refactor(cli): group core credentials and security helpers

bin/lib/credentials.js

@@ -1,10 +1,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 //
-// Thin re-export shim — the implementation lives in src/lib/credentials.ts,
-// compiled to dist/lib/credentials.js.
+// Thin re-export shim — the implementation lives in src/lib/credentials/store.ts,
+// compiled to dist/lib/credentials/store.js.
 
-const mod = require("../../dist/lib/credentials");
+const mod = require("../../dist/lib/credentials/store");
 
 const exports_ = { ...mod };
 

bin/lib/ports.js

@@ -5,4 +5,4 @@
 // Override any port via environment variables.
 // Based on the approach from jnun (PR #683).
 
-module.exports = require("../../dist/lib/ports");
+module.exports = require("../../dist/lib/core/ports");

scripts/check-legacy-migrated-paths.ts

@@ -38,7 +38,7 @@ const REMOVED_SHIM_MOVES: Record<string, string> = {
   "bin/lib/runtime-recovery.js": "src/lib/runtime-recovery.ts",
   "bin/lib/sandbox-build-context.js": "src/lib/sandbox-build-context.ts",
   "bin/lib/services.js": "src/lib/services.ts",
-  "bin/lib/version.js": "src/lib/version.ts",
+  "bin/lib/version.js": "src/lib/core/version.ts",
   "bin/lib/onboard.js": "src/lib/onboard.ts",
   "bin/lib/policies.js": "src/lib/policies.ts",
   "bin/lib/runner.js": "src/lib/runner.ts",

scripts/dev-tier-selector.js

@@ -18,7 +18,7 @@
 const readline = require("readline");
 
 // ── Stubs ──────────────────────────────────────────────────────────────────
-const creds = require("../dist/lib/credentials.js");
+const creds = require("../dist/lib/credentials/store.js");
 const runner = require("../dist/lib/runner.js");
 const registry = require("../dist/lib/state/registry.js");
 

scripts/generate-openclaw-config.py

@@ -69,7 +69,7 @@ def _coerce_positive_int(env: dict, name: str, default: int) -> int:
 def is_loopback(hostname: str) -> bool:
     """Check if a hostname is a loopback address.
 
-    Mirrors isLoopbackHostname() from src/lib/url-utils.ts.
+    Mirrors isLoopbackHostname() from src/lib/core/url-utils.ts.
     Returns True for localhost, ::1, and 127.x.x.x addresses.
     """
     normalized = (hostname or "").strip().lower().strip("[]")

scripts/ts-migration-assist.ts

@@ -26,7 +26,7 @@ const SPECIAL_REWRITES: Record<string, Array<[string, string]>> = {
     ['require("./inference-config")', 'require("../../bin/lib/inference-config")'],
     ['require("./platform")', 'require("../../bin/lib/platform")'],
     ['require("./resolve-openshell")', 'require("../../bin/lib/resolve-openshell")'],
-    ['require("./credentials")', 'require("../../bin/lib/credentials")'],
+    ['require("./credentials/store")', 'require("../../bin/lib/credentials")'],
     ['require("./state/registry")', 'require("../../bin/lib/registry")'],
     ['require("./nim")', 'require("../../bin/lib/nim")'],
     ['require("./onboard-session")', 'require("../../bin/lib/onboard-session")'],

src/lib/actions/deploy.ts

@@ -3,7 +3,7 @@
 
 import { execFileSync, spawnSync } from "node:child_process";
 
