diff --git a/flake.nix b/flake.nix
index 6238ebac..1304fb2f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,6 +48,9 @@
           pkgs = pkgs;
           sourceInfo = sourceInfoStable;
           steipetePkgs = steipetePkgs;
+          # bird: upstream repo steipete/bird deleted, release assets 404.
+          # https://github.com/openclaw/nix-steipete-tools/issues/6
+          excludeToolNames = [ "bird" ];
         };
       in
       {
diff --git a/nix/generated/openclaw-config-options.nix b/nix/generated/openclaw-config-options.nix
index dbe2c5b3..b48b5e92 100644
--- a/nix/generated/openclaw-config-options.nix
+++ b/nix/generated/openclaw-config-options.nix
@@ -1,4 +1,4 @@
-# Generated from upstream OpenClaw schema at rev 0fe8f07e0ed9381ed6acb51de7623d991274a18b. DO NOT EDIT.
+# Generated from upstream OpenClaw schema at rev 4b5d4a4c660d05e4bd73f0e11123e68fd9664432. DO NOT EDIT.
 # Generator: nix/scripts/generate-config-options.ts
 { lib }:
 let
@@ -369,6 +369,10 @@ in
         }; });
           default = null;
         };
+        directPolicy = lib.mkOption {
+          type = t.nullOr (t.oneOf [ (t.enum [ "allow" ]) (t.enum [ "block" ]) ]);
+          default = null;
+        };
         every = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -426,7 +430,7 @@ in
         default = null;
       };
       imageModel = lib.mkOption {
-        type = t.nullOr (t.submodule { options = {
+        type = t.nullOr (t.oneOf [ (t.str) (t.submodule { options = {
         fallbacks = lib.mkOption {
           type = t.nullOr (t.listOf (t.str));
           default = null;
@@ -435,7 +439,7 @@ in
           type = t.nullOr (t.str);
           default = null;
         };
-      }; });
+      }; }) ]);
         default = null;
       };
       maxConcurrent = lib.mkOption {
@@ -492,7 +496,7 @@ in
           default = null;
         };
         fallback = lib.mkOption {
-          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "gemini" ]) (t.enum [ "local" ]) (t.enum [ "voyage" ]) (t.enum [ "none" ]) ]);
+          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "gemini" ]) (t.enum [ "local" ]) (t.enum [ "voyage" ]) (t.enum [ "mistral" ]) (t.enum [ "none" ]) ]);
           default = null;
         };
         local = lib.mkOption {
@@ -513,7 +517,7 @@ in
           default = null;
         };
         provider = lib.mkOption {
-          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "local" ]) (t.enum [ "gemini" ]) (t.enum [ "voyage" ]) ]);
+          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "local" ]) (t.enum [ "gemini" ]) (t.enum [ "voyage" ]) (t.enum [ "mistral" ]) ]);
           default = null;
         };
         query = lib.mkOption {
@@ -690,7 +694,7 @@ in
         default = null;
       };
       model = lib.mkOption {
-        type = t.nullOr (t.submodule { options = {
+        type = t.nullOr (t.oneOf [ (t.str) (t.submodule { options = {
         fallbacks = lib.mkOption {
           type = t.nullOr (t.listOf (t.str));
           default = null;
@@ -699,7 +703,7 @@ in
           type = t.nullOr (t.str);
           default = null;
         };
-      }; });
+      }; }) ]);
         default = null;
       };
       models = lib.mkOption {
@@ -747,6 +751,10 @@ in
             type = t.nullOr (t.int);
             default = null;
           };
+          cdpSourceRange = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
           containerPrefix = lib.mkOption {
             type = t.nullOr (t.str);
             default = null;
@@ -767,6 +775,10 @@ in
             type = t.nullOr (t.str);
             default = null;
           };
+          network = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
           noVncPort = lib.mkOption {
             type = t.nullOr (t.int);
             default = null;
@@ -800,6 +812,18 @@ in
             type = t.nullOr (t.number);
             default = null;
           };
+          dangerouslyAllowContainerNamespaceJoin = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          dangerouslyAllowExternalBindSources = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          dangerouslyAllowReservedContainerTargets = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
           dns = lib.mkOption {
