fix: format code with golines to pass linter checks

Fixed formatting issues in three files to comply with golines requirements:
- pkg/agent/loop.go: Split long function calls and logger statements
- pkg/config/config.go: Align struct field tags
- pkg/tools/toolloop.go: Split long function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.fr.md

@@ -524,7 +524,7 @@ Connectez PicoClaw au réseau social des Agents simplement en envoyant un seul m
 | Commande                  | Description                              |
 | ------------------------- | ---------------------------------------- |
 | `picoclaw onboard`        | Initialiser la config & le workspace     |
-| `picoclaw onboard weixin` | Connecter un compte WeChat via QR |
+| `picoclaw auth weixin` | Connecter un compte WeChat via QR |
 | `picoclaw agent -m "..."` | Chatter avec l'agent                     |
 | `picoclaw agent`          | Mode chat interactif                     |
 | `picoclaw gateway`        | Démarrer le gateway                      |

README.id.md

@@ -520,7 +520,7 @@ Hubungkan PicoClaw ke Jaringan Sosial Agent hanya dengan mengirim satu pesan mel
 | Perintah                   | Deskripsi                        |
 | -------------------------- | -------------------------------- |
 | `picoclaw onboard`         | Inisialisasi konfigurasi & workspace |
-| `picoclaw onboard weixin` | Hubungkan akun WeChat via QR |
+| `picoclaw auth weixin` | Hubungkan akun WeChat via QR |
 | `picoclaw agent -m "..."` | Chat dengan agent                |
 | `picoclaw agent`           | Mode chat interaktif             |
 | `picoclaw gateway`         | Mulai gateway                    |

README.it.md

@@ -520,7 +520,7 @@ Connetti PicoClaw al Social Network degli Agent semplicemente inviando un singol
 | Comando                   | Descrizione                        |
 | ------------------------- | ---------------------------------- |
 | `picoclaw onboard`        | Inizializza config & workspace     |
-| `picoclaw onboard weixin` | Connetti account WeChat tramite QR |
+| `picoclaw auth weixin` | Connetti account WeChat tramite QR |
 | `picoclaw agent -m "..."` | Chatta con l'agent                 |
 | `picoclaw agent`          | Modalità chat interattiva          |
 | `picoclaw gateway`        | Avvia il gateway                   |

README.ja.md

@@ -520,7 +520,7 @@ CLI または統合チャットアプリからメッセージを 1 つ送るだ
 | コマンド                    | 説明                           |
 | ------------------------- | ------------------------------ |
 | `picoclaw onboard`        | 設定＆ワークスペースの初期化     |
-| `picoclaw onboard weixin` | WeChat アカウントを QR で接続 |
+| `picoclaw auth weixin` | WeChat アカウントを QR で接続 |
 | `picoclaw agent -m "..."` | Agent とチャット                |
 | `picoclaw agent`          | インタラクティブチャットモード   |
 | `picoclaw gateway`        | Gateway を起動                  |

README.md

@@ -523,7 +523,7 @@ Connect PicoClaw to the Agent Social Network simply by sending a single message
 | Command                   | Description                      |
 | ------------------------- | -------------------------------- |
 | `picoclaw onboard`        | Initialize config & workspace    |
-| `picoclaw onboard weixin` | Connect WeChat account via QR |
+| `picoclaw auth weixin` | Connect WeChat account via QR |
 | `picoclaw agent -m "..."` | Chat with the agent              |
 | `picoclaw agent`          | Interactive chat mode            |
 | `picoclaw gateway`        | Start the gateway                |

README.pt-br.md

@@ -520,7 +520,7 @@ Conecte o PicoClaw à Rede Social de Agents simplesmente enviando uma única men
 | Comando                   | Descrição                              |
 | ------------------------- | -------------------------------------- |
 | `picoclaw onboard`        | Inicializar config e workspace         |
-| `picoclaw onboard weixin` | Conectar conta WeChat via QR |
+| `picoclaw auth weixin` | Conectar conta WeChat via QR |
 | `picoclaw agent -m "..."` | Conversar com o agent                  |
 | `picoclaw agent`          | Modo de chat interativo                |
 | `picoclaw gateway`        | Iniciar o gateway                      |

