s=48" width="48" height="48" alt="grp06" title="grp06"/></a> <a href="https://github.com/antons"><img src="https://avatars.githubusercontent.com/u/129705?v=4&s=48" width="48" height="48" alt="antons" title="antons"/></a> <a href="https://github.com/austinm911"><img src="https://avatars.githubusercontent.com/u/31991302?v=4&s=48" width="48" height="48" alt="austinm911" title="austinm911"/></a> <a href="https://github.com/apps/blacksmith-sh"><img src="https://avatars.githubusercontent.com/in/807020?v=4&s=48" width="48" height="48" alt="blacksmith-sh[bot]" title="blacksmith-sh[bot]"/></a> <a href="https://github.com/dan-dr"><img src="https://avatars.githubusercontent.com/u/6669808?v=4&s=48" width="48" height="48" alt="dan-dr" title="dan-dr"/></a> <a href="https://github.com/HeimdallStrategy"><img src="https://avatars.githubusercontent.com/u/223014405?v=4&s=48" width="48" height="48" alt="HeimdallStrategy" title="HeimdallStrategy"/></a> <a href="https://github.com/imfing"><img src="https://avatars.githubusercontent.com/u/5097752?v=4&s=48" width="48" height="48" alt="imfing" title="imfing"/></a> <a href="https://github.com/jalehman"><img src="https://avatars.githubusercontent.com/u/550978?v=4&s=48" width="48" height="48" alt="jalehman" title="jalehman"/></a> <a href="https://github.com/jarvis-medmatic"><img src="https://avatars.githubusercontent.com/u/252428873?v=4&s=48" width="48" height="48" alt="jarvis-medmatic" title="jarvis-medmatic"/></a> <a href="https://github.com/kkarimi"><img src="https://avatars.githubusercontent.com/u/875218?v=4&s=48" width="48" height="48" alt="kkarimi" title="kkarimi"/></a>
-  <a href="https://github.com/mahmoudashraf93"><img src="https://avatars.githubusercontent.com/u/9130129?v=4&s=48" width="48" height="48" alt="mahmoudashraf93" title="mahmoudashraf93"/></a> <a href="https://github.com/petter-b"><img src="https://avatars.githubusercontent.com/u/62076402?v=4&s=48" width="48" height="48" alt="petter-b" title="petter-b"/></a> <a href="https://github.com/pkrmf"><img src="https://avatars.githubusercontent.com/u/1714267?v=4&s=48" width="48" height="48" alt="pkrmf" title="pkrmf"/></a> <a href="https://github.com/RandyVentures"><img src="https://avatars.githubusercontent.com/u/149904821?v=4&s=48" width="48" height="48" alt="RandyVentures" title="RandyVentures"/></a> <a href="https://github.com/search?q=Ryan%20Lisse"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ryan Lisse" title="Ryan Lisse"/></a> <a href="https://github.com/erikpr1994"><img src="https://avatars.githubusercontent.com/u/6299331?v=4&s=48" width="48" height="48" alt="erikpr1994" title="erikpr1994"/></a> <a href="https://github.com/search?q=Ghost"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ghost" title="Ghost"/></a> <a href="https://github.com/jonasjancarik"><img src="https://avatars.githubusercontent.com/u/2459191?v=4&s=48" width="48" height="48" alt="jonasjancarik" title="jonasjancarik"/></a> <a href="https://github.com/search?q=Keith%20the%20Silly%20Goose"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Keith the Silly Goose" title="Keith the Silly Goose"/></a> <a href="https://github.com/search?q=L36%20Server"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="L36 Server" title="L36 Server"/></a>
-  <a href="https://github.com/search?q=Marc"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Marc" title="Marc"/></a> <a href="https://github.com/mitschabaude-bot"><img src="https://avatars.githubusercontent.com/u/247582884?v=4&s=48" width="48" height="48" alt="mitschabaude-bot" title="mitschabaude-bot"/></a> <a href="https://github.com/neist"><img src="https://avatars.githubusercontent.com/u/1029724?v=4&s=48" width="48" height="48" alt="neist" title="neist"/></a> <a href="https://github.com/ngutman"><img src="https://avatars.githubusercontent.com/u/1540134?v=4&s=48" width="48" height="48" alt="ngutman" title="ngutman"/></a> <a href="https://github.com/chrisrodz"><img src="https://avatars.githubusercontent.com/u/2967620?v=4&s=48" width="48" height="48" alt="chrisrodz" title="chrisrodz"/></a> <a href="https://github.com/dougvk"><img src="https://avatars.githubusercontent.com/u/401660?v=4&s=48" width="48" height="48" alt="dougvk" title="dougvk"/></a> <a href="https://github.com/search?q=Friederike%20Seiler"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Friederike Seiler" title="Friederike Seiler"/></a> <a href="https://github.com/gabriel-trigo"><img src="https://avatars.githubusercontent.com/u/38991125?v=4&s=48" width="48" height="48" alt="gabriel-trigo" title="gabriel-trigo"/></a> <a href="https://github.com/Iamadig"><img src="https://avatars.githubusercontent.com/u/102129234?v=4&s=48" width="48" height="48" alt="iamadig" title="iamadig"/></a> <a href="https://github.com/search?q=Kit"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kit" title="Kit"/></a>
-  <a href="https://github.com/koala73"><img src="https://avatars.githubusercontent.com/u/996596?v=4&s=48" width="48" height="48" alt="koala73" title="koala73"/></a> <a href="https://github.com/manmal"><img src="https://avatars.githubusercontent.com/u/142797?v=4&s=48" width="48" height="48" alt="manmal" title="manmal"/></a> <a href="https://github.com/ogulcancelik"><img src="https://avatars.githubusercontent.com/u/7064011?v=4&s=48" width="48" height="48" alt="ogulcancelik" title="ogulcancelik"/></a> <a href="https://github.com/pasogott"><img src="https://avatars.githubusercontent.com/u/23458152?v=4&s=48" width="48" height="48" alt="pasogott" title="pasogott"/></a> <a href="https://github.com/petradonka"><img src="https://avatars.githubusercontent.com/u/7353770?v=4&s=48" width="48" height="48" alt="petradonka" title="petradonka"/></a> <a href="https://github.com/rubyrunsstuff"><img src="https://avatars.githubusercontent.com/u/246602379?v=4&s=48" width="48" height="48" alt="rubyrunsstuff" title="rubyrunsstuff"/></a> <a href="https://github.com/sibbl"><img src="https://avatars.githubusercontent.com/u/866535?v=4&s=48" width="48" height="48" alt="sibbl" title="sibbl"/></a> <a href="https://github.com/suminhthanh"><img src="https://avatars.githubusercontent.com/u/2907636?v=4&s=48" width="48" height="48" alt="suminhthanh" title="suminhthanh"/></a> <a href="https://github.com/VACInc"><img src="https://avatars.githubusercontent.com/u/3279061?v=4&s=48" width="48" height="48" alt="VACInc" title="VACInc"/></a> <a href="https://github.com/wes-davis"><img src="https://avatars.githubusercontent.com/u/16506720?v=4&s=48" width="48" height="48" alt="wes-davis" title="wes-davis"/></a>
-  <a href="https://github.com/zats"><img src="https://avatars.githubusercontent.com/u/2688806?v=4&s=48" width="48" height="48" alt="zats" title="zats"/></a> <a href="https://github.com/24601"><img src="https://avatars.githubusercontent.com/u/1157207?v=4&s=48" width="48" height="48" alt="24601" title="24601"/></a> <a href="https://github.com/search?q=Chris%20Taylor"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Chris Taylor" title="Chris Taylor"/></a> <a href="https://github.com/djangonavarro220"><img src="https://avatars.githubusercontent.com/u/251162586?v=4&s=48" width="48" height="48" alt="Django Navarro" title="Django Navarro"/></a> <a href="https://github.com/evalexpr"><img src="https://avatars.githubusercontent.com/u/23485511?v=4&s=48" width="48" height="48" alt="evalexpr" title="evalexpr"/></a> <a href="https://github.com/henrino3"><img src="https://avatars.githubusercontent.com/u/4260288?v=4&s=48" width="48" height="48" alt="henrino3" title="henrino3"/></a> <a href="https://github.com/humanwritten"><img src="https://avatars.githubusercontent.com/u/206531610?v=4&s=48" width="48" height="48" alt="humanwritten" title="humanwritten"/></a> <a href="https://github.com/larlyssa"><img src="https://avatars.githubusercontent.com/u/13128869?v=4&s=48" width="48" height="48" alt="larlyssa" title="larlyssa"/></a> <a href="https://github.com/mkbehr"><img src="https://avatars.githubusercontent.com/u/1285?v=4&s=48" width="48" height="48" alt="mkbehr" title="mkbehr"/></a> <a href="https://github.com/oswalpalash"><img src="https://avatars.githubusercontent.com/u/6431196?v=4&s=48" width="48" height="48" alt="oswalpalash" title="oswalpalash"/></a>
-  <a href="https://github.com/pcty-nextgen-service-account"><img src="https://avatars.githubusercontent.com/u/112553441?v=4&s=48" width="48" height="48" alt="pcty-nextgen-service-account" title="pcty-nextgen-service-account"/></a> <a href="https://github.com/Syhids"><img src="https://avatars.githubusercontent.com/u/671202?v=4&s=48" width="48" height="48" alt="Syhids" title="Syhids"/></a> <a href="https://github.com/search?q=Aaron%20Konyer"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Aaron Konyer" title="Aaron Konyer"/></a> <a href="https://github.com/aaronveklabs"><img src="https://avatars.githubusercontent.com/u/225997828?v=4&s=48" width="48" height="48" alt="aaronveklabs" title="aaronveklabs"/></a> <a href="https://github.com/adam91holt"><img src="https://avatars.githubusercontent.com/u/9592417?v=4&s=48" width="48" height="48" alt="adam91holt" title="adam91holt"/></a> <a href="https://github.com/erik-agens"><img src="https://avatars.githubusercontent.com/u/80908960?v=4&s=48" width="48" height="48" alt="erik-agens" title="erik-agens"/></a> <a href="https://github.com/fcatuhe"><img src="https://avatars.githubusercontent.com/u/17382215?v=4&s=48" width="48" height="48" alt="fcatuhe" title="fcatuhe"/></a> <a href="https://github.com/ivanrvpereira"><img src="https://avatars.githubusercontent.com/u/183991?v=4&s=48" width="48" height="48" alt="ivanrvpereira" title="ivanrvpereira"/></a> <a href="https://github.com/jayhickey"><img src="https://avatars.githubusercontent.com/u/1676460?v=4&s=48" width="48" height="48" alt="jayhickey" title="jayhickey"/></a> <a href="https://github.com/jeffersonwarrior"><img src="https://avatars.githubusercontent.com/u/89030989?v=4&s=48" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a>
-  <a href="https://github.com/search?q=jeffersonwarrior"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/jdrhyne"><img src="https://avatars.githubusercontent.com/u/7828464?v=4&s=48" width="48" height="48" alt="Jonathan D. Rhyne (DJ-D)" title="Jonathan D. Rhyne (DJ-D)"/></a> <a href="https://github.com/jverdi"><img src="https://avatars.githubusercontent.com/u/345050?v=4&s=48" width="48" height="48" alt="jverdi" title="jverdi"/></a> <a href="https://github.com/longmaba"><img src="https://avatars.githubusercontent.com/u/9361500?v=4&s=48" width="48" height="48" alt="longmaba" title="longmaba"/></a> <a href="https://github.com/mickahouan"><img src="https://avatars.githubusercontent.com/u/31423109?v=4&s=48" width="48" height="48" alt="mickahouan" title="mickahouan"/></a> <a href="https://github.com/mjrussell"><img src="https://avatars.githubusercontent.com/u/1641895?v=4&s=48" width="48" height="48" alt="mjrussell" title="mjrussell"/></a> <a href="https://github.com/p6l-richard"><img src="https://avatars.githubusercontent.com/u/18185649?v=4&s=48" width="48" height="48" alt="p6l-richard" title="p6l-richard"/></a> <a href="https://github.com/philipp-spiess"><img src="https://avatars.githubusercontent.com/u/458591?v=4&s=48" width="48" height="48" alt="philipp-spiess" title="philipp-spiess"/></a> <a href="https://github.com/robaxelsen"><img src="https://avatars.githubusercontent.com/u/13132899?v=4&s=48" width="48" height="48" alt="robaxelsen" title="robaxelsen"/></a> <a href="https://github.com/search?q=Sash%20Catanzarite"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Sash Catanzarite" title="Sash Catanzarite"/></a>
-  <a href="https://github.com/T5-AndyML"><img src="https://avatars.githubusercontent.com/u/22801233?v=4&s=48" width="48" height="48" alt="T5-AndyML" title="T5-AndyML"/></a> <a href="https://github.com/search?q=VAC"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="VAC" title="VAC"/></a> <a href="https://github.com/zknicker"><img src="https://avatars.githubusercontent.com/u/1164085?v=4&s=48" width="48" height="48" alt="zknicker" title="zknicker"/></a> <a href="https://github.com/search?q=alejandro%20maza"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="alejandro maza" title="alejandro maza"/></a> <a href="https://github.com/andrewting19"><img src="https://avatars.githubusercontent.com/u/10536704?v=4&s=48" width="48" height="48" alt="andrewting19" title="andrewting19"/></a> <a href="https://github.com/anpoirier"><img src="https://avatars.githubusercontent.com/u/1245729?v=4&s=48" width="48" height="48" alt="anpoirier" title="anpoirier"/></a> <a href="https://github.com/Asleep123"><img src="https://avatars.githubusercontent.com/u/122379135?v=4&s=48" width="48" height="48" alt="Asleep123" title="Asleep123"/></a> <a href="https://github.com/bolismauro"><img src="https://avatars.githubusercontent.com/u/771999?v=4&s=48" width="48" height="48" alt="bolismauro" title="bolismauro"/></a> <a href="https://github.com/cash-echo-bot"><img src="https://avatars.githubusercontent.com/u/252747386?v=4&s=48" width="48" height="48" alt="cash-echo-bot" title="cash-echo-bot"/></a> <a href="https://github.com/search?q=Clawd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Clawd" title="Clawd"/></a>
-  <a href="https://github.com/conhecendocontato"><img src="https://avatars.githubusercontent.com/u/82890727?v=4&s=48" width="48" height="48" alt="conhecendocontato" title="conhecendocontato"/></a> <a href="https://github.com/search?q=Dimitrios%20Ploutarchos"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Dimitrios Ploutarchos" title="Dimitrios Ploutarchos"/></a> <a href="https://github.com/search?q=Drake%20Thomsen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Drake Thomsen" title="Drake Thomsen"/></a> <a href="https://github.com/search?q=Felix%20Krause"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Felix Krause" title="Felix Krause"/></a> <a href="https://github.com/gtsifrikas"><img src="https://avatars.githubusercontent.com/u/8904378?v=4&s=48" width="48" height="48" alt="gtsifrikas" title="gtsifrikas"/></a> <a href="https://github.com/HazAT"><img src="https://avatars.githubusercontent.com/u/363802?v=4&s=48" width="48" height="48" alt="HazAT" title="HazAT"/></a> <a href="https://github.com/hrdwdmrbl"><img src="https://avatars.githubusercontent.com/u/554881?v=4&s=48" width="48" height="48" alt="hrdwdmrbl" title="hrdwdmrbl"/></a> <a href="https://github.com/hugobarauna"><img src="https://avatars.githubusercontent.com/u/2719?v=4&s=48" width="48" height="48" alt="hugobarauna" title="hugobarauna"/></a> <a href="https://github.com/search?q=Jamie%20Openshaw"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jamie Openshaw" title="Jamie Openshaw"/></a> <a href="https://github.com/search?q=Jarvis"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jarvis" title="Jarvis"/></a>
-  <a href="https://github.com/search?q=Jefferson%20Nunn"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jefferson Nunn" title="Jefferson Nunn"/></a> <a href="https://github.com/search?q=Kevin%20Lin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kevin Lin" title="Kevin Lin"/></a> <a href="https://github.com/kitze"><img src="https://avatars.githubusercontent.com/u/1160594?v=4&s=48" width="48" height="48" alt="kitze" title="kitze"/></a> <a href="https://github.com/levifig"><img src="https://avatars.githubusercontent.com/u/1605?v=4&s=48" width="48" height="48" alt="levifig" title="levifig"/></a> <a href="https://github.com/search?q=Lloyd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Lloyd" title="Lloyd"/></a> <a href="https://github.com/loukotal"><img src="https://avatars.githubusercontent.com/u/18210858?v=4&s=48" width="48" height="48" alt="loukotal" title="loukotal"/></a> <a href="https://github.com/martinpucik"><img src="https://avatars.githubusercontent.com/u/5503097?v=4&s=48" width="48" height="48" alt="martinpucik" title="martinpucik"/></a> <a href="https://github.com/search?q=Miles"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Miles" title="Miles"/></a> <a href="https://github.com/mrdbstn"><img src="https://avatars.githubusercontent.com/u/58957632?v=4&s=48" width="48" height="48" alt="mrdbstn" title="mrdbstn"/></a> <a href="https://github.com/MSch"><img src="https://avatars.githubusercontent.com/u/7475?v=4&s=48" width="48" height="48" alt="MSch" title="MSch"/></a>
-  <a href="https://github.com/search?q=Mustafa%20Tag%20Eldeen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mustafa Tag Eldeen" title="Mustafa Tag Eldeen"/></a> <a href="https://github.com/ndraiman"><img src="https://avatars.githubusercontent.com/u/12609607?v=4&s=48" width="48" height="48" alt="ndraiman" title="ndraiman"/></a> <a href="https://github.com/nexty5870"><img src="https://avatars.githubusercontent.com/u/3869659?v=4&s=48" width="48" height="48" alt="nexty5870" title="nexty5870"/></a> <a href="https://github.com/odysseus0"><img src="https://avatars.githubusercontent.com/u/8635094?v=4&s=48" width="48" height="48" alt="odysseus0" title="odysseus0"/></a> <a href="https://github.com/prathamdby"><img src="https://avatars.githubusercontent.com/u/134331217?v=4&s=48" width="48" height="48" alt="prathamdby" title="prathamdby"/></a> <a href="https://github.com/reeltimeapps"><img src="https://avatars.githubusercontent.com/u/637338?v=4&s=48" width="48" height="48" alt="reeltimeapps" title="reeltimeapps"/></a> <a href="https://github.com/RLTCmpe"><img src="https://avatars.githubusercontent.com/u/10762242?v=4&s=48" width="48" height="48" alt="RLTCmpe" title="RLTCmpe"/></a> <a href="https://github.com/rodrigouroz"><img src="https://avatars.githubusercontent.com/u/384037?v=4&s=48" width="48" height="48" alt="rodrigouroz" title="rodrigouroz"/></a> <a href="https://github.com/search?q=Rolf%20Fredheim"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rolf Fredheim" title="Rolf Fredheim"/></a> <a href="https://github.com/search?q=Rony%20Kelner"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rony Kelner" title="Rony Kelner"/></a>
-  <a href="https://github.com/search?q=Samrat%20Jha"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Samrat Jha" title="Samrat Jha"/></a> <a href="https://github.com/siraht"><img src="https://avatars.githubusercontent.com/u/73152895?v=4&s=48" width="48" height="48" alt="siraht" title="siraht"/></a> <a href="https://github.com/snopoke"><img src="https://avatars.githubusercontent.com/u/249606?v=4&s=48" width="48" height="48" alt="snopoke" title="snopoke"/></a> <a href="https://github.com/search?q=The%20Admiral"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="The Admiral" title="The Admiral"/></a> <a href="https://github.com/thesash"><img src="https://avatars.githubusercontent.com/u/1166151?v=4&s=48" width="48" height="48" alt="thesash" title="thesash"/></a> <a href="https://github.com/search?q=Ubuntu"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ubuntu" title="Ubuntu"/></a> <a href="https://github.com/voidserf"><img src="https://avatars.githubusercontent.com/u/477673?v=4&s=48" width="48" height="48" alt="voidserf" title="voidserf"/></a> <a href="https://github.com/wstock"><img src="https://avatars.githubusercontent.com/u/1394687?v=4&s=48" width="48" height="48" alt="wstock" title="wstock"/></a> <a href="https://github.com/search?q=Zach%20Knickerbocker"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Zach Knickerbocker" title="Zach Knickerbocker"/></a> <a href="https://github.com/Alphonse-arianee"><img src="https://avatars.githubusercontent.com/u/254457365?v=4&s=48" width="48" height="48" alt="Alphonse-arianee" title="Alphonse-arianee"/></a>
-  <a href="https://github.com/search?q=Azade"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Azade" title="Azade"/></a> <a href="https://github.com/carlulsoe"><img src="https://avatars.githubusercontent.com/u/34673973?v=4&s=48" width="48" height="48" alt="carlulsoe" title="carlulsoe"/></a> <a href="https://github.com/search?q=ddyo"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ddyo" title="ddyo"/></a> <a href="https://github.com/search?q=Erik"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Erik" title="Erik"/></a> <a href="https://github.com/latitudeki5223"><img src="https://avatars.githubusercontent.com/u/119656367?v=4&s=48" width="48" height="48" alt="latitudeki5223" title="latitudeki5223"/></a> <a href="https://github.com/search?q=Manuel%20Maly"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Manuel Maly" title="Manuel Maly"/></a> <a href="https://github.com/search?q=Mourad%20Boustani"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mourad Boustani" title="Mourad Boustani"/></a> <a href="https://github.com/odrobnik"><img src="https://avatars.githubusercontent.com/u/333270?v=4&s=48" width="48" height="48" alt="odrobnik" title="odrobnik"/></a> <a href="https://github.com/pcty-nextgen-ios-builder"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="pcty-nextgen-ios-builder" title="pcty-nextgen-ios-builder"/></a> <a href="https://github.com/search?q=Quentin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Quentin" title="Quentin"/></a>
-  <a href="https://github.com/search?q=Randy%20Torres"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Randy Torres" title="Randy Torres"/></a> <a href="https://github.com/rhjoh"><img src="https://avatars.githubusercontent.com/u/105699450?v=4&s=48" width="48" height="48" alt="rhjoh" title="rhjoh"/></a> <a href="https://github.com/ronak-guliani"><img src="https://avatars.githubusercontent.com/u/23518228?v=4&s=48" width="48" height="48" alt="ronak-guliani" title="ronak-guliani"/></a> <a href="https://github.com/search?q=William%20Stock"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="William Stock" title="William Stock"/></a>
+  <a href="https://github.com/steipete"><img src="https://avatars.githubusercontent.com/u/58493?v=4&s=48" width="48" height="48" alt="steipete" title="steipete"/></a> <a href="https://github.com/bohdanpodvirnyi"><img src="https://avatars.githubusercontent.com/u/31819391?v=4&s=48" width="48" height="48" alt="bohdanpodvirnyi" title="bohdanpodvirnyi"/></a> <a href="https://github.com/joaohlisboa"><img src="https://avatars.githubusercontent.com/u/8200873?v=4&s=48" width="48" height="48" alt="joaohlisboa" title="joaohlisboa"/></a> <a href="https://github.com/mneves75"><img src="https://avatars.githubusercontent.com/u/2423436?v=4&s=48" width="48" height="48" alt="mneves75" title="mneves75"/></a> <a href="https://github.com/MatthieuBizien"><img src="https://avatars.githubusercontent.com/u/173090?v=4&s=48" width="48" height="48" alt="MatthieuBizien" title="MatthieuBizien"/></a> <a href="https://github.com/MaudeBot"><img src="https://avatars.githubusercontent.com/u/255777700?v=4&s=48" width="48" height="48" alt="MaudeBot" title="MaudeBot"/></a> <a href="https://github.com/rahthakor"><img src="https://avatars.githubusercontent.com/u/8470553?v=4&s=48" width="48" height="48" alt="rahthakor" title="rahthakor"/></a> <a href="https://github.com/vrknetha"><img src="https://avatars.githubusercontent.com/u/20596261?v=4&s=48" width="48" height="48" alt="vrknetha" title="vrknetha"/></a> <a href="https://github.com/radek-paclt"><img src="https://avatars.githubusercontent.com/u/50451445?v=4&s=48" width="48" height="48" alt="radek-paclt" title="radek-paclt"/></a> <a href="https://github.com/joshp123"><img src="https://avatars.githubusercontent.com/u/1497361?v=4&s=48" width="48" height="48" alt="joshp123" title="joshp123"/></a>
+  <a href="https://github.com/mukhtharcm"><img src="https://avatars.githubusercontent.com/u/56378562?v=4&s=48" width="48" height="48" alt="mukhtharcm" title="mukhtharcm"/></a> <a href="https://github.com/maxsumrall"><img src="https://avatars.githubusercontent.com/u/628843?v=4&s=48" width="48" height="48" alt="maxsumrall" title="maxsumrall"/></a> <a href="https://github.com/xadenryan"><img src="https://avatars.githubusercontent.com/u/165437834?v=4&s=48" width="48" height="48" alt="xadenryan" title="xadenryan"/></a> <a href="https://github.com/tobiasbischoff"><img src="https://avatars.githubusercontent.com/u/711564?v=4&s=48" width="48" height="48" alt="Tobias Bischoff" title="Tobias Bischoff"/></a> <a href="https://github.com/juanpablodlc"><img src="https://avatars.githubusercontent.com/u/92012363?v=4&s=48" width="48" height="48" alt="juanpablodlc" title="juanpablodlc"/></a> <a href="https://github.com/hsrvc"><img src="https://avatars.githubusercontent.com/u/129702169?v=4&s=48" width="48" height="48" alt="hsrvc" title="hsrvc"/></a> <a href="https://github.com/magimetal"><img src="https://avatars.githubusercontent.com/u/36491250?v=4&s=48" width="48" height="48" alt="magimetal" title="magimetal"/></a> <a href="https://github.com/meaningfool"><img src="https://avatars.githubusercontent.com/u/2862331?v=4&s=48" width="48" height="48" alt="meaningfool" title="meaningfool"/></a> <a href="https://github.com/NicholasSpisak"><img src="https://avatars.githubusercontent.com/u/129075147?v=4&s=48" width="48" height="48" alt="NicholasSpisak" title="NicholasSpisak"/></a> <a href="https://github.com/AbhisekBasu1"><img src="https://avatars.githubusercontent.com/u/40645221?v=4&s=48" width="48" height="48" alt="abhisekbasu1" title="abhisekbasu1"/></a>
+  <a href="https://github.com/sebslight"><img src="https://avatars.githubusercontent.com/u/19554889?v=4&s=48" width="48" height="48" alt="sebslight" title="sebslight"/></a> <a href="https://github.com/claude"><img src="https://avatars.githubusercontent.com/u/81847?v=4&s=48" width="48" height="48" alt="claude" title="claude"/></a> <a href="https://github.com/jamesgroat"><img src="https://avatars.githubusercontent.com/u/2634024?v=4&s=48" width="48" height="48" alt="jamesgroat" title="jamesgroat"/></a> <a href="https://github.com/Hyaxia"><img src="https://avatars.githubusercontent.com/u/36747317?v=4&s=48" width="48" height="48" alt="Hyaxia" title="Hyaxia"/></a> <a href="https://github.com/dantelex"><img src="https://avatars.githubusercontent.com/u/631543?v=4&s=48" width="48" height="48" alt="dantelex" title="dantelex"/></a> <a href="https://github.com/daveonkels"><img src="https://avatars.githubusercontent.com/u/533642?v=4&s=48" width="48" height="48" alt="daveonkels" title="daveonkels"/></a> <a href="https://github.com/mteam88"><img src="https://avatars.githubusercontent.com/u/84196639?v=4&s=48" width="48" height="48" alt="mteam88" title="mteam88"/></a> <a href="https://github.com/omniwired"><img src="https://avatars.githubusercontent.com/u/322761?v=4&s=48" width="48" height="48" alt="Eng. Juan Combetto" title="Eng. Juan Combetto"/></a> <a href="https://github.com/dbhurley"><img src="https://avatars.githubusercontent.com/u/5251425?v=4&s=48" width="48" height="48" alt="dbhurley" title="dbhurley"/></a> <a href="https://github.com/mbelinky"><img src="https://avatars.githubusercontent.com/u/132747814?v=4&s=48" width="48" height="48" alt="Mariano Belinky" title="Mariano Belinky"/></a>
+  <a href="https://github.com/TSavo"><img src="https://avatars.githubusercontent.com/u/877990?v=4&s=48" width="48" height="48" alt="TSavo" title="TSavo"/></a> <a href="https://github.com/julianengel"><img src="https://avatars.githubusercontent.com/u/10634231?v=4&s=48" width="48" height="48" alt="julianengel" title="julianengel"/></a> <a href="https://github.com/benithors"><img src="https://avatars.githubusercontent.com/u/20652882?v=4&s=48" width="48" height="48" alt="benithors" title="benithors"/></a> <a href="https://github.com/bradleypriest"><img src="https://avatars.githubusercontent.com/u/167215?v=4&s=48" width="48" height="48" alt="bradleypriest" title="bradleypriest"/></a> <a href="https://github.com/timolins"><img src="https://avatars.githubusercontent.com/u/1440854?v=4&s=48" width="48" height="48" alt="timolins" title="timolins"/></a> <a href="https://github.com/Nachx639"><img src="https://avatars.githubusercontent.com/u/71144023?v=4&s=48" width="48" height="48" alt="nachx639" title="nachx639"/></a> <a href="https://github.com/sreekaransrinath"><img src="https://avatars.githubusercontent.com/u/50989977?v=4&s=48" width="48" height="48" alt="sreekaransrinath" title="sreekaransrinath"/></a> <a href="https://github.com/gupsammy"><img src="https://avatars.githubusercontent.com/u/20296019?v=4&s=48" width="48" height="48" alt="gupsammy" title="gupsammy"/></a> <a href="https://github.com/cristip73"><img src="https://avatars.githubusercontent.com/u/24499421?v=4&s=48" width="48" height="48" alt="cristip73" title="cristip73"/></a> <a href="https://github.com/nachoiacovino"><img src="https://avatars.githubusercontent.com/u/50103937?v=4&s=48" width="48" height="48" alt="nachoiacovino" title="nachoiacovino"/></a>
+  <a href="https://github.com/vsabavat"><img src="https://avatars.githubusercontent.com/u/50385532?v=4&s=48" width="48" height="48" alt="Vasanth Rao Naik Sabavat" title="Vasanth Rao Naik Sabavat"/></a> <a href="https://github.com/cpojer"><img src="https://avatars.githubusercontent.com/u/13352?v=4&s=48" width="48" height="48" alt="cpojer" title="cpojer"/></a> <a href="https://github.com/lc0rp"><img src="https://avatars.githubusercontent.com/u/2609441?v=4&s=48" width="48" height="48" alt="lc0rp" title="lc0rp"/></a> <a href="https://github.com/scald"><img src="https://avatars.githubusercontent.com/u/1215913?v=4&s=48" width="48" height="48" alt="scald" title="scald"/></a> <a href="https://github.com/gumadeiras"><img src="https://avatars.githubusercontent.com/u/5599352?v=4&s=48" width="48" height="48" alt="gumadeiras" title="gumadeiras"/></a> <a href="https://github.com/andranik-sahakyan"><img src="https://avatars.githubusercontent.com/u/8908029?v=4&s=48" width="48" height="48" alt="andranik-sahakyan" title="andranik-sahakyan"/></a> <a href="https://github.com/davidguttman"><img src="https://avatars.githubusercontent.com/u/431696?v=4&s=48" width="48" height="48" alt="davidguttman" title="davidguttman"/></a> <a href="https://github.com/sleontenko"><img src="https://avatars.githubusercontent.com/u/7135949?v=4&s=48" width="48" height="48" alt="sleontenko" title="sleontenko"/></a> <a href="https://github.com/sircrumpet"><img src="https://avatars.githubusercontent.com/u/4436535?v=4&s=48" width="48" height="48" alt="sircrumpet" title="sircrumpet"/></a> <a href="https://github.com/peschee"><img src="https://avatars.githubusercontent.com/u/63866?v=4&s=48" width="48" height="48" alt="peschee" title="peschee"/></a>
+  <a href="https://github.com/rafaelreis-r"><img src="https://avatars.githubusercontent.com/u/57492577?v=4&s=48" width="48" height="48" alt="rafaelreis-r" title="rafaelreis-r"/></a> <a href="https://github.com/thewilloftheshadow"><img src="https://avatars.githubusercontent.com/u/35580099?v=4&s=48" width="48" height="48" alt="thewilloftheshadow" title="thewilloftheshadow"/></a> <a href="https://github.com/ratulsarna"><img src="https://avatars.githubusercontent.com/u/105903728?v=4&s=48" width="48" height="48" alt="ratulsarna" title="ratulsarna"/></a> <a href="https://github.com/lutr0"><img src="https://avatars.githubusercontent.com/u/76906369?v=4&s=48" width="48" height="48" alt="lutr0" title="lutr0"/></a> <a href="https://github.com/danielz1z"><img src="https://avatars.githubusercontent.com/u/235270390?v=4&s=48" width="48" height="48" alt="danielz1z" title="danielz1z"/></a> <a href="https://github.com/emanuelst"><img src="https://avatars.githubusercontent.com/u/9994339?v=4&s=48" width="48" height="48" alt="emanuelst" title="emanuelst"/></a> <a href="https://github.com/KristijanJovanovski"><img src="https://avatars.githubusercontent.com/u/8942284?v=4&s=48" width="48" height="48" alt="KristijanJovanovski" title="KristijanJovanovski"/></a> <a href="https://github.com/CashWilliams"><img src="https://avatars.githubusercontent.com/u/613573?v=4&s=48" width="48" height="48" alt="CashWilliams" title="CashWilliams"/></a> <a href="https://github.com/rdev"><img src="https://avatars.githubusercontent.com/u/8418866?v=4&s=48" width="48" height="48" alt="rdev" title="rdev"/></a> <a href="https://github.com/osolmaz"><img src="https://avatars.githubusercontent.com/u/2453968?v=4&s=48" width="48" height="48" alt="osolmaz" title="osolmaz"/></a>
+  <a href="https://github.com/joshrad-dev"><img src="https://avatars.githubusercontent.com/u/62785552?v=4&s=48" width="48" height="48" alt="joshrad-dev" title="joshrad-dev"/></a> <a href="https://github.com/kiranjd"><img src="https://avatars.githubusercontent.com/u/25822851?v=4&s=48" width="48" height="48" alt="kiranjd" title="kiranjd"/></a> <a href="https://github.com/adityashaw2"><img src="https://avatars.githubusercontent.com/u/41204444?v=4&s=48" width="48" height="48" alt="adityashaw2" title="adityashaw2"/></a> <a href="https://github.com/search?q=sheeek"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="sheeek" title="sheeek"/></a> <a href="https://github.com/artuskg"><img src="https://avatars.githubusercontent.com/u/11966157?v=4&s=48" width="48" height="48" alt="artuskg" title="artuskg"/></a> <a href="https://github.com/onutc"><img src="https://avatars.githubusercontent.com/u/152018508?v=4&s=48" width="48" height="48" alt="onutc" title="onutc"/></a> <a href="https://github.com/tyler6204"><img src="https://avatars.githubusercontent.com/u/64381258?v=4&s=48" width="48" height="48" alt="tyler6204" title="tyler6204"/></a> <a href="https://github.com/ManuelHettich"><img src="https://avatars.githubusercontent.com/u/17690367?v=4&s=48" width="48" height="48" alt="manuelhettich" title="manuelhettich"/></a> <a href="https://github.com/minghinmatthewlam"><img src="https://avatars.githubusercontent.com/u/14224566?v=4&s=48" width="48" height="48" alt="minghinmatthewlam" title="minghinmatthewlam"/></a> <a href="https://github.com/myfunc"><img src="https://avatars.githubusercontent.com/u/19294627?v=4&s=48" width="48" height="48" alt="myfunc" title="myfunc"/></a>
+  <a href="https://github.com/buddyh"><img src="https://avatars.githubusercontent.com/u/31752869?v=4&s=48" width="48" height="48" alt="buddyh" title="buddyh"/></a> <a href="https://github.com/connorshea"><img src="https://avatars.githubusercontent.com/u/2977353?v=4&s=48" width="48" height="48" alt="connorshea" title="connorshea"/></a> <a href="https://github.com/mcinteerj"><img src="https://avatars.githubusercontent.com/u/3613653?v=4&s=48" width="48" height="48" alt="mcinteerj" title="mcinteerj"/></a> <a href="https://github.com/John-Rood"><img src="https://avatars.githubusercontent.com/u/62669593?v=4&s=48" width="48" height="48" alt="John-Rood" title="John-Rood"/></a> <a href="https://github.com/timkrase"><img src="https://avatars.githubusercontent.com/u/38947626?v=4&s=48" width="48" height="48" alt="timkrase" title="timkrase"/></a> <a href="https://github.com/zerone0x"><img src="https://avatars.githubusercontent.com/u/39543393?v=4&s=48" width="48" height="48" alt="zerone0x" title="zerone0x"/></a> <a href="https://github.com/gerardward2007"><img src="https://avatars.githubusercontent.com/u/3002155?v=4&s=48" width="48" height="48" alt="gerardward2007" title="gerardward2007"/></a> <a href="https://github.com/obviyus"><img src="https://avatars.githubusercontent.com/u/22031114?v=4&s=48" width="48" height="48" alt="obviyus" title="obviyus"/></a> <a href="https://github.com/tosh-hamburg"><img src="https://avatars.githubusercontent.com/u/58424326?v=4&s=48" width="48" height="48" alt="tosh-hamburg" title="tosh-hamburg"/></a> <a href="https://github.com/azade-c"><img src="https://avatars.githubusercontent.com/u/252790079?v=4&s=48" width="48" height="48" alt="azade-c" title="azade-c"/></a>
+  <a href="https://github.com/roshanasingh4"><img src="https://avatars.githubusercontent.com/u/88576930?v=4&s=48" width="48" height="48" alt="roshanasingh4" title="roshanasingh4"/></a> <a href="https://github.com/bjesuiter"><img src="https://avatars.githubusercontent.com/u/2365676?v=4&s=48" width="48" height="48" alt="bjesuiter" title="bjesuiter"/></a> <a href="https://github.com/cheeeee"><img src="https://avatars.githubusercontent.com/u/21245729?v=4&s=48" width="48" height="48" alt="cheeeee" title="cheeeee"/></a> <a href="https://github.com/j1philli"><img src="https://avatars.githubusercontent.com/u/3744255?v=4&s=48" width="48" height="48" alt="Josh Phillips" title="Josh Phillips"/></a> <a href="https://github.com/Whoaa512"><img src="https://avatars.githubusercontent.com/u/1581943?v=4&s=48" width="48" height="48" alt="Whoaa512" title="Whoaa512"/></a> <a href="https://github.com/YuriNachos"><img src="https://avatars.githubusercontent.com/u/19365375?v=4&s=48" width="48" height="48" alt="YuriNachos" title="YuriNachos"/></a> <a href="https://github.com/chriseidhof"><img src="https://avatars.githubusercontent.com/u/5382?v=4&s=48" width="48" height="48" alt="chriseidhof" title="chriseidhof"/></a> <a href="https://github.com/vignesh07"><img src="https://avatars.githubusercontent.com/u/1436853?v=4&s=48" width="48" height="48" alt="vignesh07" title="vignesh07"/></a> <a href="https://github.com/ysqander"><img src="https://avatars.githubusercontent.com/u/80843820?v=4&s=48" width="48" height="48" alt="ysqander" title="ysqander"/></a> <a href="https://github.com/superman32432432"><img src="https://avatars.githubusercontent.com/u/7228420?v=4&s=48" width="48" height="48" alt="superman32432432" title="superman32432432"/></a>
+  <a href="https://github.com/search?q=Yurii%20Chukhlib"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Yurii Chukhlib" title="Yurii Chukhlib"/></a> <a href="https://github.com/grp06"><img src="https://avatars.githubusercontent.com/u/1573959?v=4&s=48" width="48" height="48" alt="grp06" title="grp06"/></a> <a href="https://github.com/antons"><img src="https://avatars.githubusercontent.com/u/129705?v=4&s=48" width="48" height="48" alt="antons" title="antons"/></a> <a href="https://github.com/austinm911"><img src="https://avatars.githubusercontent.com/u/31991302?v=4&s=48" width="48" height="48" alt="austinm911" title="austinm911"/></a> <a href="https://github.com/apps/blacksmith-sh"><img src="https://avatars.githubusercontent.com/in/807020?v=4&s=48" width="48" height="48" alt="blacksmith-sh[bot]" title="blacksmith-sh[bot]"/></a> <a href="https://github.com/dan-dr"><img src="https://avatars.githubusercontent.com/u/6669808?v=4&s=48" width="48" height="48" alt="dan-dr" title="dan-dr"/></a> <a href="https://github.com/HeimdallStrategy"><img src="https://avatars.githubusercontent.com/u/223014405?v=4&s=48" width="48" height="48" alt="HeimdallStrategy" title="HeimdallStrategy"/></a> <a href="https://github.com/imfing"><img src="https://avatars.githubusercontent.com/u/5097752?v=4&s=48" width="48" height="48" alt="imfing" title="imfing"/></a> <a href="https://github.com/jalehman"><img src="https://avatars.githubusercontent.com/u/550978?v=4&s=48" width="48" height="48" alt="jalehman" title="jalehman"/></a> <a href="https://github.com/jarvis-medmatic"><img src="https://avatars.githubusercontent.com/u/252428873?v=4&s=48" width="48" height="48" alt="jarvis-medmatic" title="jarvis-medmatic"/></a>
+  <a href="https://github.com/kkarimi"><img src="https://avatars.githubusercontent.com/u/875218?v=4&s=48" width="48" height="48" alt="kkarimi" title="kkarimi"/></a> <a href="https://github.com/mahmoudashraf93"><img src="https://avatars.githubusercontent.com/u/9130129?v=4&s=48" width="48" height="48" alt="mahmoudashraf93" title="mahmoudashraf93"/></a> <a href="https://github.com/petter-b"><img src="https://avatars.githubusercontent.com/u/62076402?v=4&s=48" width="48" height="48" alt="petter-b" title="petter-b"/></a> <a href="https://github.com/pkrmf"><img src="https://avatars.githubusercontent.com/u/1714267?v=4&s=48" width="48" height="48" alt="pkrmf" title="pkrmf"/></a> <a href="https://github.com/RandyVentures"><img src="https://avatars.githubusercontent.com/u/149904821?v=4&s=48" width="48" height="48" alt="RandyVentures" title="RandyVentures"/></a> <a href="https://github.com/search?q=Ryan%20Lisse"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ryan Lisse" title="Ryan Lisse"/></a> <a href="https://github.com/dougvk"><img src="https://avatars.githubusercontent.com/u/401660?v=4&s=48" width="48" height="48" alt="dougvk" title="dougvk"/></a> <a href="https://github.com/erikpr1994"><img src="https://avatars.githubusercontent.com/u/6299331?v=4&s=48" width="48" height="48" alt="erikpr1994" title="erikpr1994"/></a> <a href="https://github.com/search?q=Ghost"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ghost" title="Ghost"/></a> <a href="https://github.com/jonasjancarik"><img src="https://avatars.githubusercontent.com/u/2459191?v=4&s=48" width="48" height="48" alt="jonasjancarik" title="jonasjancarik"/></a>
+  <a href="https://github.com/search?q=Keith%20the%20Silly%20Goose"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Keith the Silly Goose" title="Keith the Silly Goose"/></a> <a href="https://github.com/search?q=L36%20Server"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="L36 Server" title="L36 Server"/></a> <a href="https://github.com/search?q=Marc"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Marc" title="Marc"/></a> <a href="https://github.com/mitschabaude-bot"><img src="https://avatars.githubusercontent.com/u/247582884?v=4&s=48" width="48" height="48" alt="mitschabaude-bot" title="mitschabaude-bot"/></a> <a href="https://github.com/neist"><img src="https://avatars.githubusercontent.com/u/1029724?v=4&s=48" width="48" height="48" alt="neist" title="neist"/></a> <a href="https://github.com/ngutman"><img src="https://avatars.githubusercontent.com/u/1540134?v=4&s=48" width="48" height="48" alt="ngutman" title="ngutman"/></a> <a href="https://github.com/chrisrodz"><img src="https://avatars.githubusercontent.com/u/2967620?v=4&s=48" width="48" height="48" alt="chrisrodz" title="chrisrodz"/></a> <a href="https://github.com/search?q=Friederike%20Seiler"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Friederike Seiler" title="Friederike Seiler"/></a> <a href="https://github.com/gabriel-trigo"><img src="https://avatars.githubusercontent.com/u/38991125?v=4&s=48" width="48" height="48" alt="gabriel-trigo" title="gabriel-trigo"/></a> <a href="https://github.com/Iamadig"><img src="https://avatars.githubusercontent.com/u/102129234?v=4&s=48" width="48" height="48" alt="iamadig" title="iamadig"/></a>
+  <a href="https://github.com/search?q=Kit"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kit" title="Kit"/></a> <a href="https://github.com/koala73"><img src="https://avatars.githubusercontent.com/u/996596?v=4&s=48" width="48" height="48" alt="koala73" title="koala73"/></a> <a href="https://github.com/manmal"><img src="https://avatars.githubusercontent.com/u/142797?v=4&s=48" width="48" height="48" alt="manmal" title="manmal"/></a> <a href="https://github.com/ogulcancelik"><img src="https://avatars.githubusercontent.com/u/7064011?v=4&s=48" width="48" height="48" alt="ogulcancelik" title="ogulcancelik"/></a> <a href="https://github.com/pasogott"><img src="https://avatars.githubusercontent.com/u/23458152?v=4&s=48" width="48" height="48" alt="pasogott" title="pasogott"/></a> <a href="https://github.com/petradonka"><img src="https://avatars.githubusercontent.com/u/7353770?v=4&s=48" width="48" height="48" alt="petradonka" title="petradonka"/></a> <a href="https://github.com/rubyrunsstuff"><img src="https://avatars.githubusercontent.com/u/246602379?v=4&s=48" width="48" height="48" alt="rubyrunsstuff" title="rubyrunsstuff"/></a> <a href="https://github.com/sibbl"><img src="https://avatars.githubusercontent.com/u/866535?v=4&s=48" width="48" height="48" alt="sibbl" title="sibbl"/></a> <a href="https://github.com/suminhthanh"><img src="https://avatars.githubusercontent.com/u/2907636?v=4&s=48" width="48" height="48" alt="suminhthanh" title="suminhthanh"/></a> <a href="https://github.com/VACInc"><img src="https://avatars.githubusercontent.com/u/3279061?v=4&s=48" width="48" height="48" alt="VACInc" title="VACInc"/></a>
+  <a href="https://github.com/wes-davis"><img src="https://avatars.githubusercontent.com/u/16506720?v=4&s=48" width="48" height="48" alt="wes-davis" title="wes-davis"/></a> <a href="https://github.com/zats"><img src="https://avatars.githubusercontent.com/u/2688806?v=4&s=48" width="48" height="48" alt="zats" title="zats"/></a> <a href="https://github.com/24601"><img src="https://avatars.githubusercontent.com/u/1157207?v=4&s=48" width="48" height="48" alt="24601" title="24601"/></a> <a href="https://github.com/search?q=Chris%20Taylor"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Chris Taylor" title="Chris Taylor"/></a> <a href="https://github.com/djangonavarro220"><img src="https://avatars.githubusercontent.com/u/251162586?v=4&s=48" width="48" height="48" alt="Django Navarro" title="Django Navarro"/></a> <a href="https://github.com/evalexpr"><img src="https://avatars.githubusercontent.com/u/23485511?v=4&s=48" width="48" height="48" alt="evalexpr" title="evalexpr"/></a> <a href="https://github.com/henrino3"><img src="https://avatars.githubusercontent.com/u/4260288?v=4&s=48" width="48" height="48" alt="henrino3" title="henrino3"/></a> <a href="https://github.com/humanwritten"><img src="https://avatars.githubusercontent.com/u/206531610?v=4&s=48" width="48" height="48" alt="humanwritten" title="humanwritten"/></a> <a href="https://github.com/larlyssa"><img src="https://avatars.githubusercontent.com/u/13128869?v=4&s=48" width="48" height="48" alt="larlyssa" title="larlyssa"/></a> <a href="https://github.com/mkbehr"><img src="https://avatars.githubusercontent.com/u/1285?v=4&s=48" width="48" height="48" alt="mkbehr" title="mkbehr"/></a>
+  <a href="https://github.com/oswalpalash"><img src="https://avatars.githubusercontent.com/u/6431196?v=4&s=48" width="48" height="48" alt="oswalpalash" title="oswalpalash"/></a> <a href="https://github.com/pcty-nextgen-service-account"><img src="https://avatars.githubusercontent.com/u/112553441?v=4&s=48" width="48" height="48" alt="pcty-nextgen-service-account" title="pcty-nextgen-service-account"/></a> <a href="https://github.com/Syhids"><img src="https://avatars.githubusercontent.com/u/671202?v=4&s=48" width="48" height="48" alt="Syhids" title="Syhids"/></a> <a href="https://github.com/search?q=Aaron%20Konyer"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Aaron Konyer" title="Aaron Konyer"/></a> <a href="https://github.com/aaronveklabs"><img src="https://avatars.githubusercontent.com/u/225997828?v=4&s=48" width="48" height="48" alt="aaronveklabs" title="aaronveklabs"/></a> <a href="https://github.com/adam91holt"><img src="https://avatars.githubusercontent.com/u/9592417?v=4&s=48" width="48" height="48" alt="adam91holt" title="adam91holt"/></a> <a href="https://github.com/search?q=ClawdFx"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ClawdFx" title="ClawdFx"/></a> <a href="https://github.com/erik-agens"><img src="https://avatars.githubusercontent.com/u/80908960?v=4&s=48" width="48" height="48" alt="erik-agens" title="erik-agens"/></a> <a href="https://github.com/fcatuhe"><img src="https://avatars.githubusercontent.com/u/17382215?v=4&s=48" width="48" height="48" alt="fcatuhe" title="fcatuhe"/></a> <a href="https://github.com/ivanrvpereira"><img src="https://avatars.githubusercontent.com/u/183991?v=4&s=48" width="48" height="48" alt="ivanrvpereira" title="ivanrvpereira"/></a>
+  <a href="https://github.com/jayhickey"><img src="https://avatars.githubusercontent.com/u/1676460?v=4&s=48" width="48" height="48" alt="jayhickey" title="jayhickey"/></a> <a href="https://github.com/jeffersonwarrior"><img src="https://avatars.githubusercontent.com/u/89030989?v=4&s=48" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/search?q=jeffersonwarrior"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="jeffersonwarrior" title="jeffersonwarrior"/></a> <a href="https://github.com/jdrhyne"><img src="https://avatars.githubusercontent.com/u/7828464?v=4&s=48" width="48" height="48" alt="Jonathan D. Rhyne (DJ-D)" title="Jonathan D. Rhyne (DJ-D)"/></a> <a href="https://github.com/jverdi"><img src="https://avatars.githubusercontent.com/u/345050?v=4&s=48" width="48" height="48" alt="jverdi" title="jverdi"/></a> <a href="https://github.com/longmaba"><img src="https://avatars.githubusercontent.com/u/9361500?v=4&s=48" width="48" height="48" alt="longmaba" title="longmaba"/></a> <a href="https://github.com/mickahouan"><img src="https://avatars.githubusercontent.com/u/31423109?v=4&s=48" width="48" height="48" alt="mickahouan" title="mickahouan"/></a> <a href="https://github.com/mjrussell"><img src="https://avatars.githubusercontent.com/u/1641895?v=4&s=48" width="48" height="48" alt="mjrussell" title="mjrussell"/></a> <a href="https://github.com/p6l-richard"><img src="https://avatars.githubusercontent.com/u/18185649?v=4&s=48" width="48" height="48" alt="p6l-richard" title="p6l-richard"/></a> <a href="https://github.com/philipp-spiess"><img src="https://avatars.githubusercontent.com/u/458591?v=4&s=48" width="48" height="48" alt="philipp-spiess" title="philipp-spiess"/></a>
+  <a href="https://github.com/robaxelsen"><img src="https://avatars.githubusercontent.com/u/13132899?v=4&s=48" width="48" height="48" alt="robaxelsen" title="robaxelsen"/></a> <a href="https://github.com/search?q=Sash%20Catanzarite"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Sash Catanzarite" title="Sash Catanzarite"/></a> <a href="https://github.com/T5-AndyML"><img src="https://avatars.githubusercontent.com/u/22801233?v=4&s=48" width="48" height="48" alt="T5-AndyML" title="T5-AndyML"/></a> <a href="https://github.com/search?q=VAC"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="VAC" title="VAC"/></a> <a href="https://github.com/zknicker"><img src="https://avatars.githubusercontent.com/u/1164085?v=4&s=48" width="48" height="48" alt="zknicker" title="zknicker"/></a> <a href="https://github.com/search?q=alejandro%20maza"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="alejandro maza" title="alejandro maza"/></a> <a href="https://github.com/ameno-"><img src="https://avatars.githubusercontent.com/u/2416135?v=4&s=48" width="48" height="48" alt="ameno-" title="ameno-"/></a> <a href="https://github.com/andrewting19"><img src="https://avatars.githubusercontent.com/u/10536704?v=4&s=48" width="48" height="48" alt="andrewting19" title="andrewting19"/></a> <a href="https://github.com/anpoirier"><img src="https://avatars.githubusercontent.com/u/1245729?v=4&s=48" width="48" height="48" alt="anpoirier" title="anpoirier"/></a> <a href="https://github.com/Asleep123"><img src="https://avatars.githubusercontent.com/u/122379135?v=4&s=48" width="48" height="48" alt="Asleep123" title="Asleep123"/></a>
+  <a href="https://github.com/bolismauro"><img src="https://avatars.githubusercontent.com/u/771999?v=4&s=48" width="48" height="48" alt="bolismauro" title="bolismauro"/></a> <a href="https://github.com/cash-echo-bot"><img src="https://avatars.githubusercontent.com/u/252747386?v=4&s=48" width="48" height="48" alt="cash-echo-bot" title="cash-echo-bot"/></a> <a href="https://github.com/search?q=Clawd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Clawd" title="Clawd"/></a> <a href="https://github.com/conhecendocontato"><img src="https://avatars.githubusercontent.com/u/82890727?v=4&s=48" width="48" height="48" alt="conhecendocontato" title="conhecendocontato"/></a> <a href="https://github.com/search?q=Dimitrios%20Ploutarchos"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Dimitrios Ploutarchos" title="Dimitrios Ploutarchos"/></a> <a href="https://github.com/search?q=Drake%20Thomsen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Drake Thomsen" title="Drake Thomsen"/></a> <a href="https://github.com/search?q=Felix%20Krause"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Felix Krause" title="Felix Krause"/></a> <a href="https://github.com/gtsifrikas"><img src="https://avatars.githubusercontent.com/u/8904378?v=4&s=48" width="48" height="48" alt="gtsifrikas" title="gtsifrikas"/></a> <a href="https://github.com/HazAT"><img src="https://avatars.githubusercontent.com/u/363802?v=4&s=48" width="48" height="48" alt="HazAT" title="HazAT"/></a> <a href="https://github.com/hrdwdmrbl"><img src="https://avatars.githubusercontent.com/u/554881?v=4&s=48" width="48" height="48" alt="hrdwdmrbl" title="hrdwdmrbl"/></a>
+  <a href="https://github.com/hugobarauna"><img src="https://avatars.githubusercontent.com/u/2719?v=4&s=48" width="48" height="48" alt="hugobarauna" title="hugobarauna"/></a> <a href="https://github.com/search?q=Jamie%20Openshaw"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jamie Openshaw" title="Jamie Openshaw"/></a> <a href="https://github.com/search?q=Jarvis"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jarvis" title="Jarvis"/></a> <a href="https://github.com/search?q=Jefferson%20Nunn"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Jefferson Nunn" title="Jefferson Nunn"/></a> <a href="https://github.com/search?q=Kevin%20Lin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Kevin Lin" title="Kevin Lin"/></a> <a href="https://github.com/kitze"><img src="https://avatars.githubusercontent.com/u/1160594?v=4&s=48" width="48" height="48" alt="kitze" title="kitze"/></a> <a href="https://github.com/levifig"><img src="https://avatars.githubusercontent.com/u/1605?v=4&s=48" width="48" height="48" alt="levifig" title="levifig"/></a> <a href="https://github.com/search?q=Lloyd"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Lloyd" title="Lloyd"/></a> <a href="https://github.com/loukotal"><img src="https://avatars.githubusercontent.com/u/18210858?v=4&s=48" width="48" height="48" alt="loukotal" title="loukotal"/></a> <a href="https://github.com/martinpucik"><img src="https://avatars.githubusercontent.com/u/5503097?v=4&s=48" width="48" height="48" alt="martinpucik" title="martinpucik"/></a>
+  <a href="https://github.com/search?q=Miles"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Miles" title="Miles"/></a> <a href="https://github.com/mrdbstn"><img src="https://avatars.githubusercontent.com/u/58957632?v=4&s=48" width="48" height="48" alt="mrdbstn" title="mrdbstn"/></a> <a href="https://github.com/MSch"><img src="https://avatars.githubusercontent.com/u/7475?v=4&s=48" width="48" height="48" alt="MSch" title="MSch"/></a> <a href="https://github.com/search?q=Mustafa%20Tag%20Eldeen"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mustafa Tag Eldeen" title="Mustafa Tag Eldeen"/></a> <a href="https://github.com/ndraiman"><img src="https://avatars.githubusercontent.com/u/12609607?v=4&s=48" width="48" height="48" alt="ndraiman" title="ndraiman"/></a> <a href="https://github.com/nexty5870"><img src="https://avatars.githubusercontent.com/u/3869659?v=4&s=48" width="48" height="48" alt="nexty5870" title="nexty5870"/></a> <a href="https://github.com/odysseus0"><img src="https://avatars.githubusercontent.com/u/8635094?v=4&s=48" width="48" height="48" alt="odysseus0" title="odysseus0"/></a> <a href="https://github.com/prathamdby"><img src="https://avatars.githubusercontent.com/u/134331217?v=4&s=48" width="48" height="48" alt="prathamdby" title="prathamdby"/></a> <a href="https://github.com/reeltimeapps"><img src="https://avatars.githubusercontent.com/u/637338?v=4&s=48" width="48" height="48" alt="reeltimeapps" title="reeltimeapps"/></a> <a href="https://github.com/RLTCmpe"><img src="https://avatars.githubusercontent.com/u/10762242?v=4&s=48" width="48" height="48" alt="RLTCmpe" title="RLTCmpe"/></a>
+  <a href="https://github.com/rodrigouroz"><img src="https://avatars.githubusercontent.com/u/384037?v=4&s=48" width="48" height="48" alt="rodrigouroz" title="rodrigouroz"/></a> <a href="https://github.com/search?q=Rolf%20Fredheim"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rolf Fredheim" title="Rolf Fredheim"/></a> <a href="https://github.com/search?q=Rony%20Kelner"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Rony Kelner" title="Rony Kelner"/></a> <a href="https://github.com/search?q=Samrat%20Jha"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Samrat Jha" title="Samrat Jha"/></a> <a href="https://github.com/siraht"><img src="https://avatars.githubusercontent.com/u/73152895?v=4&s=48" width="48" height="48" alt="siraht" title="siraht"/></a> <a href="https://github.com/snopoke"><img src="https://avatars.githubusercontent.com/u/249606?v=4&s=48" width="48" height="48" alt="snopoke" title="snopoke"/></a> <a href="https://github.com/search?q=The%20Admiral"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="The Admiral" title="The Admiral"/></a> <a href="https://github.com/thesash"><img src="https://avatars.githubusercontent.com/u/1166151?v=4&s=48" width="48" height="48" alt="thesash" title="thesash"/></a> <a href="https://github.com/search?q=Ubuntu"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Ubuntu" title="Ubuntu"/></a> <a href="https://github.com/voidserf"><img src="https://avatars.githubusercontent.com/u/477673?v=4&s=48" width="48" height="48" alt="voidserf" title="voidserf"/></a>
+  <a href="https://github.com/wstock"><img src="https://avatars.githubusercontent.com/u/1394687?v=4&s=48" width="48" height="48" alt="wstock" title="wstock"/></a> <a href="https://github.com/search?q=Zach%20Knickerbocker"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Zach Knickerbocker" title="Zach Knickerbocker"/></a> <a href="https://github.com/Alphonse-arianee"><img src="https://avatars.githubusercontent.com/u/254457365?v=4&s=48" width="48" height="48" alt="Alphonse-arianee" title="Alphonse-arianee"/></a> <a href="https://github.com/search?q=Azade"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Azade" title="Azade"/></a> <a href="https://github.com/carlulsoe"><img src="https://avatars.githubusercontent.com/u/34673973?v=4&s=48" width="48" height="48" alt="carlulsoe" title="carlulsoe"/></a> <a href="https://github.com/search?q=ddyo"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="ddyo" title="ddyo"/></a> <a href="https://github.com/search?q=Erik"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Erik" title="Erik"/></a> <a href="https://github.com/latitudeki5223"><img src="https://avatars.githubusercontent.com/u/119656367?v=4&s=48" width="48" height="48" alt="latitudeki5223" title="latitudeki5223"/></a> <a href="https://github.com/search?q=Manuel%20Maly"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Manuel Maly" title="Manuel Maly"/></a> <a href="https://github.com/search?q=Mourad%20Boustani"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Mourad Boustani" title="Mourad Boustani"/></a>
+  <a href="https://github.com/odrobnik"><img src="https://avatars.githubusercontent.com/u/333270?v=4&s=48" width="48" height="48" alt="odrobnik" title="odrobnik"/></a> <a href="https://github.com/pcty-nextgen-ios-builder"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="pcty-nextgen-ios-builder" title="pcty-nextgen-ios-builder"/></a> <a href="https://github.com/search?q=Quentin"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Quentin" title="Quentin"/></a> <a href="https://github.com/search?q=Randy%20Torres"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="Randy Torres" title="Randy Torres"/></a> <a href="https://github.com/rhjoh"><img src="https://avatars.githubusercontent.com/u/105699450?v=4&s=48" width="48" height="48" alt="rhjoh" title="rhjoh"/></a> <a href="https://github.com/ronak-guliani"><img src="https://avatars.githubusercontent.com/u/23518228?v=4&s=48" width="48" height="48" alt="ronak-guliani" title="ronak-guliani"/></a> <a href="https://github.com/search?q=William%20Stock"><img src="assets/avatar-placeholder.svg" width="48" height="48" alt="William Stock" title="William Stock"/></a>
 </p>