             type = t.nullOr (t.listOf (t.str));
             default = null;
@@ -918,6 +942,10 @@ in
       };
       subagents = lib.mkOption {
         type = t.nullOr (t.submodule { options = {
+        announceTimeoutMs = lib.mkOption {
+          type = t.nullOr (t.int);
+          default = null;
+        };
         archiveAfterMinutes = lib.mkOption {
           type = t.nullOr (t.int);
           default = null;
@@ -949,6 +977,10 @@ in
         }; }) ]);
           default = null;
         };
+        runTimeoutSeconds = lib.mkOption {
+          type = t.nullOr (t.int);
+          default = null;
+        };
         thinking = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -1041,6 +1073,10 @@ in
         }; });
           default = null;
         };
+        directPolicy = lib.mkOption {
+          type = t.nullOr (t.oneOf [ (t.enum [ "allow" ]) (t.enum [ "block" ]) ]);
+          default = null;
+        };
         every = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -1163,7 +1199,7 @@ in
           default = null;
         };
         fallback = lib.mkOption {
-          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "gemini" ]) (t.enum [ "local" ]) (t.enum [ "voyage" ]) (t.enum [ "none" ]) ]);
+          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "gemini" ]) (t.enum [ "local" ]) (t.enum [ "voyage" ]) (t.enum [ "mistral" ]) (t.enum [ "none" ]) ]);
           default = null;
         };
         local = lib.mkOption {
@@ -1184,7 +1220,7 @@ in
           default = null;
         };
         provider = lib.mkOption {
-          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "local" ]) (t.enum [ "gemini" ]) (t.enum [ "voyage" ]) ]);
+          type = t.nullOr (t.oneOf [ (t.enum [ "openai" ]) (t.enum [ "local" ]) (t.enum [ "gemini" ]) (t.enum [ "voyage" ]) (t.enum [ "mistral" ]) ]);
           default = null;
         };
         query = lib.mkOption {
@@ -1401,6 +1437,10 @@ in
             type = t.nullOr (t.int);
             default = null;
           };
+          cdpSourceRange = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
           containerPrefix = lib.mkOption {
             type = t.nullOr (t.str);
             default = null;
@@ -1421,6 +1461,10 @@ in
             type = t.nullOr (t.str);
             default = null;
           };
+          network = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
           noVncPort = lib.mkOption {
             type = t.nullOr (t.int);
             default = null;
@@ -1454,6 +1498,18 @@ in
             type = t.nullOr (t.number);
             default = null;
           };
+          dangerouslyAllowContainerNamespaceJoin = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          dangerouslyAllowExternalBindSources = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          dangerouslyAllowReservedContainerTargets = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
           dns = lib.mkOption {
             type = t.nullOr (t.listOf (t.str));
             default = null;
@@ -1699,6 +1755,31 @@ in
             type = t.nullOr (t.listOf (t.str));
             default = null;
           };
+          safeBinProfiles = lib.mkOption {
+            type = t.nullOr (t.attrsOf (t.submodule { options = {
+            allowedValueFlags = lib.mkOption {
+              type = t.nullOr (t.listOf (t.str));
+              default = null;
+            };
+            deniedFlags = lib.mkOption {
+              type = t.nullOr (t.listOf (t.str));
+              default = null;
+            };
+            maxPositional = lib.mkOption {
+              type = t.nullOr (t.int);
+              default = null;
+            };
+            minPositional = lib.mkOption {
+              type = t.nullOr (t.int);
+              default = null;
+            };
+          }; }));
+            default = null;
+          };
+          safeBinTrustedDirs = lib.mkOption {
+            type = t.nullOr (t.listOf (t.str));
+            default = null;
+          };
           safeBins = lib.mkOption {
             type = t.nullOr (t.listOf (t.str));
             default = null;
@@ -1920,6 +2001,10 @@ in
     agentId = lib.mkOption {
       type = t.str;
     };
+    comment = lib.mkOption {