-import { getCredential } from "../credentials";
+import { getCredential } from "../credentials/store";
 import { executeDeploy } from "../deploy";
 import { ROOT, run, runInteractive, shellQuote, validateName } from "../runner";
 

src/lib/actions/maintenance.ts

@@ -3,7 +3,7 @@
 
 /* v8 ignore start -- exercised through CLI subprocess maintenance tests. */
 
-import { prompt as askPrompt } from "../credentials";
+import { prompt as askPrompt } from "../credentials/store";
 import {
   type GarbageCollectImagesOptions,
   normalizeGarbageCollectImagesOptions,

src/lib/actions/root-help.ts

@@ -1,10 +1,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { AGENT_PRODUCT_NAME, CLI_DISPLAY_NAME, CLI_NAME } from "../branding";
-import { commandsByGroup, visibleCommands, type CommandDef } from "../command-registry";
+import { AGENT_PRODUCT_NAME, CLI_DISPLAY_NAME, CLI_NAME } from "../cli/branding";
+import { commandsByGroup, visibleCommands, type CommandDef } from "../cli/command-registry";
 import { getRegisteredOclifCommandSummary } from "../cli/oclif-metadata";
-import { getVersion } from "../version";
+import { getVersion } from "../core/version";
 
 const useColor = !process.env.NO_COLOR && !!process.stdout.isTTY;
 const trueColor =

src/lib/actions/sandbox/connect.ts

@@ -6,7 +6,7 @@
 import { spawnSync } from "node:child_process";
 import os from "node:os";
 
-import { CLI_NAME } from "../../branding";
+import { CLI_NAME } from "../../cli/branding";
 import { parseGatewayInference } from "../../inference-config";
 import { ensureOllamaAuthProxy } from "../../onboard-ollama-proxy";
 import {
@@ -24,7 +24,7 @@ import {
 } from "../../state/sandbox-session";
 import { checkAndRecoverSandboxProcesses } from "./process-recovery";
 import * as sandboxVersion from "../../sandbox-version";
-import { D, G, R, YW } from "../../terminal-style";
+import { D, G, R, YW } from "../../cli/terminal-style";
 import { resolveOpenshell } from "../../adapters/openshell/resolve";
 
 const agentRuntime = require("../../../../bin/lib/agent-runtime");

src/lib/actions/sandbox/destroy.ts

@@ -5,16 +5,16 @@
 
 import fs from "node:fs";
 
-import { CLI_NAME } from "../../branding";
-import { prompt as askPrompt } from "../../credentials";
+import { CLI_NAME } from "../../cli/branding";
+import { prompt as askPrompt } from "../../credentials/store";
 import {
   type DestroySandboxOptions,
   normalizeDestroySandboxOptions,
 } from "../../domain/lifecycle/options";
 import * as onboardSession from "../../onboard-session";
 import type { Session } from "../../onboard-session";
 import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
-import { DASHBOARD_PORT } from "../../ports";
+import { DASHBOARD_PORT } from "../../core/ports";
 import * as registry from "../../state/registry";
 import { resolveOpenshell } from "../../adapters/openshell/resolve";
 import { parseLiveSandboxNames } from "../../runtime-recovery";
@@ -27,7 +27,7 @@ import {
   shouldCleanupGatewayAfterDestroy,
   shouldStopHostServicesAfterDestroy,
 } from "../../domain/sandbox/destroy";
-import { G, R, YW } from "../../terminal-style";
+import { G, R, YW } from "../../cli/terminal-style";
 
 type DockerRmi = (tag: string, opts?: { ignoreError?: boolean }) => { status: number | null };
 

src/lib/actions/sandbox/doctor.ts

@@ -7,15 +7,15 @@ import { execFileSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { CLI_DISPLAY_NAME, CLI_NAME } from "../../branding";
-import { isErrnoException } from "../../errno";
+import { CLI_DISPLAY_NAME, CLI_NAME } from "../../cli/branding";
+import { isErrnoException } from "../../core/errno";
 import { recoverNamedGatewayRuntime } from "../../gateway-runtime-action";
 import { probeProviderHealth } from "../../inference-health";
 import { parseGatewayInference } from "../../inference-config";
 import { stripAnsi } from "../../adapters/openshell/client";
 import { captureOpenshell } from "../../adapters/openshell/runtime";
 import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
-import { GATEWAY_PORT, OLLAMA_PORT } from "../../ports";
+import { GATEWAY_PORT, OLLAMA_PORT } from "../../core/ports";
 import * as registry from "../../state/registry";
 import type { SandboxEntry } from "../../state/registry";
 import { resolveOpenshell } from "../../adapters/openshell/resolve";
@@ -24,7 +24,7 @@ import { parseLiveSandboxNames } from "../../runtime-recovery";
 import * as sandboxVersion from "../../sandbox-version";
 import * as shields from "../../shields";
 import { buildStatusCommandDeps } from "../../status-command-deps";
-import { B, D, G, R, RD, YW } from "../../terminal-style";
+import { B, D, G, R, RD, YW } from "../../cli/terminal-style";
 