apps/android/app/src/main/java/com/clawdbot/android/NodeRuntime.kt

@@ -529,7 +529,7 @@ class NodeRuntime(context: Context) {
       caps = buildCapabilities(),
       commands = buildInvokeCommands(),
       permissions = emptyMap(),
-      client = buildClientInfo(clientId = "node-host", clientMode = "node"),
+      client = buildClientInfo(clientId = "clawdbot-android", clientMode = "node"),
       userAgent = buildUserAgent(),
     )
   }

apps/ios/Sources/Voice/TalkModeManager.swift

@@ -132,6 +132,12 @@ final class TalkModeManager: NSObject {
     }
 
     private func startRecognition() throws {
+        #if targetEnvironment(simulator)
+            throw NSError(domain: "TalkMode", code: 2, userInfo: [
+                NSLocalizedDescriptionKey: "Talk mode is not supported on the iOS simulator",
+            ])
+        #endif
+
         self.stopRecognition()
         self.speechRecognizer = SFSpeechRecognizer()
         guard let recognizer = self.speechRecognizer else {
@@ -146,6 +152,11 @@ final class TalkModeManager: NSObject {
 
         let input = self.audioEngine.inputNode
         let format = input.outputFormat(forBus: 0)
+        guard format.sampleRate > 0, format.channelCount > 0 else {
+            throw NSError(domain: "TalkMode", code: 3, userInfo: [
+                NSLocalizedDescriptionKey: "Invalid audio input format",
+            ])
+        }
         input.removeTap(onBus: 0)
         let tapBlock = Self.makeAudioTapAppendCallback(request: request)
         input.installTap(onBus: 0, bufferSize: 2048, format: format, block: tapBlock)

apps/macos/Sources/Clawdbot/ConfigSettings.swift

@@ -6,15 +6,19 @@ struct ConfigSettings: View {
     private let isNixMode = ProcessInfo.processInfo.isNixMode
     @Bindable var store: ChannelsStore
     @State private var hasLoaded = false
+    @State private var activeSectionKey: String?
+    @State private var activeSubsection: SubsectionSelection?
 
     init(store: ChannelsStore = .shared) {
         self.store = store
     }
 
     var body: some View {
-        ScrollView {
-            self.content
+        HStack(spacing: 16) {
+            self.sidebar
+            self.detail
         }
+        .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
         .task {
             guard !self.hasLoaded else { return }
             guard !self.isPreview else { return }
@@ -22,42 +26,125 @@ struct ConfigSettings: View {
             await self.store.loadConfigSchema()
             await self.store.loadConfig()
         }
+        .onAppear { self.ensureSelection() }
+        .onChange(of: self.store.configSchemaLoading) { _, loading in
+            if !loading { self.ensureSelection() }
+        }
     }
 }
 
 extension ConfigSettings {
-    private var content: some View {
-        VStack(alignment: .leading, spacing: 16) {
-            self.header
-            if let status = self.store.configStatus {
-                Text(status)
-                    .font(.callout)
-                    .foregroundStyle(.secondary)
-            }
-            self.actionRow
-            Group {
-                if self.store.configSchemaLoading {
-                    ProgressView().controlSize(.small)
-                } else if let schema = self.store.configSchema {
-                    ConfigSchemaForm(store: self.store, schema: schema, path: [])
-                        .disabled(self.isNixMode)
-                } else {
-                    Text("Schema unavailable.")
+    private enum SubsectionSelection: Hashable {
+        case all
+        case key(String)
+    }
+
+    private struct ConfigSection: Identifiable {
+        let key: String
+        let label: String
+        let help: String?
+        let node: ConfigSchemaNode
+
+        var id: String { self.key }
+    }
+
+    private struct ConfigSubsection: Identifiable {
+        let key: String
+        let label: String
+        let help: String?
+        let node: ConfigSchemaNode
+        let path: ConfigPath
+
+        var id: String { self.key }
+    }
+
+    private var sections: [ConfigSection] {
+        guard let schema = self.store.configSchema else { return [] }
+        return self.resolveSections(schema)
+    }
+
+    private var activeSection: ConfigSection? {
+        self.sections.first { $0.key == self.activeSectionKey }
+    }
+
+    private var sidebar: some View {
+        ScrollView {
+            LazyVStack(alignment: .leading, spacing: 8) {
+                if self.sections.isEmpty {
+                    Text("No config sections available.")
                         .font(.caption)
                         .foregroundStyle(.secondary)
+                        .padding(.horizontal, 6)
+                        .padding(.vertical, 4)
+                } else {
+                    ForEach(self.sections) { section in
+                        self.sidebarRow(section)
+                    }
                 }
             }
-            if self.store.configDirty, !self.isNixMode {
-                Text("Unsaved changes")
+            .padding(.vertical, 10)
+            .padding(.horizontal, 10)
+        }
+        .frame(minWidth: 220, idealWidth: 240, maxWidth: 280, maxHeight: .infinity, alignment: .topLeading)
+        .background(
+            RoundedRectangle(cornerRadius: 12, style: .continuous)
+                .fill(Color(nsColor: .windowBackgroundColor)))
+        .clipShape(RoundedRectangle(cornerRadius: 12, style: .continuous))
+    }
+
+    private var detail: some View {
+        VStack(alignment: .leading, spacing: 16) {
+            if self.store.configSchemaLoading {
+                ProgressView().controlSize(.small)
+            } else if let section = self.activeSection {
+                self.sectionDetail(section)
+            } else if self.store.configSchema != nil {
+                self.emptyDetail
+            } else {
+                Text("Schema unavailable.")
                     .font(.caption)
                     .foregroundStyle(.secondary)
             }
-            Spacer(minLength: 0)
         }
-        .frame(maxWidth: .infinity, alignment: .leading)
+        .frame(minWidth: 460, maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
+    }
+
+    private var emptyDetail: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            self.header
+            Text("Select a config section to view settings.")
+                .font(.callout)
+                .foregroundStyle(.secondary)
+        }
         .padding(.horizontal, 24)
         .padding(.vertical, 18)
-        .groupBoxStyle(PlainSettingsGroupBoxStyle())
+    }
+
+    private func sectionDetail(_ section: ConfigSection) -> some View {
+        ScrollView(.vertical) {
+            VStack(alignment: .leading, spacing: 16) {
+                self.header
+                if let status = self.store.configStatus {
+                    Text(status)
+                        .font(.callout)
+                        .foregroundStyle(.secondary)
+                }
+                self.actionRow
+                self.sectionHeader(section)
+                self.subsectionNav(section)
+                self.sectionForm(section)
+                if self.store.configDirty, !self.isNixMode {
+                    Text("Unsaved changes")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                Spacer(minLength: 0)
+            }
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .padding(.horizontal, 24)
+            .padding(.vertical, 18)
+            .groupBoxStyle(PlainSettingsGroupBoxStyle())
+        }
     }
 
     @ViewBuilder
@@ -71,6 +158,18 @@ extension ConfigSettings {
             .foregroundStyle(.secondary)
     }
 
+    private func sectionHeader(_ section: ConfigSection) -> some View {
+        VStack(alignment: .leading, spacing: 6) {
+            Text(section.label)
+                .font(.title3.weight(.semibold))
+            if let help = section.help {
+                Text(help)
+                    .font(.callout)
+                    .foregroundStyle(.secondary)
+            }
+        }
+    }
+
     private var actionRow: some View {
         HStack(spacing: 10) {
             Button("Reload") {
@@ -85,6 +184,204 @@ extension ConfigSettings {
         }
         .buttonStyle(.bordered)
     }
+
+    private func sidebarRow(_ section: ConfigSection) -> some View {
+        let isSelected = self.activeSectionKey == section.key
+        return Button {
+            self.selectSection(section)
+        } label: {
+            VStack(alignment: .leading, spacing: 2) {
+                Text(section.label)
+                if let help = section.help {
+                    Text(help)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(2)
+                }
+            }
+            .padding(.vertical, 6)
+            .padding(.horizontal, 8)
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .background(isSelected ? Color.accentColor.opacity(0.18) : Color.clear)
+            .clipShape(RoundedRectangle(cornerRadius: 10, style: .continuous))
+            .background(Color.clear)
+            .contentShape(Rectangle())
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .buttonStyle(.plain)
+        .contentShape(Rectangle())
+    }
+
+    @ViewBuilder
+    private func subsectionNav(_ section: ConfigSection) -> some View {
+        let subsections = self.resolveSubsections(for: section)
+        if subsections.isEmpty {
+            EmptyView()
+        } else {
+            ScrollView(.horizontal, showsIndicators: false) {
+                HStack(spacing: 8) {
+                    self.subsectionButton(
+                        title: "All",
+                        isSelected: self.activeSubsection == .all)
+                    {
+                        self.activeSubsection = .all
+                    }
+                    ForEach(subsections) { subsection in
+                        self.subsectionButton(
+                            title: subsection.label,
+                            isSelected: self.activeSubsection == .key(subsection.key))
+                        {
+                            self.activeSubsection = .key(subsection.key)
+                        }
+                    }
+                }
+                .padding(.vertical, 2)
+            }
+        }
+    }
+
+    private func subsectionButton(
+        title: String,
+        isSelected: Bool,
+        action: @escaping () -> Void) -> some View
+    {
+        Button(action: action) {
+            Text(title)
+                .font(.callout.weight(.semibold))
+                .foregroundStyle(isSelected ? Color.accentColor : .primary)
+                .padding(.horizontal, 10)
+                .padding(.vertical, 6)
+                .background(isSelected ? Color.accentColor.opacity(0.18) : Color(nsColor: .controlBackgroundColor))
+                .clipShape(Capsule())
+        }
+        .buttonStyle(.plain)
+    }
+
+    private func sectionForm(_ section: ConfigSection) -> some View {
+        let subsection = self.activeSubsection
+        let defaultPath: ConfigPath = [.key(section.key)]
+        let subsections = self.resolveSubsections(for: section)
+        let resolved: (ConfigSchemaNode, ConfigPath) = {
+            if case let .key(key) = subsection,
+               let match = subsections.first(where: { $0.key == key })
+            {
+                return (match.node, match.path)
+            }
+            return (self.resolvedSchemaNode(section.node), defaultPath)
+        }()
+
+        return ConfigSchemaForm(store: self.store, schema: resolved.0, path: resolved.1)
+            .disabled(self.isNixMode)
+    }
+
+    private func ensureSelection() {
+        guard let schema = self.store.configSchema else { return }
+        let sections = self.resolveSections(schema)
+        guard !sections.isEmpty else { return }
+
+        let active = sections.first { $0.key == self.activeSectionKey } ?? sections[0]
+        if self.activeSectionKey != active.key {
+            self.activeSectionKey = active.key
+        }
+        self.ensureSubsection(for: active)
+    }
+
+    private func ensureSubsection(for section: ConfigSection) {
+        let subsections = self.resolveSubsections(for: section)
+        guard !subsections.isEmpty else {
+            self.activeSubsection = nil
+            return
+        }
+
+        switch self.activeSubsection {
+        case .all:
+            return
+        case let .key(key):
+            if subsections.contains(where: { $0.key == key }) { return }
+        case .none:
+            break
+        }
+
+        if let first = subsections.first {
+            self.activeSubsection = .key(first.key)
+        }
+    }
+
+    private func selectSection(_ section: ConfigSection) {
+        guard self.activeSectionKey != section.key else { return }
+        self.activeSectionKey = section.key
+        let subsections = self.resolveSubsections(for: section)
+        if let first = subsections.first {
+            self.activeSubsection = .key(first.key)
+        } else {
+            self.activeSubsection = nil
+        }
+    }
+
+    private func resolveSections(_ root: ConfigSchemaNode) -> [ConfigSection] {
+        let node = self.resolvedSchemaNode(root)
+        let hints = self.store.configUiHints
+        let keys = node.properties.keys.sorted { lhs, rhs in
+            let orderA = hintForPath([.key(lhs)], hints: hints)?.order ?? 0
+            let orderB = hintForPath([.key(rhs)], hints: hints)?.order ?? 0
+            if orderA != orderB { return orderA < orderB }
+            return lhs < rhs
+        }
+
+        return keys.compactMap { key in
+            guard let child = node.properties[key] else { return nil }
+            let path: ConfigPath = [.key(key)]
+            let hint = hintForPath(path, hints: hints)
+            let label = hint?.label
+                ?? child.title
+                ?? self.humanize(key)
+            let help = hint?.help ?? child.description
+            return ConfigSection(key: key, label: label, help: help, node: child)
+        }
+    }
+
+    private func resolveSubsections(for section: ConfigSection) -> [ConfigSubsection] {
+        let node = self.resolvedSchemaNode(section.node)
+        guard node.schemaType == "object" else { return [] }
+        let hints = self.store.configUiHints
+        let keys = node.properties.keys.sorted { lhs, rhs in
+            let orderA = hintForPath([.key(section.key), .key(lhs)], hints: hints)?.order ?? 0
+            let orderB = hintForPath([.key(section.key), .key(rhs)], hints: hints)?.order ?? 0
+            if orderA != orderB { return orderA < orderB }
+            return lhs < rhs
+        }
+
+        return keys.compactMap { key in
+            guard let child = node.properties[key] else { return nil }
+            let path: ConfigPath = [.key(section.key), .key(key)]
+            let hint = hintForPath(path, hints: hints)
+            let label = hint?.label
+                ?? child.title
+                ?? self.humanize(key)
+            let help = hint?.help ?? child.description
+            return ConfigSubsection(
+                key: key,
+                label: label,
+                help: help,
+                node: child,
+                path: path)
+        }
+    }
+
+    private func resolvedSchemaNode(_ node: ConfigSchemaNode) -> ConfigSchemaNode {
+        let variants = node.anyOf.isEmpty ? node.oneOf : node.anyOf
+        if !variants.isEmpty {
+            let nonNull = variants.filter { !$0.isNullSchema }
+            if nonNull.count == 1, let only = nonNull.first { return only }
+        }
+        return node
+    }
+
+    private func humanize(_ key: String) -> String {
+        key.replacingOccurrences(of: "_", with: " ")
+            .replacingOccurrences(of: "-", with: " ")
+            .capitalized
+    }
 }
 
 struct ConfigSettings_Previews: PreviewProvider {

apps/macos/Sources/Clawdbot/ControlChannel.swift

@@ -87,15 +87,7 @@ final class ControlChannel {
 
     func configure() async {
         self.logger.info("control channel configure mode=local")
-        self.state = .connecting
-        do {
-            try await GatewayConnection.shared.refresh()
-            self.state = .connected
-            PresenceReporter.shared.sendImmediate(reason: "connect")
-        } catch {
-            let message = self.friendlyGatewayMessage(error)
-            self.state = .degraded(message)
-        }
+        await self.refreshEndpoint(reason: "configure")
     }
 
     func configure(mode: Mode = .local) async throws {
@@ -111,7 +103,7 @@ final class ControlChannel {
                         "target=\(target, privacy: .public) identitySet=\(idSet, privacy: .public)")
                 self.state = .connecting
                 _ = try await GatewayEndpointStore.shared.ensureRemoteControlTunnel()
-                await self.configure()
+                await self.refreshEndpoint(reason: "configure")
             } catch {
                 self.state = .degraded(error.localizedDescription)
                 throw error
@@ -119,6 +111,19 @@ final class ControlChannel {
         }
     }
 