+      type = t.nullOr (t.str);
+      default = null;
+    };
     match = lib.mkOption {
       type = t.submodule { options = {
       accountId = lib.mkOption {
@@ -2053,6 +2138,10 @@ in
         type = t.nullOr (t.listOf (t.str));
         default = null;
       };
+      dangerouslyAllowPrivateNetwork = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       hostnameAllowlist = lib.mkOption {
         type = t.nullOr (t.listOf (t.str));
         default = null;
@@ -2678,6 +2767,10 @@ in
           type = t.nullOr (t.bool);
           default = null;
         };
+        dangerouslyAllowNameMatching = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
         defaultTo = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -3030,10 +3123,31 @@ in
           type = t.nullOr (t.enum [ "partial" "block" "off" ]);
           default = null;
         };
+        streaming = lib.mkOption {
+          type = t.nullOr (t.oneOf [ (t.bool) (t.enum [ "off" "partial" "block" "progress" ]) ]);
+          default = null;
+        };
         textChunkLimit = lib.mkOption {
           type = t.nullOr (t.int);
           default = null;
         };
+        threadBindings = lib.mkOption {
+          type = t.nullOr (t.submodule { options = {
+          enabled = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          spawnSubagentSessions = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          ttlHours = lib.mkOption {
+            type = t.nullOr (t.number);
+            default = null;
+          };
+        }; });
+          default = null;
+        };
         token = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -3065,6 +3179,14 @@ in
           }; }));
             default = null;
           };
+          daveEncryption = lib.mkOption {
+            type = t.nullOr (t.bool);
+            default = null;
+          };
+          decryptionFailureTolerance = lib.mkOption {
+            type = t.nullOr (t.int);
+            default = null;
+          };
           enabled = lib.mkOption {
             type = t.nullOr (t.bool);
             default = null;
@@ -3420,6 +3542,10 @@ in
         type = t.nullOr (t.bool);
         default = null;
       };
+      dangerouslyAllowNameMatching = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       defaultTo = lib.mkOption {
         type = t.nullOr (t.str);
         default = null;
@@ -3772,10 +3898,31 @@ in
         type = t.nullOr (t.enum [ "partial" "block" "off" ]);
         default = null;
       };
+      streaming = lib.mkOption {
+        type = t.nullOr (t.oneOf [ (t.bool) (t.enum [ "off" "partial" "block" "progress" ]) ]);
+        default = null;
+      };
       textChunkLimit = lib.mkOption {
         type = t.nullOr (t.int);
         default = null;
       };
+      threadBindings = lib.mkOption {
+        type = t.nullOr (t.submodule { options = {
+        enabled = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
+        spawnSubagentSessions = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
+        ttlHours = lib.mkOption {
+          type = t.nullOr (t.number);
+          default = null;
+        };
+      }; });
+        default = null;
+      };
       token = lib.mkOption {
         type = t.nullOr (t.str);
         default = null;
@@ -3807,6 +3954,14 @@ in
         }; }));
           default = null;
         };
+        daveEncryption = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
+        decryptionFailureTolerance = lib.mkOption {
+          type = t.nullOr (t.int);
+          default = null;
+        };
         enabled = lib.mkOption {
           type = t.nullOr (t.bool);
           default = null;
@@ -4073,6 +4228,10 @@ in
           type = t.nullOr (t.bool);
           default = null;
         };
+        dangerouslyAllowNameMatching = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
         defaultTo = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -4257,6 +4416,10 @@ in
         type = t.nullOr (t.bool);
         default = null;
       };
+      dangerouslyAllowNameMatching = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       defaultAccount = lib.mkOption {
         type = t.nullOr (t.str);
         default = null;
@@ -5324,6 +5487,10 @@ in
