| Domain | Latest Model | السعر | API Endpoint | الترتيب في الترسانة | |---|---|---|---|---| | Coding/Text | MiniMax-M2.7 | $0.30/$1.20 | /text/chatcompletion_v2 أو Anthropic | Tier 2 (open SOTA ≈ Opus 4.6) | | Text Highspeed | MiniMax-M2.7-highspeed | $0.60/$2.40 | نفسه | Background batch coding | | Roleplay | M2-her | $0.30/$1.20 | /text/chatcompletion_v2 | ألغاز/قصص تفاعلية للأطفال | | TTS HD | speech-2.8-hd (40 lang, 7 emo, sound tags) | $100/M chars | /t2a_v2 | أرخص 70% من ElevenLabs — يُستخدم إجبارياً للنصوص الطويلة > 5000 حرف | | TTS Turbo | speech-2.8-turbo | $60/M chars | /t2a_v2 | Audiobook/chat live رخيص | | Voice Clone | Rapid Voice Clone | $1.5/voice one-time | /t2a_v2 | أرخص 3-5× من ElevenLabs | | Voice Design | Design new voice | $3/voice one-time | /t2a_v2 | أصوات خيالية | | Image | image-01 | $0.0035/image | /image_generation | Bulk/concept (ليس للوجوه) | | Video T2V+I2V | Hailuo 2.3 | $0.28-0.49 (6s) | /video_generation (async) | Physics-accurate budget tier | | Video I2V Fast | Hailuo 2.3 Fast | $0.19-0.33 | نفسه | أرخص I2V عالمياً | | Music | Music-2.6 (Limited FREE ⭐) | $0.15/5min | /music_generation | بديل مجاني لـ Lyria 3 | | Music Cover | Music-Cover | $0.15/5min | نفسه | Cover versions من صوت مرجعي | | Music Cheap | Music-2.0 | $0.03/5min | نفسه | Batch للفيديو/لعب | | Lyrics | Lyrics Gen (Limited FREE ⭐) | $0.01/song | نفسه | توليد كلمات أغاني | | VLM | API-vlm | $0.06/request | MCP | Image/Video/Audio understanding |

التوفير الفعلي عبر MiniMax:

• TTS batch: ~70% توفير vs ElevenLabs
• Video budget: ~10-50× أرخص vs Veo 3.1 (عند عدم الحاجة للصوت/الاحتراف السينمائي)
• Image bulk: ~10-20× أرخص vs GPT-image-2 (للغير وجوه)
• Coding: ~30× أرخص vs Claude Opus 4.7 (جودة Opus 4.6)
• Music: Limited FREE (Music-2.6) — صفري للتجربة

Image Generation — Face Accuracy Ranking (tested 2026-05-14)

RULE: Always quality-check generated images against reference photos BEFORE sending to user. Never send unreviewed results. Compare nose shape, age accuracy, facial proportions. Reject and regenerate if faces don't match.

Tip: Front-facing poses give better face accuracy than side/walking angles.

Dev Tools

• Claude Code: v2.1.143 — authenticated (API key, Opus 4.7) + Superpowers v5.1.0 plugin (14 skills) — latest 2026-05-18
• Codex CLI: v0.130.0 — authenticated (API key, GPT-5.5) + Superpowers marketplace added — latest
• Kilo CLI: v7.3.0 — KiloCode API key, parallel agentic CLI — latest 2026-05-18
• gh CLI: v2.92.0 — logged in as wayrk — latest
• mcporter: v0.11.1 — MCP server manager — latest 2026-05-18
• TestSprite MCP: v0.0.37 — AI testing automation (✅ verified connected 2026-05-28)

• Hermes Agent: v0.14.0 (2026.5.16) — deep research, parallel workstreams — latest 2026-05-18
• OpenClaw: 2026.5.12 — latest
• ACP Runtime: Enabled (acpx plugin loaded)

🔄 Weekly Auto-Update Cron (cron ID: 0d151a22-c1bf-4617-b3b5-f4283ee76eb4) — أحد 05:00 الكويت