+    func refreshEndpoint(reason: String) async {
+        self.logger.info("control channel refresh endpoint reason=\(reason, privacy: .public)")
+        self.state = .connecting
+        do {
+            try await self.establishGatewayConnection()
+            self.state = .connected
+            PresenceReporter.shared.sendImmediate(reason: "connect")
+        } catch {
+            let message = self.friendlyGatewayMessage(error)
+            self.state = .degraded(message)
+        }
+    }
+
     func disconnect() async {
         await GatewayConnection.shared.shutdown()
         self.state = .disconnected
@@ -275,18 +280,28 @@ final class ControlChannel {
                 }
             }
 
-            do {
-                try await GatewayConnection.shared.refresh()
+            await self.refreshEndpoint(reason: "recovery:\(reasonText)")
+            if case .connected = self.state {
                 self.logger.info("control channel recovery finished")
-            } catch {
-                self.logger.error(
-                    "control channel recovery failed \(error.localizedDescription, privacy: .public)")
+            } else if case let .degraded(message) = self.state {
+                self.logger.error("control channel recovery failed \(message, privacy: .public)")
             }
 
             self.recoveryTask = nil
         }
     }
 
+    private func establishGatewayConnection(timeoutMs: Int = 5000) async throws {
+        try await GatewayConnection.shared.refresh()
+        let ok = try await GatewayConnection.shared.healthOK(timeoutMs: timeoutMs)
+        if ok == false {
+            throw NSError(
+                domain: "Gateway",
+                code: 0,
+                userInfo: [NSLocalizedDescriptionKey: "gateway health not ok"])
+        }
+    }
+
     func sendSystemEvent(_ text: String, params: [String: AnyHashable] = [:]) async throws {
         var merged = params
         merged["text"] = AnyHashable(text)

apps/macos/Sources/Clawdbot/ExecApprovalsSocket.swift

@@ -319,7 +319,7 @@ private enum ExecHostExecutor {
             security: context.security,
             allowlistMatch: context.allowlistMatch,
             skillAllow: context.skillAllow),
-           approvalDecision == nil
+            approvalDecision == nil
         {
             let decision = ExecApprovalsPromptPresenter.prompt(
                 ExecApprovalPromptRequest(

apps/macos/Sources/Clawdbot/GatewayConnectivityCoordinator.swift

@@ -0,0 +1,63 @@
+import Foundation
+import Observation
+import OSLog
+
+@MainActor
+@Observable
+final class GatewayConnectivityCoordinator {
+    static let shared = GatewayConnectivityCoordinator()
+
+    private let logger = Logger(subsystem: "com.clawdbot", category: "gateway.connectivity")
+    private var endpointTask: Task<Void, Never>?
+    private var lastResolvedURL: URL?
+
+    private(set) var endpointState: GatewayEndpointState?
+    private(set) var resolvedURL: URL?
+    private(set) var resolvedMode: AppState.ConnectionMode?
+    private(set) var resolvedHostLabel: String?
+
+    private init() {
+        self.start()
+    }
+
+    func start() {
+        guard self.endpointTask == nil else { return }
+        self.endpointTask = Task { [weak self] in
+            guard let self else { return }
+            let stream = await GatewayEndpointStore.shared.subscribe()
+            for await state in stream {
+                await MainActor.run { self.handleEndpointState(state) }
+            }
+        }
+    }
+
+    var localEndpointHostLabel: String? {
+        guard self.resolvedMode == .local, let url = self.resolvedURL else { return nil }
+        return Self.hostLabel(for: url)
+    }
+
+    private func handleEndpointState(_ state: GatewayEndpointState) {
+        self.endpointState = state
+        switch state {
+        case let .ready(mode, url, _, _):
+            self.resolvedMode = mode
+            self.resolvedURL = url
+            self.resolvedHostLabel = Self.hostLabel(for: url)
+            let urlChanged = self.lastResolvedURL?.absoluteString != url.absoluteString
+            if urlChanged {
+                self.lastResolvedURL = url
+                Task { await ControlChannel.shared.refreshEndpoint(reason: "endpoint changed") }
+            }
+        case let .connecting(mode, _):
+            self.resolvedMode = mode
+        case let .unavailable(mode, _):
+            self.resolvedMode = mode
+        }
+    }
+
+    private static func hostLabel(for url: URL) -> String {
+        let host = url.host ?? url.absoluteString
+        if let port = url.port { return "\(host):\(port)" }
+        return host
+    }
+}

apps/macos/Sources/Clawdbot/GatewayEndpointStore.swift

@@ -68,6 +68,7 @@ actor GatewayEndpointStore {
                     env: ProcessInfo.processInfo.environment)
                 let customBindHost = GatewayEndpointStore.resolveGatewayCustomBindHost(root: root)
                 let tailscaleIP = await MainActor.run { TailscaleService.shared.tailscaleIP }
+                    ?? TailscaleService.fallbackTailnetIPv4()
                 return GatewayEndpointStore.resolveLocalGatewayHost(
                     bindMode: bind,
                     customBindHost: customBindHost,
@@ -172,6 +173,10 @@ actor GatewayEndpointStore {
             return configToken
         }
 
+        if isRemote {
+            return nil
+        }
+
         if let token = launchdSnapshot?.token?.trimmingCharacters(in: .whitespacesAndNewlines),
            !token.isEmpty
         {
@@ -483,6 +488,7 @@ actor GatewayEndpointStore {
         guard currentHost == "127.0.0.1" || currentHost == "localhost" else { return nil }
 
         let tailscaleIP = await MainActor.run { TailscaleService.shared.tailscaleIP }
+            ?? TailscaleService.fallbackTailnetIPv4()
         guard let tailscaleIP, !tailscaleIP.isEmpty else { return nil }
 
         let scheme = GatewayEndpointStore.resolveGatewayScheme(
@@ -554,13 +560,16 @@ actor GatewayEndpointStore {
     {
         switch bindMode {
         case "tailnet":
-            tailscaleIP ?? "127.0.0.1"
+            return tailscaleIP ?? "127.0.0.1"
         case "auto":
-            "127.0.0.1"
+            if let tailscaleIP, !tailscaleIP.isEmpty {
+                return tailscaleIP
+            }
+            return "127.0.0.1"
         case "custom":
-            customBindHost ?? "127.0.0.1"
+            return customBindHost ?? "127.0.0.1"
         default:
-            "127.0.0.1"
+            return "127.0.0.1"
         }
     }
 }
@@ -631,11 +640,12 @@ extension GatewayEndpointStore {
 
     static func _testResolveLocalGatewayHost(
         bindMode: String?,
-        tailscaleIP: String?) -> String
+        tailscaleIP: String?,
+        customBindHost: String? = nil) -> String
     {
         self.resolveLocalGatewayHost(
             bindMode: bindMode,
-            customBindHost: nil,
+            customBindHost: customBindHost,
             tailscaleIP: tailscaleIP)
     }
 }

apps/macos/Sources/Clawdbot/HealthStore.swift

@@ -235,8 +235,8 @@ final class HealthStore {
             let lower = error.lowercased()
             if lower.contains("connection refused") {
                 let port = GatewayEnvironment.gatewayPort()
-                return "The gateway control port (127.0.0.1:\(port)) isn’t listening — " +
-                    "restart Clawdbot to bring it back."
+                let host = GatewayConnectivityCoordinator.shared.localEndpointHostLabel ?? "127.0.0.1:\(port)"
+                return "The gateway control port (\(host)) isn’t listening — restart Clawdbot to bring it back."
             }
             if lower.contains("timeout") {
                 return "Timed out waiting for the control server; the gateway may be crashed or still starting."

apps/macos/Sources/Clawdbot/MenuBar.swift

@@ -13,6 +13,7 @@ struct ClawdbotApp: App {
     private let gatewayManager = GatewayProcessManager.shared
     private let controlChannel = ControlChannel.shared
     private let activityStore = WorkActivityStore.shared
+    private let connectivityCoordinator = GatewayConnectivityCoordinator.shared
     @State private var statusItem: NSStatusItem?
     @State private var isMenuPresented = false
     @State private var isPanelVisible = false

apps/macos/Sources/Clawdbot/MenuSessionsInjector.swift

@@ -469,7 +469,7 @@ extension MenuSessionsInjector {
             }
         case .local:
             platform = "local"
-            host = "127.0.0.1:\(port)"
+            host = GatewayConnectivityCoordinator.shared.localEndpointHostLabel ?? "127.0.0.1:\(port)"
         case .unconfigured:
             platform = nil
             host = nil

apps/macos/Sources/Clawdbot/TailscaleService.swift

@@ -2,6 +2,9 @@ import AppKit
 import Foundation
 import Observation
 import os
+#if canImport(Darwin)
+import Darwin
+#endif
 
 /// Manages Tailscale integration and status checking.
 @Observable
@@ -100,16 +103,14 @@ final class TailscaleService {
     }
 
     func checkTailscaleStatus() async {
+        let previousIP = self.tailscaleIP
         self.isInstalled = self.checkAppInstallation()
-        guard self.isInstalled else {
+        if !self.isInstalled {
             self.isRunning = false
             self.tailscaleHostname = nil
             self.tailscaleIP = nil
             self.statusError = "Tailscale is not installed"
-            return
-        }
-
-        if let apiResponse = await fetchTailscaleStatus() {
+        } else if let apiResponse = await fetchTailscaleStatus() {
             self.isRunning = apiResponse.status.lowercased() == "running"
 
             if self.isRunning {
@@ -138,6 +139,19 @@ final class TailscaleService {
             self.statusError = "Please start the Tailscale app"
             self.logger.info("Tailscale API not responding; app likely not running")
         }
+
+        if self.tailscaleIP == nil, let fallback = Self.detectTailnetIPv4() {
+            self.tailscaleIP = fallback
+            if !self.isRunning {
+                self.isRunning = true
+            }
+            self.statusError = nil
+            self.logger.info("Tailscale interface IP detected (fallback) ip=\(fallback, privacy: .public)")
+        }
+
+        if previousIP != self.tailscaleIP {
+            await GatewayEndpointStore.shared.refresh()
+        }
     }
 
     func openTailscaleApp() {
@@ -163,4 +177,50 @@ final class TailscaleService {
             NSWorkspace.shared.open(url)
         }
     }
+
+    private static func isTailnetIPv4(_ address: String) -> Bool {
+        let parts = address.split(separator: ".")
+        guard parts.count == 4 else { return false }
+        let octets = parts.compactMap { Int($0) }
+        guard octets.count == 4 else { return false }
+        let a = octets[0]
+        let b = octets[1]
+        return a == 100 && b >= 64 && b <= 127
+    }
+
+    private static func detectTailnetIPv4() -> String? {
+        var addrList: UnsafeMutablePointer<ifaddrs>?
+        guard getifaddrs(&addrList) == 0, let first = addrList else { return nil }
+        defer { freeifaddrs(addrList) }
+
+        for ptr in sequence(first: first, next: { $0.pointee.ifa_next }) {
+            let flags = Int32(ptr.pointee.ifa_flags)
+            let isUp = (flags & IFF_UP) != 0
+            let isLoopback = (flags & IFF_LOOPBACK) != 0
+            let family = ptr.pointee.ifa_addr.pointee.sa_family
+            if !isUp || isLoopback || family != UInt8(AF_INET) { continue }
+
+            var addr = ptr.pointee.ifa_addr.pointee
+            var buffer = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+            let result = getnameinfo(
+                &addr,
+                socklen_t(ptr.pointee.ifa_addr.pointee.sa_len),
+                &buffer,
+                socklen_t(buffer.count),
+                nil,
+                0,
+                NI_NUMERICHOST)
+            guard result == 0 else { continue }
+            let len = buffer.prefix { $0 != 0 }
+            let bytes = len.map { UInt8(bitPattern: $0) }
+            guard let ip = String(bytes: bytes, encoding: .utf8) else { continue }
+            if Self.isTailnetIPv4(ip) { return ip }
+        }
+
+        return nil
+    }
+
+    nonisolated static func fallbackTailnetIPv4() -> String? {
+        Self.detectTailnetIPv4()
+    }
 }

apps/macos/Sources/ClawdbotMacCLI/ConnectCommand.swift

@@ -1,13 +1,16 @@
 import ClawdbotKit
 import ClawdbotProtocol
 import Foundation
+#if canImport(Darwin)
+import Darwin
+#endif
 
 struct ConnectOptions {
     var url: String?
     var token: String?
     var password: String?
     var mode: String?
-    var timeoutMs: Int = 15_000
+    var timeoutMs: Int = 15000
     var json: Bool = false
     var probe: Bool = false
     var clientId: String = "clawdbot-macos"
@@ -19,53 +22,43 @@ struct ConnectOptions {
 
     static func parse(_ args: [String]) -> ConnectOptions {
         var opts = ConnectOptions()
+        let flagHandlers: [String: (inout ConnectOptions) -> Void] = [
+            "-h": { $0.help = true },
+            "--help": { $0.help = true },
+            "--json": { $0.json = true },
+            "--probe": { $0.probe = true },
+        ]
+        let valueHandlers: [String: (inout ConnectOptions, String) -> Void] = [
+            "--url": { $0.url = $1 },
+            "--token": { $0.token = $1 },
+            "--password": { $0.password = $1 },
+            "--mode": { $0.mode = $1 },
+            "--timeout": { opts, raw in
+                if let parsed = Int(raw.trimmingCharacters(in: .whitespacesAndNewlines)) {
+                    opts.timeoutMs = max(250, parsed)
+                }
+            },
+            "--client-id": { $0.clientId = $1 },
+            "--client-mode": { $0.clientMode = $1 },
+            "--display-name": { $0.displayName = $1 },
+            "--role": { $0.role = $1 },
+            "--scopes": { opts, raw in
+                opts.scopes = raw.split(separator: ",").map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+                    .filter { !$0.isEmpty }
+            },
+        ]
         var i = 0
         while i < args.count {
             let arg = args[i]
-            switch arg {
-            case "-h", "--help":
-                opts.help = true
-            case "--json":
-                opts.json = true
-            case "--probe":
-                opts.probe = true
-            case "--url":
-                opts.url = self.nextValue(args, index: &i)
-            case "--token":
-                opts.token = self.nextValue(args, index: &i)
-            case "--password":
-                opts.password = self.nextValue(args, index: &i)
-            case "--mode":
-                if let value = self.nextValue(args, index: &i) {
-                    opts.mode = value
-                }
-            case "--timeout":
-                if let raw = self.nextValue(args, index: &i),
-                   let parsed = Int(raw.trimmingCharacters(in: .whitespacesAndNewlines))
-                {
-                    opts.timeoutMs = max(250, parsed)
-                }
-            case "--client-id":
-                if let value = self.nextValue(args, index: &i) {
-                    opts.clientId = value
-                }
-            case "--client-mode":
-                if let value = self.nextValue(args, index: &i) {
-                    opts.clientMode = value
-                }
-            case "--display-name":
-                opts.displayName = self.nextValue(args, index: &i)
-            case "--role":
-                if let value = self.nextValue(args, index: &i) {
-                    opts.role = value
-                }
-            case "--scopes":
-                if let value = self.nextValue(args, index: &i) {
-                    opts.scopes = value.split(separator: ",").map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
-                        .filter { !$0.isEmpty }
-                }
-            default:
-                break
+            if let handler = flagHandlers[arg] {
+                handler(&opts)
+                i += 1
+                continue
+            }
+            if let handler = valueHandlers[arg], let value = self.nextValue(args, index: &i) {
+                handler(&opts, value)
+                i += 1
+                continue
             }
             i += 1
         }
@@ -254,8 +247,12 @@ private func resolveGatewayEndpoint(opts: ConnectOptions, config: GatewayConfig)
 
     if resolvedMode == "remote" {
         guard let raw = config.remoteUrl?.trimmingCharacters(in: .whitespacesAndNewlines),
-              !raw.isEmpty else {
-            throw NSError(domain: "Gateway", code: 1, userInfo: [NSLocalizedDescriptionKey: "gateway.remote.url is missing"])
+              !raw.isEmpty
+        else {
+            throw NSError(
+                domain: "Gateway",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "gateway.remote.url is missing"])
         }
         guard let url = URL(string: raw) else {
             throw NSError(domain: "Gateway", code: 1, userInfo: [NSLocalizedDescriptionKey: "invalid url: \(raw)"])
@@ -268,9 +265,12 @@ private func resolveGatewayEndpoint(opts: ConnectOptions, config: GatewayConfig)
     }
 
     let port = config.port ?? 18789
-    let host = "127.0.0.1"
+    let host = resolveLocalHost(bind: config.bind)
     guard let url = URL(string: "ws://\(host):\(port)") else {
-        throw NSError(domain: "Gateway", code: 1, userInfo: [NSLocalizedDescriptionKey: "invalid url: ws://\(host):\(port)"])
+        throw NSError(
+            domain: "Gateway",
+            code: 1,
+            userInfo: [NSLocalizedDescriptionKey: "invalid url: ws://\(host):\(port)"])
     }
     return GatewayEndpoint(
         url: url,
@@ -280,7 +280,7 @@ private func resolveGatewayEndpoint(opts: ConnectOptions, config: GatewayConfig)
 }
 
 private func bestEffortEndpoint(opts: ConnectOptions, config: GatewayConfig) -> GatewayEndpoint? {
-    return try? resolveGatewayEndpoint(opts: opts, config: config)
+    try? resolveGatewayEndpoint(opts: opts, config: config)
 }
 
 private func resolvedToken(opts: ConnectOptions, mode: String, config: GatewayConfig) -> String? {
@@ -304,3 +304,56 @@ private func resolvedPassword(opts: ConnectOptions, mode: String, config: Gatewa
     }
     return config.password
 }
+
+private func resolveLocalHost(bind: String?) -> String {
+    let normalized = (bind ?? "").trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+    let tailnetIP = detectTailnetIPv4()
+    switch normalized {
+    case "tailnet", "auto":
+        return tailnetIP ?? "127.0.0.1"
+    default:
+        return "127.0.0.1"
+    }
+}
+
+private func detectTailnetIPv4() -> String? {
+    var addrList: UnsafeMutablePointer<ifaddrs>?
+    guard getifaddrs(&addrList) == 0, let first = addrList else { return nil }
+    defer { freeifaddrs(addrList) }
+
+    for ptr in sequence(first: first, next: { $0.pointee.ifa_next }) {
+        let flags = Int32(ptr.pointee.ifa_flags)
+        let isUp = (flags & IFF_UP) != 0
+        let isLoopback = (flags & IFF_LOOPBACK) != 0
+        let family = ptr.pointee.ifa_addr.pointee.sa_family
+        if !isUp || isLoopback || family != UInt8(AF_INET) { continue }
+
+        var addr = ptr.pointee.ifa_addr.pointee
+        var buffer = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+        let result = getnameinfo(
+            &addr,
+            socklen_t(ptr.pointee.ifa_addr.pointee.sa_len),
+            &buffer,
+            socklen_t(buffer.count),
+            nil,
+            0,
+            NI_NUMERICHOST)
+        guard result == 0 else { continue }
+        let len = buffer.prefix { $0 != 0 }
+        let bytes = len.map { UInt8(bitPattern: $0) }
+        guard let ip = String(bytes: bytes, encoding: .utf8) else { continue }
+        if isTailnetIPv4(ip) { return ip }
+    }
+
+    return nil
+}
+
+private func isTailnetIPv4(_ address: String) -> Bool {
+    let parts = address.split(separator: ".")
+    guard parts.count == 4 else { return false }
+    let octets = parts.compactMap { Int($0) }
+    guard octets.count == 4 else { return false }
+    let a = octets[0]
+    let b = octets[1]
+    return a == 100 && b >= 64 && b <= 127
+}

apps/macos/Tests/ClawdbotIPCTests/ChannelsSettingsSmokeTests.swift

@@ -3,6 +3,8 @@ import SwiftUI
 import Testing
 @testable import Clawdbot
 
+private typealias SnapshotAnyCodable = Clawdbot.AnyCodable
+
 @Suite(.serialized)
 @MainActor
 struct ChannelsSettingsSmokeTests {
@@ -17,8 +19,11 @@ struct ChannelsSettingsSmokeTests {
                 "signal": "Signal",
                 "imessage": "iMessage",
             ],
+            channelDetailLabels: nil,
+            channelSystemImages: nil,
+            channelMeta: nil,
             channels: [
-                "whatsapp": AnyCodable([
+                "whatsapp": SnapshotAnyCodable([
                     "configured": true,
                     "linked": true,
                     "authAgeMs": 86_400_000,
@@ -37,7 +42,7 @@ struct ChannelsSettingsSmokeTests {
                     "lastEventAt": 1_700_000_060_000,
                     "lastError": "needs login",
                 ]),
-                "telegram": AnyCodable([
+                "telegram": SnapshotAnyCodable([
                     "configured": true,
                     "tokenSource": "env",
                     "running": true,
@@ -52,7 +57,7 @@ struct ChannelsSettingsSmokeTests {
                     ],
                     "lastProbeAt": 1_700_000_050_000,
                 ]),
-                "signal": AnyCodable([
+                "signal": SnapshotAnyCodable([
                     "configured": true,
                     "baseUrl": "http://127.0.0.1:8080",
                     "running": true,
@@ -65,7 +70,7 @@ struct ChannelsSettingsSmokeTests {
                     ],
                     "lastProbeAt": 1_700_000_050_000,
                 ]),
-                "imessage": AnyCodable([
+                "imessage": SnapshotAnyCodable([
                     "configured": false,
                     "running": false,
                     "lastError": "not configured",
@@ -100,15 +105,18 @@ struct ChannelsSettingsSmokeTests {
                 "signal": "Signal",
                 "imessage": "iMessage",
             ],
+            channelDetailLabels: nil,
+            channelSystemImages: nil,
+            channelMeta: nil,
             channels: [
-                "whatsapp": AnyCodable([
+                "whatsapp": SnapshotAnyCodable([
                     "configured": false,
                     "linked": false,
                     "running": false,
                     "connected": false,
                     "reconnectAttempts": 0,
                 ]),
-                "telegram": AnyCodable([
+                "telegram": SnapshotAnyCodable([
                     "configured": false,
                     "running": false,
                     "lastError": "bot missing",
@@ -120,7 +128,7 @@ struct ChannelsSettingsSmokeTests {
                     ],
                     "lastProbeAt": 1_700_000_100_000,
                 ]),
-                "signal": AnyCodable([
+                "signal": SnapshotAnyCodable([
                     "configured": false,
                     "baseUrl": "http://127.0.0.1:8080",
                     "running": false,
@@ -133,7 +141,7 @@ struct ChannelsSettingsSmokeTests {
                     ],
                     "lastProbeAt": 1_700_000_200_000,
                 ]),
-                "imessage": AnyCodable([
+                "imessage": SnapshotAnyCodable([
                     "configured": false,
                     "running": false,
                     "lastError": "not configured",

apps/macos/Tests/ClawdbotIPCTests/CronJobEditorSmokeTests.swift

@@ -11,16 +11,19 @@ struct CronJobEditorSmokeTests {
     }
 
     @Test func cronJobEditorBuildsBodyForNewJob() {
+        let channelsStore = ChannelsStore(isPreview: true)
         let view = CronJobEditor(
             job: nil,
             isSaving: .constant(false),
             error: .constant(nil),
+            channelsStore: channelsStore,
             onCancel: {},
             onSave: { _ in })
         _ = view.body
     }
 
     @Test func cronJobEditorBuildsBodyForExistingJob() {
+        let channelsStore = ChannelsStore(isPreview: true)
         let job = CronJob(
             id: "job-1",
             agentId: "ops",
@@ -54,31 +57,36 @@ struct CronJobEditorSmokeTests {
             job: job,
             isSaving: .constant(false),
             error: .constant(nil),
+            channelsStore: channelsStore,
             onCancel: {},
             onSave: { _ in })
         _ = view.body
     }
 
     @Test func cronJobEditorExercisesBuilders() {
+        let channelsStore = ChannelsStore(isPreview: true)
         var view = CronJobEditor(
             job: nil,
             isSaving: .constant(false),
             error: .constant(nil),
+            channelsStore: channelsStore,
             onCancel: {},
             onSave: { _ in })
         view.exerciseForTesting()
     }
 
     @Test func cronJobEditorIncludesDeleteAfterRunForAtSchedule() throws {
+        let channelsStore = ChannelsStore(isPreview: true)
         let view = CronJobEditor(
             job: nil,
             isSaving: .constant(false),
             error: .constant(nil),
+            channelsStore: channelsStore,
             onCancel: {},
             onSave: { _ in })
 
         var root: [String: Any] = [:]
-        view.applyDeleteAfterRun(to: &root, scheduleKind: .at, deleteAfterRun: true)
+        view.applyDeleteAfterRun(to: &root, scheduleKind: CronJobEditor.ScheduleKind.at, deleteAfterRun: true)
         let raw = root["deleteAfterRun"] as? Bool
         #expect(raw == true)
     }

apps/macos/Tests/ClawdbotIPCTests/GatewayChannelConfigureTests.swift

@@ -1,3 +1,4 @@
+import ClawdbotKit
 import Foundation
 import os
 import Testing

apps/macos/Tests/ClawdbotIPCTests/GatewayChannelConnectTests.swift

@@ -1,3 +1,4 @@
+import ClawdbotKit
 import Foundation
 import os
 import Testing

apps/macos/Tests/ClawdbotIPCTests/GatewayChannelRequestTests.swift

@@ -1,3 +1,4 @@
+import ClawdbotKit
 import Foundation
 import os
 import Testing

apps/macos/Tests/ClawdbotIPCTests/GatewayChannelShutdownTests.swift

@@ -1,3 +1,4 @@
+import ClawdbotKit
 import Foundation
 import os
 import Testing

apps/macos/Tests/ClawdbotIPCTests/GatewayConnectionControlTests.swift

@@ -1,3 +1,4 @@
+import ClawdbotKit
 import Foundation
 import Testing
 @testable import Clawdbot

apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift

@@ -139,4 +139,40 @@ import Testing
         let resolved = ConnectionModeResolver.resolve(root: root, defaults: defaults)
         #expect(resolved.mode == .remote)
     }
+
+    @Test func resolveLocalGatewayHostPrefersTailnetForAuto() {
+        let host = GatewayEndpointStore._testResolveLocalGatewayHost(
+            bindMode: "auto",
+            tailscaleIP: "100.64.1.2")
+        #expect(host == "100.64.1.2")
+    }
+
+    @Test func resolveLocalGatewayHostFallsBackToLoopbackForAuto() {
+        let host = GatewayEndpointStore._testResolveLocalGatewayHost(
+            bindMode: "auto",
+            tailscaleIP: nil)
+        #expect(host == "127.0.0.1")
+    }
+
+    @Test func resolveLocalGatewayHostPrefersTailnetForTailnetMode() {
+        let host = GatewayEndpointStore._testResolveLocalGatewayHost(
+            bindMode: "tailnet",
+            tailscaleIP: "100.64.1.5")
+        #expect(host == "100.64.1.5")
+    }
+
+    @Test func resolveLocalGatewayHostFallsBackToLoopbackForTailnetMode() {
+        let host = GatewayEndpointStore._testResolveLocalGatewayHost(
+            bindMode: "tailnet",
+            tailscaleIP: nil)
+        #expect(host == "127.0.0.1")
+    }
+
+    @Test func resolveLocalGatewayHostUsesCustomBindHost() {
+        let host = GatewayEndpointStore._testResolveLocalGatewayHost(
+            bindMode: "custom",
+            tailscaleIP: "100.64.1.9",
+            customBindHost: "192.168.1.10")
+        #expect(host == "192.168.1.10")
+    }
 }

apps/macos/Tests/ClawdbotIPCTests/LowCoverageHelperTests.swift

@@ -7,15 +7,17 @@ import Testing
 
 @Suite(.serialized)
 struct LowCoverageHelperTests {
+    private typealias ProtoAnyCodable = ClawdbotProtocol.AnyCodable
+
     @Test func anyCodableHelperAccessors() throws {
-        let payload: [String: AnyCodable] = [
-            "title": AnyCodable("Hello"),
-            "flag": AnyCodable(true),
-            "count": AnyCodable(3),
-            "ratio": AnyCodable(1.25),
-            "list": AnyCodable([AnyCodable("a"), AnyCodable(2)]),
+        let payload: [String: ProtoAnyCodable] = [
+            "title": ProtoAnyCodable("Hello"),
+            "flag": ProtoAnyCodable(true),
+            "count": ProtoAnyCodable(3),
+            "ratio": ProtoAnyCodable(1.25),
+            "list": ProtoAnyCodable([ProtoAnyCodable("a"), ProtoAnyCodable(2)]),
         ]
-        let any = AnyCodable(payload)
+        let any = ProtoAnyCodable(payload)
         let dict = try #require(any.dictionaryValue)
         #expect(dict["title"]?.stringValue == "Hello")
         #expect(dict["flag"]?.boolValue == true)
@@ -76,31 +78,27 @@ struct LowCoverageHelperTests {
         #expect(result.stderr.contains("stderr-1999"))
     }
 
-    @Test func pairedNodesStorePersists() async throws {
-        let dir = FileManager().temporaryDirectory
-            .appendingPathComponent("paired-\(UUID().uuidString)", isDirectory: true)
-        try FileManager().createDirectory(at: dir, withIntermediateDirectories: true)
-        let url = dir.appendingPathComponent("nodes.json")
-        let store = PairedNodesStore(fileURL: url)
-        await store.load()
-        #expect(await store.all().isEmpty)
-
-        let node = PairedNode(
+    @Test func nodeInfoCodableRoundTrip() throws {
+        let info = NodeInfo(
             nodeId: "node-1",
             displayName: "Node One",
             platform: "macOS",
             version: "1.0",
+            coreVersion: "1.0-core",
+            uiVersion: "1.0-ui",
             deviceFamily: "Mac",
             modelIdentifier: "MacBookPro",
-            token: "token",
-            createdAtMs: 1,
-            lastSeenAtMs: nil)
-        try await store.upsert(node)
-        #expect(await store.find(nodeId: "node-1")?.displayName == "Node One")
-
-        try await store.touchSeen(nodeId: "node-1")
-        let updated = await store.find(nodeId: "node-1")
-        #expect(updated?.lastSeenAtMs != nil)
+            remoteIp: "192.168.1.2",
+            caps: ["chat"],
+            commands: ["send"],
+            permissions: ["send": true],
+            paired: true,
+            connected: false)
+        let data = try JSONEncoder().encode(info)
+        let decoded = try JSONDecoder().decode(NodeInfo.self, from: data)
+        #expect(decoded.nodeId == "node-1")
+        #expect(decoded.isPaired == true)
+        #expect(decoded.isConnected == false)
     }
 
     @Test @MainActor func presenceReporterHelpers() {

apps/macos/Tests/ClawdbotIPCTests/MacGatewayChatTransportMappingTests.swift

@@ -21,6 +21,7 @@ import Testing
             features: [:],
             snapshot: snapshot,
             canvashosturl: nil,
+            auth: nil,
             policy: [:])
 
         let mapped = MacGatewayChatTransport.mapPushToTransportEvent(.snapshot(hello))

apps/macos/Tests/ClawdbotIPCTests/OnboardingWizardStepViewTests.swift

@@ -3,13 +3,15 @@ import SwiftUI
 import Testing
 @testable import Clawdbot
 
+private typealias ProtoAnyCodable = ClawdbotProtocol.AnyCodable
+
 @Suite(.serialized)
 @MainActor
 struct OnboardingWizardStepViewTests {
     @Test func noteStepBuilds() {
         let step = WizardStep(
             id: "step-1",
-            type: AnyCodable("note"),
+            type: ProtoAnyCodable("note"),
             title: "Welcome",
             message: "Hello",
             options: nil,
@@ -22,17 +24,17 @@ struct OnboardingWizardStepViewTests {
     }
 
     @Test func selectStepBuilds() {
-        let options: [[String: AnyCodable]] = [
-            ["value": AnyCodable("local"), "label": AnyCodable("Local"), "hint": AnyCodable("This Mac")],
-            ["value": AnyCodable("remote"), "label": AnyCodable("Remote")],
+        let options: [[String: ProtoAnyCodable]] = [
+            ["value": ProtoAnyCodable("local"), "label": ProtoAnyCodable("Local"), "hint": ProtoAnyCodable("This Mac")],
+            ["value": ProtoAnyCodable("remote"), "label": ProtoAnyCodable("Remote")],
         ]
         let step = WizardStep(
             id: "step-2",
-            type: AnyCodable("select"),
+            type: ProtoAnyCodable("select"),
             title: "Mode",
             message: "Choose a mode",
             options: options,
-            initialvalue: AnyCodable("local"),
+            initialvalue: ProtoAnyCodable("local"),
             placeholder: nil,
             sensitive: nil,
             executor: nil)

apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift

@@ -15,6 +15,9 @@ extension URLSessionWebSocketTask: WebSocketTasking {}
 
 public struct WebSocketTaskBox: @unchecked Sendable {
     public let task: any WebSocketTasking
+    public init(task: any WebSocketTasking) {
+        self.task = task
+    }
 
     public var state: URLSessionTask.State { self.task.state }
 

apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayNodeSession.swift

@@ -23,6 +23,35 @@ public actor GatewayNodeSession {
     private var onConnected: (@Sendable () async -> Void)?
     private var onDisconnected: (@Sendable (String) async -> Void)?
     private var onInvoke: (@Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse)?
+
+    static func invokeWithTimeout(
+        request: BridgeInvokeRequest,
+        timeoutMs: Int?,
+        onInvoke: @escaping @Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse
+    ) async -> BridgeInvokeResponse {
+        let timeout = max(0, timeoutMs ?? 0)
+        guard timeout > 0 else {
+            return await onInvoke(request)
+        }
+
+        return await withTaskGroup(of: BridgeInvokeResponse.self) { group in
+            group.addTask { await onInvoke(request) }
+            group.addTask {
+                try? await Task.sleep(nanoseconds: UInt64(timeout) * 1_000_000)
+                return BridgeInvokeResponse(
+                    id: request.id,
+                    ok: false,
+                    error: ClawdbotNodeError(
+                        code: .unavailable,
+                        message: "node invoke timed out")
+                )
+            }
+
+            let first = await group.next()!
+            group.cancelAll()
+            return first
+        }
+    }
     private var serverEventSubscribers: [UUID: AsyncStream<EventFrame>.Continuation] = [:]
     private var canvasHostUrl: String?
 
@@ -167,7 +196,11 @@ public actor GatewayNodeSession {
             let request = try self.decoder.decode(NodeInvokeRequestPayload.self, from: data)
             guard let onInvoke else { return }
             let req = BridgeInvokeRequest(id: request.id, command: request.command, paramsJSON: request.paramsJSON)
-            let response = await onInvoke(req)
+            let response = await Self.invokeWithTimeout(
+                request: req,
+                timeoutMs: request.timeoutMs,
+                onInvoke: onInvoke
+            )
             await self.sendInvokeResult(request: request, response: response)
         } catch {
             self.logger.error("node invoke decode failed: \(error.localizedDescription, privacy: .public)")
@@ -180,8 +213,10 @@ public actor GatewayNodeSession {
             "id": AnyCodable(request.id),
             "nodeId": AnyCodable(request.nodeId),
             "ok": AnyCodable(response.ok),
-            "payloadJSON": AnyCodable(response.payloadJSON ?? NSNull()),
         ]
+        if let payloadJSON = response.payloadJSON {
+            params["payloadJSON"] = AnyCodable(payloadJSON)
+        }
         if let error = response.error {
             params["error"] = AnyCodable([
                 "code": AnyCodable(error.code.rawValue),

apps/shared/ClawdbotKit/Tests/ClawdbotKitTests/GatewayNodeSessionTests.swift

@@ -0,0 +1,56 @@
+import Foundation
+import Testing
+@testable import ClawdbotKit
+import ClawdbotProtocol
+
+struct GatewayNodeSessionTests {
+    @Test
+    func invokeWithTimeoutReturnsUnderlyingResponseBeforeTimeout() async {
+        let request = BridgeInvokeRequest(id: "1", command: "x", paramsJSON: nil)
+        let response = await GatewayNodeSession.invokeWithTimeout(
+            request: request,
+            timeoutMs: 50,
+            onInvoke: { req in
+                #expect(req.id == "1")
+                return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: "{}", error: nil)
+            }
+        )
+
+        #expect(response.ok == true)
+        #expect(response.error == nil)
+        #expect(response.payloadJSON == "{}")
+    }
+
+    @Test
+    func invokeWithTimeoutReturnsTimeoutError() async {
+        let request = BridgeInvokeRequest(id: "abc", command: "x", paramsJSON: nil)
+        let response = await GatewayNodeSession.invokeWithTimeout(
+            request: request,
+            timeoutMs: 10,
+            onInvoke: { _ in
+                try? await Task.sleep(nanoseconds: 200_000_000) // 200ms
+                return BridgeInvokeResponse(id: "abc", ok: true, payloadJSON: "{}", error: nil)
+            }
+        )
+
+        #expect(response.ok == false)
+        #expect(response.error?.code == .unavailable)
+        #expect(response.error?.message.contains("timed out") == true)
+    }
+
+    @Test
+    func invokeWithTimeoutZeroDisablesTimeout() async {
+        let request = BridgeInvokeRequest(id: "1", command: "x", paramsJSON: nil)
+        let response = await GatewayNodeSession.invokeWithTimeout(
+            request: request,
+            timeoutMs: 0,
+            onInvoke: { req in
+                try? await Task.sleep(nanoseconds: 5_000_000)
+                return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: nil, error: nil)
+            }
+        )
+
+        #expect(response.ok == true)
+        #expect(response.error == nil)
+    }
+}

docs/cli/index.md

@@ -825,9 +825,9 @@ Common options:
 - `--url`, `--token`, `--timeout`, `--json`
 
 Subcommands:
-- `nodes status`
+- `nodes status [--connected] [--last-connected <duration>]`
 - `nodes describe --node <id|name|ip>`
-- `nodes list`
+- `nodes list [--connected] [--last-connected <duration>]`
 - `nodes pending`
 - `nodes approve <requestId>`
 - `nodes reject <requestId>`

docs/cli/nodes.md

@@ -18,15 +18,22 @@ Related:
 
 ```bash
 clawdbot nodes list
+clawdbot nodes list --connected
+clawdbot nodes list --last-connected 24h
 clawdbot nodes pending
 clawdbot nodes approve <requestId>
 clawdbot nodes status
+clawdbot nodes status --connected
+clawdbot nodes status --last-connected 24h
 ```
 
+`nodes list` prints pending/paired tables. Paired rows include the most recent connect age (Last Connect).
+Use `--connected` to only show currently-connected nodes. Use `--last-connected <duration>` to
+filter to nodes that connected within a duration (e.g. `24h`, `7d`).
+
 ## Invoke / run
 
 ```bash
 clawdbot nodes invoke --node <id|name|ip> --command <command> --params <json>
 clawdbot nodes run --node <id|name|ip> <command...>
 ```
-

docs/cli/security.md

@@ -21,4 +21,4 @@ clawdbot security audit --fix
 ```
 
 The audit warns when multiple DM senders share the main session and recommends `session.dmScope="per-channel-peer"` for shared inboxes.
-It also warns when small models (<=300B) are used without sandboxing and with web/browser tools enabled.
+It also warns when small models (`<=300B`) are used without sandboxing and with web/browser tools enabled.

docs/cli/update.md

@@ -7,9 +7,9 @@ read_when:
 
 # `clawdbot update`
 
-Safely update a **source checkout** (git install) of Clawdbot.
+Safely update Clawdbot and switch between stable/beta/dev channels.
 
-If you installed via **npm/pnpm** (global install, no git metadata), use the package manager flow in [Updating](/install/updating).
+If you installed via **npm/pnpm** (global install, no git metadata), updates happen via the package manager flow in [Updating](/install/updating).
 
 ## Usage
 
@@ -48,7 +48,16 @@ Options:
 - `--json`: print machine-readable status JSON.
 - `--timeout <seconds>`: timeout for checks (default is 3s).
 
-## What it does (git checkout)
+## What it does
+
+When you switch channels explicitly (`--channel ...`), Clawdbot also keeps the
+install method aligned:
+
+- `dev` → ensures a git checkout (default: `~/clawdbot`, override with `CLAWDBOT_GIT_DIR`),
+  updates it, and installs the global CLI from that checkout.
+- `stable`/`beta` → installs from npm using the matching dist-tag.
+
+## Git checkout flow
 
 Channels:
 

docs/gateway/configuration.md

@@ -1774,6 +1774,7 @@ Note: `applyPatch` is only under `tools.exec`.
 - `tools.web.fetch.maxChars` (default 50000)
 - `tools.web.fetch.timeoutSeconds` (default 30)
 - `tools.web.fetch.cacheTtlMinutes` (default 15)
+- `tools.web.fetch.maxRedirects` (default 3)
 - `tools.web.fetch.userAgent` (optional override)
 - `tools.web.fetch.readability` (default true; disable to use basic HTML cleanup only)
 - `tools.web.fetch.firecrawl.enabled` (default true when an API key is set)
@@ -2614,10 +2615,13 @@ Defaults:
     // noSandbox: false,
     // executablePath: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
     // attachOnly: false, // set true when tunneling a remote CDP to localhost
+    // snapshotDefaults: { mode: "efficient" }, // tool/CLI default snapshot preset
   }
 }
 ```
 
+Note: `browser.snapshotDefaults` only affects Clawdbot's browser tool + CLI. Direct HTTP clients must pass `mode` explicitly.
+
 ### `ui` (Appearance)
 
 Optional accent color used by the native apps for UI chrome (e.g. Talk Mode bubble tint).

docs/install/development-channels.md

@@ -7,7 +7,7 @@ read_when:
 
 # Development channels
 
-Last updated: 2026-01-20
+Last updated: 2026-01-21
 
 Clawdbot ships three update channels:
 
@@ -38,6 +38,13 @@ clawdbot update --channel dev
 
 This updates via the corresponding npm dist-tag (`latest`, `beta`, `dev`).
 