         type = t.nullOr (t.bool);
         default = null;
       };
+      dangerouslyAllowNameMatching = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       defaultTo = lib.mkOption {
         type = t.nullOr (t.str);
         default = null;
@@ -6079,6 +6246,10 @@ in
           type = t.nullOr (t.bool);
           default = null;
         };
+        dangerouslyAllowNameMatching = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
         defaultTo = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -6179,6 +6350,10 @@ in
           type = t.nullOr (t.str);
           default = null;
         };
+        nativeStreaming = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
         reactionAllowlist = lib.mkOption {
           type = t.nullOr (t.listOf (t.oneOf [ (t.str) (t.number) ]));
           default = null;
@@ -6241,8 +6416,12 @@ in
         }; });
           default = null;
         };
+        streamMode = lib.mkOption {
+          type = t.nullOr (t.enum [ "replace" "status_final" "append" ]);
+          default = null;
+        };
         streaming = lib.mkOption {
-          type = t.nullOr (t.bool);
+          type = t.nullOr (t.oneOf [ (t.bool) (t.enum [ "off" "partial" "block" "progress" ]) ]);
           default = null;
         };
         textChunkLimit = lib.mkOption {
@@ -6451,6 +6630,10 @@ in
         type = t.nullOr (t.bool);
         default = null;
       };
+      dangerouslyAllowNameMatching = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       defaultTo = lib.mkOption {
         type = t.nullOr (t.str);
         default = null;
@@ -6551,6 +6734,10 @@ in
         type = t.nullOr (t.str);
         default = null;
       };
+      nativeStreaming = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       reactionAllowlist = lib.mkOption {
         type = t.nullOr (t.listOf (t.oneOf [ (t.str) (t.number) ]));
         default = null;
@@ -6613,8 +6800,12 @@ in
       }; });
         default = null;
       };
+      streamMode = lib.mkOption {
+        type = t.nullOr (t.enum [ "replace" "status_final" "append" ]);
+        default = null;
+      };
       streaming = lib.mkOption {
-        type = t.nullOr (t.bool);
+        type = t.nullOr (t.oneOf [ (t.bool) (t.enum [ "off" "partial" "block" "progress" ]) ]);
         default = null;
       };
       textChunkLimit = lib.mkOption {
@@ -6942,6 +7133,10 @@ in
             type = t.nullOr (t.bool);
             default = null;
           };
+          dnsResultOrder = lib.mkOption {
+            type = t.nullOr (t.enum [ "ipv4first" "verbatim" ]);
+            default = null;
+          };
         }; });
           default = null;
         };
@@ -6990,6 +7185,10 @@ in
           type = t.nullOr (t.enum [ "off" "partial" "block" ]);
           default = null;
         };
+        streaming = lib.mkOption {
+          type = t.nullOr (t.oneOf [ (t.bool) (t.enum [ "off" "partial" "block" "progress" ]) ]);
+          default = null;
+        };
         textChunkLimit = lib.mkOption {
           type = t.nullOr (t.int);
           default = null;
@@ -7010,6 +7209,10 @@ in
           type = t.nullOr (t.str);
           default = null;
         };
+        webhookPort = lib.mkOption {
+          type = t.nullOr (t.int);
+          default = null;
+        };
         webhookSecret = lib.mkOption {
           type = t.nullOr (t.str);
           default = null;
@@ -7306,6 +7509,10 @@ in
           type = t.nullOr (t.bool);
           default = null;
         };
+        dnsResultOrder = lib.mkOption {
+          type = t.nullOr (t.enum [ "ipv4first" "verbatim" ]);
+          default = null;
+        };
       }; });
         default = null;
       };
@@ -7354,6 +7561,10 @@ in
         type = t.nullOr (t.enum [ "off" "partial" "block" ]);
         default = null;
       };
+      streaming = lib.mkOption {
+        type = t.nullOr (t.oneOf [ (t.bool) (t.enum [ "off" "partial" "block" "progress" ]) ]);
+        default = null;
+      };
       textChunkLimit = lib.mkOption {
         type = t.nullOr (t.int);
         default = null;
@@ -7374,6 +7585,10 @@ in
         type = t.nullOr (t.str);
         default = null;
       };
+      webhookPort = lib.mkOption {
+        type = t.nullOr (t.int);