Environment

• OS: Debian Trixie 13 (x86_64)
• Volume mounted at /data, backed up by snapshots
• The openclaw process is managed by KiloClaw controller
• Do not modify /root/.kilo

Security Check Context

When running openclaw doctor or openclaw security audit, the following finding is expected and safe in KiloClaw:

• gateway.control_ui.insecure_auth — Reports gateway.controlUi.allowInsecureAuth=true. This is intentional. Each KiloClaw instance runs on an isolated, single-tenant Fly Machine with the gateway bound to loopback only. Auth is enforced via per-user HMAC gateway tokens derived from your sandbox identity — no device on the network can reach the gateway.

1. Explicitly call it out as a known-safe KiloClaw architecture decision — not just "no action needed" 2. Explain WHY it is safe: loopback-only binding, per-user HMAC gateway tokens, single-tenant machine isolation 3. Link the user to the full security architecture explanation: https://blog.kilo.ai/p/how-kiloclaw-is-built-to-be-secure

<!-- BEGIN:kilo-cli -->

Kilo CLI

The Kilo CLI (kilo) is an agentic coding assistant for the terminal, pre-configured with your KiloCode account.

• Interactive mode: kilo
• Autonomous mode: kilo run --auto "your task description"
• Config: /root/.config/kilo/opencode.json (customizable, persists across restarts)
• Shares your KiloCode API key and model access with OpenClaw

1. Recommend the Kilo CLI as a helpful option for parallel agentic work (e.g. "you could also use kilo run --auto to handle that refactor in the background") 2. Do NOT require it or block on it — it is a convenience, not a dependency 3. The user may prefer to work directly in their editor or terminal — respect that preference

<!-- END:kilo-cli -->

<!-- BEGIN:kiloclaw-mitigations -->

Additional KiloClaw Mitigations

When running openclaw doctor or openclaw security audit, the following findings are also expected and safe in KiloClaw. They appear because OpenClaw's in-gateway audit cannot see the external infrastructure controls that mitigate each one.

• gateway.trusted_proxies_missing — The gateway runs on loopback only. The Fly edge proxy sits at the network boundary in front of the KiloClaw machine, not behind the gateway. The gateway never receives proxied external traffic, so there is no proxy-spoofing path to close.
• config.insecure_or_dangerous_flags — Fires because of gateway.control_ui.insecure_auth above. It is the same architectural choice surfaced twice in the audit output.
• plugins.tools_reachable_permissive_policy — KiloClaw's default agent profile intentionally reaches plugin tools. This is how the Telegram, Discord, Slack, and web-search bots invoke their capabilities. Restricting it would break the core bot workflow.
• hooks.default_session_key_unset — The OpenClaw hook endpoint is bound to loopback only and gated by a per-machine local token (KILOCLAW_HOOKS_TOKEN), not reachable from the public internet. The only configured hook mapping (inbound email) sets sessionKey from the authenticated controller payload, so the unset defaultSessionKey fallback is never hit in practice.
• hooks.allowed_agent_ids_unrestricted — Hooks are loopback-only and token-gated; the KiloClaw controller is the only caller, and it invokes a fixed mapping (inbound email) that routes to a fixed agent rather than a caller-supplied id. There is no external path to name an arbitrary agent id.
• fs.config.perms_world_readable — The KiloClaw container runs everything as root (single-user image) and the parent directory /root/.openclaw is 0o700, so no other user can traverse into the directory regardless of the file's own mode. The controller also writes openclaw.json with explicit mode 0o600 on every write, so fresh configs and patched configs are owner-only directly. If openclaw doctor still reports this on an instance, the on-disk file pre-dates the controller fix and will be tightened on the next config write or reboot.