+When you **explicitly** switch channels with `--channel`, Clawdbot also aligns
+the install method:
+
+- `dev` ensures a git checkout (default `~/clawdbot`, override with `CLAWDBOT_GIT_DIR`),
+  updates it, and installs the global CLI from that checkout.
+- `stable`/`beta` installs from npm using the matching dist-tag.
+
 Tip: if you want stable + dev in parallel, keep two clones and point your gateway at the stable one.
 
 ## Plugins and channels

docs/nodes/index.md

@@ -34,6 +34,81 @@ clawdbot nodes rename --node <idOrNameOrIp> --name "Kitchen iPad"
 Notes:
 - `nodes rename` stores a display name override in the gateway pairing store.
 
+## Remote node host (system.run)
+
+Use a **node host** when your Gateway runs on one machine and you want commands
+to execute on another. The model still talks to the **gateway**; the gateway
+forwards `exec` calls to the **node host** when `host=node` is selected.
+
+### What runs where
+- **Gateway host**: receives messages, runs the model, routes tool calls.
+- **Node host**: executes `system.run`/`system.which` on the node machine.
+- **Approvals**: enforced on the node host via `~/.clawdbot/exec-approvals.json`.
+
+### Start a node host (foreground)
+
+On the node machine:
+
+```bash
+clawdbot node start --host <gateway-host> --port 18789 --display-name "Build Node"
+```
+
+### Start a node host (service)
+
+```bash
+clawdbot node service install --host <gateway-host> --port 18789 --display-name "Build Node"
+clawdbot node service start
+```
+
+### Pair + name
+
+On the gateway host:
+
+```bash
+clawdbot nodes pending
+clawdbot nodes approve <requestId>
+clawdbot nodes list
+```
+
+Naming options:
+- `--display-name` on `clawdbot node start/service install` (persists in `~/.clawdbot/node.json` on the node).
+- `clawdbot nodes rename --node <id|name|ip> --name "Build Node"` (gateway override).
+
+### Allowlist the commands
+
+Exec approvals are **per node host**. Add allowlist entries from the gateway:
+
+```bash
+clawdbot approvals allowlist add --node <id|name|ip> "/usr/bin/uname"
+clawdbot approvals allowlist add --node <id|name|ip> "/usr/bin/sw_vers"
+```
+
+Approvals live on the node host at `~/.clawdbot/exec-approvals.json`.
+
+### Point exec at the node
+
+Configure defaults (gateway config):
+
+```bash
+clawdbot config set tools.exec.host node
+clawdbot config set tools.exec.security allowlist
+clawdbot config set tools.exec.node "<id-or-name>"
+```
+
+Or per session:
+
+```
+/exec host=node security=allowlist node=<id-or-name>
+```
+
+Once set, any `exec` call with `host=node` runs on the node host (subject to the
+node allowlist/approvals).
+
+Related:
+- [Node host CLI](/cli/node)
+- [Exec tool](/tools/exec)
+- [Exec approvals](/tools/exec-approvals)
+
 ## Invoking commands
 
 Low-level (raw RPC):
@@ -214,6 +289,9 @@ Notes:
 - The node host stores its node id + pairing token in `~/.clawdbot/node.json`.
 - Exec approvals are enforced locally via `~/.clawdbot/exec-approvals.json`
   (see [Exec approvals](/tools/exec-approvals)).
+- On macOS, the headless node host prefers the companion app exec host when reachable and falls
+  back to local execution if the app is unavailable. Set `CLAWDBOT_NODE_EXEC_HOST=app` to require
+  the app, or `CLAWDBOT_NODE_EXEC_FALLBACK=0` to disable fallback.
 - Add `--tls` / `--tls-fingerprint` when the bridge requires TLS.
 
 ## Mac node mode

docs/tools/browser.md

@@ -500,6 +500,7 @@ Notes:
   - `--format ai` (default when Playwright is installed): returns an AI snapshot with numeric refs (`aria-ref="<n>"`).
   - `--format aria`: returns the accessibility tree (no refs; inspection only).
   - `--efficient` (or `--mode efficient`): compact role snapshot preset (interactive + compact + depth + lower maxChars).
+  - Config default (tool/CLI only): set `browser.snapshotDefaults.mode: "efficient"` to use efficient snapshots when the caller does not pass a mode (see [Gateway configuration](/gateway/configuration#browser-clawd-managed-browser)).
   - Role snapshot options (`--interactive`, `--compact`, `--depth`, `--selector`) force a role-based snapshot with refs like `ref=e12`.
   - `--frame "<iframe selector>"` scopes role snapshots to an iframe (pairs with role refs like `e12`).
   - `--interactive` outputs a flat, easy-to-pick list of interactive elements (best for driving actions).

docs/tools/exec.md

@@ -39,7 +39,7 @@ Notes:
 
 - `tools.exec.notifyOnExit` (default: true): when true, backgrounded exec sessions enqueue a system event and request a heartbeat on exit.
 - `tools.exec.host` (default: `sandbox`)
-- `tools.exec.security` (default: `deny`)
+- `tools.exec.security` (default: `deny` for sandbox, `allowlist` for gateway + node when unset)
 - `tools.exec.ask` (default: `on-miss`)
 - `tools.exec.node` (default: unset)
 - `tools.exec.pathPrepend`: list of directories to prepend to `PATH` for exec runs.

docs/tools/slash-commands.md

@@ -60,6 +60,7 @@ Text + native (when enabled):
 - `/commands`
 - `/skill <name> [input]` (run a skill by name)
 - `/status` (show current status; includes provider usage/quota for the current model provider when available)
+- `/allowlist` (list/add/remove allowlist entries)
 - `/context [list|detail|json]` (explain “context”; `detail` shows per-file + per-tool + per-skill + system prompt size)
 - `/whoami` (show your sender id; alias: `/id`)
 - `/subagents list|stop|log|info|send` (inspect, stop, log, or message sub-agent runs for the current session)
@@ -93,6 +94,7 @@ Notes:
 - Commands accept an optional `:` between the command and args (e.g. `/think: high`, `/send: on`, `/help:`).
 - `/new <model>` accepts a model alias, `provider/model`, or a provider name (fuzzy match); if no match, the text is treated as the message body.
 - For full provider usage breakdown, use `clawdbot status --usage`.
+- `/allowlist add|remove` requires `commands.config=true` and honors channel `configWrites`.
 - `/usage` controls the per-response usage footer; `/usage cost` prints a local cost summary from Clawdbot session logs.
 - `/restart` is disabled by default; set `commands.restart: true` to enable it.
 - `/verbose` is meant for debugging and extra visibility; keep it **off** in normal use.

docs/tools/web.md

@@ -215,6 +215,7 @@ Fetch a URL and extract readable content.
         maxChars: 50000,
         timeoutSeconds: 30,
         cacheTtlMinutes: 15,
+        maxRedirects: 3,
         userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36",
         readability: true,
         firecrawl: {
@@ -241,6 +242,7 @@ Notes:
 - `web_fetch` uses Readability (main-content extraction) first, then Firecrawl (if configured). If both fail, the tool returns an error.
 - Firecrawl requests use bot-circumvention mode and cache results by default.
 - `web_fetch` sends a Chrome-like User-Agent and `Accept-Language` by default; override `userAgent` if needed.
+- `web_fetch` blocks private/internal hostnames and re-checks redirects (limit with `maxRedirects`).
 - `web_fetch` is best-effort extraction; some sites will need the browser tool.
 - See [Firecrawl](/tools/firecrawl) for key setup and service details.
 - Responses are cached (default 15 minutes) to reduce repeated fetches.

package.json

@@ -210,6 +210,7 @@
     "@types/proper-lockfile": "^4.1.4",
     "@types/qrcode-terminal": "^0.12.2",
     "@types/ws": "^8.18.1",
+    "@typescript/native-preview": "7.0.0-dev.20260120.1",
     "@vitest/coverage-v8": "^4.0.17",
     "docx-preview": "^0.3.7",
     "lit": "^3.3.2",
@@ -231,7 +232,7 @@
     "overrides": {
       "@sinclair/typebox": "0.34.47",
       "hono": "4.11.4",
-      "tar": "7.5.3"
+      "tar": "7.5.4"
     },
     "patchedDependencies": {
       "@mariozechner/pi-ai@0.49.2": "patches/@mariozechner__pi-ai@0.49.2.patch"

pnpm-lock.yaml

@@ -7,7 +7,7 @@ settings:
 overrides:
   '@sinclair/typebox': 0.34.47
   hono: 4.11.4
-  tar: 7.5.3
+  tar: 7.5.4
 
 patchedDependencies:
   '@mariozechner/pi-ai@0.49.2':
@@ -151,8 +151,8 @@ importers:
         specifier: 0.1.7-alpha.2
         version: 0.1.7-alpha.2
       tar:
-        specifier: 7.5.3
-        version: 7.5.3
+        specifier: 7.5.4
+        version: 7.5.4
       tslog:
         specifier: ^4.10.2
         version: 4.10.2
@@ -202,6 +202,9 @@ importers:
       '@types/ws':
         specifier: ^8.18.1
         version: 8.18.1
+      '@typescript/native-preview':
+        specifier: 7.0.0-dev.20260120.1
+        version: 7.0.0-dev.20260120.1
       '@vitest/coverage-v8':
         specifier: ^4.0.17
         version: 4.0.17(@vitest/browser@4.0.17(vite@7.3.1(@types/node@25.0.9)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))(vitest@4.0.17))(vitest@4.0.17)
@@ -2530,6 +2533,45 @@ packages:
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-r3pWFuR2H7mn6ScwpH5jJljKQqKto0npVuJSk6pRwFwexpTyxOGmJTZJ1V0AWiisaNxU2+CNAqWFJSJYIE/QTg==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-cuC1+wLbUP+Ip2UT94G134fqRdp5w3b3dhcCO6/FQ4yXxvRNyv/WK+upHBUFDaeSOeHgDTyO9/QFYUWwC4If1A==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-zZGvEGY7wcHYefMZ87KNmvjN3NLIhsCMHEpHZiGCS3khKf+8z6ZsanrzCjOTodvL01VPyBzHxV1EtkSxAcLiQg==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-vN6OYVySol/kQZjJGmAzd6L30SyVlCgmCXS8WjUYtE5clN0YrzQHop16RK29fYZHMxpkOniVBtRPxUYQANZBlQ==}
+    cpu: [arm]
+    os: [linux]
+
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-JBfNhWd/asd5MDeS3VgRvE24pGKBkmvLub6tsux6ypr+Yhy+o0WaAEzVpmlRYZUqss2ai5tvOu4dzPBXzZAtFw==}
+    cpu: [x64]
+    os: [linux]
+
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-tTndRtYCq2xwgE0VkTi9ACNiJaV43+PqvBqCxk8ceYi3X36Ve+CCnwlZfZJ4k9NxZthtrAwF/kUmpC9iIYbq1w==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-oZia7hFL6k9pVepfonuPI86Jmyz6WlJKR57tWCDwRNmpA7odxuTq1PbvcYgy1z4+wHF1nnKKJY0PMAiq6ac18w==}
+    cpu: [x64]
+    os: [win32]
+
+  '@typescript/native-preview@7.0.0-dev.20260120.1':
+    resolution: {integrity: sha512-nnEf37C9ue7OBRnF2zmV/OCBmV5Y7T/K4mCHa+nxgiXcF/1w8sA0cgdFl+gHQ0mysqUJ+Bu5btAMeWgpLyjrgg==}
+    hasBin: true
+
   '@typespec/ts-http-runtime@0.3.2':
     resolution: {integrity: sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==}
     engines: {node: '>=20.0.0'}
@@ -4863,10 +4905,9 @@ packages:
   tailwindcss@4.1.17:
     resolution: {integrity: sha512-j9Ee2YjuQqYT9bbRTfTZht9W/ytp5H+jJpZKiYdP/bpnXARAuELt9ofP0lPnmHjbga7SNQIxdTAXCmtKVYjN+Q==}
 
-  tar@7.5.3:
-    resolution: {integrity: sha512-ENg5JUHUm2rDD7IvKNFGzyElLXNjachNLp6RaGf4+JOgxXHkqA+gq81ZAMCUmtMtqBsoU62lcp6S27g1LCYGGQ==}
+  tar@7.5.4:
+    resolution: {integrity: sha512-AN04xbWGrSTDmVwlI4/GTlIIwMFk/XEv7uL8aa57zuvRy6s4hdBed+lVq2fAZ89XDa7Us3ANXcE3Tvqvja1kTA==}
     engines: {node: '>=18'}
-    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me
 
   thenify-all@1.6.0:
     resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
@@ -7699,6 +7740,37 @@ snapshots:
     dependencies:
       '@types/node': 25.0.9
 
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260120.1':
+    optional: true
+
+  '@typescript/native-preview@7.0.0-dev.20260120.1':
+    optionalDependencies:
+      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260120.1
+      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260120.1
+      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260120.1
+      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260120.1
+      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260120.1
+      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260120.1
+      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260120.1
+
   '@typespec/ts-http-runtime@0.3.2':
     dependencies:
       http-proxy-agent: 7.0.2
@@ -8196,7 +8268,7 @@ snapshots:
       npmlog: 6.0.2
       rc: 1.2.8
       semver: 7.7.3
-      tar: 7.5.3
+      tar: 7.5.4
       url-join: 4.0.1
       which: 2.0.2
       yargs: 17.7.2
@@ -10438,7 +10510,7 @@ snapshots:
 
   tailwindcss@4.1.17: {}
 
-  tar@7.5.3:
+  tar@7.5.4:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
       chownr: 3.0.0

scripts/clawlog.sh

@@ -21,7 +21,7 @@ handle_sudo_error() {
     echo -e "\n${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
     echo -e "${YELLOW}⚠️  Password Required for Log Access${NC}"
     echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
-    echo -e "vtlog needs to use sudo to show complete log data (Apple hides sensitive info by default)."
+    echo -e "clawlog needs to use sudo to show complete log data (Apple hides sensitive info by default)."
     echo -e "\nTo avoid password prompts, configure passwordless sudo for the log command:"
     echo -e "See: ${BLUE}apple/docs/logging-private-fix.md${NC}\n"
     echo -e "Quick fix:"
@@ -51,7 +51,7 @@ show_usage() {
 clawlog - Clawdbot Logging Utility
 
 USAGE:
-    vtlog [OPTIONS]
+    clawlog [OPTIONS]
 
 DESCRIPTION:
     View Clawdbot logs with full details (bypasses Apple's privacy redaction).
@@ -69,10 +69,10 @@ LOG CATEGORIES (examples):
     • shell               - ShellExecutor
 
 QUICK START:
-    vtlog -n 100             Show last 100 lines from all components
-    vtlog -f                 Follow logs in real-time
-    vtlog -e                 Show only errors
-    vtlog -c ServerManager   Show logs from ServerManager only
+    clawlog -n 100             Show last 100 lines from all components
+    clawlog -f                 Follow logs in real-time
+    clawlog -e                 Show only errors
+    clawlog -c ServerManager   Show logs from ServerManager only
 
 OPTIONS:
     -h, --help              Show this help message
@@ -91,15 +91,15 @@ OPTIONS:
     --json                  Output in JSON format
 
 EXAMPLES:
-    vtlog                   Show last 50 lines from past 5 minutes (default)
-    vtlog -f                Stream logs continuously
-    vtlog -n 100            Show last 100 lines
-    vtlog -e                Show only recent errors
-    vtlog -l 30m -n 200     Show last 200 lines from past 30 minutes
-    vtlog -c ServerManager  Show recent ServerManager logs
-    vtlog -s "fail"         Search for "fail" in recent logs
-    vtlog --server -e       Show recent server errors
-    vtlog -f -d             Stream debug logs continuously
+    clawlog                   Show last 50 lines from past 5 minutes (default)
+    clawlog -f                Stream logs continuously
+    clawlog -n 100            Show last 100 lines
+    clawlog -e                Show only recent errors
+    clawlog -l 30m -n 200     Show last 200 lines from past 30 minutes
+    clawlog -c ServerManager  Show recent ServerManager logs
+    clawlog -s "fail"         Search for "fail" in recent logs
+    clawlog --server -e       Show recent server errors
+    clawlog -f -d             Stream debug logs continuously
 
 CATEGORIES:
     Common categories include:

scripts/run-node.mjs

@@ -7,6 +7,8 @@ import process from "node:process";
 const args = process.argv.slice(2);
 const env = { ...process.env };
 const cwd = process.cwd();
+const compiler = env.CLAWDBOT_TS_COMPILER === "tsc" ? "tsc" : "tsgo";
+const projectArgs = ["--project", "tsconfig.json"];
 
 const distRoot = path.join(cwd, "dist");
 const distEntry = path.join(distRoot, "entry.js");
@@ -110,11 +112,10 @@ const writeBuildStamp = () => {
 };
 
 if (!shouldBuild()) {
-  logRunner("Skipping build; dist is fresh.");
   runNode();
 } else {
   logRunner("Building TypeScript (dist is stale).");
-  const build = spawn("pnpm", ["exec", "tsc", "-p", "tsconfig.json"], {
+  const build = spawn("pnpm", ["exec", compiler, ...projectArgs], {
     cwd,
     env,
     stdio: "inherit",

scripts/watch-node.mjs

@@ -5,8 +5,10 @@ import process from "node:process";
 const args = process.argv.slice(2);
 const env = { ...process.env };
 const cwd = process.cwd();
+const compiler = env.CLAWDBOT_TS_COMPILER === "tsc" ? "tsc" : "tsgo";
+const projectArgs = ["--project", "tsconfig.json"];
 
-const initialBuild = spawnSync("pnpm", ["exec", "tsc", "-p", "tsconfig.json"], {
+const initialBuild = spawnSync("pnpm", ["exec", compiler, ...projectArgs], {
   cwd,
   env,
   stdio: "inherit",
@@ -16,7 +18,12 @@ if (initialBuild.status !== 0) {
   process.exit(initialBuild.status ?? 1);
 }
 
-const tsc = spawn("pnpm", ["exec", "tsc", "--watch", "--preserveWatchOutput"], {
+const watchArgs =
+  compiler === "tsc"
+    ? [...projectArgs, "--watch", "--preserveWatchOutput"]
+    : [...projectArgs, "--watch"];
+
+const compilerProcess = spawn("pnpm", ["exec", compiler, ...watchArgs], {
   cwd,
   env,
   stdio: "inherit",
@@ -34,14 +41,14 @@ function cleanup(code = 0) {
   if (exiting) return;
   exiting = true;
   nodeProcess.kill("SIGTERM");
-  tsc.kill("SIGTERM");
+  compilerProcess.kill("SIGTERM");
   process.exit(code);
 }
 
 process.on("SIGINT", () => cleanup(130));
 process.on("SIGTERM", () => cleanup(143));
 
-tsc.on("exit", (code) => {
+compilerProcess.on("exit", (code) => {
   if (exiting) return;
   cleanup(code ?? 1);
 });

skills/coding-agent/SKILL.md

@@ -76,7 +76,7 @@ bash pty:true workdir:~/project background:true command:"codex exec --full-auto
 # Monitor progress
 process action:log sessionId:XXX
 
-# Check if done  
+# Check if done
 process action:poll sessionId:XXX
 
 # Send input (if agent asks a question)
@@ -217,15 +217,55 @@ git worktree remove /tmp/issue-99
 
 ## ⚠️ Rules
 
-1. **Always use pty:true** — coding agents need a terminal!
-2. **Respect tool choice** — if user asks for Codex, use Codex. NEVER offer to build it yourself!
-3. **Be patient** — don't kill sessions because they're "slow"
-4. **Monitor with process:log** — check progress without interfering
-5. **--full-auto for building** — auto-approves changes
-6. **vanilla for reviewing** — no special flags needed
-7. **Parallel is OK** — run many Codex processes at once for batch work
-8. **NEVER start Codex in ~/clawd/** — it'll read your soul docs and get weird ideas about the org chart!
-9. **NEVER checkout branches in ~/Projects/clawdbot/** — that's the LIVE Clawdbot instance!
+1. **Always use pty:true** - coding agents need a terminal!
+2. **Respect tool choice** - if user asks for Codex, use Codex.
+   - Orchestrator mode: do NOT hand-code patches yourself.
+   - If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over.
+3. **Be patient** - don't kill sessions because they're "slow"
+4. **Monitor with process:log** - check progress without interfering
+5. **--full-auto for building** - auto-approves changes
+6. **vanilla for reviewing** - no special flags needed
+7. **Parallel is OK** - run many Codex processes at once for batch work
+8. **NEVER start Codex in ~/clawd/** - it'll read your soul docs and get weird ideas about the org chart!
+9. **NEVER checkout branches in ~/Projects/clawdbot/** - that's the LIVE Clawdbot instance!
+
+---
+
+## Progress Updates (Critical)
+
+When you spawn coding agents in the background, keep the user in the loop.
+
+- Send 1 short message when you start (what's running + where).
+- Then only update again when something changes:
+  - a milestone completes (build finished, tests passed)
+  - the agent asks a question / needs input
+  - you hit an error or need user action
+  - the agent finishes (include what changed + where)
+- If you kill a session, immediately say you killed it and why.
+
+This prevents the user from seeing only "Agent failed before reply" and having no idea what happened.
+
+---
+
+## Auto-Notify on Completion
+
+For long-running background tasks, append a wake trigger to your prompt so Clawdbot gets notified immediately when the agent finishes (instead of waiting for the next heartbeat):
+
+```
+... your task here.
+
+When completely finished, run this command to notify me:
+clawdbot gateway wake --text "Done: [brief summary of what was built]" --mode now
+```
+
+**Example:**
+```bash
+bash pty:true workdir:~/project background:true command:"codex --yolo exec 'Build a REST API for todos.
+
+When completely finished, run: clawdbot gateway wake --text \"Done: Built todos REST API with CRUD endpoints\" --mode now'"
+```
+
+This triggers an immediate wake event — Skippy gets pinged in seconds, not 10 minutes.
 
 ---
 

src/agents/auth-profiles/session-override.test.ts

@@ -0,0 +1,61 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+import type { ClawdbotConfig } from "../../config/config.js";
+import type { SessionEntry } from "../../config/sessions.js";
+import { resolveSessionAuthProfileOverride } from "./session-override.js";
+
+async function writeAuthStore(agentDir: string) {
+  const authPath = path.join(agentDir, "auth-profiles.json");
+  const payload = {
+    version: 1,
+    profiles: {
+      "zai:work": { type: "api_key", provider: "zai", key: "sk-test" },
+    },
+    order: {
+      zai: ["zai:work"],
+    },
+  };
+  await fs.writeFile(authPath, JSON.stringify(payload), "utf-8");
+}
+
+describe("resolveSessionAuthProfileOverride", () => {
+  it("keeps user override when provider alias differs", async () => {
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-auth-"));
+    const prevStateDir = process.env.CLAWDBOT_STATE_DIR;
+    process.env.CLAWDBOT_STATE_DIR = tmpDir;
+    try {
+      const agentDir = path.join(tmpDir, "agent");
+      await fs.mkdir(agentDir, { recursive: true });
+      await writeAuthStore(agentDir);
+
+      const sessionEntry: SessionEntry = {
+        sessionId: "s1",
+        updatedAt: Date.now(),
+        authProfileOverride: "zai:work",
+        authProfileOverrideSource: "user",
+      };
+      const sessionStore = { "agent:main:main": sessionEntry };
+
+      const resolved = await resolveSessionAuthProfileOverride({
+        cfg: {} as ClawdbotConfig,
+        provider: "z.ai",
+        agentDir,
+        sessionEntry,
+        sessionStore,
+        sessionKey: "agent:main:main",
+        storePath: undefined,
+        isNewSession: false,
+      });
+
+      expect(resolved).toBe("zai:work");
+      expect(sessionEntry.authProfileOverride).toBe("zai:work");
+    } finally {
+      if (prevStateDir === undefined) delete process.env.CLAWDBOT_STATE_DIR;
+      else process.env.CLAWDBOT_STATE_DIR = prevStateDir;
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+});

src/agents/auth-profiles/session-override.ts

@@ -0,0 +1,139 @@
+import type { ClawdbotConfig } from "../../config/config.js";
+import { updateSessionStore, type SessionEntry } from "../../config/sessions.js";
+import { normalizeProviderId } from "../model-selection.js";
+import {
+  ensureAuthProfileStore,
+  isProfileInCooldown,
+  resolveAuthProfileOrder,
+} from "../auth-profiles.js";
+
+function isProfileForProvider(params: {
+  provider: string;
+  profileId: string;
+  store: ReturnType<typeof ensureAuthProfileStore>;
+}): boolean {
+  const entry = params.store.profiles[params.profileId];
+  if (!entry?.provider) return false;
+  return normalizeProviderId(entry.provider) === normalizeProviderId(params.provider);
+}
+
+export async function clearSessionAuthProfileOverride(params: {
+  sessionEntry: SessionEntry;
+  sessionStore: Record<string, SessionEntry>;
+  sessionKey: string;
+  storePath?: string;
+}) {
+  const { sessionEntry, sessionStore, sessionKey, storePath } = params;
+  delete sessionEntry.authProfileOverride;
+  delete sessionEntry.authProfileOverrideSource;
+  delete sessionEntry.authProfileOverrideCompactionCount;
+  sessionEntry.updatedAt = Date.now();
+  sessionStore[sessionKey] = sessionEntry;
+  if (storePath) {
+    await updateSessionStore(storePath, (store) => {
+      store[sessionKey] = sessionEntry;
+    });
+  }
+}
+
+export async function resolveSessionAuthProfileOverride(params: {
+  cfg: ClawdbotConfig;
+  provider: string;
+  agentDir: string;
+  sessionEntry?: SessionEntry;
+  sessionStore?: Record<string, SessionEntry>;
+  sessionKey?: string;
+  storePath?: string;
+  isNewSession: boolean;
+}): Promise<string | undefined> {
+  const {
+    cfg,
+    provider,
+    agentDir,
+    sessionEntry,
+    sessionStore,
+    sessionKey,
+    storePath,
+    isNewSession,
+  } = params;
+  if (!sessionEntry || !sessionStore || !sessionKey) return sessionEntry?.authProfileOverride;
+
+  const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
+  const order = resolveAuthProfileOrder({ cfg, store, provider });
+  let current = sessionEntry.authProfileOverride?.trim();
+
+  if (current && !store.profiles[current]) {
+    await clearSessionAuthProfileOverride({ sessionEntry, sessionStore, sessionKey, storePath });
+    current = undefined;
+  }
+
+  if (current && !isProfileForProvider({ provider, profileId: current, store })) {
+    await clearSessionAuthProfileOverride({ sessionEntry, sessionStore, sessionKey, storePath });
+    current = undefined;
+  }
+
+  if (current && order.length > 0 && !order.includes(current)) {
+    await clearSessionAuthProfileOverride({ sessionEntry, sessionStore, sessionKey, storePath });
+    current = undefined;
+  }
+
+  if (order.length === 0) return undefined;
+
+  const pickFirstAvailable = () =>
+    order.find((profileId) => !isProfileInCooldown(store, profileId)) ?? order[0];
+  const pickNextAvailable = (active: string) => {
+    const startIndex = order.indexOf(active);
+    if (startIndex < 0) return pickFirstAvailable();
+    for (let offset = 1; offset <= order.length; offset += 1) {
+      const candidate = order[(startIndex + offset) % order.length];
+      if (!isProfileInCooldown(store, candidate)) return candidate;
+    }
+    return order[startIndex] ?? order[0];
+  };
+
+  const compactionCount = sessionEntry.compactionCount ?? 0;
+  const storedCompaction =
+    typeof sessionEntry.authProfileOverrideCompactionCount === "number"
+      ? sessionEntry.authProfileOverrideCompactionCount
+      : compactionCount;
+
+  const source =
+    sessionEntry.authProfileOverrideSource ??
+    (typeof sessionEntry.authProfileOverrideCompactionCount === "number"
+      ? "auto"
+      : current
+        ? "user"
+        : undefined);
+  if (source === "user" && current && !isNewSession) {
+    return current;
+  }
+
+  let next = current;
+  if (isNewSession) {
+    next = current ? pickNextAvailable(current) : pickFirstAvailable();
+  } else if (current && compactionCount > storedCompaction) {
+    next = pickNextAvailable(current);
+  } else if (!current || isProfileInCooldown(store, current)) {
+    next = pickFirstAvailable();
+  }
+
+  if (!next) return current;
+  const shouldPersist =
+    next !== sessionEntry.authProfileOverride ||
+    sessionEntry.authProfileOverrideSource !== "auto" ||
+    sessionEntry.authProfileOverrideCompactionCount !== compactionCount;
+  if (shouldPersist) {
+    sessionEntry.authProfileOverride = next;
+    sessionEntry.authProfileOverrideSource = "auto";
+    sessionEntry.authProfileOverrideCompactionCount = compactionCount;
+    sessionEntry.updatedAt = Date.now();
+    sessionStore[sessionKey] = sessionEntry;
+    if (storePath) {
+      await updateSessionStore(storePath, (store) => {
+        store[sessionKey] = sessionEntry;
+      });
+    }
+  }
+
+  return next;
+}

src/agents/bash-tools.exec.ts

@@ -400,7 +400,7 @@ export function createExecTool(
         host = "gateway";
       }
 
-      const configuredSecurity = defaults?.security ?? "deny";
+      const configuredSecurity = defaults?.security ?? (host === "sandbox" ? "deny" : "allowlist");
       const requestedSecurity = normalizeExecSecurity(params.security);
       let security = minSecurity(configuredSecurity, requestedSecurity ?? configuredSecurity);
       if (elevatedRequested) {
@@ -447,7 +447,10 @@ export function createExecTool(
       applyPathPrepend(env, defaultPathPrepend);
 
       if (host === "node") {
-        const approvals = resolveExecApprovals(defaults?.agentId);
+        const approvals = resolveExecApprovals(
+          defaults?.agentId,
+          host === "node" ? { security: "allowlist" } : undefined,
+        );
         const hostSecurity = minSecurity(security, approvals.agent.security);
         const hostAsk = maxAsk(ask, approvals.agent.ask);
         const askFallback = approvals.agent.askFallback;
@@ -491,12 +494,7 @@ export function createExecTool(
         if (nodeEnv) {
           applyPathPrepend(nodeEnv, defaultPathPrepend, { requireExisting: true });
         }
-        const resolution = resolveCommandResolution(params.command, workdir, env);
-        const allowlistMatch =
-          hostSecurity === "allowlist" ? matchAllowlist(approvals.allowlist, resolution) : null;
-        const requiresAsk =
-          hostAsk === "always" ||
-          (hostAsk === "on-miss" && hostSecurity === "allowlist" && !allowlistMatch);
+        const requiresAsk = hostAsk === "always" || hostAsk === "on-miss";
 
         let approvedByAsk = false;
         let approvalDecision: "allow-once" | "allow-always" | null = null;
@@ -511,7 +509,7 @@ export function createExecTool(
               security: hostSecurity,
               ask: hostAsk,
               agentId: defaults?.agentId,
-              resolvedPath: resolution?.resolvedPath ?? null,
+              resolvedPath: null,
               sessionKey: defaults?.sessionKey ?? null,
               timeoutMs: 120_000,
             },
@@ -529,11 +527,7 @@ export function createExecTool(
               approvedByAsk = true;
               approvalDecision = "allow-once";
             } else if (askFallback === "allowlist") {
-              if (!allowlistMatch) {
-                throw new Error("exec denied: approval required (approval UI not available)");
-              }
-              approvedByAsk = true;
-              approvalDecision = "allow-once";
+              // Defer allowlist enforcement to the node host.
             } else {
               throw new Error("exec denied: approval required (approval UI not available)");
             }
@@ -545,32 +539,8 @@ export function createExecTool(
           if (decision === "allow-always") {
             approvedByAsk = true;
             approvalDecision = "allow-always";
-            if (hostSecurity === "allowlist") {
-              const pattern =
-                resolution?.resolvedPath ??
-                resolution?.rawExecutable ??
-                params.command.split(/\s+/).shift() ??
-                "";
-              if (pattern) {
-                addAllowlistEntry(approvals.file, defaults?.agentId, pattern);
-              }
-            }
           }
         }
-
-        if (hostSecurity === "allowlist" && !allowlistMatch && !approvedByAsk) {
-          throw new Error("exec denied: allowlist miss");
-        }
-
-        if (allowlistMatch) {
-          recordAllowlistUse(
-            approvals.file,
-            defaults?.agentId,
-            allowlistMatch,
-            params.command,
-            resolution?.resolvedPath,
-          );
-        }
         const invokeParams: Record<string, unknown> = {
           nodeId,
           command: "system.run",
@@ -616,7 +586,7 @@ export function createExecTool(
       }
 
       if (host === "gateway") {
-        const approvals = resolveExecApprovals(defaults?.agentId);
+        const approvals = resolveExecApprovals(defaults?.agentId, { security: "allowlist" });
         const hostSecurity = minSecurity(security, approvals.agent.security);
         const hostAsk = maxAsk(ask, approvals.agent.ask);
         const askFallback = approvals.agent.askFallback;

src/agents/pi-embedded-runner.run-embedded-pi-agent.auth-profile-rotation.test.ts

@@ -92,13 +92,16 @@ const makeConfig = (): ClawdbotConfig =>
     },
   }) satisfies ClawdbotConfig;
 
-const writeAuthStore = async (agentDir: string) => {
+const writeAuthStore = async (agentDir: string, opts?: { includeAnthropic?: boolean }) => {
   const authPath = path.join(agentDir, "auth-profiles.json");
   const payload = {
     version: 1,
     profiles: {
       "openai:p1": { type: "api_key", provider: "openai", key: "sk-one" },
       "openai:p2": { type: "api_key", provider: "openai", key: "sk-two" },
+      ...(opts?.includeAnthropic
+        ? { "anthropic:default": { type: "api_key", provider: "anthropic", key: "sk-anth" } }
+        : {}),
     },
     usageStats: {
       "openai:p1": { lastUsed: 1 },
@@ -206,4 +209,43 @@ describe("runEmbeddedPiAgent auth profile rotation", () => {
       await fs.rm(workspaceDir, { recursive: true, force: true });
     }
   });
+
+  it("ignores user-locked profile when provider mismatches", async () => {
+    const agentDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-agent-"));
+    const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-workspace-"));
+    try {
+      await writeAuthStore(agentDir, { includeAnthropic: true });
+
+      runEmbeddedAttemptMock.mockResolvedValueOnce(
+        makeAttempt({
+          assistantTexts: ["ok"],
+          lastAssistant: buildAssistant({
+            stopReason: "stop",
+            content: [{ type: "text", text: "ok" }],
+          }),
+        }),
+      );
+
+      await runEmbeddedPiAgent({
+        sessionId: "session:test",
+        sessionKey: "agent:test:mismatch",
+        sessionFile: path.join(workspaceDir, "session.jsonl"),
+        workspaceDir,
+        agentDir,
+        config: makeConfig(),
+        prompt: "hello",
+        provider: "openai",
+        model: "mock-1",
+        authProfileId: "anthropic:default",
+        authProfileIdSource: "user",
+        timeoutMs: 5_000,
+        runId: "run:mismatch",
+      });
+
+      expect(runEmbeddedAttemptMock).toHaveBeenCalledTimes(1);
+    } finally {
+      await fs.rm(agentDir, { recursive: true, force: true });
+      await fs.rm(workspaceDir, { recursive: true, force: true });
+    }
+  });
 });

src/agents/pi-embedded-runner/run.ts

@@ -23,6 +23,7 @@ import {
   resolveAuthProfileOrder,
   type ResolvedProviderAuth,
 } from "../model-auth.js";
+import { normalizeProviderId } from "../model-selection.js";
 import { ensureClawdbotModelsJson } from "../models-config.js";
 import {
   classifyFailoverReason,
@@ -116,8 +117,16 @@ export async function runEmbeddedPiAgent(
 
       const authStore = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
       const preferredProfileId = params.authProfileId?.trim();
-      const lockedProfileId =
-        params.authProfileIdSource === "user" ? preferredProfileId : undefined;
+      let lockedProfileId = params.authProfileIdSource === "user" ? preferredProfileId : undefined;
+      if (lockedProfileId) {
+        const lockedProfile = authStore.profiles[lockedProfileId];
+        if (
+          !lockedProfile ||
+          normalizeProviderId(lockedProfile.provider) !== normalizeProviderId(provider)
+        ) {
+          lockedProfileId = undefined;
+        }
+      }
       const profileOrder = resolveAuthProfileOrder({
         cfg: params.config,
         store: authStore,

src/agents/pi-embedded-subscribe.handlers.types.ts

@@ -39,6 +39,10 @@ export type EmbeddedPiSubscribeState = {
   lastStreamedAssistant?: string;
   lastStreamedReasoning?: string;
   lastBlockReplyText?: string;
+  assistantMessageIndex: number;
+  lastAssistantTextMessageIndex: number;
+  lastAssistantTextNormalized?: string;
+  lastAssistantTextTrimmed?: string;
   assistantTextBaseline: number;
   suppressBlockChunks: boolean;
   lastReasoningSent?: string;

src/agents/pi-embedded-subscribe.subscribe-embedded-pi-session.does-not-emit-duplicate-block-replies-text.test.ts