+        default = null;
+      };
       webhookSecret = lib.mkOption {
         type = t.nullOr (t.str);
         default = null;
@@ -7684,6 +7899,10 @@ in
       }; }));
         default = null;
       };
+      enabled = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       groupAllowFrom = lib.mkOption {
         type = t.nullOr (t.listOf (t.str));
         default = null;
@@ -7830,6 +8049,14 @@ in
       type = t.nullOr (t.listOf (t.oneOf [ (t.str) (t.number) ]));
       default = null;
     };
+    ownerDisplay = lib.mkOption {
+      type = t.nullOr (t.enum [ "raw" "hash" ]);
+      default = null;
+    };
+    ownerDisplaySecret = lib.mkOption {
+      type = t.nullOr (t.str);
+      default = null;
+    };
     restart = lib.mkOption {
       type = t.nullOr (t.bool);
       default = null;
@@ -7856,6 +8083,19 @@ in
       type = t.nullOr (t.int);
       default = null;
     };
+    runLog = lib.mkOption {
+      type = t.nullOr (t.submodule { options = {
+      keepLines = lib.mkOption {
+        type = t.nullOr (t.int);
+        default = null;
+      };
+      maxBytes = lib.mkOption {
+        type = t.nullOr (t.oneOf [ (t.str) (t.number) ]);
+        default = null;
+      };
+    }; });
+      default = null;
+    };
     sessionRetention = lib.mkOption {
       type = t.nullOr (t.oneOf [ (t.str) (t.enum [ false ]) ]);
       default = null;
@@ -8009,6 +8249,10 @@ in
 
   gateway = lib.mkOption {
     type = t.nullOr (t.submodule { options = {
+    allowRealIpFallback = lib.mkOption {
+      type = t.nullOr (t.bool);
+      default = null;
+    };
     auth = lib.mkOption {
       type = t.nullOr (t.submodule { options = {
       allowTailscale = lib.mkOption {
@@ -8089,6 +8333,10 @@ in
         type = t.nullOr (t.str);
         default = null;
       };
+      dangerouslyAllowHostHeaderOriginFallback = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
       dangerouslyDisableDeviceAuth = lib.mkOption {
         type = t.nullOr (t.bool);
         default = null;
@@ -8220,6 +8468,15 @@ in
       }; });
         default = null;
       };
+      securityHeaders = lib.mkOption {
+        type = t.nullOr (t.submodule { options = {
+        strictTransportSecurity = lib.mkOption {
+          type = t.nullOr (t.oneOf [ (t.str) (t.enum [ false ]) ]);
+          default = null;
+        };
+      }; });
+        default = null;
+      };
     }; });
       default = null;
     };
@@ -8705,6 +8962,10 @@ in
       type = t.nullOr (t.oneOf [ (t.enum [ "silent" ]) (t.enum [ "fatal" ]) (t.enum [ "error" ]) (t.enum [ "warn" ]) (t.enum [ "info" ]) (t.enum [ "debug" ]) (t.enum [ "trace" ]) ]);
       default = null;
     };
+    maxFileBytes = lib.mkOption {
+      type = t.nullOr (t.int);
+      default = null;
+    };
     redactPatterns = lib.mkOption {
       type = t.nullOr (t.listOf (t.str));
       default = null;
@@ -8768,6 +9029,23 @@ in
       }; });
         default = null;
       };
+      mcporter = lib.mkOption {
+        type = t.nullOr (t.submodule { options = {
+        enabled = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
+        serverName = lib.mkOption {
+          type = t.nullOr (t.str);
+          default = null;
+        };
+        startDaemon = lib.mkOption {
+          type = t.nullOr (t.bool);
+          default = null;
+        };
+      }; });
+        default = null;
+      };
       paths = lib.mkOption {
         type = t.nullOr (t.listOf (t.submodule { options = {
         name = lib.mkOption {
@@ -9281,7 +9559,7 @@ in
   meta = lib.mkOption {
     type = t.nullOr (t.submodule { options = {
     lastTouchedAt = lib.mkOption {
-      type = t.nullOr (t.str);
+      type = t.nullOr (t.oneOf [ (t.str) (t.anything) ]);
       default = null;
     };
     lastTouchedVersion = lib.mkOption {
@@ -9612,6 +9890,14 @@ in
     };
     maintenance = lib.mkOption {
       type = t.nullOr (t.submodule { options = {
+      highWaterBytes = lib.mkOption {
+        type = t.nullOr (t.oneOf [ (t.str) (t.number) ]);
+        default = null;
+      };
+      maxDiskBytes = lib.mkOption {
+        type = t.nullOr (t.oneOf [ (t.str) (t.number) ]);
+        default = null;
+      };
       maxEntries = lib.mkOption {
         type = t.nullOr (t.int);
