import{n as e,u as t}from"./paths-B4IRk3wi.js";import{p as n}from"./subsystem-BQ1073Mu.js";import{y as r}from"./utils-D1PlBTFH.js";import{Zs as i,nc as a}from"./model-selection-p21GBPS6.js";import{l as o}from"./types.secrets-C-5U96pc.js";import{t as s}from"./command-format-BbDT1tlm.js";import{t as c}from"./prompts-wv-lfVrJ.js";import{t as l}from"./onboarding.secret-input-CVyfJfq_.js";async function u(e){if(e.opts.acceptRisk!==!0&&(await e.prompter.note([`Security warning — please read.`,``,`OpenClaw is a hobby project and still in beta. Expect sharp edges.`,`By default, OpenClaw is a personal agent: one trusted operator boundary.`,`This bot can read files and run actions if tools are enabled.`,`A bad prompt can trick it into doing unsafe things.`,``,`OpenClaw is not a hostile multi-tenant boundary by default.`,`If multiple users can message one tool-enabled agent, they share that delegated tool authority.`,``,`If you’re not comfortable with security hardening and access control, don’t run OpenClaw.`,`Ask someone experienced to help before enabling tools or exposing it to the internet.`,``,`Recommended baseline:`,`- Pairing/allowlists + mention gating.`,`- Multi-user/shared inbox: split trust boundaries (separate gateway/credentials, ideally separate OS users/hosts).`,`- Sandbox + least-privilege tools.`,"- Shared inboxes: isolate DM sessions (`session.dmScope: per-channel-peer`) and keep tool access minimal.",`- Keep secrets out of the agent’s reachable filesystem.`,`- Use the strongest available model for any bot with tools or untrusted inboxes.`,``,`Run regularly:`,`openclaw security audit --deep`,`openclaw security audit --fix`,``,`Must read: https://docs.openclaw.ai/gateway/security`].join(`
`),`Security`),!await e.prompter.confirm({message:`I understand this is personal-by-default and shared/multi-user use requires lock-down. Continue?`,initialValue:!1})))throw new c(`risk not accepted`)}async function d(c,d=n,f){let p=await import(`./onboard-helpers-lK6pmfqQ.js`).then(e=>e.d);p.printWizardHeader(d),await f.intro(`OpenClaw onboarding`),await u({opts:c,prompter:f});let m=await i(),h=m.valid&&m.exists?m.config:{};if(m.exists&&!m.valid){await f.note(p.summarizeExistingConfig(h),`Invalid config`),m.issues.length>0&&await f.note([...m.issues.map(e=>`- ${e.path}: ${e.message}`),``,`Docs: https://docs.openclaw.ai/gateway/configuration`].join(`
`),`Config issues`),await f.outro(`Config invalid. Run \`${s(`openclaw doctor`)}\` to repair it, then re-run onboarding.`),d.exit(1);return}let g=`Configure details later via ${s(`openclaw configure`)}.`,_=c.flow?.trim(),v=_===`manual`?`advanced`:_;if(v&&v!==`quickstart`&&v!==`advanced`){d.error(`Invalid --flow (use quickstart, manual, or advanced).`),d.exit(1);return}let y=(v===`quickstart`||v===`advanced`?v:void 0)??await f.select({message:`Onboarding mode`,options:[{value:`quickstart`,label:`QuickStart`,hint:g},{value:`advanced`,label:`Manual`,hint:`Configure port, network, Tailscale, and auth options.`}],initialValue:`quickstart`});if(c.mode===`remote`&&y===`quickstart`&&(await f.note(`QuickStart only supports local gateways. Switching to Manual mode.`,`QuickStart`),y=`advanced`),m.exists&&(await f.note(p.summarizeExistingConfig(h),`Existing config detected`),await f.select({message:`Config handling`,options:[{value:`keep`,label:`Use existing values`},{value:`modify`,label:`Update values`},{value:`reset`,label:`Reset`}]})===`reset`)){let e=h.agents?.defaults?.workspace??p.DEFAULT_WORKSPACE,t=await f.select({message:`Reset scope`,options:[{value:`config`,label:`Config only`},{value:`config+creds+sessions`,label:`Config + creds + sessions`},{value:`full`,label:`Full reset (config + creds + sessions + workspace)`}]});await p.handleReset(t,r(e),d),h={}}let b=(()=>{let e=typeof h.gateway?.port==`number`||h.gateway?.bind!