@@ -86,6 +86,35 @@ describe("subscribeEmbeddedPiSession", () => {
 
     expect(subscription.assistantTexts).toEqual(["Hello world"]);
   });
+  it("does not duplicate assistantTexts when message_end repeats with trailing whitespace changes", () => {
+    let handler: SessionEventHandler | undefined;
+    const session: StubSession = {
+      subscribe: (fn) => {
+        handler = fn;
+        return () => {};
+      },
+    };
+
+    const subscription = subscribeEmbeddedPiSession({
+      session: session as unknown as Parameters<typeof subscribeEmbeddedPiSession>[0]["session"],
+      runId: "run",
+    });
+
+    const assistantMessageWithNewline = {
+      role: "assistant",
+      content: [{ type: "text", text: "Hello world\n" }],
+    } as AssistantMessage;
+
+    const assistantMessageTrimmed = {
+      role: "assistant",
+      content: [{ type: "text", text: "Hello world" }],
+    } as AssistantMessage;
+
+    handler?.({ type: "message_end", message: assistantMessageWithNewline });
+    handler?.({ type: "message_end", message: assistantMessageTrimmed });
+
+    expect(subscription.assistantTexts).toEqual(["Hello world"]);
+  });
   it("does not duplicate assistantTexts when message_end repeats with reasoning blocks", () => {
     let handler: SessionEventHandler | undefined;
     const session: StubSession = {

src/agents/pi-embedded-subscribe.ts

@@ -48,6 +48,10 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
     lastStreamedAssistant: undefined,
     lastStreamedReasoning: undefined,
     lastBlockReplyText: undefined,
+    assistantMessageIndex: 0,
+    lastAssistantTextMessageIndex: -1,
+    lastAssistantTextNormalized: undefined,
+    lastAssistantTextTrimmed: undefined,
     assistantTextBaseline: 0,
     suppressBlockChunks: false, // Avoid late chunk inserts after final text merge.
     lastReasoningSent: undefined,
@@ -84,9 +88,36 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
     state.lastStreamedReasoning = undefined;
     state.lastReasoningSent = undefined;
     state.suppressBlockChunks = false;
+    state.assistantMessageIndex += 1;
+    state.lastAssistantTextMessageIndex = -1;
+    state.lastAssistantTextNormalized = undefined;
+    state.lastAssistantTextTrimmed = undefined;
     state.assistantTextBaseline = nextAssistantTextBaseline;
   };
 
+  const rememberAssistantText = (text: string) => {
+    state.lastAssistantTextMessageIndex = state.assistantMessageIndex;
+    state.lastAssistantTextTrimmed = text.trimEnd();
+    const normalized = normalizeTextForComparison(text);
+    state.lastAssistantTextNormalized = normalized.length > 0 ? normalized : undefined;
+  };
+
+  const shouldSkipAssistantText = (text: string) => {
+    if (state.lastAssistantTextMessageIndex !== state.assistantMessageIndex) return false;
+    const trimmed = text.trimEnd();
+    if (trimmed && trimmed === state.lastAssistantTextTrimmed) return true;
+    const normalized = normalizeTextForComparison(text);
+    if (normalized.length > 0 && normalized === state.lastAssistantTextNormalized) return true;
+    return false;
+  };
+
+  const pushAssistantText = (text: string) => {
+    if (!text) return;
+    if (shouldSkipAssistantText(text)) return;
+    assistantTexts.push(text);
+    rememberAssistantText(text);
+  };
+
   const finalizeAssistantTexts = (args: {
     text: string;
     addedDuringMessage: boolean;
@@ -103,16 +134,15 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
           assistantTexts.length - state.assistantTextBaseline,
           text,
         );
+        rememberAssistantText(text);
       } else {
-        const last = assistantTexts.at(-1);
-        if (!last || last !== text) assistantTexts.push(text);
+        pushAssistantText(text);
       }
       state.suppressBlockChunks = true;
     } else if (!addedDuringMessage && !chunkerHasBuffered && text) {
       // Non-streaming models (no text_delta): ensure assistantTexts gets the final
       // text when the chunker has nothing buffered to drain.
-      const last = assistantTexts.at(-1);
-      if (!last || last !== text) assistantTexts.push(text);
+      pushAssistantText(text);
     }
 
     state.assistantTextBaseline = assistantTexts.length;
@@ -338,8 +368,11 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
       return;
     }
 
+    if (shouldSkipAssistantText(chunk)) return;
+
     state.lastBlockReplyText = chunk;
     assistantTexts.push(chunk);
+    rememberAssistantText(chunk);
     if (!params.onBlockReply) return;
     const splitResult = parseReplyDirectives(chunk);
     const {

src/agents/skills-install.ts

@@ -34,6 +34,10 @@ export type SkillInstallResult = {
   code: number | null;
 };
 
+function isNodeReadableStream(value: unknown): value is NodeJS.ReadableStream {
+  return Boolean(value && typeof (value as NodeJS.ReadableStream).pipe === "function");
+}
+
 function summarizeInstallOutput(text: string): string | undefined {
   const raw = text.trim();
   if (!raw) return undefined;
@@ -154,13 +158,10 @@ async function downloadFile(
     }
     await ensureDir(path.dirname(destPath));
     const file = fs.createWriteStream(destPath);
-    const body = response.body;
-    // Node's Readable.fromWeb expects the node:stream/web type; cast through unknown for DOM streams.
-    const nodeStream = body as unknown as NodeJS.ReadableStream;
-    const readable =
-      typeof nodeStream.pipe === "function"
-        ? nodeStream
-        : Readable.fromWeb(body as unknown as NodeReadableStream);
+    const body = response.body as unknown;
+    const readable = isNodeReadableStream(body)
+      ? body
+      : Readable.fromWeb(body as NodeReadableStream);
     await pipeline(readable, file);
     const stat = await fs.promises.stat(destPath);
     return { bytes: stat.size };

src/agents/tools/browser-tool.test.ts

@@ -49,9 +49,10 @@ const browserConfigMocks = vi.hoisted(() => ({
 }));
 vi.mock("../../browser/config.js", () => browserConfigMocks);
 
-vi.mock("../../config/config.js", () => ({
+const configMocks = vi.hoisted(() => ({
   loadConfig: vi.fn(() => ({ browser: {} })),
 }));
+vi.mock("../../config/config.js", () => configMocks);
 
 const toolCommonMocks = vi.hoisted(() => ({
   imageResultFromFile: vi.fn(),
@@ -70,11 +71,12 @@ import { createBrowserTool } from "./browser-tool.js";
 describe("browser tool snapshot maxChars", () => {
   afterEach(() => {
     vi.clearAllMocks();
+    configMocks.loadConfig.mockReturnValue({ browser: {} });
   });
 
   it("applies the default ai snapshot limit", async () => {
     const tool = createBrowserTool();
-    await tool.execute?.(null, { action: "snapshot", format: "ai" });
+    await tool.execute?.(null, { action: "snapshot", snapshotFormat: "ai" });
 
     expect(browserClientMocks.browserSnapshot).toHaveBeenCalledWith(
       "http://127.0.0.1:18791",
@@ -90,7 +92,7 @@ describe("browser tool snapshot maxChars", () => {
     const override = 2_000;
     await tool.execute?.(null, {
       action: "snapshot",
-      format: "ai",
+      snapshotFormat: "ai",
       maxChars: override,
     });
 
@@ -106,7 +108,7 @@ describe("browser tool snapshot maxChars", () => {
     const tool = createBrowserTool();
     await tool.execute?.(null, {
       action: "snapshot",
-      format: "ai",
+      snapshotFormat: "ai",
       maxChars: 0,
     });
 
@@ -124,7 +126,7 @@ describe("browser tool snapshot maxChars", () => {
 
   it("passes refs mode through to browser snapshot", async () => {
     const tool = createBrowserTool();
-    await tool.execute?.(null, { action: "snapshot", format: "ai", refs: "aria" });
+    await tool.execute?.(null, { action: "snapshot", snapshotFormat: "ai", refs: "aria" });
 
     expect(browserClientMocks.browserSnapshot).toHaveBeenCalledWith(
       "http://127.0.0.1:18791",
@@ -135,9 +137,36 @@ describe("browser tool snapshot maxChars", () => {
     );
   });
 
+  it("uses config snapshot defaults when mode is not provided", async () => {
+    configMocks.loadConfig.mockReturnValue({
+      browser: { snapshotDefaults: { mode: "efficient" } },
+    });
+    const tool = createBrowserTool();
+    await tool.execute?.(null, { action: "snapshot", snapshotFormat: "ai" });
+
+    expect(browserClientMocks.browserSnapshot).toHaveBeenCalledWith(
+      "http://127.0.0.1:18791",
+      expect.objectContaining({
+        mode: "efficient",
+      }),
+    );
+  });
+
+  it("does not apply config snapshot defaults to aria snapshots", async () => {
+    configMocks.loadConfig.mockReturnValue({
+      browser: { snapshotDefaults: { mode: "efficient" } },
+    });
+    const tool = createBrowserTool();
+    await tool.execute?.(null, { action: "snapshot", snapshotFormat: "aria" });
+
+    expect(browserClientMocks.browserSnapshot).toHaveBeenCalled();
+    const [, opts] = browserClientMocks.browserSnapshot.mock.calls.at(-1) ?? [];
+    expect(opts?.mode).toBeUndefined();
+  });
+
   it("defaults to host when using profile=chrome (even in sandboxed sessions)", async () => {
     const tool = createBrowserTool({ defaultControlUrl: "http://127.0.0.1:9999" });
-    await tool.execute?.(null, { action: "snapshot", profile: "chrome", format: "ai" });
+    await tool.execute?.(null, { action: "snapshot", profile: "chrome", snapshotFormat: "ai" });
 
     expect(browserClientMocks.browserSnapshot).toHaveBeenCalledWith(
       "http://127.0.0.1:18791",
@@ -151,6 +180,7 @@ describe("browser tool snapshot maxChars", () => {
 describe("browser tool snapshot labels", () => {
   afterEach(() => {
     vi.clearAllMocks();
+    configMocks.loadConfig.mockReturnValue({ browser: {} });
   });
 
   it("returns image + text when labels are requested", async () => {
@@ -175,7 +205,7 @@ describe("browser tool snapshot labels", () => {
 
     const result = await tool.execute?.(null, {
       action: "snapshot",
-      format: "ai",
+      snapshotFormat: "ai",
       labels: true,
     });
 

src/agents/tools/browser-tool.ts

@@ -190,11 +190,17 @@ export function createBrowserTool(opts?: {
           return jsonResult({ ok: true });
         }
         case "snapshot": {
+          const snapshotDefaults = loadConfig().browser?.snapshotDefaults;
           const format =
             params.snapshotFormat === "ai" || params.snapshotFormat === "aria"
               ? (params.snapshotFormat as "ai" | "aria")
               : "ai";
-          const mode = params.mode === "efficient" ? "efficient" : undefined;
+          const mode =
+            params.mode === "efficient"
+              ? "efficient"
+              : format === "ai" && snapshotDefaults?.mode === "efficient"
+                ? "efficient"
+                : undefined;
           const labels = typeof params.labels === "boolean" ? params.labels : undefined;
           const refs = params.refs === "aria" || params.refs === "role" ? params.refs : undefined;
           const hasMaxChars = Object.hasOwn(params, "maxChars");

src/agents/tools/session-status-tool.ts

@@ -36,6 +36,7 @@ import {
   DEFAULT_AGENT_ID,
   resolveAgentIdFromSessionKey,
 } from "../../routing/session-key.js";
+import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import type { AnyAgentTool } from "./common.js";
 import { readStringParam } from "./common.js";
 import { resolveInternalSessionKey, resolveMainSessionAlias } from "./sessions-helpers.js";
@@ -240,6 +241,7 @@ export function createSessionStatusTool(opts?: {
         throw new Error(`Unknown sessionKey: ${requestedKeyRaw}`);
       }
 
+      const configured = resolveDefaultModelForAgent({ cfg, agentId });
       const modelRaw = readStringParam(params, "model");
       let changedModel = false;
       if (typeof modelRaw === "string") {
@@ -249,33 +251,33 @@ export function createSessionStatusTool(opts?: {
           sessionEntry: resolved.entry,
           agentId,
         });
-        const nextEntry: SessionEntry = {
-          ...resolved.entry,
-          updatedAt: Date.now(),
-        };
-        if (selection.kind === "reset" || selection.isDefault) {
-          delete nextEntry.providerOverride;
-          delete nextEntry.modelOverride;
-          delete nextEntry.authProfileOverride;
-          delete nextEntry.authProfileOverrideSource;
-          delete nextEntry.authProfileOverrideCompactionCount;
-        } else {
-          nextEntry.providerOverride = selection.provider;
-          nextEntry.modelOverride = selection.model;
-          delete nextEntry.authProfileOverride;
-          delete nextEntry.authProfileOverrideSource;
-          delete nextEntry.authProfileOverrideCompactionCount;
-        }
-        store[resolved.key] = nextEntry;
-        await updateSessionStore(storePath, (nextStore) => {
-          nextStore[resolved.key] = nextEntry;
+        const nextEntry: SessionEntry = { ...resolved.entry };
+        const applied = applyModelOverrideToSessionEntry({
+          entry: nextEntry,
+          selection:
+            selection.kind === "reset"
+              ? {
+                  provider: configured.provider,
+                  model: configured.model,
+                  isDefault: true,
+                }
+              : {
+                  provider: selection.provider,
+                  model: selection.model,
+                  isDefault: selection.isDefault,
+                },
         });
-        resolved.entry = nextEntry;
-        changedModel = true;
+        if (applied.updated) {
+          store[resolved.key] = nextEntry;
+          await updateSessionStore(storePath, (nextStore) => {
+            nextStore[resolved.key] = nextEntry;
+          });
+          resolved.entry = nextEntry;
+          changedModel = true;
+        }
       }
 
       const agentDir = resolveAgentDir(cfg, agentId);
-      const configured = resolveDefaultModelForAgent({ cfg, agentId });
       const providerForCard = resolved.entry.providerOverride?.trim() || configured.provider;
       const usageProvider = resolveUsageProviderId(providerForCard);
       let usageLine: string | undefined;

src/agents/tools/web-fetch.ssrf.test.ts

@@ -0,0 +1,160 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const lookupMock = vi.fn();
+
+vi.mock("node:dns/promises", () => ({
+  lookup: lookupMock,
+}));
+
+function makeHeaders(map: Record<string, string>): { get: (key: string) => string | null } {
+  return {
+    get: (key) => map[key.toLowerCase()] ?? null,
+  };
+}
+
+function redirectResponse(location: string): Response {
+  return {
+    ok: false,
+    status: 302,
+    headers: makeHeaders({ location }),
+    body: { cancel: vi.fn() },
+  } as Response;
+}
+
+function textResponse(body: string): Response {
+  return {
+    ok: true,
+    status: 200,
+    headers: makeHeaders({ "content-type": "text/plain" }),
+    text: async () => body,
+  } as Response;
+}
+
+describe("web_fetch SSRF protection", () => {
+  const priorFetch = global.fetch;
+
+  afterEach(() => {
+    // @ts-expect-error restore
+    global.fetch = priorFetch;
+    lookupMock.mockReset();
+    vi.restoreAllMocks();
+  });
+
+  it("blocks localhost hostnames before fetch/firecrawl", async () => {
+    const fetchSpy = vi.fn();
+    // @ts-expect-error mock fetch
+    global.fetch = fetchSpy;
+
+    const { createWebFetchTool } = await import("./web-tools.js");
+    const tool = createWebFetchTool({
+      config: {
+        tools: {
+          web: {
+            fetch: {
+              cacheTtlMinutes: 0,
+              firecrawl: { apiKey: "firecrawl-test" },
+            },
+          },
+        },
+      },
+    });
+
+    await expect(tool?.execute?.("call", { url: "http://localhost/test" })).rejects.toThrow(
+      /Blocked hostname/i,
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(lookupMock).not.toHaveBeenCalled();
+  });
+
+  it("blocks private IP literals without DNS", async () => {
+    const fetchSpy = vi.fn();
+    // @ts-expect-error mock fetch
+    global.fetch = fetchSpy;
+
+    const { createWebFetchTool } = await import("./web-tools.js");
+    const tool = createWebFetchTool({
+      config: {
+        tools: { web: { fetch: { cacheTtlMinutes: 0, firecrawl: { enabled: false } } } },
+      },
+    });
+
+    await expect(tool?.execute?.("call", { url: "http://127.0.0.1/test" })).rejects.toThrow(
+      /private|internal|blocked/i,
+    );
+    await expect(tool?.execute?.("call", { url: "http://[::ffff:127.0.0.1]/" })).rejects.toThrow(
+      /private|internal|blocked/i,
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(lookupMock).not.toHaveBeenCalled();
+  });
+
+  it("blocks when DNS resolves to private addresses", async () => {
+    lookupMock.mockImplementation(async (hostname: string) => {
+      if (hostname === "public.test") {
+        return [{ address: "93.184.216.34", family: 4 }];
+      }
+      return [{ address: "10.0.0.5", family: 4 }];
+    });
+
+    const fetchSpy = vi.fn();
+    // @ts-expect-error mock fetch
+    global.fetch = fetchSpy;
+
+    const { createWebFetchTool } = await import("./web-tools.js");
+    const tool = createWebFetchTool({
+      config: {
+        tools: { web: { fetch: { cacheTtlMinutes: 0, firecrawl: { enabled: false } } } },
+      },
+    });
+
+    await expect(tool?.execute?.("call", { url: "https://private.test/resource" })).rejects.toThrow(
+      /private|internal|blocked/i,
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("blocks redirects to private hosts", async () => {
+    lookupMock.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+
+    const fetchSpy = vi.fn().mockResolvedValueOnce(redirectResponse("http://127.0.0.1/secret"));
+    // @ts-expect-error mock fetch
+    global.fetch = fetchSpy;
+
+    const { createWebFetchTool } = await import("./web-tools.js");
+    const tool = createWebFetchTool({
+      config: {
+        tools: {
+          web: {
+            fetch: { cacheTtlMinutes: 0, firecrawl: { apiKey: "firecrawl-test" } },
+          },
+        },
+      },
+    });
+
+    await expect(tool?.execute?.("call", { url: "https://example.com" })).rejects.toThrow(
+      /private|internal|blocked/i,
+    );
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("allows public hosts", async () => {
+    lookupMock.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+
+    const fetchSpy = vi.fn().mockResolvedValue(textResponse("ok"));
+    // @ts-expect-error mock fetch
+    global.fetch = fetchSpy;
+
+    const { createWebFetchTool } = await import("./web-tools.js");
+    const tool = createWebFetchTool({
+      config: {
+        tools: { web: { fetch: { cacheTtlMinutes: 0, firecrawl: { enabled: false } } } },
+      },
+    });
+
+    const result = await tool?.execute?.("call", { url: "https://example.com" });
+    expect(result?.details).toMatchObject({
+      status: 200,
+      extractor: "raw",
+    });
+  });
+});

src/agents/tools/web-fetch.ts

@@ -1,6 +1,7 @@
 import { Type } from "@sinclair/typebox";
 
 import type { ClawdbotConfig } from "../../config/config.js";
+import { assertPublicHostname, SsrFBlockedError } from "../../infra/net/ssrf.js";
 import { stringEnum } from "../schema/typebox.js";
 import type { AnyAgentTool } from "./common.js";
 import { jsonResult, readNumberParam, readStringParam } from "./common.js";
@@ -29,6 +30,7 @@ export { extractReadableContent } from "./web-fetch-utils.js";
 const EXTRACT_MODES = ["markdown", "text"] as const;
 
 const DEFAULT_FETCH_MAX_CHARS = 50_000;
+const DEFAULT_FETCH_MAX_REDIRECTS = 3;
 const DEFAULT_ERROR_MAX_CHARS = 4_000;
 const DEFAULT_FIRECRAWL_BASE_URL = "https://api.firecrawl.dev";
 const DEFAULT_FIRECRAWL_MAX_AGE_MS = 172_800_000;
@@ -144,6 +146,11 @@ function resolveMaxChars(value: unknown, fallback: number): number {
   return Math.max(100, Math.floor(parsed));
 }
 
+function resolveMaxRedirects(value: unknown, fallback: number): number {
+  const parsed = typeof value === "number" && Number.isFinite(value) ? value : fallback;
+  return Math.max(0, Math.floor(parsed));
+}
+
 function looksLikeHtml(value: string): boolean {
   const trimmed = value.trimStart();
   if (!trimmed) return false;
@@ -151,6 +158,68 @@ function looksLikeHtml(value: string): boolean {
   return head.startsWith("<!doctype html") || head.startsWith("<html");
 }
 
+function isRedirectStatus(status: number): boolean {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+
+async function fetchWithRedirects(params: {
+  url: string;
+  maxRedirects: number;
+  timeoutSeconds: number;
+  userAgent: string;
+}): Promise<{ response: Response; finalUrl: string }> {
+  const signal = withTimeout(undefined, params.timeoutSeconds * 1000);
+  const visited = new Set<string>();
+  let currentUrl = params.url;
+  let redirectCount = 0;
+
+  while (true) {
+    let parsedUrl: URL;
+    try {
+      parsedUrl = new URL(currentUrl);
+    } catch {
+      throw new Error("Invalid URL: must be http or https");
+    }
+    if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+      throw new Error("Invalid URL: must be http or https");
+    }
+
+    await assertPublicHostname(parsedUrl.hostname);
+
+    const res = await fetch(parsedUrl.toString(), {
+      method: "GET",
+      headers: {
+        Accept: "*/*",
+        "User-Agent": params.userAgent,
+        "Accept-Language": "en-US,en;q=0.9",
+      },
+      signal,
+      redirect: "manual",
+    });
+
+    if (isRedirectStatus(res.status)) {
+      const location = res.headers.get("location");
+      if (!location) {
+        throw new Error(`Redirect missing location header (${res.status})`);
+      }
+      redirectCount += 1;
+      if (redirectCount > params.maxRedirects) {
+        throw new Error(`Too many redirects (limit: ${params.maxRedirects})`);
+      }
+      const nextUrl = new URL(location, parsedUrl).toString();
+      if (visited.has(nextUrl)) {
+        throw new Error("Redirect loop detected");
+      }
+      visited.add(nextUrl);
+      void res.body?.cancel();
+      currentUrl = nextUrl;
+      continue;
+    }
+
+    return { response: res, finalUrl: currentUrl };
+  }
+}
+
 function formatWebFetchErrorDetail(params: {
   detail: string;
   contentType?: string | null;
@@ -247,6 +316,7 @@ async function runWebFetch(params: {
   url: string;
   extractMode: ExtractMode;
   maxChars: number;
+  maxRedirects: number;
   timeoutSeconds: number;
   cacheTtlMs: number;
   userAgent: string;
@@ -278,20 +348,23 @@ async function runWebFetch(params: {
 
   const start = Date.now();
   let res: Response;
+  let finalUrl = params.url;
   try {
-    res = await fetch(parsedUrl.toString(), {
-      method: "GET",
-      headers: {
-        Accept: "*/*",
-        "User-Agent": params.userAgent,
-        "Accept-Language": "en-US,en;q=0.9",
-      },
-      signal: withTimeout(undefined, params.timeoutSeconds * 1000),
+    const result = await fetchWithRedirects({
+      url: params.url,
+      maxRedirects: params.maxRedirects,
+      timeoutSeconds: params.timeoutSeconds,
+      userAgent: params.userAgent,
     });
+    res = result.response;
+    finalUrl = result.finalUrl;
   } catch (error) {
+    if (error instanceof SsrFBlockedError) {
+      throw error;
+    }
     if (params.firecrawlEnabled && params.firecrawlApiKey) {
       const firecrawl = await fetchFirecrawlContent({
-        url: params.url,
+        url: finalUrl,
         extractMode: params.extractMode,
         apiKey: params.firecrawlApiKey,
         baseUrl: params.firecrawlBaseUrl,
@@ -304,7 +377,7 @@ async function runWebFetch(params: {
       const truncated = truncateText(firecrawl.text, params.maxChars);
       const payload = {
         url: params.url,
-        finalUrl: firecrawl.finalUrl || params.url,
+        finalUrl: firecrawl.finalUrl || finalUrl,
         status: firecrawl.status ?? 200,
         contentType: "text/markdown",
         title: firecrawl.title,
@@ -339,7 +412,7 @@ async function runWebFetch(params: {
       const truncated = truncateText(firecrawl.text, params.maxChars);
       const payload = {
         url: params.url,
-        finalUrl: firecrawl.finalUrl || params.url,
+        finalUrl: firecrawl.finalUrl || finalUrl,
         status: firecrawl.status ?? res.status,
         contentType: "text/markdown",
         title: firecrawl.title,
@@ -374,7 +447,7 @@ async function runWebFetch(params: {
     if (params.readabilityEnabled) {
       const readable = await extractReadableContent({
         html: body,
-        url: res.url || params.url,
+        url: finalUrl,
         extractMode: params.extractMode,
       });
       if (readable?.text) {
@@ -382,7 +455,7 @@ async function runWebFetch(params: {
         title = readable.title;
         extractor = "readability";
       } else {
-        const firecrawl = await tryFirecrawlFallback(params);
+        const firecrawl = await tryFirecrawlFallback({ ...params, url: finalUrl });
         if (firecrawl) {
           text = firecrawl.text;
           title = firecrawl.title;
@@ -411,7 +484,7 @@ async function runWebFetch(params: {
   const truncated = truncateText(text, params.maxChars);
   const payload = {
     url: params.url,
-    finalUrl: res.url || params.url,
+    finalUrl,
     status: res.status,
     contentType,
     title,
@@ -508,6 +581,7 @@ export function createWebFetchTool(options?: {
         url,
         extractMode,
         maxChars: resolveMaxChars(maxChars ?? fetch?.maxChars, DEFAULT_FETCH_MAX_CHARS),
+        maxRedirects: resolveMaxRedirects(fetch?.maxRedirects, DEFAULT_FETCH_MAX_REDIRECTS),
         timeoutSeconds: resolveTimeoutSeconds(fetch?.timeoutSeconds, DEFAULT_TIMEOUT_SECONDS),
         cacheTtlMs: resolveCacheTtlMs(fetch?.cacheTtlMinutes, DEFAULT_CACHE_TTL_MINUTES),
         userAgent,

src/auto-reply/commands-registry.data.ts

@@ -157,6 +157,13 @@ function buildChatCommands(): ChatCommandDefinition[] {
       description: "Show current status.",
       textAlias: "/status",
     }),
+    defineChatCommand({
+      key: "allowlist",
+      description: "List/add/remove allowlist entries.",
+      textAlias: "/allowlist",
+      acceptsArgs: true,
+      scope: "text",
+    }),
     defineChatCommand({
       key: "context",
       nativeName: "context",

src/auto-reply/reply/agent-runner-helpers.ts

@@ -16,19 +16,21 @@ export const createShouldEmitToolResult = (params: {
   storePath?: string;
   resolvedVerboseLevel: VerboseLevel;
 }): (() => boolean) => {
+  // Normalize verbose values from session store/config so false/"false" still means off.
+  const fallbackVerbose = normalizeVerboseLevel(String(params.resolvedVerboseLevel ?? "")) ?? "off";
   return () => {
     if (!params.sessionKey || !params.storePath) {
-      return params.resolvedVerboseLevel !== "off";
+      return fallbackVerbose !== "off";
     }
     try {
       const store = loadSessionStore(params.storePath);
       const entry = store[params.sessionKey];
-      const current = normalizeVerboseLevel(entry?.verboseLevel);
+      const current = normalizeVerboseLevel(String(entry?.verboseLevel ?? ""));
       if (current) return current !== "off";
     } catch {
       // ignore store read failures
     }
-    return params.resolvedVerboseLevel !== "off";
+    return fallbackVerbose !== "off";
   };
 };
 
@@ -37,19 +39,21 @@ export const createShouldEmitToolOutput = (params: {
   storePath?: string;
   resolvedVerboseLevel: VerboseLevel;
 }): (() => boolean) => {
+  // Normalize verbose values from session store/config so false/"false" still means off.
+  const fallbackVerbose = normalizeVerboseLevel(String(params.resolvedVerboseLevel ?? "")) ?? "off";
   return () => {
     if (!params.sessionKey || !params.storePath) {
-      return params.resolvedVerboseLevel === "full";
+      return fallbackVerbose === "full";
     }
     try {
       const store = loadSessionStore(params.storePath);
       const entry = store[params.sessionKey];
-      const current = normalizeVerboseLevel(entry?.verboseLevel);
+      const current = normalizeVerboseLevel(String(entry?.verboseLevel ?? ""));
       if (current) return current === "full";
     } catch {
       // ignore store read failures
     }
-    return params.resolvedVerboseLevel === "full";
+    return fallbackVerbose === "full";
   };
 };
 

src/auto-reply/reply/agent-runner.authprofileid-fallback.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, it, vi } from "vitest";
+import type { TemplateContext } from "../templating.js";
+import type { FollowupRun, QueueSettings } from "./queue.js";
+import { createMockTypingController } from "./test-helpers.js";
+
+const runEmbeddedPiAgentMock = vi.fn();
+
+vi.mock("../../agents/model-fallback.js", () => ({
+  runWithModelFallback: async ({
+    run,
+  }: {
+    run: (provider: string, model: string) => Promise<unknown>;
+  }) => ({
+    // Force a cross-provider fallback candidate
+    result: await run("openai-codex", "gpt-5.2"),
+    provider: "openai-codex",
+    model: "gpt-5.2",
+  }),
+}));
+
+vi.mock("../../agents/pi-embedded.js", () => ({
+  queueEmbeddedPiMessage: vi.fn().mockReturnValue(false),
+  runEmbeddedPiAgent: (params: unknown) => runEmbeddedPiAgentMock(params),
+}));
+
+vi.mock("./queue.js", async () => {
+  const actual = await vi.importActual<typeof import("./queue.js")>("./queue.js");
+  return {
+    ...actual,
+    enqueueFollowupRun: vi.fn(),
+    scheduleFollowupDrain: vi.fn(),
+  };
+});
+
+import { runReplyAgent } from "./agent-runner.js";
+
+function createBaseRun(params: { runOverrides?: Partial<FollowupRun["run"]> }) {
+  const typing = createMockTypingController();
+  const sessionCtx = {
+    Provider: "telegram",
+    OriginatingTo: "chat",
+    AccountId: "primary",
+    MessageSid: "msg",
+    Surface: "telegram",
+  } as unknown as TemplateContext;
+
+  const resolvedQueue = { mode: "interrupt" } as unknown as QueueSettings;
+
+  const followupRun = {
+    prompt: "hello",
+    summaryLine: "hello",
+    enqueuedAt: Date.now(),
+    run: {
+      agentId: "main",
+      agentDir: "/tmp/agent",
+      sessionId: "session",
+      sessionKey: "main",
+      messageProvider: "telegram",
+      sessionFile: "/tmp/session.jsonl",
+      workspaceDir: "/tmp",
+      config: {},
+      skillsSnapshot: {},
+      provider: "anthropic",
+      model: "claude-opus",
+      authProfileId: "anthropic:clawd",
+      authProfileIdSource: "manual",
+      thinkLevel: "low",
+      verboseLevel: "off",
+      elevatedLevel: "off",
+      bashElevated: {
+        enabled: false,
+        allowed: false,
+        defaultLevel: "off",
+      },
+      timeoutMs: 5_000,
+      blockReplyBreak: "message_end",
+    },
+  } as unknown as FollowupRun;
+
+  return {
+    typing,
+    sessionCtx,
+    resolvedQueue,
+    followupRun: {
+      ...followupRun,
+      run: { ...followupRun.run, ...params.runOverrides },
+    },
+  };
+}
+
+describe("authProfileId fallback scoping", () => {
+  it("drops authProfileId when provider changes during fallback", async () => {
+    runEmbeddedPiAgentMock.mockReset();
+    runEmbeddedPiAgentMock.mockResolvedValue({ payloads: [{ text: "ok" }], meta: {} });
+
+    const sessionKey = "main";
+    const sessionEntry = {
+      sessionId: "session",
+      updatedAt: Date.now(),
+      totalTokens: 1,
+      compactionCount: 0,
+    };
+
+    const { typing, sessionCtx, resolvedQueue, followupRun } = createBaseRun({
+      runOverrides: {
+        provider: "anthropic",
+        model: "claude-opus",
+        authProfileId: "anthropic:clawd",
+        authProfileIdSource: "manual",
+      },
+    });
+
+    await runReplyAgent({
+      commandBody: "hello",
+      followupRun,
+      queueKey: sessionKey,
+      resolvedQueue,
+      shouldSteer: false,
+      shouldFollowup: false,
+      isActive: false,
+      isStreaming: false,
+      typing,
+      sessionCtx,
+      sessionEntry,
+      sessionStore: { [sessionKey]: sessionEntry },
+      sessionKey,
+      storePath: undefined,
+      defaultModel: "anthropic/claude-opus-4-5",
+      agentCfgContextTokens: 100_000,
+      resolvedVerboseLevel: "off",
+      isNewSession: false,
+      blockStreamingEnabled: false,
+      resolvedBlockStreamingBreak: "message_end",
+      shouldInjectGroupIntro: false,
+      typingMode: "instant",
+    });
+
+    expect(runEmbeddedPiAgentMock).toHaveBeenCalledTimes(1);
+    const call = runEmbeddedPiAgentMock.mock.calls[0]?.[0] as {
+      authProfileId?: unknown;
+      authProfileIdSource?: unknown;
+      provider?: unknown;
+    };
+
+    expect(call.provider).toBe("openai-codex");
+    expect(call.authProfileId).toBeUndefined();
+    expect(call.authProfileIdSource).toBeUndefined();
+  });
+});

src/auto-reply/reply/commands-allowlist.test.ts

@@ -0,0 +1,139 @@
+import { describe, expect, it, vi } from "vitest";
+
+import type { ClawdbotConfig } from "../../config/config.js";
+import type { MsgContext } from "../templating.js";
+import { buildCommandContext, handleCommands } from "./commands.js";
+import { parseInlineDirectives } from "./directive-handling.js";
+
+const readConfigFileSnapshotMock = vi.hoisted(() => vi.fn());
+const validateConfigObjectWithPluginsMock = vi.hoisted(() => vi.fn());
+const writeConfigFileMock = vi.hoisted(() => vi.fn());
+
+vi.mock("../../config/config.js", async () => {
+  const actual =
+    await vi.importActual<typeof import("../../config/config.js")>("../../config/config.js");
+  return {
+    ...actual,
+    readConfigFileSnapshot: readConfigFileSnapshotMock,
+    validateConfigObjectWithPlugins: validateConfigObjectWithPluginsMock,
+    writeConfigFile: writeConfigFileMock,
+  };
+});
+
+const readChannelAllowFromStoreMock = vi.hoisted(() => vi.fn());
+const addChannelAllowFromStoreEntryMock = vi.hoisted(() => vi.fn());
+const removeChannelAllowFromStoreEntryMock = vi.hoisted(() => vi.fn());
+
+vi.mock("../../pairing/pairing-store.js", async () => {
+  const actual = await vi.importActual<typeof import("../../pairing/pairing-store.js")>(
+    "../../pairing/pairing-store.js",
+  );
+  return {
+    ...actual,
+    readChannelAllowFromStore: readChannelAllowFromStoreMock,
+    addChannelAllowFromStoreEntry: addChannelAllowFromStoreEntryMock,
+    removeChannelAllowFromStoreEntry: removeChannelAllowFromStoreEntryMock,
+  };
+});
+
+vi.mock("../../channels/plugins/pairing.js", async () => {
+  const actual = await vi.importActual<typeof import("../../channels/plugins/pairing.js")>(
+    "../../channels/plugins/pairing.js",
+  );
+  return {
+    ...actual,
+    listPairingChannels: () => ["telegram"],
+  };
+});
+
+function buildParams(commandBody: string, cfg: ClawdbotConfig, ctxOverrides?: Partial<MsgContext>) {
+  const ctx = {
+    Body: commandBody,
+    CommandBody: commandBody,
+    CommandSource: "text",
+    CommandAuthorized: true,
+    Provider: "telegram",
+    Surface: "telegram",
+    ...ctxOverrides,
+  } as MsgContext;
+
+  const command = buildCommandContext({
+    ctx,
+    cfg,
+    isGroup: false,
+    triggerBodyNormalized: commandBody.trim().toLowerCase(),
+    commandAuthorized: true,
+  });
+
+  return {
+    ctx,
+    cfg,
+    command,
+    directives: parseInlineDirectives(commandBody),
+    elevated: { enabled: true, allowed: true, failures: [] },
+    sessionKey: "agent:main:main",
+    workspaceDir: "/tmp",
+    defaultGroupActivation: () => "mention",
+    resolvedVerboseLevel: "off" as const,
+    resolvedReasoningLevel: "off" as const,
+    resolveDefaultThinkingLevel: async () => undefined,
+    provider: "telegram",
+    model: "test-model",
+    contextTokens: 0,
+    isGroup: false,
+  };
+}
+
+describe("handleCommands /allowlist", () => {
+  it("lists config + store allowFrom entries", async () => {
+    readChannelAllowFromStoreMock.mockResolvedValueOnce(["456"]);
+
+    const cfg = {
+      commands: { text: true },
+      channels: { telegram: { allowFrom: ["123", "@Alice"] } },
+    } as ClawdbotConfig;
+    const params = buildParams("/allowlist list dm", cfg);
+    const result = await handleCommands(params);
+
+    expect(result.shouldContinue).toBe(false);
+    expect(result.reply?.text).toContain("Channel: telegram");
+    expect(result.reply?.text).toContain("DM allowFrom (config): 123, @alice");
+    expect(result.reply?.text).toContain("Paired allowFrom (store): 456");
+  });
+
+  it("adds entries to config and pairing store", async () => {
+    readConfigFileSnapshotMock.mockResolvedValueOnce({
+      valid: true,
+      parsed: {
+        channels: { telegram: { allowFrom: ["123"] } },
+      },
+    });
+    validateConfigObjectWithPluginsMock.mockImplementation((config: unknown) => ({
+      ok: true,
+      config,
+    }));
+    addChannelAllowFromStoreEntryMock.mockResolvedValueOnce({
+      changed: true,
+      allowFrom: ["123", "789"],
+    });
+
+    const cfg = {
+      commands: { text: true, config: true },
+      channels: { telegram: { allowFrom: ["123"] } },
+    } as ClawdbotConfig;
+    const params = buildParams("/allowlist add dm 789", cfg);
+    const result = await handleCommands(params);
+
+    expect(result.shouldContinue).toBe(false);
+    expect(writeConfigFileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        channels: { telegram: { allowFrom: ["123", "789"] } },
+      }),
+    );
+    expect(addChannelAllowFromStoreEntryMock).toHaveBeenCalledWith({
+      channel: "telegram",
+      entry: "789",
+    });
+    expect(result.reply?.text).toContain("DM allowlist added");
+  });
+});