README.vi.md

@@ -520,7 +520,7 @@ Kết nối PicoClaw với Mạng xã hội Agent chỉ bằng cách gửi một
 | Lệnh                      | Mô tả                                    |
 | ------------------------- | ---------------------------------------- |
 | `picoclaw onboard`        | Khởi tạo cấu hình & workspace           |
-| `picoclaw onboard weixin` | Kết nối tài khoản WeChat qua QR |
+| `picoclaw auth weixin` | Kết nối tài khoản WeChat qua QR |
 | `picoclaw agent -m "..."` | Trò chuyện với agent                     |
 | `picoclaw agent`          | Chế độ trò chuyện tương tác             |
 | `picoclaw gateway`        | Khởi động gateway                        |

README.zh.md

@@ -520,7 +520,7 @@ PicoClaw 原生支持 [MCP](https://modelcontextprotocol.io/) — 连接任意 M
 | 命令                       | 说明                   |
 | ------------------------- | ---------------------- |
 | `picoclaw onboard`        | 初始化配置与工作区       |
-| `picoclaw onboard weixin` | 扫码连接微信个人号 |
+| `picoclaw auth weixin` | 扫码连接微信个人号 |
 | `picoclaw agent -m "..."` | 与 Agent 对话           |
 | `picoclaw agent`          | 交互式对话模式           |
 | `picoclaw gateway`        | 启动网关                |

cmd/picoclaw/internal/auth/command.go

@@ -16,6 +16,7 @@ func NewAuthCommand() *cobra.Command {
 		newLogoutCommand(),
 		newStatusCommand(),
 		newModelsCommand(),
+		newWeixinCommand(),
 	)
 
 	return cmd

cmd/picoclaw/internal/auth/command_test.go

@@ -32,6 +32,7 @@ func TestNewAuthCommand(t *testing.T) {
 		"logout",
 		"status",
 		"models",
+		"weixin",
 	}
 
 	subcommands := cmd.Commands()

cmd/picoclaw/internal/auth/weixin.go

@@ -1,4 +1,4 @@
-package onboard
+package auth
 
 import (
 	"context"
@@ -27,7 +27,7 @@ to authorize your account. On success, the bot token is saved to the picoclaw
 config so you can start the gateway immediately.
 
 Example:
-  picoclaw onboard weixin`,
+  picoclaw auth weixin`,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return runWeixinOnboard(baseURL, proxy, time.Duration(timeout)*time.Second)
 		},

cmd/picoclaw/internal/onboard/command.go

@@ -16,7 +16,7 @@ func NewOnboardCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "onboard",
 		Aliases: []string{"o"},
-		Short:   "Initialize picoclaw configuration, workspace, and channel accounts",
+		Short:   "Initialize picoclaw configuration and workspace",
 		// Run without subcommands → original onboard flow
 		Run: func(cmd *cobra.Command, args []string) {
 			if len(args) == 0 {
@@ -30,8 +30,5 @@ func NewOnboardCommand() *cobra.Command {
 	cmd.Flags().BoolVar(&encrypt, "enc", false,
 		"Enable credential encryption (generates SSH key and prompts for passphrase)")
 
-	// Channel onboarding subcommands
-	cmd.AddCommand(newWeixinCommand())
-
 	return cmd
 }

cmd/picoclaw/internal/onboard/command_test.go

@@ -13,7 +13,7 @@ func TestNewOnboardCommand(t *testing.T) {
 	require.NotNil(t, cmd)
 
 	assert.Equal(t, "onboard", cmd.Use)
-	assert.Equal(t, "Initialize picoclaw configuration, workspace, and channel accounts", cmd.Short)
+	assert.Equal(t, "Initialize picoclaw configuration and workspace", cmd.Short)
 
 	assert.Len(t, cmd.Aliases, 1)
 	assert.True(t, cmd.HasAlias("o"))
@@ -28,6 +28,5 @@ func TestNewOnboardCommand(t *testing.T) {
 	encFlag := cmd.Flags().Lookup("enc")
 	require.NotNil(t, encFlag, "expected --enc flag to be registered")
 	assert.Equal(t, "false", encFlag.DefValue, "--enc should default to false")
-	assert.True(t, cmd.HasSubCommands())
-	assert.NotNil(t, cmd.Commands())
+	assert.False(t, cmd.HasSubCommands())
 }

docs/channels/weixin/README.md

@@ -7,7 +7,7 @@ PicoClaw supports connecting to your personal WeChat account using the official
 The easiest way to set up the Weixin channel is using the interactive onboarding command:
 
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 
 This command will:

docs/channels/weixin/README.zh.md

@@ -7,7 +7,7 @@ PicoClaw 支持使用腾讯官方 iLink API 连接您的个人微信账号。
 最简单的方法是使用交互式 onboarding 命令进行一键激活：
 