==void 0||h.gateway?.auth?.mode!==void 0||h.gateway?.auth?.token!==void 0||h.gateway?.auth?.password!==void 0||h.gateway?.customBindHost!==void 0||h.gateway?.tailscale?.mode!==void 0,n=h.gateway?.bind,r=n===`loopback`||n===`lan`||n===`auto`||n===`custom`||n===`tailnet`?n:`loopback`,i=`token`;h.gateway?.auth?.mode===`token`||h.gateway?.auth?.mode===`password`?i=h.gateway.auth.mode:h.gateway?.auth?.token?i=`token`:h.gateway?.auth?.password&&(i=`password`);let a=h.gateway?.tailscale?.mode,o=a===`off`||a===`serve`||a===`funnel`?a:`off`;return{hasExisting:e,port:t(h),bind:r,authMode:i,tailscaleMode:o,token:h.gateway?.auth?.token,password:h.gateway?.auth?.password,customBindHost:h.gateway?.customBindHost,tailscaleResetOnExit:h.gateway?.tailscale?.resetOnExit??!1}})();if(y===`quickstart`){let t=e=>e===`loopback`?`Loopback (127.0.0.1)`:e===`lan`?`LAN`:e===`custom`?`Custom IP`:e===`tailnet`?`Tailnet (Tailscale IP)`:`Auto`,n=e=>e===`token`?`Token (default)`:`Password`,r=e=>e===`off`?`Off`:e===`serve`?`Serve`:`Funnel`,i=b.hasExisting?[`Keeping your current gateway settings:`,`Gateway port: ${b.port}`,`Gateway bind: ${t(b.bind)}`,...b.bind===`custom`&&b.customBindHost?[`Gateway custom IP: ${b.customBindHost}`]:[],`Gateway auth: ${n(b.authMode)}`,`Tailscale exposure: ${r(b.tailscaleMode)}`,`Direct to chat channels.`]:[`Gateway port: ${e}`,`Gateway bind: Loopback (127.0.0.1)`,`Gateway auth: Token (default)`,`Tailscale exposure: Off`,`Direct to chat channels.`];await f.note(i.join(`
`),`QuickStart`)}let x=t(h),S=`ws://127.0.0.1:${x}`,C=process.env.OPENCLAW_GATEWAY_TOKEN??process.env.CLAWDBOT_GATEWAY_TOKEN;try{let e=await l({config:h,value:h.gateway?.auth?.token,path:`gateway.auth.token`,env:process.env});e&&(C=e)}catch(e){await f.note([`Could not resolve gateway.auth.token SecretRef for onboarding probe.`,e instanceof Error?e.message:String(e)].join(`
`),`Gateway auth`)}let w=process.env.OPENCLAW_GATEWAY_PASSWORD??process.env.CLAWDBOT_GATEWAY_PASSWORD;try{let e=await l({config:h,value:h.gateway?.auth?.password,path:`gateway.auth.password`,env:process.env});e&&(w=e)}catch(e){await f.note([`Could not resolve gateway.auth.password SecretRef for onboarding probe.`,e instanceof Error?e.message:String(e)].join(`
`),`Gateway auth`)}let T=await p.probeGatewayReachable({url:S,token:C,password:w}),E=h.gateway?.remote?.url?.trim()??``,D=o(h.gateway?.remote?.token);try{let e=await l({config:h,value:h.gateway?.remote?.token,path:`gateway.remote.token`,env:process.env});e&&(D=e)}catch(e){await f.note([`Could not resolve gateway.remote.token SecretRef for onboarding probe.`,e instanceof Error?e.message:String(e)].join(`
`),`Gateway auth`)}let O=E?await p.probeGatewayReachable({url:E,token:D}):null,k=c.mode??(y===`quickstart`?`local`:await f.select({message:`What do you want to set up?`,options:[{value:`local`,label:`Local gateway (this machine)`,hint:T.ok?`Gateway reachable (${S})`:`No gateway detected (${S})`},{value:`remote`,label:`Remote gateway (info-only)`,hint:E?O?.ok?`Gateway reachable (${E})`:`Configured but unreachable (${E})`:`No remote URL configured yet`}]}));if(k===`remote`){let{promptRemoteGatewayConfig:e}=await import(`./onboard-remote-bmfoKFez.js`).then(e=>e.t),{logConfigUpdated:t}=await import(`./logging-DZNwCl5f.js`).then(e=>e.r),n=await e(h,f,{secretInputMode:c.secretInputMode});n=p.applyWizardMetadata(n,{command:`onboard`,mode:k}),await a(n),t(d),await f.outro(`Remote gateway configured.