src/auto-reply/reply/commands-allowlist.ts

@@ -0,0 +1,657 @@
+import {
+  readConfigFileSnapshot,
+  validateConfigObjectWithPlugins,
+  writeConfigFile,
+} from "../../config/config.js";
+import { resolveChannelConfigWrites } from "../../channels/plugins/config-writes.js";
+import { getChannelDock } from "../../channels/dock.js";
+import { normalizeChannelId } from "../../channels/registry.js";
+import { listPairingChannels } from "../../channels/plugins/pairing.js";
+import { logVerbose } from "../../globals.js";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../../routing/session-key.js";
+import { resolveDiscordAccount } from "../../discord/accounts.js";
+import { resolveIMessageAccount } from "../../imessage/accounts.js";
+import { resolveSignalAccount } from "../../signal/accounts.js";
+import { resolveSlackAccount } from "../../slack/accounts.js";
+import { resolveTelegramAccount } from "../../telegram/accounts.js";
+import { resolveWhatsAppAccount } from "../../web/accounts.js";
+import { resolveSlackUserAllowlist } from "../../slack/resolve-users.js";
+import { resolveDiscordUserAllowlist } from "../../discord/resolve-users.js";
+import {
+  addChannelAllowFromStoreEntry,
+  readChannelAllowFromStore,
+  removeChannelAllowFromStoreEntry,
+} from "../../pairing/pairing-store.js";
+import type { ClawdbotConfig } from "../../config/config.js";
+import type { ChannelId } from "../../channels/plugins/types.js";
+import type { CommandHandler } from "./commands-types.js";
+
+type AllowlistScope = "dm" | "group" | "all";
+type AllowlistAction = "list" | "add" | "remove";
+type AllowlistTarget = "both" | "config" | "store";
+
+type AllowlistCommand =
+  | {
+      action: "list";
+      scope: AllowlistScope;
+      channel?: string;
+      account?: string;
+      resolve?: boolean;
+    }
+  | {
+      action: "add" | "remove";
+      scope: AllowlistScope;
+      channel?: string;
+      account?: string;
+      entry: string;
+      resolve?: boolean;
+      target: AllowlistTarget;
+    }
+  | { action: "error"; message: string };
+
+const ACTIONS = new Set(["list", "add", "remove"]);
+const SCOPES = new Set<AllowlistScope>(["dm", "group", "all"]);
+
+function parseAllowlistCommand(raw: string): AllowlistCommand | null {
+  const trimmed = raw.trim();
+  if (!trimmed.toLowerCase().startsWith("/allowlist")) return null;
+  const rest = trimmed.slice("/allowlist".length).trim();
+  if (!rest) return { action: "list", scope: "dm" };
+
+  const tokens = rest.split(/\s+/);
+  let action: AllowlistAction = "list";
+  let scope: AllowlistScope = "dm";
+  let resolve = false;
+  let target: AllowlistTarget = "both";
+  let channel: string | undefined;
+  let account: string | undefined;
+  const entryTokens: string[] = [];
+
+  let i = 0;
+  if (tokens[i] && ACTIONS.has(tokens[i].toLowerCase())) {
+    action = tokens[i].toLowerCase() as AllowlistAction;
+    i += 1;
+  }
+  if (tokens[i] && SCOPES.has(tokens[i].toLowerCase() as AllowlistScope)) {
+    scope = tokens[i].toLowerCase() as AllowlistScope;
+    i += 1;
+  }
+
+  for (; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    const lowered = token.toLowerCase();
+    if (lowered === "--resolve" || lowered === "resolve") {
+      resolve = true;
+      continue;
+    }
+    if (lowered === "--config" || lowered === "config") {
+      target = "config";
+      continue;
+    }
+    if (lowered === "--store" || lowered === "store") {
+      target = "store";
+      continue;
+    }
+    if (lowered === "--channel" && tokens[i + 1]) {
+      channel = tokens[i + 1];
+      i += 1;
+      continue;
+    }
+    if (lowered === "--account" && tokens[i + 1]) {
+      account = tokens[i + 1];
+      i += 1;
+      continue;
+    }
+    const kv = token.split("=");
+    if (kv.length === 2) {
+      const key = kv[0]?.trim().toLowerCase();
+      const value = kv[1]?.trim();
+      if (key === "channel") {
+        if (value) channel = value;
+        continue;
+      }
+      if (key === "account") {
+        if (value) account = value;
+        continue;
+      }
+      if (key === "scope" && value && SCOPES.has(value.toLowerCase() as AllowlistScope)) {
+        scope = value.toLowerCase() as AllowlistScope;
+        continue;
+      }
+    }
+    entryTokens.push(token);
+  }
+
+  if (action === "add" || action === "remove") {
+    const entry = entryTokens.join(" ").trim();
+    if (!entry) {
+      return { action: "error", message: "Usage: /allowlist add|remove <entry>" };
+    }
+    return { action, scope, entry, channel, account, resolve, target };
+  }
+
+  return { action: "list", scope, channel, account, resolve };
+}
+
+function normalizeAllowFrom(params: {
+  cfg: ClawdbotConfig;
+  channelId: ChannelId;
+  accountId?: string | null;
+  values: Array<string | number>;
+}): string[] {
+  const dock = getChannelDock(params.channelId);
+  if (dock?.config?.formatAllowFrom) {
+    return dock.config.formatAllowFrom({
+      cfg: params.cfg,
+      accountId: params.accountId,
+      allowFrom: params.values,
+    });
+  }
+  return params.values.map((entry) => String(entry).trim()).filter(Boolean);
+}
+
+function formatEntryList(entries: string[], resolved?: Map<string, string>): string {
+  if (entries.length === 0) return "(none)";
+  return entries
+    .map((entry) => {
+      const name = resolved?.get(entry);
+      return name ? `${entry} (${name})` : entry;
+    })
+    .join(", ");
+}
+
+function resolveAccountTarget(
+  parsed: Record<string, unknown>,
+  channelId: ChannelId,
+  accountId?: string | null,
+) {
+  const channels = (parsed.channels ??= {}) as Record<string, unknown>;
+  const channel = (channels[channelId] ??= {}) as Record<string, unknown>;
+  const normalizedAccountId = normalizeAccountId(accountId);
+  const hasAccounts = Boolean(channel.accounts && typeof channel.accounts === "object");
+  const useAccount = normalizedAccountId !== DEFAULT_ACCOUNT_ID || hasAccounts;
+  if (!useAccount) {
+    return { target: channel, pathPrefix: `channels.${channelId}`, accountId: normalizedAccountId };
+  }
+  const accounts = (channel.accounts ??= {}) as Record<string, unknown>;
+  const account = (accounts[normalizedAccountId] ??= {}) as Record<string, unknown>;
+  return {
+    target: account,
+    pathPrefix: `channels.${channelId}.accounts.${normalizedAccountId}`,
+    accountId: normalizedAccountId,
+  };
+}
+
+function getNestedValue(root: Record<string, unknown>, path: string[]): unknown {
+  let current: unknown = root;
+  for (const key of path) {
+    if (!current || typeof current !== "object") return undefined;
+    current = (current as Record<string, unknown>)[key];
+  }
+  return current;
+}
+
+function ensureNestedObject(
+  root: Record<string, unknown>,
+  path: string[],
+): Record<string, unknown> {
+  let current = root;
+  for (const key of path) {
+    const existing = current[key];
+    if (!existing || typeof existing !== "object") {
+      current[key] = {};
+    }
+    current = current[key] as Record<string, unknown>;
+  }
+  return current;
+}
+
+function setNestedValue(root: Record<string, unknown>, path: string[], value: unknown) {
+  if (path.length === 0) return;
+  if (path.length === 1) {
+    root[path[0]] = value;
+    return;
+  }
+  const parent = ensureNestedObject(root, path.slice(0, -1));
+  parent[path[path.length - 1]] = value;
+}
+
+function deleteNestedValue(root: Record<string, unknown>, path: string[]) {
+  if (path.length === 0) return;
+  if (path.length === 1) {
+    delete root[path[0]];
+    return;
+  }
+  const parent = getNestedValue(root, path.slice(0, -1));
+  if (!parent || typeof parent !== "object") return;
+  delete (parent as Record<string, unknown>)[path[path.length - 1]];
+}
+
+function resolveChannelAllowFromPaths(
+  channelId: ChannelId,
+  scope: AllowlistScope,
+): string[] | null {
+  if (scope === "all") return null;
+  if (scope === "dm") {
+    if (channelId === "slack" || channelId === "discord") return ["dm", "allowFrom"];
+    if (
+      channelId === "telegram" ||
+      channelId === "whatsapp" ||
+      channelId === "signal" ||
+      channelId === "imessage"
+    ) {
+      return ["allowFrom"];
+    }
+    return null;
+  }
+  if (scope === "group") {
+    if (
+      channelId === "telegram" ||
+      channelId === "whatsapp" ||
+      channelId === "signal" ||
+      channelId === "imessage"
+    ) {
+      return ["groupAllowFrom"];
+    }
+    return null;
+  }
+  return null;
+}
+
+async function resolveSlackNames(params: {
+  cfg: ClawdbotConfig;
+  accountId?: string | null;
+  entries: string[];
+}) {
+  const account = resolveSlackAccount({ cfg: params.cfg, accountId: params.accountId });
+  const token = account.config.userToken?.trim() || account.botToken?.trim();
+  if (!token) return new Map<string, string>();
+  const resolved = await resolveSlackUserAllowlist({ token, entries: params.entries });
+  const map = new Map<string, string>();
+  for (const entry of resolved) {
+    if (entry.resolved && entry.name) map.set(entry.input, entry.name);
+  }
+  return map;
+}
+
+async function resolveDiscordNames(params: {
+  cfg: ClawdbotConfig;
+  accountId?: string | null;
+  entries: string[];
+}) {
+  const account = resolveDiscordAccount({ cfg: params.cfg, accountId: params.accountId });
+  const token = account.token?.trim();
+  if (!token) return new Map<string, string>();
+  const resolved = await resolveDiscordUserAllowlist({ token, entries: params.entries });
+  const map = new Map<string, string>();
+  for (const entry of resolved) {
+    if (entry.resolved && entry.name) map.set(entry.input, entry.name);
+  }
+  return map;
+}
+
+export const handleAllowlistCommand: CommandHandler = async (params, allowTextCommands) => {
+  if (!allowTextCommands) return null;
+  const parsed = parseAllowlistCommand(params.command.commandBodyNormalized);
+  if (!parsed) return null;
+  if (parsed.action === "error") {
+    return { shouldContinue: false, reply: { text: `⚠️ ${parsed.message}` } };
+  }
+  if (!params.command.isAuthorizedSender) {
+    logVerbose(
+      `Ignoring /allowlist from unauthorized sender: ${params.command.senderId || "<unknown>"}`,
+    );
+    return { shouldContinue: false };
+  }
+
+  const channelId =
+    normalizeChannelId(parsed.channel) ??
+    params.command.channelId ??
+    normalizeChannelId(params.command.channel);
+  if (!channelId) {
+    return {
+      shouldContinue: false,
+      reply: { text: "⚠️ Unknown channel. Add channel=<id> to the command." },
+    };
+  }
+  const accountId = normalizeAccountId(parsed.account ?? params.ctx.AccountId);
+  const scope = parsed.scope;
+
+  if (parsed.action === "list") {
+    const pairingChannels = listPairingChannels();
+    const supportsStore = pairingChannels.includes(channelId);
+    const storeAllowFrom = supportsStore
+      ? await readChannelAllowFromStore(channelId).catch(() => [])
+      : [];
+
+    let dmAllowFrom: string[] = [];
+    let groupAllowFrom: string[] = [];
+    let groupOverrides: Array<{ label: string; entries: string[] }> = [];
+    let dmPolicy: string | undefined;
+    let groupPolicy: string | undefined;
+
+    if (channelId === "telegram") {
+      const account = resolveTelegramAccount({ cfg: params.cfg, accountId });
+      dmAllowFrom = (account.config.allowFrom ?? []).map(String);
+      groupAllowFrom = (account.config.groupAllowFrom ?? []).map(String);
+      dmPolicy = account.config.dmPolicy;
+      groupPolicy = account.config.groupPolicy;
+      const groups = account.config.groups ?? {};
+      for (const [groupId, groupCfg] of Object.entries(groups)) {
+        const entries = (groupCfg?.allowFrom ?? []).map(String).filter(Boolean);
+        if (entries.length > 0) {
+          groupOverrides.push({ label: groupId, entries });
+        }
+        const topics = groupCfg?.topics ?? {};
+        for (const [topicId, topicCfg] of Object.entries(topics)) {
+          const topicEntries = (topicCfg?.allowFrom ?? []).map(String).filter(Boolean);
+          if (topicEntries.length > 0) {
+            groupOverrides.push({ label: `${groupId} topic ${topicId}`, entries: topicEntries });
+          }
+        }
+      }
+    } else if (channelId === "whatsapp") {
+      const account = resolveWhatsAppAccount({ cfg: params.cfg, accountId });
+      dmAllowFrom = (account.allowFrom ?? []).map(String);
+      groupAllowFrom = (account.groupAllowFrom ?? []).map(String);
+      dmPolicy = account.dmPolicy;
+      groupPolicy = account.groupPolicy;
+    } else if (channelId === "signal") {
+      const account = resolveSignalAccount({ cfg: params.cfg, accountId });
+      dmAllowFrom = (account.config.allowFrom ?? []).map(String);
+      groupAllowFrom = (account.config.groupAllowFrom ?? []).map(String);
+      dmPolicy = account.config.dmPolicy;
+      groupPolicy = account.config.groupPolicy;
+    } else if (channelId === "imessage") {
+      const account = resolveIMessageAccount({ cfg: params.cfg, accountId });
+      dmAllowFrom = (account.config.allowFrom ?? []).map(String);
+      groupAllowFrom = (account.config.groupAllowFrom ?? []).map(String);
+      dmPolicy = account.config.dmPolicy;
+      groupPolicy = account.config.groupPolicy;
+    } else if (channelId === "slack") {
+      const account = resolveSlackAccount({ cfg: params.cfg, accountId });
+      dmAllowFrom = (account.dm?.allowFrom ?? []).map(String);
+      groupPolicy = account.groupPolicy;
+      const channels = account.channels ?? {};
+      groupOverrides = Object.entries(channels)
+        .map(([key, value]) => {
+          const entries = (value?.users ?? []).map(String).filter(Boolean);
+          return entries.length > 0 ? { label: key, entries } : null;
+        })
+        .filter(Boolean) as Array<{ label: string; entries: string[] }>;
+    } else if (channelId === "discord") {
+      const account = resolveDiscordAccount({ cfg: params.cfg, accountId });
+      dmAllowFrom = (account.config.dm?.allowFrom ?? []).map(String);
+      groupPolicy = account.config.groupPolicy;
+      const guilds = account.config.guilds ?? {};
+      for (const [guildKey, guildCfg] of Object.entries(guilds)) {
+        const entries = (guildCfg?.users ?? []).map(String).filter(Boolean);
+        if (entries.length > 0) {
+          groupOverrides.push({ label: `guild ${guildKey}`, entries });
+        }
+        const channels = guildCfg?.channels ?? {};
+        for (const [channelKey, channelCfg] of Object.entries(channels)) {
+          const channelEntries = (channelCfg?.users ?? []).map(String).filter(Boolean);
+          if (channelEntries.length > 0) {
+            groupOverrides.push({
+              label: `guild ${guildKey} / channel ${channelKey}`,
+              entries: channelEntries,
+            });
+          }
+        }
+      }
+    }
+
+    const dmDisplay = normalizeAllowFrom({
+      cfg: params.cfg,
+      channelId,
+      accountId,
+      values: dmAllowFrom,
+    });
+    const groupDisplay = normalizeAllowFrom({
+      cfg: params.cfg,
+      channelId,
+      accountId,
+      values: groupAllowFrom,
+    });
+    const groupOverrideEntries = groupOverrides.flatMap((entry) => entry.entries);
+    const groupOverrideDisplay = normalizeAllowFrom({
+      cfg: params.cfg,
+      channelId,
+      accountId,
+      values: groupOverrideEntries,
+    });
+    const resolvedDm =
+      parsed.resolve && dmDisplay.length > 0 && channelId === "slack"
+        ? await resolveSlackNames({ cfg: params.cfg, accountId, entries: dmDisplay })
+        : parsed.resolve && dmDisplay.length > 0 && channelId === "discord"
+          ? await resolveDiscordNames({ cfg: params.cfg, accountId, entries: dmDisplay })
+          : undefined;
+    const resolvedGroup =
+      parsed.resolve && groupOverrideDisplay.length > 0 && channelId === "slack"
+        ? await resolveSlackNames({
+            cfg: params.cfg,
+            accountId,
+            entries: groupOverrideDisplay,
+          })
+        : parsed.resolve && groupOverrideDisplay.length > 0 && channelId === "discord"
+          ? await resolveDiscordNames({
+              cfg: params.cfg,
+              accountId,
+              entries: groupOverrideDisplay,
+            })
+          : undefined;
+
+    const lines: string[] = ["🧾 Allowlist"];
+    lines.push(`Channel: ${channelId}${accountId ? ` (account ${accountId})` : ""}`);
+    if (dmPolicy) lines.push(`DM policy: ${dmPolicy}`);
+    if (groupPolicy) lines.push(`Group policy: ${groupPolicy}`);
+
+    const showDm = scope === "dm" || scope === "all";
+    const showGroup = scope === "group" || scope === "all";
+    if (showDm) {
+      lines.push(`DM allowFrom (config): ${formatEntryList(dmDisplay, resolvedDm)}`);
+    }
+    if (supportsStore && storeAllowFrom.length > 0) {
+      const storeLabel = normalizeAllowFrom({
+        cfg: params.cfg,
+        channelId,
+        accountId,
+        values: storeAllowFrom,
+      });
+      lines.push(`Paired allowFrom (store): ${formatEntryList(storeLabel)}`);
+    }
+    if (showGroup) {
+      if (groupAllowFrom.length > 0) {
+        lines.push(`Group allowFrom (config): ${formatEntryList(groupDisplay)}`);
+      }
+      if (groupOverrides.length > 0) {
+        lines.push("Group overrides:");
+        for (const entry of groupOverrides) {
+          const normalized = normalizeAllowFrom({
+            cfg: params.cfg,
+            channelId,
+            accountId,
+            values: entry.entries,
+          });
+          lines.push(`- ${entry.label}: ${formatEntryList(normalized, resolvedGroup)}`);
+        }
+      }
+    }
+
+    return { shouldContinue: false, reply: { text: lines.join("\n") } };
+  }
+
+  if (params.cfg.commands?.config !== true) {
+    return {
+      shouldContinue: false,
+      reply: { text: "⚠️ /allowlist edits are disabled. Set commands.config=true to enable." },
+    };
+  }
+
+  const shouldUpdateConfig = parsed.target !== "store";
+  const shouldTouchStore = parsed.target !== "config" && listPairingChannels().includes(channelId);
+
+  if (shouldUpdateConfig) {
+    const allowWrites = resolveChannelConfigWrites({
+      cfg: params.cfg,
+      channelId,
+      accountId: params.ctx.AccountId,
+    });
+    if (!allowWrites) {
+      const hint = `channels.${channelId}.configWrites=true`;
+      return {
+        shouldContinue: false,
+        reply: { text: `⚠️ Config writes are disabled for ${channelId}. Set ${hint} to enable.` },
+      };
+    }
+
+    const allowlistPath = resolveChannelAllowFromPaths(channelId, scope);
+    if (!allowlistPath) {
+      return {
+        shouldContinue: false,
+        reply: {
+          text: `⚠️ ${channelId} does not support ${scope} allowlist edits via /allowlist.`,
+        },
+      };
+    }
+
+    const snapshot = await readConfigFileSnapshot();
+    if (!snapshot.valid || !snapshot.parsed || typeof snapshot.parsed !== "object") {
+      return {
+        shouldContinue: false,
+        reply: { text: "⚠️ Config file is invalid; fix it before using /allowlist." },
+      };
+    }
+    const parsedConfig = structuredClone(snapshot.parsed as Record<string, unknown>);
+    const {
+      target,
+      pathPrefix,
+      accountId: normalizedAccountId,
+    } = resolveAccountTarget(parsedConfig, channelId, accountId);
+    const existingRaw = getNestedValue(target, allowlistPath);
+    const existing = Array.isArray(existingRaw)
+      ? existingRaw.map((entry) => String(entry).trim()).filter(Boolean)
+      : [];
+
+    const normalizedEntry = normalizeAllowFrom({
+      cfg: params.cfg,
+      channelId,
+      accountId: normalizedAccountId,
+      values: [parsed.entry],
+    });
+    if (normalizedEntry.length === 0) {
+      return {
+        shouldContinue: false,
+        reply: { text: "⚠️ Invalid allowlist entry." },
+      };
+    }
+
+    const existingNormalized = normalizeAllowFrom({
+      cfg: params.cfg,
+      channelId,
+      accountId: normalizedAccountId,
+      values: existing,
+    });
+
+    const shouldMatch = (value: string) => normalizedEntry.includes(value);
+
+    let configChanged = false;
+    let next = existing;
+    const configHasEntry = existingNormalized.some((value) => shouldMatch(value));
+    if (parsed.action === "add") {
+      if (!configHasEntry) {
+        next = [...existing, parsed.entry.trim()];
+        configChanged = true;
+      }
+    }
+
+    if (parsed.action === "remove") {
+      const keep: string[] = [];
+      for (const entry of existing) {
+        const normalized = normalizeAllowFrom({
+          cfg: params.cfg,
+          channelId,
+          accountId: normalizedAccountId,
+          values: [entry],
+        });
+        if (normalized.some((value) => shouldMatch(value))) {
+          configChanged = true;
+          continue;
+        }
+        keep.push(entry);
+      }
+      next = keep;
+    }
+
+    if (configChanged) {
+      if (next.length === 0) {
+        deleteNestedValue(target, allowlistPath);
+      } else {
+        setNestedValue(target, allowlistPath, next);
+      }
+    }
+
+    if (configChanged) {
+      const validated = validateConfigObjectWithPlugins(parsedConfig);
+      if (!validated.ok) {
+        const issue = validated.issues[0];
+        return {
+          shouldContinue: false,
+          reply: { text: `⚠️ Config invalid after update (${issue.path}: ${issue.message}).` },
+        };
+      }
+      await writeConfigFile(validated.config);
+    }
+
+    if (!configChanged && !shouldTouchStore) {
+      const message = parsed.action === "add" ? "✅ Already allowlisted." : "⚠️ Entry not found.";
+      return { shouldContinue: false, reply: { text: message } };
+    }
+
+    if (shouldTouchStore) {
+      if (parsed.action === "add") {
+        await addChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
+      } else if (parsed.action === "remove") {
+        await removeChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
+      }
+    }
+
+    const actionLabel = parsed.action === "add" ? "added" : "removed";
+    const scopeLabel = scope === "dm" ? "DM" : "group";
+    const locations: string[] = [];
+    if (configChanged) {
+      locations.push(`${pathPrefix}.${allowlistPath.join(".")}`);
+    }
+    if (shouldTouchStore) {
+      locations.push("pairing store");
+    }
+    const targetLabel = locations.length > 0 ? locations.join(" + ") : "no-op";
+    return {
+      shouldContinue: false,
+      reply: {
+        text: `✅ ${scopeLabel} allowlist ${actionLabel}: ${targetLabel}.`,
+      },
+    };
+  }
+
+  if (!shouldTouchStore) {
+    return {
+      shouldContinue: false,
+      reply: { text: "⚠️ This channel does not support allowlist storage." },
+    };
+  }
+
+  if (parsed.action === "add") {
+    await addChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
+  } else if (parsed.action === "remove") {
+    await removeChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
+  }
+
+  const actionLabel = parsed.action === "add" ? "added" : "removed";
+  const scopeLabel = scope === "dm" ? "DM" : "group";
+  return {
+    shouldContinue: false,
+    reply: { text: `✅ ${scopeLabel} allowlist ${actionLabel} in pairing store.` },
+  };
+};

src/auto-reply/reply/commands-core.ts

@@ -13,6 +13,7 @@ import {
   handleStatusCommand,
   handleWhoamiCommand,
 } from "./commands-info.js";
+import { handleAllowlistCommand } from "./commands-allowlist.js";
 import { handleSubagentsCommand } from "./commands-subagents.js";
 import {
   handleAbortTrigger,
@@ -37,6 +38,7 @@ const HANDLERS: CommandHandler[] = [
   handleHelpCommand,
   handleCommandsListCommand,
   handleStatusCommand,
+  handleAllowlistCommand,
   handleContextCommand,
   handleWhoamiCommand,
   handleSubagentsCommand,

src/auto-reply/reply/commands-status.ts

@@ -184,9 +184,7 @@ export async function buildStatusReply(params: {
     const requesterKey = resolveInternalSessionKey({ key: sessionKey, alias, mainKey });
     const runs = listSubagentRunsForRequester(requesterKey);
     const verboseEnabled = resolvedVerboseLevel && resolvedVerboseLevel !== "off";
-    if (runs.length === 0) {
-      if (verboseEnabled) subagentsLine = "🤖 Subagents: none";
-    } else {
+    if (runs.length > 0) {
       const active = runs.filter((entry) => !entry.endedAt);
       const done = runs.length - active.length;
       if (verboseEnabled) {

src/auto-reply/reply/commands.test.ts

@@ -215,6 +215,20 @@ describe("handleCommands subagents", () => {
     expect(result.reply?.text).toContain("Subagents: none");
   });
 
+  it("omits subagent status line when none exist", async () => {
+    resetSubagentRegistryForTests();
+    const cfg = {
+      commands: { text: true },
+      channels: { whatsapp: { allowFrom: ["*"] } },
+      session: { mainKey: "main", scope: "per-sender" },
+    } as ClawdbotConfig;
+    const params = buildParams("/status", cfg);
+    params.resolvedVerboseLevel = "on";
+    const result = await handleCommands(params);
+    expect(result.shouldContinue).toBe(false);
+    expect(result.reply?.text).not.toContain("Subagents:");
+  });
+
   it("returns help for unknown subagents action", async () => {
     resetSubagentRegistryForTests();
     const cfg = {

src/auto-reply/reply/directive-handling.impl.ts

@@ -10,6 +10,7 @@ import { type SessionEntry, updateSessionStore } from "../../config/sessions.js"
 import type { ExecAsk, ExecHost, ExecSecurity } from "../../infra/exec-approvals.js";
 import { enqueueSystemEvent } from "../../infra/system-events.js";
 import { applyVerboseOverride } from "../../sessions/level-overrides.js";
+import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import { formatThinkingLevels, formatXHighModelHint, supportsXHighThinking } from "../thinking.js";
 import type { ReplyPayload } from "../types.js";
 import {
@@ -340,22 +341,11 @@ export async function handleDirectiveOnly(params: {
       }
     }
     if (modelSelection) {
-      if (modelSelection.isDefault) {
-        delete sessionEntry.providerOverride;
-        delete sessionEntry.modelOverride;
-      } else {
-        sessionEntry.providerOverride = modelSelection.provider;
-        sessionEntry.modelOverride = modelSelection.model;
-      }
-      if (profileOverride) {
-        sessionEntry.authProfileOverride = profileOverride;
-        sessionEntry.authProfileOverrideSource = "user";
-        delete sessionEntry.authProfileOverrideCompactionCount;
-      } else if (directives.hasModelDirective) {
-        delete sessionEntry.authProfileOverride;
-        delete sessionEntry.authProfileOverrideSource;
-        delete sessionEntry.authProfileOverrideCompactionCount;
-      }
+      applyModelOverrideToSessionEntry({
+        entry: sessionEntry,
+        selection: modelSelection,
+        profileOverride,
+      });
     }
     if (directives.hasQueueDirective && directives.queueReset) {
       delete sessionEntry.queueMode;

src/auto-reply/reply/directive-handling.persist.ts

@@ -16,6 +16,7 @@ import type { ClawdbotConfig } from "../../config/config.js";
 import { type SessionEntry, updateSessionStore } from "../../config/sessions.js";
 import { enqueueSystemEvent } from "../../infra/system-events.js";
 import { applyVerboseOverride } from "../../sessions/level-overrides.js";
+import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import { resolveProfileOverride } from "./directive-handling.auth.js";
 import type { InlineDirectives } from "./directive-handling.parse.js";
 import { formatElevatedEvent, formatReasoningEvent } from "./directive-handling.shared.js";
@@ -164,22 +165,15 @@ export async function persistInlineDirectives(params: {
           }
           const isDefault =
             resolved.ref.provider === defaultProvider && resolved.ref.model === defaultModel;
-          if (isDefault) {
-            delete sessionEntry.providerOverride;
-            delete sessionEntry.modelOverride;
-          } else {
-            sessionEntry.providerOverride = resolved.ref.provider;
-            sessionEntry.modelOverride = resolved.ref.model;
-          }
-          if (profileOverride) {
-            sessionEntry.authProfileOverride = profileOverride;
-            sessionEntry.authProfileOverrideSource = "user";
-            delete sessionEntry.authProfileOverrideCompactionCount;
-          } else if (directives.hasModelDirective) {
-            delete sessionEntry.authProfileOverride;
-            delete sessionEntry.authProfileOverrideSource;
-            delete sessionEntry.authProfileOverrideCompactionCount;
-          }
+          const { updated: modelUpdated } = applyModelOverrideToSessionEntry({
+            entry: sessionEntry,
+            selection: {
+              provider: resolved.ref.provider,
+              model: resolved.ref.model,
+              isDefault,
+            },
+            profileOverride,
+          });
           provider = resolved.ref.provider;
           model = resolved.ref.model;
           const nextLabel = `${provider}/${model}`;
@@ -189,7 +183,7 @@ export async function persistInlineDirectives(params: {
               contextKey: `model:${nextLabel}`,
             });
           }
-          updated = true;
+          updated = updated || modelUpdated;
         }
       }
     }

src/auto-reply/reply/get-reply-run.ts

@@ -5,16 +5,11 @@ import {
   isEmbeddedPiRunStreaming,
   resolveEmbeddedSessionLane,
 } from "../../agents/pi-embedded.js";
-import {
-  ensureAuthProfileStore,
-  isProfileInCooldown,
-  resolveAuthProfileOrder,
-} from "../../agents/auth-profiles.js";
+import { resolveSessionAuthProfileOverride } from "../../agents/auth-profiles/session-override.js";
 import type { ExecToolDefaults } from "../../agents/bash-tools.js";
 import type { ClawdbotConfig } from "../../config/config.js";
 import {
   resolveSessionFilePath,
-  saveSessionStore,
   type SessionEntry,
   updateSessionStore,
 } from "../../config/sessions.js";
@@ -108,92 +103,6 @@ type RunPreparedReplyParams = {
   abortedLastRun: boolean;
 };
 
-async function resolveSessionAuthProfileOverride(params: {
-  cfg: ClawdbotConfig;
-  provider: string;
-  agentDir: string;
-  sessionEntry?: SessionEntry;
-  sessionStore?: Record<string, SessionEntry>;
-  sessionKey?: string;
-  storePath?: string;
-  isNewSession: boolean;
-}): Promise<string | undefined> {
-  const {
-    cfg,
-    provider,
-    agentDir,
-    sessionEntry,
-    sessionStore,
-    sessionKey,
-    storePath,
-    isNewSession,
-  } = params;
-  if (!sessionEntry || !sessionStore || !sessionKey) return sessionEntry?.authProfileOverride;
-
-  const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
-  const order = resolveAuthProfileOrder({ cfg, store, provider });
-  if (order.length === 0) return sessionEntry.authProfileOverride;
-
-  const pickFirstAvailable = () =>
-    order.find((profileId) => !isProfileInCooldown(store, profileId)) ?? order[0];
-  const pickNextAvailable = (current: string) => {
-    const startIndex = order.indexOf(current);
-    if (startIndex < 0) return pickFirstAvailable();
-    for (let offset = 1; offset <= order.length; offset += 1) {
-      const candidate = order[(startIndex + offset) % order.length];
-      if (!isProfileInCooldown(store, candidate)) return candidate;
-    }
-    return order[startIndex] ?? order[0];
-  };
-
-  const compactionCount = sessionEntry.compactionCount ?? 0;
-  const storedCompaction =
-    typeof sessionEntry.authProfileOverrideCompactionCount === "number"
-      ? sessionEntry.authProfileOverrideCompactionCount
-      : compactionCount;
-
-  let current = sessionEntry.authProfileOverride?.trim();
-  if (current && !order.includes(current)) current = undefined;
-
-  const source =
-    sessionEntry.authProfileOverrideSource ??
-    (typeof sessionEntry.authProfileOverrideCompactionCount === "number"
-      ? "auto"
-      : current
-        ? "user"
-        : undefined);
-  if (source === "user" && current && !isNewSession) {
-    return current;
-  }
-
-  let next = current;
-  if (isNewSession) {
-    next = current ? pickNextAvailable(current) : pickFirstAvailable();
-  } else if (current && compactionCount > storedCompaction) {
-    next = pickNextAvailable(current);
-  } else if (!current || isProfileInCooldown(store, current)) {
-    next = pickFirstAvailable();
-  }
-
-  if (!next) return current;
-  const shouldPersist =
-    next !== sessionEntry.authProfileOverride ||
-    sessionEntry.authProfileOverrideSource !== "auto" ||
-    sessionEntry.authProfileOverrideCompactionCount !== compactionCount;
-  if (shouldPersist) {
-    sessionEntry.authProfileOverride = next;
-    sessionEntry.authProfileOverrideSource = "auto";
-    sessionEntry.authProfileOverrideCompactionCount = compactionCount;
-    sessionEntry.updatedAt = Date.now();
-    sessionStore[sessionKey] = sessionEntry;
-    if (storePath) {
-      await saveSessionStore(storePath, sessionStore);
-    }
-  }
-
-  return next;
-}
-
 export async function runPreparedReply(
   params: RunPreparedReplyParams,
 ): Promise<ReplyPayload | ReplyPayload[] | undefined> {

src/auto-reply/reply/model-selection.ts

@@ -11,6 +11,8 @@ import {
 } from "../../agents/model-selection.js";
 import type { ClawdbotConfig } from "../../config/config.js";
 import { type SessionEntry, updateSessionStore } from "../../config/sessions.js";
+import { clearSessionAuthProfileOverride } from "../../agents/auth-profiles/session-override.js";
+import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import type { ThinkLevel } from "./directives.js";
 
 export type ModelDirectiveSelection = {
@@ -184,16 +186,19 @@ export async function createModelSelectionState(params: {
     if (overrideModel) {
       const key = modelKey(overrideProvider, overrideModel);
       if (allowedModelKeys.size > 0 && !allowedModelKeys.has(key)) {
-        delete sessionEntry.providerOverride;
-        delete sessionEntry.modelOverride;
-        sessionEntry.updatedAt = Date.now();
-        sessionStore[sessionKey] = sessionEntry;
-        if (storePath) {
-          await updateSessionStore(storePath, (store) => {
-            store[sessionKey] = sessionEntry;
-          });
+        const { updated } = applyModelOverrideToSessionEntry({
+          entry: sessionEntry,
+          selection: { provider: defaultProvider, model: defaultModel, isDefault: true },
+        });
+        if (updated) {
+          sessionStore[sessionKey] = sessionEntry;
+          if (storePath) {
+            await updateSessionStore(storePath, (store) => {
+              store[sessionKey] = sessionEntry;
+            });
+          }
         }
-        resetModelOverride = true;
+        resetModelOverride = updated;
       }
     }
   }
@@ -215,17 +220,14 @@ export async function createModelSelectionState(params: {
       allowKeychainPrompt: false,
     });
     const profile = store.profiles[sessionEntry.authProfileOverride];
-    if (!profile || profile.provider !== provider) {
-      delete sessionEntry.authProfileOverride;
-      delete sessionEntry.authProfileOverrideSource;
-      delete sessionEntry.authProfileOverrideCompactionCount;
-      sessionEntry.updatedAt = Date.now();
-      sessionStore[sessionKey] = sessionEntry;
-      if (storePath) {
-        await updateSessionStore(storePath, (store) => {
-          store[sessionKey] = sessionEntry;
-        });
-      }
+    const providerKey = normalizeProviderId(provider);
+    if (!profile || normalizeProviderId(profile.provider) !== providerKey) {
+      await clearSessionAuthProfileOverride({
+        sessionEntry,
+        sessionStore,
+        sessionKey,
+        storePath,
+      });
     }
   }
 

src/auto-reply/reply/route-reply.test.ts

@@ -209,6 +209,22 @@ describe("routeReply", () => {
     expect(mocks.sendMessageSlack).toHaveBeenCalledWith("channel:C123", "hi", expect.any(Object));
   });
 
+  it("uses threadId for Slack when replyToId is missing", async () => {
+    mocks.sendMessageSlack.mockClear();
+    await routeReply({
+      payload: { text: "hi" },
+      channel: "slack",
+      to: "channel:C123",
+      threadId: "456.789",
+      cfg: {} as never,
+    });
+    expect(mocks.sendMessageSlack).toHaveBeenCalledWith(
+      "channel:C123",
+      "hi",
+      expect.objectContaining({ threadTs: "456.789" }),
+    );
+  });
+
   it("passes thread id to Telegram sends", async () => {
     mocks.sendMessageTelegram.mockClear();
     await routeReply({

src/auto-reply/reply/session-reset-model.test.ts

@@ -42,6 +42,39 @@ describe("applyResetModelOverride", () => {
     expect(sessionCtx.BodyStripped).toBe("summarize");
   });
 