 const agentRuntime = require("../../../../bin/lib/agent-runtime");
 

src/lib/actions/sandbox/gateway-state.ts

@@ -7,7 +7,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-import { CLI_DISPLAY_NAME, CLI_NAME } from "../../branding";
+import { CLI_DISPLAY_NAME, CLI_NAME } from "../../cli/branding";
 import { parseSandboxPhase } from "../../state/gateway";
 import {
   getNamedGatewayLifecycleState,

src/lib/actions/sandbox/policy-channel.ts

@@ -6,9 +6,9 @@
 import fs from "node:fs";
 import path from "node:path";
 
-import { CLI_DISPLAY_NAME, CLI_NAME } from "../../branding";
-import { hashCredential } from "../../credential-hash";
-import { getCredential, prompt as askPrompt } from "../../credentials";
+import { CLI_DISPLAY_NAME, CLI_NAME } from "../../cli/branding";
+import { hashCredential } from "../../security/credential-hash";
+import { getCredential, prompt as askPrompt } from "../../credentials/store";
 import { recoverNamedGatewayRuntime } from "../../gateway-runtime-action";
 const { isNonInteractive } = require("../../onboard") as { isNonInteractive: () => boolean };
 const onboardProviders = require("../../onboard-providers");

src/lib/actions/sandbox/process-recovery.ts

@@ -8,7 +8,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-import { DASHBOARD_PORT } from "../../ports";
+import { DASHBOARD_PORT } from "../../core/ports";
 import { ROOT, shellQuote } from "../../runner";
 import {
   captureOpenshell,
@@ -19,8 +19,8 @@ import {
 } from "../../adapters/openshell/runtime";
 import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
 import { parseForwardList } from "../../state/sandbox-session";
-import { G, R } from "../../terminal-style";
-import { sleepSeconds } from "../../wait";
+import { G, R } from "../../cli/terminal-style";
+import { sleepSeconds } from "../../core/wait";
 
 const agentRuntime = require("../../../../bin/lib/agent-runtime");
 

src/lib/actions/sandbox/rebuild.ts

@@ -3,8 +3,8 @@
 
 /* v8 ignore start -- exercised through CLI subprocess rebuild tests. */
 
-import { CLI_NAME } from "../../branding";
-import { prompt as askPrompt } from "../../credentials";
+import { CLI_NAME } from "../../cli/branding";
+import { prompt as askPrompt } from "../../credentials/store";
 import {
   normalizeRebuildSandboxOptions,
   type RebuildSandboxOptions,
@@ -37,7 +37,7 @@ import {
 } from "../../state/sandbox-session";
 import * as sandboxState from "../../state/sandbox";
 import * as sandboxVersion from "../../sandbox-version";
-import { B, D, G, R, RD as _RD, YW } from "../../terminal-style";
+import { B, D, G, R, RD as _RD, YW } from "../../cli/terminal-style";
 
 const agentRuntime = require("../../../../bin/lib/agent-runtime");
 

src/lib/actions/sandbox/skill-install.ts

@@ -7,11 +7,11 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-import { CLI_NAME } from "../../branding";
+import { CLI_NAME } from "../../cli/branding";
 import { captureOpenshell } from "../../adapters/openshell/runtime";
 import { ensureLiveSandboxOrExit } from "./gateway-state";
 import * as skillInstall from "../../skill-install";
-import { D, G, R, YW } from "../../terminal-style";
+import { D, G, R, YW } from "../../cli/terminal-style";
 
 const agentRuntime = require("../../../../bin/lib/agent-runtime");
 

src/lib/actions/sandbox/snapshot.ts

@@ -6,7 +6,7 @@
 import fs from "node:fs";
 import path from "node:path";
 