`);return}let A=r((c.workspace??(y===`quickstart`?h.agents?.defaults?.workspace??p.DEFAULT_WORKSPACE:await f.text({message:`Workspace directory`,initialValue:h.agents?.defaults?.workspace??p.DEFAULT_WORKSPACE}))).trim()||p.DEFAULT_WORKSPACE),{applyOnboardingLocalWorkspaceConfig:j}=await import(`./onboard-config-DS9dUv8M.js`).then(e=>e.n),M=j(h,A),{ensureAuthProfileStore:N}=await import(`./model-selection-p21GBPS6.js`).then(e=>e.Ct),{promptAuthChoiceGrouped:P}=await import(`./auth-choice-prompt-xYj13czb.js`).then(e=>e.t),{promptCustomApiConfig:F}=await import(`./onboard-custom-BJxU7YK6.js`).then(e=>e.r),{applyAuthChoice:I,resolvePreferredProviderForAuthChoice:L,warnIfModelConfigLooksOff:R}=await import(`./auth-choice-BBJNsu3R.js`).then(e=>e.t),{applyPrimaryModel:z,promptDefaultModel:B}=await import(`./model-picker-CVTiccWc.js`).then(e=>e.i),V=N(void 0,{allowKeychainPrompt:!1}),H=c.authChoice===void 0,U=c.authChoice??await P({prompter:f,store:V,includeSkip:!0});if(U===`custom-api-key`)M=(await F({prompter:f,runtime:d,config:M,secretInputMode:c.secretInputMode})).config;else{let e=await I({authChoice:U,config:M,prompter:f,runtime:d,setDefaultModel:!(H&&U===`ollama`),opts:{tokenProvider:c.tokenProvider,token:c.authChoice===`apiKey`&&c.token?c.token:void 0}});M=e.config,e.agentModelOverride&&(M=z(M,e.agentModelOverride))}if(H&&U!==`custom-api-key`){let e=await B({config:M,prompter:f,allowKeep:!0,ignoreAllowlist:!0,includeVllm:!0,preferredProvider:L(U)});e.config&&(M=e.config),e.model&&(M=z(M,e.model))}if(U===`ollama`){let{ensureOllamaModelPulled:e}=await import(`./ollama-setup-CCMVRp6u.js`).then(e=>e.r);await e({config:M,prompter:f})}await R(M,f);let{configureGatewayForOnboarding:W}=await import(`./onboarding.gateway-config-fYFHsNnh.js`),G=await W({flow:y,baseConfig:h,nextConfig:M,localPort:x,quickstartGateway:b,secretInputMode:c.secretInputMode,prompter:f,runtime:d});M=G.nextConfig;let K=G.settings;if(c.skipChannels??c.skipProviders)await f.note(`Skipping channel setup.`,`Channels`);else{let{listChannelPlugins:e}=await import(`./plugins-1aNlpDX7.js`).then(e=>e.i),{setupChannels:t}=await import(`./onboard-channels-D6_ICVD1.js`).then(e=>e.n),n=y===`quickstart`?e().filter(e=>e.meta.quickstartAllowFrom).map(e=>e.id):[];M=await t(M,d,f,{allowSignalInstall:!0,forceAllowFromChannels:n,skipDmPolicyPrompt:y===`quickstart`,skipConfirm:y===`quickstart`,quickstartDefaults:y===`quickstart`,secretInputMode:c.secretInputMode})}await a(M);let{logConfigUpdated:q}=await import(`./logging-DZNwCl5f.js`).then(e=>e.r);if(q(d),await p.ensureWorkspaceAndSessions(A,d,{skipBootstrap:!!M.agents?.defaults?.skipBootstrap}),c.skipSearch)await f.note(`Skipping search setup.`,`Search`);else{let{setupSearch:e}=await import(`./onboard-search-f2tJD4hg.js`);M=await e(M,d,f,{quickstartDefaults:y===`quickstart`,secretInputMode:c.secretInputMode})}if(c.skipSkills)await f.note(`Skipping skills setup.`,`Skills`);else{let{setupSkills:e}=await import(`./onboard-skills-jLOYYIm0.js`).then(e=>e.t);M=await e(M,A,d,f)}let{setupInternalHooks:J}=await import(`./onboard-hooks-pgC-9oLF.js`);M=await J(M,d,f),M=p.applyWizardMetadata(M,{command:`onboard`,mode:k}),await a(M);let{finalizeOnboardingWizard:Y}=await import(`./onboarding.finalize-Bt3qpfaG.js`),{launchedTui:X}=await Y({flow:y,opts:c,baseConfig:h,nextConfig:M,workspaceDir:A,settings:K,prompter:f,runtime:d})}export{d as t};