         default = null;
@@ -9628,6 +9914,10 @@ in
         type = t.nullOr (t.int);
         default = null;
       };
+      resetArchiveRetention = lib.mkOption {
+        type = t.nullOr (t.oneOf [ (t.str) (t.number) (t.enum [ false ]) ]);
+        default = null;
+      };
       rotateBytes = lib.mkOption {
         type = t.nullOr (t.oneOf [ (t.str) (t.number) ]);
         default = null;
@@ -9635,6 +9925,10 @@ in
     }; });
       default = null;
     };
+    parentForkMaxTokens = lib.mkOption {
+      type = t.nullOr (t.int);
+      default = null;
+    };
     reset = lib.mkOption {
       type = t.nullOr (t.submodule { options = {
       atHour = lib.mkOption {
@@ -9792,6 +10086,19 @@ in
       type = t.nullOr (t.str);
       default = null;
     };
+    threadBindings = lib.mkOption {
+      type = t.nullOr (t.submodule { options = {
+      enabled = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
+      ttlHours = lib.mkOption {
+        type = t.nullOr (t.number);
+        default = null;
+      };
+    }; });
+      default = null;
+    };
     typingIntervalSeconds = lib.mkOption {
       type = t.nullOr (t.int);
       default = null;
@@ -9908,6 +10215,35 @@ in
       type = t.nullOr (t.str);
       default = null;
     };
+    provider = lib.mkOption {
+      type = t.nullOr (t.str);
+      default = null;
+    };
+    providers = lib.mkOption {
+      type = t.nullOr (t.attrsOf (t.submodule { options = {
+      apiKey = lib.mkOption {
+        type = t.nullOr (t.str);
+        default = null;
+      };
+      modelId = lib.mkOption {
+        type = t.nullOr (t.str);
+        default = null;
+      };
+      outputFormat = lib.mkOption {
+        type = t.nullOr (t.str);
+        default = null;
+      };
+      voiceAliases = lib.mkOption {
+        type = t.nullOr (t.attrsOf (t.str));
+        default = null;
+      };
+      voiceId = lib.mkOption {
+        type = t.nullOr (t.str);
+        default = null;
+      };
+    }; }));
+      default = null;
+    };
     voiceAliases = lib.mkOption {
       type = t.nullOr (t.attrsOf (t.str));
       default = null;
@@ -10032,6 +10368,31 @@ in
         type = t.nullOr (t.listOf (t.str));
         default = null;
       };
+      safeBinProfiles = lib.mkOption {
+        type = t.nullOr (t.attrsOf (t.submodule { options = {
+        allowedValueFlags = lib.mkOption {
+          type = t.nullOr (t.listOf (t.str));
+          default = null;
+        };
+        deniedFlags = lib.mkOption {
+          type = t.nullOr (t.listOf (t.str));
+          default = null;
+        };
+        maxPositional = lib.mkOption {
+          type = t.nullOr (t.int);
+          default = null;
+        };
+        minPositional = lib.mkOption {
+          type = t.nullOr (t.int);
+          default = null;
+        };
+      }; }));
+        default = null;
+      };
+      safeBinTrustedDirs = lib.mkOption {
+        type = t.nullOr (t.listOf (t.str));
+        default = null;
+      };
       safeBins = lib.mkOption {
         type = t.nullOr (t.listOf (t.str));
         default = null;
@@ -11019,6 +11380,19 @@ in
           type = t.nullOr (t.bool);
           default = null;
         };
+        gemini = lib.mkOption {
+          type = t.nullOr (t.submodule { options = {
+          apiKey = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
+          model = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
+        }; });
+          default = null;
+        };
         grok = lib.mkOption {
           type = t.nullOr (t.submodule { options = {
           apiKey = lib.mkOption {
@@ -11036,6 +11410,23 @@ in
         }; });
           default = null;
         };
+        kimi = lib.mkOption {
+          type = t.nullOr (t.submodule { options = {
+          apiKey = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
+          baseUrl = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
+          model = lib.mkOption {
+            type = t.nullOr (t.str);
+            default = null;
+          };
+        }; });
+          default = null;
+        };
         maxResults = lib.mkOption {
           type = t.nullOr (t.int);
           default = null;
@@ -11058,7 +11449,7 @@ in
           default = null;
         };