-import { CLI_NAME } from "../../branding";
+import { CLI_NAME } from "../../cli/branding";
 import { dockerCapture, dockerInspect } from "../../adapters/docker";
 import { parseLiveSandboxNames } from "../../runtime-recovery";
 import { ROOT, run, shellQuote, validateName } from "../../runner";

src/lib/actions/sandbox/status.ts

@@ -3,7 +3,7 @@
 
 /* v8 ignore start -- exercised through CLI subprocess status tests. */
 
-import { CLI_DISPLAY_NAME, CLI_NAME } from "../../branding";
+import { CLI_DISPLAY_NAME, CLI_NAME } from "../../cli/branding";
 import { parseSandboxPhase } from "../../state/gateway";
 import { getNamedGatewayLifecycleState } from "../../gateway-runtime-action";
 import { parseGatewayInference } from "../../inference-config";
@@ -30,7 +30,7 @@ import {
 } from "../../state/sandbox-session";
 import * as sandboxVersion from "../../sandbox-version";
 import * as shields from "../../shields";
-import { D, G, R, RD, YW } from "../../terminal-style";
+import { D, G, R, RD, YW } from "../../cli/terminal-style";
 
 const agentRuntime = require("../../../../bin/lib/agent-runtime");
 

src/lib/actions/upgrade-sandboxes.ts

@@ -3,8 +3,8 @@
 
 /* v8 ignore start -- exercised through CLI subprocess upgrade tests. */
 
-import { CLI_NAME } from "../branding";
-import { prompt as askPrompt } from "../credentials";
+import { CLI_NAME } from "../cli/branding";
+import { prompt as askPrompt } from "../credentials/store";
 import {
   normalizeUpgradeSandboxesOptions,
   type UpgradeSandboxesOptions,
@@ -14,7 +14,7 @@ import * as registry from "../state/registry";
 import { parseLiveSandboxNames } from "../runtime-recovery";
 import { rebuildSandbox } from "./sandbox/rebuild";
 import * as sandboxVersion from "../sandbox-version";
-import { B, D, G, R, YW } from "../terminal-style";
+import { B, D, G, R, YW } from "../cli/terminal-style";
 import {
   classifyUpgradeableSandboxes,
   shouldSkipUpgradeConfirmation,

src/lib/agent/defs.ts

@@ -8,7 +8,7 @@ import fs from "node:fs";
 import path from "node:path";
 
 import { ROOT } from "../runner";
-import { DASHBOARD_PORT } from "../ports";
+import { DASHBOARD_PORT } from "../core/ports";
 
 export const AGENTS_DIR = path.join(ROOT, "agents");
 

src/lib/agent/onboard.ts

@@ -10,12 +10,12 @@ import os from "os";
 import path from "path";
 
 import { dockerBuild, dockerImageInspect } from "../adapters/docker";
-import { getAgentBranding } from "../branding";
+import { getAgentBranding } from "../cli/branding";
 import { getProviderSelectionConfig } from "../inference-config";
-import type { JsonObject as LooseObject, JsonValue as LooseValue } from "../json-types";
+import type { JsonObject as LooseObject, JsonValue as LooseValue } from "../core/json-types";
 import * as onboardSession from "../onboard-session";
 import { ROOT, redact, run, shellQuote } from "../runner";
-import { sleepSeconds } from "../wait";
+import { sleepSeconds } from "../core/wait";
 import { type AgentDefinition, loadAgent, resolveAgentName } from "./defs";
 
 export interface OnboardContext {

src/lib/agent/runtime.ts

@@ -7,7 +7,7 @@
 // When the session agent is openclaw (or absent), all functions return
 // defaults that match the hardcoded OpenClaw values on main.
 