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 
 该命令将：

docs/chat-apps.md

@@ -190,7 +190,7 @@ PicoClaw supports connecting to your personal WeChat account using the official
 
 Run the interactive QR login flow:
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 Scan the printed QR code with your WeChat mobile app. On success, the token is saved to your config.
 

docs/fr/chat-apps.md

@@ -179,7 +179,7 @@ PicoClaw prend en charge la connexion à votre compte WeChat personnel via l'API
 
 Lancez le flux de connexion interactif par QR code :
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 Scannez le QR code affiché avec votre application WeChat mobile. Une fois connecté, le token est sauvegardé dans votre configuration.
 

docs/ja/chat-apps.md

@@ -184,7 +184,7 @@ PicoClaw は Tencent iLink 公式 API を使用して WeChat 個人アカウン
 
 インタラクティブな QR ログインフローを実行します：
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 WeChat モバイルアプリで表示された QR コードをスキャンしてください。ログイン成功後、トークンが設定ファイルに保存されます。
 

docs/pt-br/chat-apps.md

@@ -179,7 +179,7 @@ O PicoClaw suporta conexão com sua conta pessoal do WeChat usando a API oficial
 
 Execute o fluxo de login interativo por QR code:
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 Escaneie o QR code exibido com seu aplicativo WeChat mobile. Após o login bem-sucedido, o token é salvo na sua configuração.
 

docs/vi/chat-apps.md

@@ -179,7 +179,7 @@ PicoClaw hỗ trợ kết nối với tài khoản WeChat cá nhân của bạn
 
 Chạy luồng đăng nhập QR tương tác:
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 Quét mã QR được in ra bằng ứng dụng WeChat trên điện thoại. Sau khi đăng nhập thành công, token sẽ được lưu vào cấu hình.
 

docs/zh/chat-apps.md

@@ -191,7 +191,7 @@ PicoClaw 通过腾讯 iLink 官方 API 支持连接微信个人号。
 
 运行交互式扫码登录流程：
 ```bash
-picoclaw onboard weixin
+picoclaw auth weixin
 ```
 用微信手机端扫描打印出的二维码。登录成功后，token 会自动保存到配置文件。
 

pkg/config/config.go

@@ -1372,11 +1372,14 @@ type MCPConfig struct {
 }
 
 func LoadConfig(path string) (*Config, error) {
+	logger.Debugf("loading config from %s", path)
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
+			logger.WarnF("config file not found, using default config", map[string]any{"path": path})
 			return DefaultConfig(), nil
 		}
+		logger.Errorf("failed to read config file: %v", err)
 		return nil, err
 	}
 
@@ -1388,6 +1391,7 @@ func LoadConfig(path string) (*Config, error) {
 		return nil, fmt.Errorf("failed to detect config version: %w", e)
 	}
 	if len(data) <= 10 {
+		logger.Warn(fmt.Sprintf("content is [%s]", string(data)))
 		return DefaultConfig().WithSecurity(&SecurityConfig{}), nil
 	}
 
@@ -1406,29 +1410,23 @@ func LoadConfig(path string) (*Config, error) {
 		}
 		cfg, e = v.Migrate()
 		if e != nil {
-			logger.DebugF(
-				"config migrate fail",
-				map[string]any{"from": versionInfo.Version, "to": CurrentVersion},
-			)
+			logger.ErrorF("config migrate fail", map[string]any{"from": versionInfo.Version, "to": CurrentVersion})
 			return nil, e
 		}
-		logger.DebugF(
-			"config migrate success",
-			map[string]any{"from": versionInfo.Version, "to": CurrentVersion},
-		)
-		defer func() {
+		logger.InfoF("config migrate success", map[string]any{"from": versionInfo.Version, "to": CurrentVersion})
+		err = makeBackup(path)
+		if err != nil {
+			return nil, err
+		}
+		defer func(cfg *Config) {
 			_ = SaveConfig(path, cfg)
-		}()
+		}(cfg)
 	case CurrentVersion:
 		// Current version
 		cfg, err = loadConfig(data)
 		if err != nil {
 			return nil, err
 		}
-	default:
-		return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version)
-	}
-
 		// Load security configuration
 		securityPath := securityPath(path)
 		sec, err := loadSecurityConfig(securityPath)
@@ -1441,6 +1439,9 @@ func LoadConfig(path string) (*Config, error) {
 		if err := applySecurityConfig(cfg, sec); err != nil {
 			return nil, fmt.Errorf("failed to apply security config: %w", err)
 		}
+	default:
+		return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version)
+	}
 
 	if passphrase := credential.PassphraseProvider(); passphrase != "" {
 		for _, m := range cfg.ModelList {
@@ -1495,6 +1496,19 @@ func LoadConfig(path string) (*Config, error) {
 	return cfg, nil
 }
 