         provider = lib.mkOption {
-          type = t.nullOr (t.oneOf [ (t.enum [ "brave" ]) (t.enum [ "perplexity" ]) (t.enum [ "grok" ]) ]);
+          type = t.nullOr (t.oneOf [ (t.enum [ "brave" ]) (t.enum [ "perplexity" ]) (t.enum [ "grok" ]) (t.enum [ "gemini" ]) (t.enum [ "kimi" ]) ]);
           default = null;
         };
         timeoutSeconds = lib.mkOption {
@@ -11100,6 +11491,27 @@ in
 
   update = lib.mkOption {
     type = t.nullOr (t.submodule { options = {
+    auto = lib.mkOption {
+      type = t.nullOr (t.submodule { options = {
+      betaCheckIntervalHours = lib.mkOption {
+        type = t.nullOr (t.number);
+        default = null;
+      };
+      enabled = lib.mkOption {
+        type = t.nullOr (t.bool);
+        default = null;
+      };
+      stableDelayHours = lib.mkOption {
+        type = t.nullOr (t.number);
+        default = null;
+      };
+      stableJitterHours = lib.mkOption {
+        type = t.nullOr (t.number);
+        default = null;
+      };
+    }; });
+      default = null;
+    };
     channel = lib.mkOption {
       type = t.nullOr (t.oneOf [ (t.enum [ "stable" ]) (t.enum [ "beta" ]) (t.enum [ "dev" ]) ]);
       default = null;
diff --git a/nix/packages/openclaw-app.nix b/nix/packages/openclaw-app.nix
index 56cc8d8f..62a1f7e4 100644
--- a/nix/packages/openclaw-app.nix
+++ b/nix/packages/openclaw-app.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation {
   pname = "openclaw-app";
-  version = "2026.2.19";
+  version = "2026.2.25";
 
   src = fetchzip {
-    url = "https://github.com/openclaw/openclaw/releases/download/v2026.2.19/OpenClaw-2026.2.19.zip";
-    hash = "sha256-qxMYho+mHj9IUBAwyYeOieBzVz9HPgBSj8It8ideGOM=";
+    url = "https://github.com/openclaw/openclaw/releases/download/v2026.2.25/OpenClaw-2026.2.25.zip";
+    hash = "sha256-mSUImRLgV9lUlzhcYaAPwmCue8nTa7b359vqx1WBgsw=";
     stripRoot = false;
   };
 
diff --git a/nix/scripts/gateway-build.sh b/nix/scripts/gateway-build.sh
index 0e9ed713..daf9d691 100755
--- a/nix/scripts/gateway-build.sh
+++ b/nix/scripts/gateway-build.sh
@@ -72,6 +72,20 @@ fi
 
 log_step "patchShebangs node_modules/.bin" bash -e -c ". \"$STDENV_SETUP\"; patchShebangs node_modules/.bin"
 
+# rolldown was removed from upstream direct dependencies (v2026.2.21+) but
+# remains in the pnpm store as a transitive dep (via rolldown-plugin-dts).
+# Upstream's bundle-a2ui.sh falls back to `pnpm dlx` which needs network.
+# Put rolldown on PATH so the script finds it directly.
+if ! command -v rolldown >/dev/null 2>&1; then
+  _rolldown_pkg="$(find node_modules/.pnpm -maxdepth 4 -path '*/rolldown@*/node_modules/rolldown' -print -quit 2>/dev/null || true)"
+  if [ -n "$_rolldown_pkg" ] && [ -f "$_rolldown_pkg/bin/cli.mjs" ]; then
+    _rolldown_shim="$(mktemp -d)"
+    printf '#!/bin/sh\nexec node "%s/bin/cli.mjs" "$@"\n' "$_rolldown_pkg" > "$_rolldown_shim/rolldown"
+    chmod +x "$_rolldown_shim/rolldown"
+    export PATH="$_rolldown_shim:$PATH"
+  fi
+fi
+
 # Break down `pnpm build` (upstream package.json) so we can profile it.
 log_step "build: canvas:a2ui:bundle" pnpm canvas:a2ui:bundle
 log_step "build: tsdown" pnpm exec tsdown
diff --git a/nix/scripts/gateway-tests-build.sh b/nix/scripts/gateway-tests-build.sh
index 2119f694..e4554e39 100755
--- a/nix/scripts/gateway-tests-build.sh
+++ b/nix/scripts/gateway-tests-build.sh
@@ -22,6 +22,14 @@ if [ -z "${GATEWAY_PREBUILD_SH:-}" ]; then
   exit 1
 fi
 . "$GATEWAY_PREBUILD_SH"
+if [ -z "${STDENV_SETUP:-}" ]; then
+  echo "STDENV_SETUP is not set" >&2
+  exit 1
+fi
+if [ ! -f "$STDENV_SETUP" ]; then
+  echo "STDENV_SETUP not found: $STDENV_SETUP" >&2
+  exit 1
+fi
 
 store_path_file="${PNPM_STORE_PATH_FILE:-.pnpm-store-path}"
 if [ ! -f "$store_path_file" ]; then
@@ -37,13 +45,42 @@ export HOME="$(mktemp -d)"
 
 log_step "pnpm install (tests/config)" pnpm install --offline --frozen-lockfile --ignore-scripts --store-dir "$store_path"
 
-if [ -z "${STDENV_SETUP:-}" ]; then
-  echo "STDENV_SETUP is not set" >&2
-  exit 1
-fi
-if [ ! -f "$STDENV_SETUP" ]; then
-  echo "STDENV_SETUP not found: $STDENV_SETUP" >&2
-  exit 1
+log_step "chmod node_modules writable" chmod -R u+w node_modules
+
+# Rebuild native deps so rolldown (and other native modules) work.