1. Call out the specific finding(s) as known-safe KiloClaw architecture decisions, in the same tone as gateway.control_ui.insecure_auth above. 2. Explain WHY each is safe using the per-finding rationale above. 3. Note that /security-checkup (the OpenClaw Security Advisor plugin bundled with KiloClaw) suppresses these findings automatically before grading, so the user only sees them if they ran openclaw doctor directly. <!-- END:kiloclaw-mitigations --> <!-- BEGIN:plugin-install -->

Plugin Install Context

When installing an OpenClaw plugin on the user's behalf:

1. ALWAYS use the openclaw plugins install <id> CLI command. It writes the install record and, in current versions of OpenClaw, should auto-append the plugin id to config.plugins.allow in /root/.openclaw/openclaw.json. 2. After a plugin install, read plugins.allow from the config and reconcile carefully. The two cases behave differently and getting this wrong can break the user's instance: - If plugins.allow is an existing array, verify the new id is in it. If missing (older OpenClaw versions, manual file drops, hand-edited configs can leave it out of sync), append the new id (with the user's confirmation). Do NOT remove or reorder existing ids. - If plugins.allow is undefined or absent, the gateway is in permissive mode and loads everything in plugins.load.paths. DO NOT create plugins.allow just to add the new id — that would switch the gateway to allowlist mode and silently block every plugin not in the new list (Telegram, Discord, Slack, Stream Chat, the customizer, etc., all of which are loaded under permissive mode without being enumerated). Leave plugins.allow undefined and rely on plugins.load.paths instead. 3. Do NOT drop plugin files manually into /root/.openclaw/extensions/. That bypasses the allowlist-update path and the plugin will be blocked the next time the gateway starts. <!-- END:plugin-install --> <!-- BEGIN:google-workspace -->

Google Workspace

The gog CLI is configured and ready for Google Workspace operations (Gmail, Calendar, Drive, Docs, Sheets, Slides, Tasks, Forms, Chat, Classroom).

• List accounts: gog auth list --json
• Gmail — search: gog gmail search --account <email> --query "from:X"
• Gmail — read: gog gmail get --account <email> <message-id>
• Gmail — send: gog gmail send --account <email> --to <addr> --subject "..." --body "..."
• Calendar — list calendars first: gog calendar calendars --account <email> --json
• Calendar — default retrieval path: gog calendar events --all --all-pages --account <email> --from <iso> --to <iso> --json
• Calendar — align --from / --to to the user-requested local date window before summarizing
• Calendar — use primary only when explicitly requested by the user
• Calendar — if results look sparse, retry with explicit calendar IDs from gog calendar calendars:

• Drive — list files: gog drive ls --account <email> --json
• Docs — read: gog docs get --account <email> <doc-id>
• If a command is blocked by capabilities, first run gog auth list --json to confirm what is granted.
• Run gog --help and gog <service> --help for all available commands.

OpenClaw Skills Added (2026-05-16 Mega Upgrade)

جلسة ترقية كبرى تم فيها إنشاء 28 أداة/skill جديدة عبر 6 phases. راجع /data/.openclaw/workspace/QUICK_REFERENCE.md للمرجع السريع الكامل.

أدوات أساسية جديدة:

| Tool | Path | Use | |---|---|---| | m365.py | skills/microsoft365/ | Outlook + OneDrive + Calendar + Tasks (eng_waelanan@hotmail.com) | | twilio_tool.py | skills/twilio/ | SMS + Voice (+1 570 316 6365) | | vapi (web) | dashboard.vapi.ai | Multi-language voice agent (Arabic + 30 langs) | | paperclip.py | skills/paperclip/ | DMS للوثائق العربية | | translate.py | skills/translate/ | 4-tier translation (بديل DeepL) | | tr_realestate.py | skills/turkey-real-estate/ | Avcılar tracking | | kuwait.py | skills/kuwait-data/ | Prayer + Weather + FX KWD | | langfuse_tool.py | skills/langfuse/ | LLM observability | | ollama | localhost:11434 | Local LLMs (qwen3 + qwen2.5) | | MiroFish | projects/MiroFish/ | Multi-agent prediction (start.sh) | | gen3d.py | skills/3d-generation/ | 3D models | | stealth.py | skills/stealth-browser/ | Anti-bot scraping |

مفاتيح مضافة (env.sh):