+func makeBackup(path string) error {
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		return nil
+	}
+	// Create backup of the config file before migration
+	bakPath := path + ".bak"
+	if err := fileutil.CopyFile(path, bakPath, 0o600); err != nil {
+		logger.ErrorF("failed to create config backup", map[string]any{"error": err})
+		return fmt.Errorf("failed to create config backup: %w", err)
+	}
+	return nil
+}
+
 func copyArray[T any](dst, src *[]T) {
 	*dst = make([]T, len(*src))
 	copy(*dst, *src)
@@ -1507,6 +1521,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		return nil
 	}
 
+	if sec.Web != nil {
 		if sec.Web.Brave != nil && len(sec.Web.Brave.APIKeys) > 0 {
 			copyArray(&cfg.Tools.Web.Brave.apiKeys, &sec.Web.Brave.APIKeys)
 		}
@@ -1526,7 +1541,9 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		if sec.Web.BaiduSearch != nil && sec.Web.BaiduSearch.APIKey != "" {
 			cfg.Tools.Web.BaiduSearch.apiKey = sec.Web.BaiduSearch.APIKey
 		}
+	}
 
+	if sec.Skills != nil {
 		if sec.Skills.Github != nil && sec.Skills.Github.Token != "" {
 			cfg.Tools.Skills.Github.token = sec.Skills.Github.Token
 		}
@@ -1534,6 +1551,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		if sec.Skills.ClawHub != nil && sec.Skills.ClawHub.AuthToken != "" {
 			cfg.Tools.Skills.Registries.ClawHub.authToken = sec.Skills.ClawHub.AuthToken
 		}
+	}
 
 	names := toNameIndex(cfg.ModelList)
 	for i, model := range cfg.ModelList {
@@ -1554,6 +1572,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		}
 	}
 
+	if sec.Channels != nil {
 		// Handle Telegram token
 		if sec.Channels.Telegram != nil && sec.Channels.Telegram.Token != "" {
 			cfg.Channels.Telegram.token = sec.Channels.Telegram.Token
@@ -1675,6 +1694,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		if sec.Channels.QQ != nil && sec.Channels.QQ.AppSecret != "" {
 			cfg.Channels.QQ.appSecret = sec.Channels.QQ.AppSecret
 		}
+	}
 
 	cfg.security = sec
 

pkg/config/config_old.go

@@ -5,7 +5,9 @@
 
 package config
 
-import "encoding/json"
+import (
+	"encoding/json"
+)
 
 type agentDefaultsV0 struct {
 	Workspace                 string         `json:"workspace"                       env:"PICOCLAW_AGENTS_DEFAULTS_WORKSPACE"`
@@ -139,21 +141,21 @@ func (v *channelsConfigV0) ToChannelsConfig() (ChannelsConfig, ChannelsSecurity)
 			Pico:       pico,
 			IRC:        irc,
 		}, ChannelsSecurity{
-			Telegram:   &telegramSecurity,
-			Feishu:     &feishuSecurity,
-			Discord:    &discordSecurity,
-			QQ:         &qqSecurity,
-			Weixin:     &weixinSecurity,
-			DingTalk:   &dingtalkSecurity,
-			Slack:      &slackSecurity,
-			Matrix:     &matrixSecurity,
-			LINE:       &lineSecurity,
-			OneBot:     &onebotSecurity,
-			WeCom:      &wecomSecurity,
-			WeComApp:   &wecomappSecurity,
-			WeComAIBot: &wecomaibotSecurity,
-			Pico:       &picoSecurity,
-			IRC:        &ircSecurity,
+			Telegram:   telegramSecurity,
+			Feishu:     feishuSecurity,
+			Discord:    discordSecurity,
+			QQ:         qqSecurity,
+			Weixin:     weixinSecurity,
+			DingTalk:   dingtalkSecurity,
+			Slack:      slackSecurity,
+			Matrix:     matrixSecurity,
+			LINE:       lineSecurity,
+			OneBot:     onebotSecurity,
+			WeCom:      wecomSecurity,
+			WeComApp:   wecomappSecurity,
+			WeComAIBot: wecomaibotSecurity,
+			Pico:       picoSecurity,
+			IRC:        ircSecurity,
 		}
 }
 