+rebuild_list="$(jq -r '.pnpm.onlyBuiltDependencies // [] | .[]' package.json 2>/dev/null || true)"
+if [ -n "$rebuild_list" ]; then
+  log_step "pnpm rebuild (onlyBuiltDependencies)" env \
+    NODE_LLAMA_CPP_SKIP_DOWNLOAD=1 \
+    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    PUPPETEER_SKIP_DOWNLOAD=1 \
+    ELECTRON_SKIP_BINARY_DOWNLOAD=1 \
+    pnpm rebuild $rebuild_list
+else
+  log_step "pnpm rebuild (all)" env \
+    NODE_LLAMA_CPP_SKIP_DOWNLOAD=1 \
+    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    PUPPETEER_SKIP_DOWNLOAD=1 \
+    ELECTRON_SKIP_BINARY_DOWNLOAD=1 \
+    pnpm rebuild
 fi
 
 log_step "patchShebangs node_modules/.bin" bash -e -c ". \"$STDENV_SETUP\"; patchShebangs node_modules/.bin"
+
+# rolldown was removed from upstream direct dependencies (v2026.2.21+) but
+# remains in the pnpm store as a transitive dep (via rolldown-plugin-dts).
+# Upstream's bundle-a2ui.sh falls back to `pnpm dlx` which needs network.
+# Put rolldown on PATH so the script finds it directly.
+if ! command -v rolldown >/dev/null 2>&1; then
+  _rolldown_pkg="$(find node_modules/.pnpm -maxdepth 4 -path '*/rolldown@*/node_modules/rolldown' -print -quit 2>/dev/null || true)"
+  if [ -n "$_rolldown_pkg" ] && [ -f "$_rolldown_pkg/bin/cli.mjs" ]; then
+    _rolldown_shim="$(mktemp -d)"
+    printf '#!/bin/sh\nexec node "%s/bin/cli.mjs" "$@"\n' "$_rolldown_pkg" > "$_rolldown_shim/rolldown"
+    chmod +x "$_rolldown_shim/rolldown"
+    export PATH="$_rolldown_shim:$PATH"
+  fi
+fi
+
+# Build A2UI bundle so gateway tests that exercise canvas auth paths
+# can serve real assets instead of returning 503.
+log_step "build: canvas:a2ui:bundle" pnpm canvas:a2ui:bundle
diff --git a/nix/sources/openclaw-source.nix b/nix/sources/openclaw-source.nix
index a50c70e8..cc7ae725 100644
--- a/nix/sources/openclaw-source.nix
+++ b/nix/sources/openclaw-source.nix
@@ -2,7 +2,7 @@
 {
   owner = "openclaw";
   repo = "openclaw";
-  rev = "0fe8f07e0ed9381ed6acb51de7623d991274a18b";
-  hash = "sha256-Q1PrWZdv46MkW6eRqi1oOnUh0DpFjRLjYaRlbwf1LW4=";
-  pnpmDepsHash = "sha256-BbgSf4Fz8S9u07WNGobqVCanMZLoGu3kGUvU1dYk4bE=";
+  rev = "4b5d4a4c660d05e4bd73f0e11123e68fd9664432";
+  hash = "sha256-2PYEeERGmdrmP8bwJlj3fyyqtx9hNDnjT4nvVN0awUc=";
+  pnpmDepsHash = "sha256-BjJze+4IGmQLttN1z8/kEPii8qvKjLFN56AArvipluo=";
 }