+  it("clears auth profile overrides when reset applies a model", async () => {
+    const cfg = {} as ClawdbotConfig;
+    const aliasIndex = buildModelAliasIndex({ cfg, defaultProvider: "openai" });
+    const sessionEntry = {
+      sessionId: "s1",
+      updatedAt: Date.now(),
+      authProfileOverride: "anthropic:default",
+      authProfileOverrideSource: "user",
+      authProfileOverrideCompactionCount: 2,
+    };
+    const sessionStore = { "agent:main:dm:1": sessionEntry };
+    const sessionCtx = { BodyStripped: "minimax summarize" };
+    const ctx = { ChatType: "direct" };
+
+    await applyResetModelOverride({
+      cfg,
+      resetTriggered: true,
+      bodyStripped: "minimax summarize",
+      sessionCtx,
+      ctx,
+      sessionEntry,
+      sessionStore,
+      sessionKey: "agent:main:dm:1",
+      defaultProvider: "openai",
+      defaultModel: "gpt-4o-mini",
+      aliasIndex,
+    });
+
+    expect(sessionEntry.authProfileOverride).toBeUndefined();
+    expect(sessionEntry.authProfileOverrideSource).toBeUndefined();
+    expect(sessionEntry.authProfileOverrideCompactionCount).toBeUndefined();
+  });
+
   it("skips when resetTriggered is false", async () => {
     const cfg = {} as ClawdbotConfig;
     const aliasIndex = buildModelAliasIndex({ cfg, defaultProvider: "openai" });

src/auto-reply/reply/session-reset-model.ts

@@ -12,6 +12,7 @@ import { updateSessionStore } from "../../config/sessions.js";
 import type { MsgContext, TemplateContext } from "../templating.js";
 import { formatInboundBodyWithSenderMeta } from "./inbound-sender-meta.js";
 import { resolveModelDirectiveSelection, type ModelDirectiveSelection } from "./model-selection.js";
+import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 
 type ResetModelResult = {
   selection?: ModelDirectiveSelection;
@@ -62,25 +63,11 @@ function applySelectionToSession(params: {
 }) {
   const { selection, sessionEntry, sessionStore, sessionKey, storePath } = params;
   if (!sessionEntry || !sessionStore || !sessionKey) return;
-  let updated = false;
-  if (selection.isDefault) {
-    if (sessionEntry.providerOverride || sessionEntry.modelOverride) {
-      delete sessionEntry.providerOverride;
-      delete sessionEntry.modelOverride;
-      updated = true;
-    }
-  } else {
-    if (sessionEntry.providerOverride !== selection.provider) {
-      sessionEntry.providerOverride = selection.provider;
-      updated = true;
-    }
-    if (sessionEntry.modelOverride !== selection.model) {
-      sessionEntry.modelOverride = selection.model;
-      updated = true;
-    }
-  }
+  const { updated } = applyModelOverrideToSessionEntry({
+    entry: sessionEntry,
+    selection,
+  });
   if (!updated) return;
-  sessionEntry.updatedAt = Date.now();
   sessionStore[sessionKey] = sessionEntry;
   if (storePath) {
     updateSessionStore(storePath, (store) => {

src/auto-reply/status.test.ts

@@ -143,6 +143,22 @@ describe("buildStatusMessage", () => {
     expect(normalized).toContain("Media: image ok (openai/gpt-5.2) · audio skipped (maxBytes)");
   });
 
+  it("omits media line when all decisions are none", () => {
+    const text = buildStatusMessage({
+      agent: { model: "anthropic/claude-opus-4-5" },
+      sessionEntry: { sessionId: "media-none", updatedAt: 0 },
+      sessionKey: "agent:main:main",
+      queue: { mode: "none" },
+      mediaDecisions: [
+        { capability: "image", outcome: "no-attachment", attachments: [] },
+        { capability: "audio", outcome: "no-attachment", attachments: [] },
+        { capability: "video", outcome: "no-attachment", attachments: [] },
+      ],
+    });
+
+    expect(normalizeTestText(text)).not.toContain("Media:");
+  });
+
   it("does not show elevated label when session explicitly disables it", () => {
     const text = buildStatusMessage({
       agent: { model: "anthropic/claude-opus-4-5", elevatedDefault: "on" },

src/auto-reply/status.ts

@@ -201,8 +201,9 @@ const formatMediaUnderstandingLine = (decisions?: MediaUnderstandingDecision[])
       }
       return null;
     })
-    .filter(Boolean);
+    .filter((part): part is string => part != null);
   if (parts.length === 0) return null;
+  if (parts.every((part) => part.endsWith(" none"))) return null;
   return `📎 Media: ${parts.join(" · ")}`;
 };
 

src/canvas-host/a2ui/.bundle.hash

@@ -1 +1 @@
-c1cdb1b463e70d87976d88abf13e373e774c057e6796c947227c56b459af9d77
+d9a36b111dfd93cbbb629fddf075800690ce0ae32a3a2ef201b365f4f6d6f5d5

src/channels/plugins/outbound/slack.ts

@@ -5,19 +5,23 @@ export const slackOutbound: ChannelOutboundAdapter = {
   deliveryMode: "direct",
   chunker: null,
   textChunkLimit: 4000,
-  sendText: async ({ to, text, accountId, deps, replyToId }) => {
+  sendText: async ({ to, text, accountId, deps, replyToId, threadId }) => {
     const send = deps?.sendSlack ?? sendMessageSlack;
+    // Use threadId fallback so routed tool notifications stay in the Slack thread.
+    const threadTs = replyToId ?? (threadId != null ? String(threadId) : undefined);
     const result = await send(to, text, {
-      threadTs: replyToId ?? undefined,
+      threadTs,
       accountId: accountId ?? undefined,
     });
     return { channel: "slack", ...result };
   },
-  sendMedia: async ({ to, text, mediaUrl, accountId, deps, replyToId }) => {
+  sendMedia: async ({ to, text, mediaUrl, accountId, deps, replyToId, threadId }) => {
     const send = deps?.sendSlack ?? sendMessageSlack;
+    // Use threadId fallback so routed tool notifications stay in the Slack thread.
+    const threadTs = replyToId ?? (threadId != null ? String(threadId) : undefined);
     const result = await send(to, text, {
       mediaUrl,
-      threadTs: replyToId ?? undefined,
+      threadTs,
       accountId: accountId ?? undefined,
     });
     return { channel: "slack", ...result };

src/cli/browser-cli-inspect.test.ts

@@ -0,0 +1,78 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { Command } from "commander";
+
+const clientMocks = vi.hoisted(() => ({
+  browserSnapshot: vi.fn(async () => ({
+    ok: true,
+    format: "ai",
+    targetId: "t1",
+    url: "https://example.com",
+    snapshot: "ok",
+  })),
+  resolveBrowserControlUrl: vi.fn(() => "http://127.0.0.1:18791"),
+}));
+vi.mock("../browser/client.js", () => clientMocks);
+
+const configMocks = vi.hoisted(() => ({
+  loadConfig: vi.fn(() => ({ browser: {} })),
+}));
+vi.mock("../config/config.js", () => configMocks);
+
+const runtime = {
+  log: vi.fn(),
+  error: vi.fn(),
+  exit: vi.fn(),
+};
+vi.mock("../runtime.js", () => ({
+  defaultRuntime: runtime,
+}));
+
+describe("browser cli snapshot defaults", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+    configMocks.loadConfig.mockReturnValue({ browser: {} });
+  });
+
+  it("uses config snapshot defaults when mode is not provided", async () => {
+    configMocks.loadConfig.mockReturnValue({
+      browser: { snapshotDefaults: { mode: "efficient" } },
+    });
+    const { registerBrowserInspectCommands } = await import("./browser-cli-inspect.js");
+    const program = new Command();
+    const browser = program.command("browser").option("--json", false);
+    registerBrowserInspectCommands(browser, () => ({}));
+
+    await program.parseAsync(["browser", "snapshot"], { from: "user" });
+
+    expect(clientMocks.browserSnapshot).toHaveBeenCalledWith(
+      "http://127.0.0.1:18791",
+      expect.objectContaining({
+        format: "ai",
+        mode: "efficient",
+      }),
+    );
+  });
+
+  it("does not apply config snapshot defaults to aria snapshots", async () => {
+    configMocks.loadConfig.mockReturnValue({
+      browser: { snapshotDefaults: { mode: "efficient" } },
+    });
+    clientMocks.browserSnapshot.mockResolvedValueOnce({
+      ok: true,
+      format: "aria",
+      targetId: "t1",
+      url: "https://example.com",
+      nodes: [],
+    });
+    const { registerBrowserInspectCommands } = await import("./browser-cli-inspect.js");
+    const program = new Command();
+    const browser = program.command("browser").option("--json", false);
+    registerBrowserInspectCommands(browser, () => ({}));
+
+    await program.parseAsync(["browser", "snapshot", "--format", "aria"], { from: "user" });
+
+    expect(clientMocks.browserSnapshot).toHaveBeenCalled();
+    const [, opts] = clientMocks.browserSnapshot.mock.calls.at(-1) ?? [];
+    expect(opts?.mode).toBeUndefined();
+  });
+});

src/cli/browser-cli-inspect.ts

@@ -2,6 +2,7 @@ import type { Command } from "commander";
 
 import { browserSnapshot, resolveBrowserControlUrl } from "../browser/client.js";
 import { browserScreenshotAction } from "../browser/client-actions.js";
+import { loadConfig } from "../config/config.js";
 import { danger } from "../globals.js";
 import { defaultRuntime } from "../runtime.js";
 import type { BrowserParentOpts } from "./browser-cli-shared.js";
@@ -62,7 +63,11 @@ export function registerBrowserInspectCommands(
       const baseUrl = resolveBrowserControlUrl(parent?.url);
       const profile = parent?.browserProfile;
       const format = opts.format === "aria" ? "aria" : "ai";
-      const mode = opts.efficient === true || opts.mode === "efficient" ? "efficient" : undefined;
+      const configMode =
+        format === "ai" && loadConfig().browser?.snapshotDefaults?.mode === "efficient"
+          ? "efficient"
+          : undefined;
+      const mode = opts.efficient === true || opts.mode === "efficient" ? "efficient" : configMode;
       try {
         const result = await browserSnapshot(baseUrl, {
           format,

src/cli/browser-cli.ts

@@ -5,6 +5,7 @@ import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
 import { theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";
+import { formatHelpExamples } from "./help-format.js";
 import { registerBrowserActionInputCommands } from "./browser-cli-actions-input.js";
 import { registerBrowserActionObserveCommands } from "./browser-cli-actions-observe.js";
 import { registerBrowserDebugCommands } from "./browser-cli-debug.js";
@@ -26,7 +27,10 @@ export function registerBrowserCli(program: Command) {
     .addHelpText(
       "after",
       () =>
-        `\nExamples:\n  ${[...browserCoreExamples, ...browserActionExamples].join("\n  ")}\n\n${theme.muted("Docs:")} ${formatDocsLink(
+        `\n${theme.heading("Examples:")}\n${formatHelpExamples(
+          [...browserCoreExamples, ...browserActionExamples].map((cmd) => [cmd, ""]),
+          true,
+        )}\n\n${theme.muted("Docs:")} ${formatDocsLink(
           "/cli/browser",
           "docs.clawd.bot/cli/browser",
         )}\n`,

src/cli/cron-cli.test.ts

@@ -246,4 +246,128 @@ describe("cron cli", () => {
     expect(patch?.patch?.payload?.kind).toBe("agentTurn");
     expect(patch?.patch?.payload?.deliver).toBe(false);
   });
+
+  it("does not include undefined delivery fields when updating message", async () => {
+    callGatewayFromCli.mockClear();
+
+    const { registerCronCli } = await import("./cron-cli.js");
+    const program = new Command();
+    program.exitOverride();
+    registerCronCli(program);
+
+    // Update message without delivery flags - should NOT include undefined delivery fields
+    await program.parseAsync(["cron", "edit", "job-1", "--message", "Updated message"], {
+      from: "user",
+    });
+
+    const updateCall = callGatewayFromCli.mock.calls.find((call) => call[0] === "cron.update");
+    const patch = updateCall?.[2] as {
+      patch?: {
+        payload?: {
+          message?: string;
+          deliver?: boolean;
+          channel?: string;
+          to?: string;
+          bestEffortDeliver?: boolean;
+        };
+      };
+    };
+
+    // Should include the new message
+    expect(patch?.patch?.payload?.message).toBe("Updated message");
+
+    // Should NOT include delivery fields at all (to preserve existing values)
+    expect(patch?.patch?.payload).not.toHaveProperty("deliver");
+    expect(patch?.patch?.payload).not.toHaveProperty("channel");
+    expect(patch?.patch?.payload).not.toHaveProperty("to");
+    expect(patch?.patch?.payload).not.toHaveProperty("bestEffortDeliver");
+  });
+
+  it("includes delivery fields when explicitly provided with message", async () => {
+    callGatewayFromCli.mockClear();
+
+    const { registerCronCli } = await import("./cron-cli.js");
+    const program = new Command();
+    program.exitOverride();
+    registerCronCli(program);
+
+    // Update message AND delivery - should include both
+    await program.parseAsync(
+      [
+        "cron",
+        "edit",
+        "job-1",
+        "--message",
+        "Updated message",
+        "--deliver",
+        "--channel",
+        "telegram",
+        "--to",
+        "19098680",
+      ],
+      { from: "user" },
+    );
+
+    const updateCall = callGatewayFromCli.mock.calls.find((call) => call[0] === "cron.update");
+    const patch = updateCall?.[2] as {
+      patch?: {
+        payload?: {
+          message?: string;
+          deliver?: boolean;
+          channel?: string;
+          to?: string;
+        };
+      };
+    };
+
+    // Should include everything
+    expect(patch?.patch?.payload?.message).toBe("Updated message");
+    expect(patch?.patch?.payload?.deliver).toBe(true);
+    expect(patch?.patch?.payload?.channel).toBe("telegram");
+    expect(patch?.patch?.payload?.to).toBe("19098680");
+  });
+
+  it("includes best-effort delivery when provided with message", async () => {
+    callGatewayFromCli.mockClear();
+
+    const { registerCronCli } = await import("./cron-cli.js");
+    const program = new Command();
+    program.exitOverride();
+    registerCronCli(program);
+
+    await program.parseAsync(
+      ["cron", "edit", "job-1", "--message", "Updated message", "--best-effort-deliver"],
+      { from: "user" },
+    );
+
+    const updateCall = callGatewayFromCli.mock.calls.find((call) => call[0] === "cron.update");
+    const patch = updateCall?.[2] as {
+      patch?: { payload?: { message?: string; bestEffortDeliver?: boolean } };
+    };
+
+    expect(patch?.patch?.payload?.message).toBe("Updated message");
+    expect(patch?.patch?.payload?.bestEffortDeliver).toBe(true);
+  });
+
+  it("includes no-best-effort delivery when provided with message", async () => {
+    callGatewayFromCli.mockClear();
+
+    const { registerCronCli } = await import("./cron-cli.js");
+    const program = new Command();
+    program.exitOverride();
+    registerCronCli(program);
+
+    await program.parseAsync(
+      ["cron", "edit", "job-1", "--message", "Updated message", "--no-best-effort-deliver"],
+      { from: "user" },
+    );
+
+    const updateCall = callGatewayFromCli.mock.calls.find((call) => call[0] === "cron.update");
+    const patch = updateCall?.[2] as {
+      patch?: { payload?: { message?: string; bestEffortDeliver?: boolean } };
+    };
+
+    expect(patch?.patch?.payload?.message).toBe("Updated message");
+    expect(patch?.patch?.payload?.bestEffortDeliver).toBe(false);
+  });
 });

src/cli/cron-cli/register.cron-edit.ts

@@ -10,6 +10,15 @@ import {
   warnIfCronSchedulerDisabled,
 } from "./shared.js";
 
+const assignIf = (
+  target: Record<string, unknown>,
+  key: string,
+  value: unknown,
+  shouldAssign: boolean,
+) => {
+  if (shouldAssign) target[key] = value;
+};
+
 export function registerCronEditCommand(cron: Command) {
   addGatewayClientOptions(
     cron
@@ -136,18 +145,19 @@ export function registerCronEditCommand(cron: Command) {
             };
           } else if (hasAgentTurnPatch) {
             const payload: Record<string, unknown> = { kind: "agentTurn" };
-            if (typeof opts.message === "string") payload.message = String(opts.message);
-            if (model) payload.model = model;
-            if (thinking) payload.thinking = thinking;
-            if (hasTimeoutSeconds) {
-              payload.timeoutSeconds = timeoutSeconds;
-            }
-            if (typeof opts.deliver === "boolean") payload.deliver = opts.deliver;
-            if (typeof opts.channel === "string") payload.channel = opts.channel;
-            if (typeof opts.to === "string") payload.to = opts.to;
-            if (typeof opts.bestEffortDeliver === "boolean") {
-              payload.bestEffortDeliver = opts.bestEffortDeliver;
-            }
+            assignIf(payload, "message", String(opts.message), typeof opts.message === "string");
+            assignIf(payload, "model", model, Boolean(model));
+            assignIf(payload, "thinking", thinking, Boolean(thinking));
+            assignIf(payload, "timeoutSeconds", timeoutSeconds, hasTimeoutSeconds);
+            assignIf(payload, "deliver", opts.deliver, typeof opts.deliver === "boolean");
+            assignIf(payload, "channel", opts.channel, typeof opts.channel === "string");
+            assignIf(payload, "to", opts.to, typeof opts.to === "string");
+            assignIf(
+              payload,
+              "bestEffortDeliver",
+              opts.bestEffortDeliver,
+              typeof opts.bestEffortDeliver === "boolean",
+            );
             patch.payload = payload;
           }
 

src/cli/devices-cli.ts

@@ -3,6 +3,8 @@ import type { Command } from "commander";
 import { callGateway } from "../gateway/call.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
 import { defaultRuntime } from "../runtime.js";
+import { renderTable } from "../terminal/table.js";
+import { theme } from "../terminal/theme.js";
 import { withProgress } from "./progress.js";
 
 type DevicesRpcOpts = {
@@ -96,11 +98,11 @@ function parseDevicePairingList(value: unknown): DevicePairingList {
 }
 
 function formatTokenSummary(tokens: DeviceTokenSummary[] | undefined) {
-  if (!tokens || tokens.length === 0) return "tokens: none";
+  if (!tokens || tokens.length === 0) return "none";
   const parts = tokens
     .map((t) => `${t.role}${t.revokedAtMs ? " (revoked)" : ""}`)
     .sort((a, b) => a.localeCompare(b));
-  return `tokens: ${parts.join(", ")}`;
+  return parts.join(", ");
 }
 
 export function registerDevicesCli(program: Command) {
@@ -118,32 +120,59 @@ export function registerDevicesCli(program: Command) {
           return;
         }
         if (list.pending?.length) {
-          defaultRuntime.log("Pending:");
-          for (const req of list.pending) {
-            const name = req.displayName || req.deviceId;
-            const repair = req.isRepair ? " (repair)" : "";
-            const ip = req.remoteIp ? ` · ${req.remoteIp}` : "";
-            const age =
-              typeof req.ts === "number" ? ` · ${formatAge(Date.now() - req.ts)} ago` : "";
-            const role = req.role ? ` · role: ${req.role}` : "";
-            defaultRuntime.log(`- ${req.requestId}: ${name}${repair}${role}${ip}${age}`);
-          }
+          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+          defaultRuntime.log(
+            `${theme.heading("Pending")} ${theme.muted(`(${list.pending.length})`)}`,
+          );
+          defaultRuntime.log(
+            renderTable({
+              width: tableWidth,
+              columns: [
+                { key: "Request", header: "Request", minWidth: 10 },
+                { key: "Device", header: "Device", minWidth: 16, flex: true },
+                { key: "Role", header: "Role", minWidth: 8 },
+                { key: "IP", header: "IP", minWidth: 12 },
+                { key: "Age", header: "Age", minWidth: 8 },
+                { key: "Flags", header: "Flags", minWidth: 8 },
+              ],
+              rows: list.pending.map((req) => ({
+                Request: req.requestId,
+                Device: req.displayName || req.deviceId,
+                Role: req.role ?? "",
+                IP: req.remoteIp ?? "",
+                Age: typeof req.ts === "number" ? `${formatAge(Date.now() - req.ts)} ago` : "",
+                Flags: req.isRepair ? "repair" : "",
+              })),
+            }).trimEnd(),
+          );
         }
         if (list.paired?.length) {
-          defaultRuntime.log("Paired:");
-          for (const device of list.paired) {
-            const name = device.displayName || device.deviceId;
-            const roles = device.roles?.length ? `roles: ${device.roles.join(", ")}` : "roles: -";
-            const scopes = device.scopes?.length
-              ? `scopes: ${device.scopes.join(", ")}`
-              : "scopes: -";
-            const ip = device.remoteIp ? ` · ${device.remoteIp}` : "";
-            const tokens = formatTokenSummary(device.tokens);
-            defaultRuntime.log(`- ${name} · ${roles} · ${scopes} · ${tokens}${ip}`);
-          }
+          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+          defaultRuntime.log(
+            `${theme.heading("Paired")} ${theme.muted(`(${list.paired.length})`)}`,
+          );
+          defaultRuntime.log(
+            renderTable({
+              width: tableWidth,
+              columns: [
+                { key: "Device", header: "Device", minWidth: 16, flex: true },
+                { key: "Roles", header: "Roles", minWidth: 12, flex: true },
+                { key: "Scopes", header: "Scopes", minWidth: 12, flex: true },
+                { key: "Tokens", header: "Tokens", minWidth: 12, flex: true },
+                { key: "IP", header: "IP", minWidth: 12 },
+              ],
+              rows: list.paired.map((device) => ({
+                Device: device.displayName || device.deviceId,
+                Roles: device.roles?.length ? device.roles.join(", ") : "",
+                Scopes: device.scopes?.length ? device.scopes.join(", ") : "",
+                Tokens: formatTokenSummary(device.tokens),
+                IP: device.remoteIp ?? "",
+              })),
+            }).trimEnd(),
+          );
         }
         if (!list.pending?.length && !list.paired?.length) {
-          defaultRuntime.log("No device pairing entries.");
+          defaultRuntime.log(theme.muted("No device pairing entries."));
         }
       }),
   );
@@ -160,7 +189,7 @@ export function registerDevicesCli(program: Command) {
           return;
         }
         const deviceId = (result as { device?: { deviceId?: string } })?.device?.deviceId;
-        defaultRuntime.log(`device approved: ${deviceId ?? "ok"}`);
+        defaultRuntime.log(`${theme.success("Approved")} ${theme.command(deviceId ?? "ok")}`);
       }),
   );
 
@@ -176,7 +205,7 @@ export function registerDevicesCli(program: Command) {
           return;
         }
         const deviceId = (result as { deviceId?: string })?.deviceId;
-        defaultRuntime.log(`device rejected: ${deviceId ?? "ok"}`);
+        defaultRuntime.log(`${theme.warn("Rejected")} ${theme.command(deviceId ?? "ok")}`);
       }),
   );
 

src/cli/directory-cli.ts

@@ -8,6 +8,7 @@ import { resolveMessageChannelSelection } from "../infra/outbound/channel-select
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
 import { theme } from "../terminal/theme.js";
+import { renderTable } from "../terminal/table.js";
 
 function parseLimit(value: unknown): number | null {
   if (typeof value === "number" && Number.isFinite(value)) {
@@ -22,9 +23,11 @@ function parseLimit(value: unknown): number | null {
   return parsed;
 }
 
-function formatEntry(entry: { kind: string; id: string; name?: string | undefined }): string {
-  const name = entry.name?.trim();
-  return name ? `${entry.id}\t${name}` : entry.id;
+function buildRows(entries: Array<{ id: string; name?: string | undefined }>) {
+  return entries.map((entry) => ({
+    ID: entry.id,
+    Name: entry.name?.trim() ?? "",
+  }));
 }
 
 export function registerDirectoryCli(program: Command) {
@@ -77,10 +80,21 @@ export function registerDirectoryCli(program: Command) {
           return;
         }
         if (!result) {
-          defaultRuntime.log("not available");
+          defaultRuntime.log(theme.muted("Not available."));
           return;
         }
-        defaultRuntime.log(formatEntry(result));
+        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+        defaultRuntime.log(`${theme.heading("Self")}`);
+        defaultRuntime.log(
+          renderTable({
+            width: tableWidth,
+            columns: [
+              { key: "ID", header: "ID", minWidth: 16, flex: true },
+              { key: "Name", header: "Name", minWidth: 18, flex: true },
+            ],
+            rows: buildRows([result]),
+          }).trimEnd(),
+        );
       } catch (err) {
         defaultRuntime.error(danger(String(err)));
         defaultRuntime.exit(1);
@@ -111,9 +125,22 @@ export function registerDirectoryCli(program: Command) {
           defaultRuntime.log(JSON.stringify(result, null, 2));
           return;
         }
-        for (const entry of result) {
-          defaultRuntime.log(formatEntry(entry));
+        if (result.length === 0) {
+          defaultRuntime.log(theme.muted("No peers found."));
+          return;
         }
+        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+        defaultRuntime.log(`${theme.heading("Peers")} ${theme.muted(`(${result.length})`)}`);
+        defaultRuntime.log(
+          renderTable({
+            width: tableWidth,
+            columns: [
+              { key: "ID", header: "ID", minWidth: 16, flex: true },
+              { key: "Name", header: "Name", minWidth: 18, flex: true },
+            ],
+            rows: buildRows(result),
+          }).trimEnd(),
+        );
       } catch (err) {
         defaultRuntime.error(danger(String(err)));
         defaultRuntime.exit(1);
@@ -143,9 +170,22 @@ export function registerDirectoryCli(program: Command) {
           defaultRuntime.log(JSON.stringify(result, null, 2));
           return;
         }
-        for (const entry of result) {
-          defaultRuntime.log(formatEntry(entry));
+        if (result.length === 0) {
+          defaultRuntime.log(theme.muted("No groups found."));
+          return;
         }
+        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+        defaultRuntime.log(`${theme.heading("Groups")} ${theme.muted(`(${result.length})`)}`);
+        defaultRuntime.log(
+          renderTable({
+            width: tableWidth,
+            columns: [
+              { key: "ID", header: "ID", minWidth: 16, flex: true },
+              { key: "Name", header: "Name", minWidth: 18, flex: true },
+            ],
+            rows: buildRows(result),
+          }).trimEnd(),
+        );
       } catch (err) {
         defaultRuntime.error(danger(String(err)));
         defaultRuntime.exit(1);
@@ -180,9 +220,24 @@ export function registerDirectoryCli(program: Command) {
           defaultRuntime.log(JSON.stringify(result, null, 2));
           return;
         }
-        for (const entry of result) {
-          defaultRuntime.log(formatEntry(entry));
+        if (result.length === 0) {
+          defaultRuntime.log(theme.muted("No group members found."));
+          return;
         }
+        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+        defaultRuntime.log(
+          `${theme.heading("Group Members")} ${theme.muted(`(${result.length})`)}`,
+        );
+        defaultRuntime.log(
+          renderTable({
+            width: tableWidth,
+            columns: [
+              { key: "ID", header: "ID", minWidth: 16, flex: true },
+              { key: "Name", header: "Name", minWidth: 18, flex: true },
+            ],
+            rows: buildRows(result),
+          }).trimEnd(),
+        );
       } catch (err) {
         defaultRuntime.error(danger(String(err)));
         defaultRuntime.exit(1);

src/cli/dns-cli.test.ts

@@ -7,6 +7,8 @@ describe("dns cli", () => {
     const log = vi.spyOn(console, "log").mockImplementation(() => {});
     const program = buildProgram();
     await program.parseAsync(["dns", "setup"], { from: "user" });
-    expect(log).toHaveBeenCalledWith(expect.stringContaining("Domain:"));
+    const output = log.mock.calls.map((call) => call.join(" ")).join("\n");
+    expect(output).toContain("DNS setup");
+    expect(output).toContain("clawdbot.internal");
   });
 });

src/cli/dns-cli.ts

@@ -7,7 +7,9 @@ import type { Command } from "commander";
 import { loadConfig } from "../config/config.js";
 import { pickPrimaryTailnetIPv4, pickPrimaryTailnetIPv6 } from "../infra/tailnet.js";
 import { getWideAreaZonePath, WIDE_AREA_DISCOVERY_DOMAIN } from "../infra/widearea-dns.js";
+import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
+import { renderTable } from "../terminal/table.js";
 import { theme } from "../terminal/theme.js";
 
 type RunOpts = { allowFailure?: boolean; inherit?: boolean };
@@ -112,14 +114,28 @@ export function registerDnsCli(program: Command) {
       const tailnetIPv6 = pickPrimaryTailnetIPv6();
       const zonePath = getWideAreaZonePath();
 
-      console.log(`Domain: ${WIDE_AREA_DISCOVERY_DOMAIN}`);
-      console.log(`Zone file (gateway-owned): ${zonePath}`);
-      console.log(
-        `Detected tailnet IP: ${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`,
+      const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+      defaultRuntime.log(theme.heading("DNS setup"));
+      defaultRuntime.log(
+        renderTable({
+          width: tableWidth,
+          columns: [
+            { key: "Key", header: "Key", minWidth: 18 },
+            { key: "Value", header: "Value", minWidth: 24, flex: true },
+          ],
+          rows: [
+            { Key: "Domain", Value: WIDE_AREA_DISCOVERY_DOMAIN },
+            { Key: "Zone file", Value: zonePath },
+            {
+              Key: "Tailnet IP",
+              Value: `${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`,
+            },
+          ],
+        }).trimEnd(),
       );
-      console.log("");
-      console.log("Recommended ~/.clawdbot/clawdbot.json:");
-      console.log(
+      defaultRuntime.log("");
+      defaultRuntime.log(theme.heading("Recommended ~/.clawdbot/clawdbot.json:"));
+      defaultRuntime.log(
         JSON.stringify(
           {
             gateway: { bind: "auto" },
@@ -129,14 +145,16 @@ export function registerDnsCli(program: Command) {
           2,
         ),
       );
-      console.log("");
-      console.log("Tailscale admin (DNS → Nameservers):");
-      console.log(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`);
-      console.log(`- Restrict to domain (Split DNS): clawdbot.internal`);
+      defaultRuntime.log("");
+      defaultRuntime.log(theme.heading("Tailscale admin (DNS → Nameservers):"));
+      defaultRuntime.log(
+        theme.muted(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`),
+      );
+      defaultRuntime.log(theme.muted("- Restrict to domain (Split DNS): clawdbot.internal"));
 
       if (!opts.apply) {
-        console.log("");
-        console.log("Run with --apply to install CoreDNS and configure it.");
+        defaultRuntime.log("");
+        defaultRuntime.log(theme.muted("Run with --apply to install CoreDNS and configure it."));
         return;
       }
 
@@ -205,16 +223,18 @@ export function registerDnsCli(program: Command) {
         fs.writeFileSync(zonePath, zoneLines.join("\n"), "utf-8");
       }
 
-      console.log("");
-      console.log("Starting CoreDNS (sudo)…");
+      defaultRuntime.log("");
+      defaultRuntime.log(theme.heading("Starting CoreDNS (sudo)…"));
       run("sudo", ["brew", "services", "restart", "coredns"], {
         inherit: true,
       });
 
       if (cfg.discovery?.wideArea?.enabled !== true) {
-        console.log("");
-        console.log(
-          "Note: enable discovery.wideArea.enabled in ~/.clawdbot/clawdbot.json on the gateway and restart the gateway so it writes the DNS-SD zone.",
+        defaultRuntime.log("");
+        defaultRuntime.log(
+          theme.muted(
+            "Note: enable discovery.wideArea.enabled in ~/.clawdbot/clawdbot.json on the gateway and restart the gateway so it writes the DNS-SD zone.",
+          ),
         );
       }
     });

src/cli/exec-approvals-cli.ts

@@ -5,7 +5,8 @@ import type { Command } from "commander";
 import type { ExecApprovalsAgent, ExecApprovalsFile } from "../infra/exec-approvals.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { theme } from "../terminal/theme.js";
+import { isRich, theme } from "../terminal/theme.js";
+import { renderTable } from "../terminal/table.js";
 import { callGatewayFromCli } from "./gateway-rpc.js";
 import { nodesCallOpts, resolveNodeId } from "./nodes-cli/rpc.js";
 import type { NodesRpcOpts } from "./nodes-cli/types.js";
@@ -24,6 +25,17 @@ type ExecApprovalsCliOpts = NodesRpcOpts & {
   agent?: string;
 };
 
+function formatAge(msAgo: number) {
+  const s = Math.max(0, Math.floor(msAgo / 1000));
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h`;
+  const d = Math.floor(h / 24);
+  return `${d}d`;
+}
+
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];
   for await (const chunk of process.stdin) {
@@ -89,6 +101,9 @@ function isEmptyAgent(agent: ExecApprovalsAgent): boolean {
 }
 
 export function registerExecApprovalsCli(program: Command) {
+  const formatExample = (cmd: string, desc: string) =>
+    `  ${theme.command(cmd)}\n    ${theme.muted(desc)}`;
+
   const approvals = program
     .command("approvals")
     .alias("exec-approvals")
@@ -106,8 +121,87 @@ export function registerExecApprovalsCli(program: Command) {
     .action(async (opts: ExecApprovalsCliOpts) => {
       const nodeId = await resolveTargetNodeId(opts);
       const snapshot = await loadSnapshot(opts, nodeId);
-      const payload = opts.json ? JSON.stringify(snapshot) : JSON.stringify(snapshot, null, 2);
-      defaultRuntime.log(payload);
+      if (opts.json) {
+        defaultRuntime.log(JSON.stringify(snapshot));
+        return;
+      }
+
+      const rich = isRich();
+      const heading = (text: string) => (rich ? theme.heading(text) : text);
+      const muted = (text: string) => (rich ? theme.muted(text) : text);
+      const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+
+      const file = snapshot.file ?? { version: 1 };
+      const defaults = file.defaults ?? {};
+      const defaultsParts = [
+        defaults.security ? `security=${defaults.security}` : null,
+        defaults.ask ? `ask=${defaults.ask}` : null,
+        defaults.askFallback ? `askFallback=${defaults.askFallback}` : null,
+        typeof defaults.autoAllowSkills === "boolean"
+          ? `autoAllowSkills=${defaults.autoAllowSkills ? "on" : "off"}`
+          : null,
+      ].filter(Boolean) as string[];
+      const agents = file.agents ?? {};
+      const allowlistRows: Array<{ Agent: string; Pattern: string; LastUsed: string }> = [];
+      const now = Date.now();
+      for (const [agentId, agent] of Object.entries(agents)) {
+        const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
+        for (const entry of allowlist) {
+          const pattern = entry?.pattern?.trim() ?? "";
+          if (!pattern) continue;
+          const lastUsedAt = typeof entry.lastUsedAt === "number" ? entry.lastUsedAt : null;
+          allowlistRows.push({
+            Agent: agentId,
+            Pattern: pattern,
+            LastUsed: lastUsedAt
+              ? `${formatAge(Math.max(0, now - lastUsedAt))} ago`
+              : muted("unknown"),
+          });
+        }
+      }
+
+      const summaryRows = [
+        { Field: "Path", Value: snapshot.path },
+        { Field: "Exists", Value: snapshot.exists ? "yes" : "no" },
+        { Field: "Hash", Value: snapshot.hash },
+        { Field: "Version", Value: String(file.version ?? 1) },
+        { Field: "Socket", Value: file.socket?.path ?? "default" },
+        { Field: "Defaults", Value: defaultsParts.length > 0 ? defaultsParts.join(", ") : "none" },
+        { Field: "Agents", Value: String(Object.keys(agents).length) },
+        { Field: "Allowlist", Value: String(allowlistRows.length) },
+      ];
+
+      defaultRuntime.log(heading("Approvals"));
+      defaultRuntime.log(
+        renderTable({
+          width: tableWidth,
+          columns: [
+            { key: "Field", header: "Field", minWidth: 8 },
+            { key: "Value", header: "Value", minWidth: 24, flex: true },
+          ],
+          rows: summaryRows,
+        }).trimEnd(),
+      );
+
+      if (allowlistRows.length === 0) {
+        defaultRuntime.log("");
+        defaultRuntime.log(muted("No allowlist entries."));
+        return;
+      }
+
+      defaultRuntime.log("");
+      defaultRuntime.log(heading("Allowlist"));
+      defaultRuntime.log(
+        renderTable({
+          width: tableWidth,
+          columns: [
+            { key: "Agent", header: "Agent", minWidth: 8 },
+            { key: "Pattern", header: "Pattern", minWidth: 20, flex: true },
+            { key: "LastUsed", header: "Last Used", minWidth: 10 },
+          ],
+          rows: allowlistRows,
+        }).trimEnd(),
+      );
     });
   nodesCallOpts(getCmd);
 
@@ -151,7 +245,23 @@ export function registerExecApprovalsCli(program: Command) {
     });
   nodesCallOpts(setCmd);
 
-  const allowlist = approvals.command("allowlist").description("Edit the per-agent allowlist");
+  const allowlist = approvals
+    .command("allowlist")
+    .description("Edit the per-agent allowlist")
+    .addHelpText(
+      "after",
+      () =>
+        `\n${theme.heading("Examples:")}\n${formatExample(
+          'clawdbot approvals allowlist add "~/Projects/**/bin/rg"',
+          "Allowlist a local binary pattern for the default agent.",
+        )}\n${formatExample(
+          'clawdbot approvals allowlist add --agent main --node <id|name|ip> "/usr/bin/uptime"',
+          "Allowlist on a specific node/agent.",
+        )}\n${formatExample(
+          'clawdbot approvals allowlist remove "~/Projects/**/bin/rg"',
+          "Remove an allowlist pattern.",
+        )}\n\n${theme.muted("Docs:")} ${formatDocsLink("/cli/approvals", "docs.clawd.bot/cli/approvals")}\n`,
+    );
 
   const allowlistAdd = allowlist
     .command("add <pattern>")

src/cli/help-format.ts

@@ -0,0 +1,25 @@
+import { theme } from "../terminal/theme.js";
+
+export type HelpExample = readonly [command: string, description: string];
+
+export function formatHelpExample(command: string, description: string): string {
+  return `  ${theme.command(command)}\n    ${theme.muted(description)}`;
+}
+
+export function formatHelpExampleLine(command: string, description: string): string {
+  if (!description) return `  ${theme.command(command)}`;
+  return `  ${theme.command(command)} ${theme.muted(`# ${description}`)}`;
+}
+
+export function formatHelpExamples(examples: ReadonlyArray<HelpExample>, inline = false): string {
+  const formatter = inline ? formatHelpExampleLine : formatHelpExample;
+  return examples.map(([command, description]) => formatter(command, description)).join("\n");
+}
+
+export function formatHelpExampleGroup(
+  label: string,
+  examples: ReadonlyArray<HelpExample>,
+  inline = false,
+) {
+  return `${theme.muted(label)}\n${formatHelpExamples(examples, inline)}`;
+}

src/cli/hooks-cli.ts

@@ -1,7 +1,6 @@
 import fs from "node:fs";
 import fsp from "node:fs/promises";
 import path from "node:path";
-import chalk from "chalk";
 import type { Command } from "commander";
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
 import type { ClawdbotConfig } from "../config/config.js";
@@ -23,6 +22,7 @@ import { recordHookInstall } from "../hooks/installs.js";
 import { buildPluginStatusReport } from "../plugins/status.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
+import { renderTable } from "../terminal/table.js";
 import { theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";
 import { resolveUserPath } from "../utils.js";
@@ -66,50 +66,40 @@ function buildHooksReport(config: ClawdbotConfig): HookStatusReport {
   return buildWorkspaceHookStatus(workspaceDir, { config, entries });
 }
 