-import { DASHBOARD_PORT } from "../ports";
+import { DASHBOARD_PORT } from "../core/ports";
 import { shellQuote } from "../runner";
 import * as onboardSession from "../onboard-session";
 import * as registry from "../state/registry";

src/lib/build-context.ts

@@ -6,7 +6,7 @@
  * creation failures.
  */
 
-import { CLI_NAME } from "./branding";
+import { CLI_NAME } from "./cli/branding";
 import fs from "node:fs";
 import path from "node:path";
 

src/lib/command-display-metadata.test.ts → src/lib/cli/command-display-metadata.test.ts

@@ -4,7 +4,7 @@
 import { Config as OclifConfig } from "@oclif/core";
 import { describe, expect, it } from "vitest";
 
-import { getRegisteredOclifCommandsMetadata } from "./cli/oclif-metadata";
+import { getRegisteredOclifCommandsMetadata } from "./oclif-metadata";
 import { COMMANDS, visibleCommands } from "./command-registry";
 
 describe("public command display metadata", () => {

src/lib/command-registry.ts → src/lib/cli/command-registry.ts

@@ -16,10 +16,10 @@
  */
 
 import { CLI_NAME } from "./branding";
-import type { CommandDisplayEntry, CommandGroup } from "./cli/command-display";
-import { getRegisteredOclifCommandsMetadata } from "./cli/oclif-metadata";
+import type { CommandDisplayEntry, CommandGroup } from "./command-display";
+import { getRegisteredOclifCommandsMetadata } from "./oclif-metadata";
 
-export type { CommandGroup } from "./cli/command-display";
+export type { CommandGroup } from "./command-display";
 
 /** Replace the canonical "nemoclaw" prefix in a usage string with CLI_NAME. */
 export function brandedUsage(usage: string): string {

src/lib/duration-flags.ts → src/lib/cli/duration-flags.ts

@@ -3,7 +3,7 @@
 
 import { Errors, Flags } from "@oclif/core";
 
-import { parseDuration } from "./domain/duration";
+import { parseDuration } from "../domain/duration";
 
 const LOGS_SINCE_DURATION_RE = /^[1-9]\d*(?:ms|s|m|h|d)$/i;
 

src/lib/cli/oclif-dispatch.ts

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { sandboxCommands } from "../command-registry";
+import { sandboxCommands } from "./command-registry";
 
 export type OclifDispatch = {
   kind: "oclif";

src/lib/cli/oclif-runner.ts

@@ -3,7 +3,7 @@
 
 import { Config as OclifConfig, execute as executeOclif } from "@oclif/core";
 
-import { CLI_NAME } from "../branding";
+import { CLI_NAME } from "./branding";
 
 export interface OclifCommandRunOptions {
   rootDir: string;

src/lib/cli/public-oclif-help.ts

@@ -3,7 +3,7 @@
 
 import { CommandHelp } from "@oclif/core";
 
-import { CLI_NAME } from "../branding";
+import { CLI_NAME } from "./branding";
 import { getRegisteredOclifCommandMetadata, type OclifCommandMetadata } from "./oclif-metadata";
 
 type PublicHelpCommand = OclifCommandMetadata & {

src/lib/commands/credentials.test.ts

@@ -9,7 +9,7 @@ const mocks = vi.hoisted(() => ({
   runOpenshellProviderCommand: vi.fn(),
 }));
 
-vi.mock("../credentials", () => ({ prompt: mocks.prompt }));
+vi.mock("../credentials/store", () => ({ prompt: mocks.prompt }));
 vi.mock("../actions/global", () => ({
   recoverNamedGatewayRuntime: mocks.recoverNamedGatewayRuntime,
   runOpenshellProviderCommand: mocks.runOpenshellProviderCommand,