-/**
- * Format a single hook for display in the list
- */
-function formatHookLine(hook: HookStatusEntry, verbose = false): string {
+function formatHookStatus(hook: HookStatusEntry): string {
+  if (hook.eligible) return theme.success("✓ ready");
+  if (hook.disabled) return theme.warn("⏸ disabled");
+  return theme.error("✗ missing");
+}
+
+function formatHookName(hook: HookStatusEntry): string {
   const emoji = hook.emoji ?? "🔗";
-  const status = hook.eligible
-    ? chalk.green("✓")
-    : hook.disabled
-      ? chalk.yellow("disabled")
-      : chalk.red("missing reqs");
+  return `${emoji} ${theme.command(hook.name)}`;
+}
 
-  const name = hook.eligible ? chalk.white(hook.name) : chalk.gray(hook.name);
+function formatHookSource(hook: HookStatusEntry): string {
+  if (!hook.managedByPlugin) return hook.source;
+  return `plugin:${hook.pluginId ?? "unknown"}`;
+}
 
-  const desc = chalk.gray(
-    hook.description.length > 50 ? `${hook.description.slice(0, 47)}...` : hook.description,
-  );
-  const sourceLabel = hook.managedByPlugin
-    ? chalk.magenta(`plugin:${hook.pluginId ?? "unknown"}`)
-    : "";
-
-  if (verbose) {
-    const missing: string[] = [];
-    if (hook.missing.bins.length > 0) {
-      missing.push(`bins: ${hook.missing.bins.join(", ")}`);
-    }
-    if (hook.missing.anyBins.length > 0) {
-      missing.push(`anyBins: ${hook.missing.anyBins.join(", ")}`);
-    }
-    if (hook.missing.env.length > 0) {
-      missing.push(`env: ${hook.missing.env.join(", ")}`);
-    }
-    if (hook.missing.config.length > 0) {
-      missing.push(`config: ${hook.missing.config.join(", ")}`);
-    }
-    if (hook.missing.os.length > 0) {
-      missing.push(`os: ${hook.missing.os.join(", ")}`);
-    }
-    const missingStr = missing.length > 0 ? chalk.red(` [${missing.join("; ")}]`) : "";
-    const sourceSuffix = sourceLabel ? ` ${sourceLabel}` : "";
-    return `${emoji} ${name} ${status}${missingStr}\n   ${desc}${sourceSuffix}`;
+function formatHookMissingSummary(hook: HookStatusEntry): string {
+  const missing: string[] = [];
+  if (hook.missing.bins.length > 0) {
+    missing.push(`bins: ${hook.missing.bins.join(", ")}`);
   }
-
-  const sourceSuffix = sourceLabel ? ` ${sourceLabel}` : "";
-  return `${emoji} ${name} ${status} - ${desc}${sourceSuffix}`;
+  if (hook.missing.anyBins.length > 0) {
+    missing.push(`anyBins: ${hook.missing.anyBins.join(", ")}`);
+  }
+  if (hook.missing.env.length > 0) {
+    missing.push(`env: ${hook.missing.env.join(", ")}`);
+  }
+  if (hook.missing.config.length > 0) {
+    missing.push(`config: ${hook.missing.config.join(", ")}`);
+  }
+  if (hook.missing.os.length > 0) {
+    missing.push(`os: ${hook.missing.os.join(", ")}`);
+  }
+  return missing.join("; ");
 }
 
 async function readInstalledPackageVersion(dir: string): Promise<string | undefined> {
@@ -157,27 +147,39 @@ export function formatHooksList(report: HookStatusReport, opts: HooksListOptions
   }
 
   const eligible = hooks.filter((h) => h.eligible);
-  const notEligible = hooks.filter((h) => !h.eligible);
+  const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+  const rows = hooks.map((hook) => {
+    const missing = formatHookMissingSummary(hook);
+    return {
+      Status: formatHookStatus(hook),
+      Hook: formatHookName(hook),
+      Description: theme.muted(hook.description),
+      Source: formatHookSource(hook),
+      Missing: missing ? theme.warn(missing) : "",
+    };
+  });
+
+  const columns = [
+    { key: "Status", header: "Status", minWidth: 10 },
+    { key: "Hook", header: "Hook", minWidth: 18, flex: true },
+    { key: "Description", header: "Description", minWidth: 24, flex: true },
+    { key: "Source", header: "Source", minWidth: 12, flex: true },
+  ];
+  if (opts.verbose) {
+    columns.push({ key: "Missing", header: "Missing", minWidth: 18, flex: true });
+  }
 
   const lines: string[] = [];
-  lines.push(chalk.bold.cyan("Hooks") + chalk.gray(` (${eligible.length}/${hooks.length} ready)`));
-  lines.push("");
-
-  if (eligible.length > 0) {
-    lines.push(chalk.bold.green("Ready:"));
-    for (const hook of eligible) {
-      lines.push(`  ${formatHookLine(hook, opts.verbose)}`);
-    }
-  }
-
-  if (notEligible.length > 0 && !opts.eligible) {
-    if (eligible.length > 0) lines.push("");
-    lines.push(chalk.bold.yellow("Not ready:"));
-    for (const hook of notEligible) {
-      lines.push(`  ${formatHookLine(hook, opts.verbose)}`);
-    }
-  }
-
+  lines.push(
+    `${theme.heading("Hooks")} ${theme.muted(`(${eligible.length}/${hooks.length} ready)`)}`,
+  );
+  lines.push(
+    renderTable({
+      width: tableWidth,
+      columns,
+      rows,
+    }).trimEnd(),
+  );
   return lines.join("\n");
 }
 
@@ -205,33 +207,33 @@ export function formatHookInfo(
   const lines: string[] = [];
   const emoji = hook.emoji ?? "🔗";
   const status = hook.eligible
-    ? chalk.green("✓ Ready")
+    ? theme.success("✓ Ready")
     : hook.disabled
-      ? chalk.yellow("⏸ Disabled")
-      : chalk.red("✗ Missing requirements");
+      ? theme.warn("⏸ Disabled")
+      : theme.error("✗ Missing requirements");
 
-  lines.push(`${emoji} ${chalk.bold.cyan(hook.name)} ${status}`);
+  lines.push(`${emoji} ${theme.heading(hook.name)} ${status}`);
   lines.push("");
-  lines.push(chalk.white(hook.description));
+  lines.push(hook.description);
   lines.push("");
 
   // Details
-  lines.push(chalk.bold("Details:"));
+  lines.push(theme.heading("Details:"));
   if (hook.managedByPlugin) {
-    lines.push(`  Source: ${hook.source} (${hook.pluginId ?? "unknown"})`);
+    lines.push(`${theme.muted("  Source:")} ${hook.source} (${hook.pluginId ?? "unknown"})`);
   } else {
-    lines.push(`  Source: ${hook.source}`);
+    lines.push(`${theme.muted("  Source:")} ${hook.source}`);
   }
-  lines.push(`  Path: ${chalk.gray(hook.filePath)}`);
-  lines.push(`  Handler: ${chalk.gray(hook.handlerPath)}`);
+  lines.push(`${theme.muted("  Path:")} ${hook.filePath}`);
+  lines.push(`${theme.muted("  Handler:")} ${hook.handlerPath}`);
   if (hook.homepage) {
-    lines.push(`  Homepage: ${chalk.blue(hook.homepage)}`);
+    lines.push(`${theme.muted("  Homepage:")} ${hook.homepage}`);
   }
   if (hook.events.length > 0) {
-    lines.push(`  Events: ${hook.events.join(", ")}`);
+    lines.push(`${theme.muted("  Events:")} ${hook.events.join(", ")}`);
   }
   if (hook.managedByPlugin) {
-    lines.push(`  Managed by plugin; enable/disable via hooks CLI not available.`);
+    lines.push(theme.muted("  Managed by plugin; enable/disable via hooks CLI not available."));
   }
 
   // Requirements
@@ -244,40 +246,40 @@ export function formatHookInfo(
 
   if (hasRequirements) {
     lines.push("");
-    lines.push(chalk.bold("Requirements:"));
+    lines.push(theme.heading("Requirements:"));
     if (hook.requirements.bins.length > 0) {
       const binsStatus = hook.requirements.bins.map((bin) => {
         const missing = hook.missing.bins.includes(bin);
-        return missing ? chalk.red(`✗ ${bin}`) : chalk.green(`✓ ${bin}`);
+        return missing ? theme.error(`✗ ${bin}`) : theme.success(`✓ ${bin}`);
       });
-      lines.push(`  Binaries: ${binsStatus.join(", ")}`);
+      lines.push(`${theme.muted("  Binaries:")} ${binsStatus.join(", ")}`);
     }
     if (hook.requirements.anyBins.length > 0) {
       const anyBinsStatus =
         hook.missing.anyBins.length > 0
-          ? chalk.red(`✗ (any of: ${hook.requirements.anyBins.join(", ")})`)
-          : chalk.green(`✓ (any of: ${hook.requirements.anyBins.join(", ")})`);
-      lines.push(`  Any binary: ${anyBinsStatus}`);
+          ? theme.error(`✗ (any of: ${hook.requirements.anyBins.join(", ")})`)
+          : theme.success(`✓ (any of: ${hook.requirements.anyBins.join(", ")})`);
+      lines.push(`${theme.muted("  Any binary:")} ${anyBinsStatus}`);
     }
     if (hook.requirements.env.length > 0) {
       const envStatus = hook.requirements.env.map((env) => {
         const missing = hook.missing.env.includes(env);
-        return missing ? chalk.red(`✗ ${env}`) : chalk.green(`✓ ${env}`);
+        return missing ? theme.error(`✗ ${env}`) : theme.success(`✓ ${env}`);
       });
-      lines.push(`  Environment: ${envStatus.join(", ")}`);
+      lines.push(`${theme.muted("  Environment:")} ${envStatus.join(", ")}`);
     }
     if (hook.requirements.config.length > 0) {
       const configStatus = hook.configChecks.map((check) => {
-        return check.satisfied ? chalk.green(`✓ ${check.path}`) : chalk.red(`✗ ${check.path}`);
+        return check.satisfied ? theme.success(`✓ ${check.path}`) : theme.error(`✗ ${check.path}`);
       });
-      lines.push(`  Config: ${configStatus.join(", ")}`);
+      lines.push(`${theme.muted("  Config:")} ${configStatus.join(", ")}`);
     }
     if (hook.requirements.os.length > 0) {
       const osStatus =
         hook.missing.os.length > 0
-          ? chalk.red(`✗ (${hook.requirements.os.join(", ")})`)
-          : chalk.green(`✓ (${hook.requirements.os.join(", ")})`);
-      lines.push(`  OS: ${osStatus}`);
+          ? theme.error(`✗ (${hook.requirements.os.join(", ")})`)
+          : theme.success(`✓ (${hook.requirements.os.join(", ")})`);
+      lines.push(`${theme.muted("  OS:")} ${osStatus}`);
     }
   }
 
@@ -313,15 +315,15 @@ export function formatHooksCheck(report: HookStatusReport, opts: HooksCheckOptio
   const notEligible = report.hooks.filter((h) => !h.eligible);
 
   const lines: string[] = [];
-  lines.push(chalk.bold.cyan("Hooks Status"));
+  lines.push(theme.heading("Hooks Status"));
   lines.push("");
-  lines.push(`Total hooks: ${report.hooks.length}`);
-  lines.push(chalk.green(`Ready: ${eligible.length}`));
-  lines.push(chalk.yellow(`Not ready: ${notEligible.length}`));
+  lines.push(`${theme.muted("Total hooks:")} ${report.hooks.length}`);
+  lines.push(`${theme.success("Ready:")} ${eligible.length}`);
+  lines.push(`${theme.warn("Not ready:")} ${notEligible.length}`);
 
   if (notEligible.length > 0) {
     lines.push("");
-    lines.push(chalk.bold.yellow("Hooks not ready:"));
+    lines.push(theme.heading("Hooks not ready:"));
     for (const hook of notEligible) {
       const reasons = [];
       if (hook.disabled) reasons.push("disabled");
@@ -374,7 +376,9 @@ export async function enableHook(hookName: string): Promise<void> {
   };
 
   await writeConfigFile(nextConfig);
-  console.log(`${chalk.green("✓")} Enabled hook: ${hook.emoji ?? "🔗"} ${hookName}`);
+  defaultRuntime.log(
+    `${theme.success("✓")} Enabled hook: ${hook.emoji ?? "🔗"} ${theme.command(hookName)}`,
+  );
 }
 
 export async function disableHook(hookName: string): Promise<void> {
@@ -408,7 +412,9 @@ export async function disableHook(hookName: string): Promise<void> {
   };
 
   await writeConfigFile(nextConfig);
-  console.log(`${chalk.yellow("⏸")} Disabled hook: ${hook.emoji ?? "🔗"} ${hookName}`);
+  defaultRuntime.log(
+    `${theme.warn("⏸")} Disabled hook: ${hook.emoji ?? "🔗"} ${theme.command(hookName)}`,
+  );
 }
 
 export function registerHooksCli(program: Command): void {
@@ -431,9 +437,11 @@ export function registerHooksCli(program: Command): void {
       try {
         const config = loadConfig();
         const report = buildHooksReport(config);
-        console.log(formatHooksList(report, opts));
+        defaultRuntime.log(formatHooksList(report, opts));
       } catch (err) {
-        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        defaultRuntime.error(
+          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
+        );
         process.exit(1);
       }
     });
@@ -446,9 +454,11 @@ export function registerHooksCli(program: Command): void {
       try {
         const config = loadConfig();
         const report = buildHooksReport(config);
-        console.log(formatHookInfo(report, name, opts));
+        defaultRuntime.log(formatHookInfo(report, name, opts));
       } catch (err) {
-        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        defaultRuntime.error(
+          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
+        );
         process.exit(1);
       }
     });
@@ -461,9 +471,11 @@ export function registerHooksCli(program: Command): void {
       try {
         const config = loadConfig();
         const report = buildHooksReport(config);
-        console.log(formatHooksCheck(report, opts));
+        defaultRuntime.log(formatHooksCheck(report, opts));
       } catch (err) {
-        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        defaultRuntime.error(
+          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
+        );
         process.exit(1);
       }
     });
@@ -475,7 +487,9 @@ export function registerHooksCli(program: Command): void {
       try {
         await enableHook(name);
       } catch (err) {
-        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        defaultRuntime.error(
+          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
+        );
         process.exit(1);
       }
     });
@@ -487,7 +501,9 @@ export function registerHooksCli(program: Command): void {
       try {
         await disableHook(name);
       } catch (err) {
-        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        defaultRuntime.error(
+          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
+        );
         process.exit(1);
       }
     });
@@ -570,7 +586,7 @@ export function registerHooksCli(program: Command): void {
           path: resolved,
           logger: {
             info: (msg) => defaultRuntime.log(msg),
-            warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
+            warn: (msg) => defaultRuntime.log(theme.warn(msg)),
           },
         });
         if (!result.ok) {
@@ -650,7 +666,7 @@ export function registerHooksCli(program: Command): void {
         spec: raw,
         logger: {
           info: (msg) => defaultRuntime.log(msg),
-          warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
+          warn: (msg) => defaultRuntime.log(theme.warn(msg)),
         },
       });
       if (!result.ok) {
@@ -726,15 +742,15 @@ export function registerHooksCli(program: Command): void {
       for (const hookId of targets) {
         const record = installs[hookId];
         if (!record) {
-          defaultRuntime.log(chalk.yellow(`No install record for "${hookId}".`));
+          defaultRuntime.log(theme.warn(`No install record for "${hookId}".`));
           continue;
         }
         if (record.source !== "npm") {
-          defaultRuntime.log(chalk.yellow(`Skipping "${hookId}" (source: ${record.source}).`));
+          defaultRuntime.log(theme.warn(`Skipping "${hookId}" (source: ${record.source}).`));
           continue;
         }
         if (!record.spec) {
-          defaultRuntime.log(chalk.yellow(`Skipping "${hookId}" (missing npm spec).`));
+          defaultRuntime.log(theme.warn(`Skipping "${hookId}" (missing npm spec).`));
           continue;
         }
 
@@ -749,11 +765,11 @@ export function registerHooksCli(program: Command): void {
             expectedHookPackId: hookId,
             logger: {
               info: (msg) => defaultRuntime.log(msg),
-              warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
+              warn: (msg) => defaultRuntime.log(theme.warn(msg)),
             },
           });
           if (!probe.ok) {
-            defaultRuntime.log(chalk.red(`Failed to check ${hookId}: ${probe.error}`));
+            defaultRuntime.log(theme.error(`Failed to check ${hookId}: ${probe.error}`));
             continue;
           }
 
@@ -773,11 +789,11 @@ export function registerHooksCli(program: Command): void {
           expectedHookPackId: hookId,
           logger: {
             info: (msg) => defaultRuntime.log(msg),
-            warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
+            warn: (msg) => defaultRuntime.log(theme.warn(msg)),
           },
         });
         if (!result.ok) {
-          defaultRuntime.log(chalk.red(`Failed to update ${hookId}: ${result.error}`));
+          defaultRuntime.log(theme.error(`Failed to update ${hookId}: ${result.error}`));
           continue;
         }
 
@@ -811,9 +827,11 @@ export function registerHooksCli(program: Command): void {
     try {
       const config = loadConfig();
       const report = buildHooksReport(config);
-      console.log(formatHooksList(report, {}));
+      defaultRuntime.log(formatHooksList(report, {}));
     } catch (err) {
-      console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+      defaultRuntime.error(
+        `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
+      );
       process.exit(1);
     }
   });

src/cli/logs-cli.test.ts

@@ -0,0 +1,85 @@
+import { Command } from "commander";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const callGatewayFromCli = vi.fn();
+
+vi.mock("./gateway-rpc.js", async () => {
+  const actual = await vi.importActual<typeof import("./gateway-rpc.js")>("./gateway-rpc.js");
+  return {
+    ...actual,
+    callGatewayFromCli: (...args: unknown[]) => callGatewayFromCli(...args),
+  };
+});
+
+describe("logs cli", () => {
+  afterEach(() => {
+    callGatewayFromCli.mockReset();
+  });
+
+  it("writes output directly to stdout/stderr", async () => {
+    callGatewayFromCli.mockResolvedValueOnce({
+      file: "/tmp/clawdbot.log",
+      cursor: 1,
+      size: 123,
+      lines: ["raw line"],
+      truncated: true,
+      reset: true,
+    });
+
+    const stdoutWrites: string[] = [];
+    const stderrWrites: string[] = [];
+    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation((chunk: unknown) => {
+      stdoutWrites.push(String(chunk));
+      return true;
+    });
+    const stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+      stderrWrites.push(String(chunk));
+      return true;
+    });
+
+    const { registerLogsCli } = await import("./logs-cli.js");
+    const program = new Command();
+    program.exitOverride();
+    registerLogsCli(program);
+
+    await program.parseAsync(["logs"], { from: "user" });
+
+    stdoutSpy.mockRestore();
+    stderrSpy.mockRestore();
+
+    expect(stdoutWrites.join("")).toContain("Log file:");
+    expect(stdoutWrites.join("")).toContain("raw line");
+    expect(stderrWrites.join("")).toContain("Log tail truncated");
+    expect(stderrWrites.join("")).toContain("Log cursor reset");
+  });
+
+  it("warns when the output pipe closes", async () => {
+    callGatewayFromCli.mockResolvedValueOnce({
+      file: "/tmp/clawdbot.log",
+      lines: ["line one"],
+    });
+
+    const stderrWrites: string[] = [];
+    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => {
+      const err = new Error("EPIPE") as NodeJS.ErrnoException;
+      err.code = "EPIPE";
+      throw err;
+    });
+    const stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+      stderrWrites.push(String(chunk));
+      return true;
+    });
+
+    const { registerLogsCli } = await import("./logs-cli.js");
+    const program = new Command();
+    program.exitOverride();
+    registerLogsCli(program);
+
+    await program.parseAsync(["logs"], { from: "user" });
+
+    stdoutSpy.mockRestore();
+    stderrSpy.mockRestore();
+
+    expect(stderrWrites.join("")).toContain("output stdout closed");
+  });
+});

src/cli/logs-cli.ts

@@ -2,8 +2,9 @@ import { setTimeout as delay } from "node:timers/promises";
 import type { Command } from "commander";
 import { buildGatewayConnectionDetails } from "../gateway/call.js";
 import { parseLogLine } from "../logging/parse-log-line.js";
-import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
+import { clearActiveProgressLine } from "../terminal/progress-line.js";
+import { createSafeStreamWriter } from "../terminal/stream-writer.js";
 import { colorize, isRich, theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";
 import { addGatewayClientOptions, callGatewayFromCli } from "./gateway-rpc.js";
@@ -104,10 +105,28 @@ function formatLogLine(
   return [head, messageValue].filter(Boolean).join(" ").trim();
 }
 
-function emitJsonLine(payload: Record<string, unknown>, toStdErr = false) {
-  const text = `${JSON.stringify(payload)}\n`;
-  if (toStdErr) process.stderr.write(text);
-  else process.stdout.write(text);
+function createLogWriters() {
+  const writer = createSafeStreamWriter({
+    beforeWrite: () => clearActiveProgressLine(),
+    onBrokenPipe: (err, stream) => {
+      const code = err.code ?? "EPIPE";
+      const target = stream === process.stdout ? "stdout" : "stderr";
+      const message = `clawdbot logs: output ${target} closed (${code}). Stopping tail.`;
+      try {
+        clearActiveProgressLine();
+        process.stderr.write(`${message}\n`);
+      } catch {
+        // ignore secondary failures while reporting the broken pipe
+      }
+    },
+  });
+
+  return {
+    logLine: (text: string) => writer.writeLine(process.stdout, text),
+    errorLine: (text: string) => writer.writeLine(process.stderr, text),
+    emitJsonLine: (payload: Record<string, unknown>, toStdErr = false) =>
+      writer.write(toStdErr ? process.stderr : process.stdout, `${JSON.stringify(payload)}\n`),
+  };
 }
 
 function emitGatewayError(
@@ -115,6 +134,8 @@ function emitGatewayError(
   opts: LogsCliOptions,
   mode: "json" | "text",
   rich: boolean,
+  emitJsonLine: (payload: Record<string, unknown>, toStdErr?: boolean) => boolean,
+  errorLine: (text: string) => boolean,
 ) {
   const details = buildGatewayConnectionDetails({ url: opts.url });
   const message = "Gateway not reachable. Is it running and accessible?";
@@ -122,22 +143,26 @@ function emitGatewayError(
   const errorText = err instanceof Error ? err.message : String(err);
 
   if (mode === "json") {
-    emitJsonLine(
-      {
-        type: "error",
-        message,
-        error: errorText,
-        details,
-        hint,
-      },
-      true,
-    );
+    if (
+      !emitJsonLine(
+        {
+          type: "error",
+          message,
+          error: errorText,
+          details,
+          hint,
+        },
+        true,
+      )
+    ) {
+      return;
+    }
     return;
   }
 
-  defaultRuntime.error(colorize(rich, theme.error, message));
-  defaultRuntime.error(details.message);
-  defaultRuntime.error(colorize(rich, theme.muted, hint));
+  if (!errorLine(colorize(rich, theme.error, message))) return;
+  if (!errorLine(details.message)) return;
+  errorLine(colorize(rich, theme.muted, hint));
 }
 
 export function registerLogsCli(program: Command) {
@@ -159,6 +184,7 @@ export function registerLogsCli(program: Command) {
   addGatewayClientOptions(logs);
 
   logs.action(async (opts: LogsCliOptions) => {
+    const { logLine, errorLine, emitJsonLine } = createLogWriters();
     const interval = parsePositiveInt(opts.interval, 1000);
     let cursor: number | undefined;
     let first = true;
@@ -171,58 +197,84 @@ export function registerLogsCli(program: Command) {
       try {
         payload = await fetchLogs(opts, cursor);
       } catch (err) {
-        emitGatewayError(err, opts, jsonMode ? "json" : "text", rich);
-        defaultRuntime.exit(1);
+        emitGatewayError(err, opts, jsonMode ? "json" : "text", rich, emitJsonLine, errorLine);
+        process.exit(1);
         return;
       }
       const lines = Array.isArray(payload.lines) ? payload.lines : [];
       if (jsonMode) {
         if (first) {
-          emitJsonLine({
-            type: "meta",
-            file: payload.file,
-            cursor: payload.cursor,
-            size: payload.size,
-          });
+          if (
+            !emitJsonLine({
+              type: "meta",
+              file: payload.file,
+              cursor: payload.cursor,
+              size: payload.size,
+            })
+          ) {
+            return;
+          }
         }
         for (const line of lines) {
           const parsed = parseLogLine(line);
           if (parsed) {
-            emitJsonLine({ type: "log", ...parsed });
+            if (!emitJsonLine({ type: "log", ...parsed })) {
+              return;
+            }
           } else {
-            emitJsonLine({ type: "raw", raw: line });
+            if (!emitJsonLine({ type: "raw", raw: line })) {
+              return;
+            }
           }
         }
         if (payload.truncated) {
-          emitJsonLine({
-            type: "notice",
-            message: "Log tail truncated (increase --max-bytes).",
-          });
+          if (
+            !emitJsonLine({
+              type: "notice",
+              message: "Log tail truncated (increase --max-bytes).",
+            })
+          ) {
+            return;
+          }
         }
         if (payload.reset) {
-          emitJsonLine({
-            type: "notice",
-            message: "Log cursor reset (file rotated).",
-          });
+          if (
+            !emitJsonLine({
+              type: "notice",
+              message: "Log cursor reset (file rotated).",
+            })
+          ) {
+            return;
+          }
         }
       } else {
         if (first && payload.file) {
           const prefix = pretty ? colorize(rich, theme.muted, "Log file:") : "Log file:";
-          defaultRuntime.log(`${prefix} ${payload.file}`);
+          if (!logLine(`${prefix} ${payload.file}`)) {
+            return;
+          }
         }
         for (const line of lines) {
-          defaultRuntime.log(
-            formatLogLine(line, {
-              pretty,
-              rich,
-            }),
-          );
+          if (
+            !logLine(
+              formatLogLine(line, {
+                pretty,
+                rich,
+              }),
+            )
+          ) {
+            return;
+          }
         }
         if (payload.truncated) {
-          defaultRuntime.error("Log tail truncated (increase --max-bytes).");
+          if (!errorLine("Log tail truncated (increase --max-bytes).")) {
+            return;
+          }
         }
         if (payload.reset) {
-          defaultRuntime.error("Log cursor reset (file rotated).");
+          if (!errorLine("Log cursor reset (file rotated).")) {
+            return;
+          }
         }
       }
       cursor =

src/cli/nodes-cli/cli-utils.ts

@@ -1,13 +1,28 @@
 import { defaultRuntime } from "../../runtime.js";
+import { isRich, theme } from "../../terminal/theme.js";
 import { runCommandWithRuntime } from "../cli-utils.js";
 import { unauthorizedHintForMessage } from "./rpc.js";
 
+export function getNodesTheme() {
+  const rich = isRich();
+  const color = (fn: (value: string) => string) => (value: string) => (rich ? fn(value) : value);
+  return {
+    rich,
+    heading: color(theme.heading),
+    ok: color(theme.success),
+    warn: color(theme.warn),
+    muted: color(theme.muted),
+    error: color(theme.error),
+  };
+}
+
 export function runNodesCommand(label: string, action: () => Promise<void>) {
   return runCommandWithRuntime(defaultRuntime, action, (err) => {
     const message = String(err);
-    defaultRuntime.error(`nodes ${label} failed: ${message}`);
+    const { error, warn } = getNodesTheme();
+    defaultRuntime.error(error(`nodes ${label} failed: ${message}`));
     const hint = unauthorizedHintForMessage(message);
-    if (hint) defaultRuntime.error(hint);
+    if (hint) defaultRuntime.error(warn(hint));
     defaultRuntime.exit(1);
   });
 }

src/cli/nodes-cli/register.camera.ts

@@ -9,9 +9,10 @@ import {
   writeBase64ToFile,
 } from "../nodes-camera.js";
 import { parseDurationMs } from "../parse-duration.js";
-import { runNodesCommand } from "./cli-utils.js";
+import { getNodesTheme, runNodesCommand } from "./cli-utils.js";
 import { callGatewayCli, nodesCallOpts, resolveNodeId } from "./rpc.js";
 import type { NodesRpcOpts } from "./types.js";
+import { renderTable } from "../../terminal/table.js";
 
 const parseFacing = (value: string): CameraFacing => {
   const v = String(value ?? "")
@@ -52,16 +53,30 @@ export function registerNodesCameraCommands(nodes: Command) {
           }
 
           if (devices.length === 0) {
-            defaultRuntime.log("No cameras reported.");
+            const { muted } = getNodesTheme();
+            defaultRuntime.log(muted("No cameras reported."));
             return;
           }
 
-          for (const device of devices) {
-            const id = typeof device.id === "string" ? device.id : "";
-            const name = typeof device.name === "string" ? device.name : "Unknown Camera";
-            const position = typeof device.position === "string" ? device.position : "unspecified";
-            defaultRuntime.log(`${name} (${position})${id ? ` — ${id}` : ""}`);
-          }
+          const { heading, muted } = getNodesTheme();
+          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+          const rows = devices.map((device) => ({
+            Name: typeof device.name === "string" ? device.name : "Unknown Camera",
+            Position: typeof device.position === "string" ? device.position : muted("unspecified"),
+            ID: typeof device.id === "string" ? device.id : "",
+          }));
+          defaultRuntime.log(heading("Cameras"));
+          defaultRuntime.log(
+            renderTable({
+              width: tableWidth,
+              columns: [
+                { key: "Name", header: "Name", minWidth: 14, flex: true },
+                { key: "Position", header: "Position", minWidth: 10 },
+                { key: "ID", header: "ID", minWidth: 10, flex: true },
+              ],
+              rows,
+            }).trimEnd(),
+          );
         });
       }),
     { timeoutMs: 60_000 },

src/cli/nodes-cli/register.canvas.ts

@@ -6,7 +6,7 @@ import { writeBase64ToFile } from "../nodes-camera.js";
 import { canvasSnapshotTempPath, parseCanvasSnapshotPayload } from "../nodes-canvas.js";
 import { parseTimeoutMs } from "../nodes-run.js";
 import { buildA2UITextJsonl, validateA2UIJsonl } from "./a2ui-jsonl.js";
-import { runNodesCommand } from "./cli-utils.js";
+import { getNodesTheme, runNodesCommand } from "./cli-utils.js";
 import { callGatewayCli, nodesCallOpts, resolveNodeId } from "./rpc.js";
 import type { NodesRpcOpts } from "./types.js";
 
@@ -121,7 +121,10 @@ export function registerNodesCanvasCommands(nodes: Command) {
             params.placement = placement;
           }
           await invokeCanvas(opts, "canvas.present", params);
-          if (!opts.json) defaultRuntime.log("canvas present ok");
+          if (!opts.json) {
+            const { ok } = getNodesTheme();
+            defaultRuntime.log(ok("canvas present ok"));
+          }
         });
       }),
   );
@@ -135,7 +138,10 @@ export function registerNodesCanvasCommands(nodes: Command) {
       .action(async (opts: NodesRpcOpts) => {
         await runNodesCommand("canvas hide", async () => {
           await invokeCanvas(opts, "canvas.hide", undefined);
-          if (!opts.json) defaultRuntime.log("canvas hide ok");
+          if (!opts.json) {
+            const { ok } = getNodesTheme();
+            defaultRuntime.log(ok("canvas hide ok"));
+          }
         });
       }),
   );
@@ -150,7 +156,10 @@ export function registerNodesCanvasCommands(nodes: Command) {
       .action(async (url: string, opts: NodesRpcOpts) => {
         await runNodesCommand("canvas navigate", async () => {
           await invokeCanvas(opts, "canvas.navigate", { url });
-          if (!opts.json) defaultRuntime.log("canvas navigate ok");
+          if (!opts.json) {
+            const { ok } = getNodesTheme();
+            defaultRuntime.log(ok("canvas navigate ok"));
+          }
         });
       }),
   );
@@ -179,7 +188,10 @@ export function registerNodesCanvasCommands(nodes: Command) {
               ? (raw as { payload?: { result?: string } }).payload
               : undefined;
           if (payload?.result) defaultRuntime.log(payload.result);
-          else defaultRuntime.log("canvas eval ok");
+          else {
+            const { ok } = getNodesTheme();
+            defaultRuntime.log(ok("canvas eval ok"));
+          }
         });
       }),
   );
@@ -213,8 +225,11 @@ export function registerNodesCanvasCommands(nodes: Command) {
           }
           await invokeCanvas(opts, "canvas.a2ui.pushJSONL", { jsonl });
           if (!opts.json) {
+            const { ok } = getNodesTheme();
             defaultRuntime.log(
-              `canvas a2ui push ok (v0.8, ${messageCount} message${messageCount === 1 ? "" : "s"})`,
+              ok(
+                `canvas a2ui push ok (v0.8, ${messageCount} message${messageCount === 1 ? "" : "s"})`,
+              ),
             );
           }
         });
@@ -230,7 +245,10 @@ export function registerNodesCanvasCommands(nodes: Command) {
       .action(async (opts: NodesRpcOpts) => {
         await runNodesCommand("canvas a2ui reset", async () => {
           await invokeCanvas(opts, "canvas.a2ui.reset", undefined);
-          if (!opts.json) defaultRuntime.log("canvas a2ui reset ok");
+          if (!opts.json) {
+            const { ok } = getNodesTheme();
+            defaultRuntime.log(ok("canvas a2ui reset ok"));
+          }
         });
       }),
   );

src/cli/nodes-cli/register.invoke.ts

@@ -2,7 +2,7 @@ import type { Command } from "commander";
 import { randomIdempotencyKey } from "../../gateway/call.js";
 import { defaultRuntime } from "../../runtime.js";
 import { parseEnvPairs, parseTimeoutMs } from "../nodes-run.js";
-import { runNodesCommand } from "./cli-utils.js";
+import { getNodesTheme, runNodesCommand } from "./cli-utils.js";
 import { callGatewayCli, nodesCallOpts, resolveNodeId, unauthorizedHintForMessage } from "./rpc.js";
 import type { NodesRpcOpts } from "./types.js";
 
@@ -21,7 +21,8 @@ export function registerNodesInvokeCommands(nodes: Command) {
           const nodeId = await resolveNodeId(opts, String(opts.node ?? ""));
           const command = String(opts.command ?? "").trim();
           if (!nodeId || !command) {
-            defaultRuntime.error("--node and --command required");
+            const { error } = getNodesTheme();
+            defaultRuntime.error(error("--node and --command required"));
             defaultRuntime.exit(1);
             return;
           }
@@ -108,16 +109,21 @@ export function registerNodesInvokeCommands(nodes: Command) {
           if (stdout) process.stdout.write(stdout);
           if (stderr) process.stderr.write(stderr);
           if (timedOut) {
-            defaultRuntime.error("run timed out");
+            const { error } = getNodesTheme();
+            defaultRuntime.error(error("run timed out"));
             defaultRuntime.exit(1);
             return;
           }
           if (exitCode !== null && exitCode !== 0) {
             const hint = unauthorizedHintForMessage(`${stderr}\n${stdout}`);
-            if (hint) defaultRuntime.error(hint);
+            if (hint) {
+              const { warn } = getNodesTheme();
+              defaultRuntime.error(warn(hint));
+            }
           }
           if (exitCode !== null && exitCode !== 0 && !success) {
-            defaultRuntime.error(`run exit ${exitCode}`);
+            const { error } = getNodesTheme();
+            defaultRuntime.error(error(`run exit ${exitCode}`));
             defaultRuntime.exit(1);
             return;
           }

src/cli/nodes-cli/register.notify.ts

@@ -1,7 +1,7 @@
 import type { Command } from "commander";
 import { randomIdempotencyKey } from "../../gateway/call.js";
 import { defaultRuntime } from "../../runtime.js";
-import { runNodesCommand } from "./cli-utils.js";
+import { getNodesTheme, runNodesCommand } from "./cli-utils.js";
 import { callGatewayCli, nodesCallOpts, resolveNodeId } from "./rpc.js";
 import type { NodesRpcOpts } from "./types.js";
 
@@ -49,7 +49,8 @@ export function registerNodesNotifyCommand(nodes: Command) {
             defaultRuntime.log(JSON.stringify(result, null, 2));
             return;
           }
-          defaultRuntime.log("notify ok");
+          const { ok } = getNodesTheme();
+          defaultRuntime.log(ok("notify ok"));
         });
       }),
   );

src/cli/nodes-cli/register.pairing.ts

@@ -1,9 +1,10 @@
 import type { Command } from "commander";
 import { defaultRuntime } from "../../runtime.js";
 import { formatAge, parsePairingList } from "./format.js";
-import { runNodesCommand } from "./cli-utils.js";
+import { getNodesTheme, runNodesCommand } from "./cli-utils.js";
 import { callGatewayCli, nodesCallOpts, resolveNodeId } from "./rpc.js";
 import type { NodesRpcOpts } from "./types.js";
+import { renderTable } from "../../terminal/table.js";
 
 export function registerNodesPairingCommands(nodes: Command) {
   nodesCallOpts(
@@ -19,16 +20,37 @@ export function registerNodesPairingCommands(nodes: Command) {
             return;
           }
           if (pending.length === 0) {
-            defaultRuntime.log("No pending pairing requests.");
+            const { muted } = getNodesTheme();
+            defaultRuntime.log(muted("No pending pairing requests."));
             return;
           }
-          for (const r of pending) {
-            const name = r.displayName || r.nodeId;
-            const repair = r.isRepair ? " (repair)" : "";
-            const ip = r.remoteIp ? ` · ${r.remoteIp}` : "";
-            const age = typeof r.ts === "number" ? ` · ${formatAge(Date.now() - r.ts)} ago` : "";
-            defaultRuntime.log(`- ${r.requestId}: ${name}${repair}${ip}${age}`);
-          }
+          const { heading, warn, muted } = getNodesTheme();
+          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+          const now = Date.now();
+          const rows = pending.map((r) => ({
+            Request: r.requestId,
+            Node: r.displayName?.trim() ? r.displayName.trim() : r.nodeId,
+            IP: r.remoteIp ?? "",
+            Requested:
+              typeof r.ts === "number"
+                ? `${formatAge(Math.max(0, now - r.ts))} ago`
+                : muted("unknown"),
+            Repair: r.isRepair ? warn("yes") : "",
+          }));
+          defaultRuntime.log(heading("Pending"));
+          defaultRuntime.log(
+            renderTable({
+              width: tableWidth,
+              columns: [
+                { key: "Request", header: "Request", minWidth: 8 },
+                { key: "Node", header: "Node", minWidth: 14, flex: true },
+                { key: "IP", header: "IP", minWidth: 10 },
+                { key: "Requested", header: "Requested", minWidth: 12 },
+                { key: "Repair", header: "Repair", minWidth: 6 },
+              ],
+              rows,
+            }).trimEnd(),
+          );
         });
       }),
   );
@@ -86,7 +108,8 @@ export function registerNodesPairingCommands(nodes: Command) {
             defaultRuntime.log(JSON.stringify(result, null, 2));
             return;
           }
-          defaultRuntime.log(`node rename ok: ${nodeId} -> ${name}`);
+          const { ok } = getNodesTheme();
+          defaultRuntime.log(ok(`node rename ok: ${nodeId} -> ${name}`));
         });
       }),
   );