@@ -169,7 +171,13 @@ type qqConfigV0 struct {
 	ReasoningChannelID   string              `json:"reasoning_channel_id"     env:"PICOCLAW_CHANNELS_QQ_REASONING_CHANNEL_ID"`
 }
 
-func (v *qqConfigV0) ToQQConfig() (QQConfig, QQSecurity) {
+func (v *qqConfigV0) ToQQConfig() (QQConfig, *QQSecurity) {
+	var sec *QQSecurity
+	if v.AppSecret != "" {
+		sec = &QQSecurity{
+			AppSecret: v.AppSecret,
+		}
+	}
 	return QQConfig{
 		Enabled:              v.Enabled,
 		AppID:                v.AppID,
@@ -179,9 +187,7 @@ func (v *qqConfigV0) ToQQConfig() (QQConfig, QQSecurity) {
 		MaxBase64FileSizeMiB: v.MaxBase64FileSizeMiB,
 		SendMarkdown:         v.SendMarkdown,
 		ReasoningChannelID:   v.ReasoningChannelID,
-		}, QQSecurity{
-			AppSecret: v.AppSecret,
-		}
+	}, sec
 }
 
 type telegramConfigV0 struct {
@@ -197,7 +203,13 @@ type telegramConfigV0 struct {
 	UseMarkdownV2      bool                `json:"use_markdown_v2"         env:"PICOCLAW_CHANNELS_TELEGRAM_USE_MARKDOWN_V2"`
 }
 
-func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, TelegramSecurity) {
+func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, *TelegramSecurity) {
+	var sec *TelegramSecurity
+	if v.Token != "" {
+		sec = &TelegramSecurity{
+			Token: v.Token,
+		}
+	}
 	return TelegramConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -209,9 +221,7 @@ func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, TelegramSecurity)
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
 		UseMarkdownV2:      v.UseMarkdownV2,
-		}, TelegramSecurity{
-			Token: v.Token,
-		}
+	}, sec
 }
 
 type feishuConfigV0 struct {
@@ -228,7 +238,15 @@ type feishuConfigV0 struct {
 	IsLark              bool                `json:"is_lark"                 env:"PICOCLAW_CHANNELS_FEISHU_IS_LARK"`
 }
 
-func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, FeishuSecurity) {
+func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, *FeishuSecurity) {
+	var sec *FeishuSecurity
+	if v.AppSecret != "" || v.EncryptKey != "" || v.VerificationToken != "" {
+		sec = &FeishuSecurity{
+			AppSecret:         v.AppSecret,
+			EncryptKey:        v.EncryptKey,
+			VerificationToken: v.VerificationToken,
+		}
+	}
 	return FeishuConfig{
 		Enabled:            v.Enabled,
 		AppID:              v.AppID,
@@ -237,11 +255,7 @@ func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, FeishuSecurity) {
 		GroupTrigger:       v.GroupTrigger,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, FeishuSecurity{
-			AppSecret:         v.AppSecret,
-			EncryptKey:        v.EncryptKey,
-			VerificationToken: v.VerificationToken,
-		}
+	}, sec
 }
 
 type discordConfigV0 struct {
@@ -256,7 +270,13 @@ type discordConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_DISCORD_REASONING_CHANNEL_ID"`
 }
 
-func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, DiscordSecurity) {
+func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, *DiscordSecurity) {
+	var sec *DiscordSecurity
+	if v.Token != "" {
+		sec = &DiscordSecurity{
+			Token: v.Token,
+		}
+	}
 	return DiscordConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -267,9 +287,7 @@ func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, DiscordSecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, DiscordSecurity{
-			Token: v.Token,
-		}
+	}, sec
 }
 
 type maixcamConfigV0 struct {
@@ -299,7 +317,13 @@ type dingtalkConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_DINGTALK_REASONING_CHANNEL_ID"`
 }
 
-func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, DingTalkSecurity) {
+func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, *DingTalkSecurity) {
+	var sec *DingTalkSecurity
+	if v.ClientSecret != "" {
+		sec = &DingTalkSecurity{
+			ClientSecret: v.ClientSecret,
+		}
+	}
 	return DingTalkConfig{
 		Enabled:            v.Enabled,
 		ClientID:           v.ClientID,
@@ -307,9 +331,7 @@ func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, DingTalkSecurity)
 		AllowFrom:          v.AllowFrom,
 		GroupTrigger:       v.GroupTrigger,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, DingTalkSecurity{
-			ClientSecret: v.ClientSecret,
-		}
+	}, sec
 }
 
 type slackConfigV0 struct {
@@ -323,7 +345,14 @@ type slackConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_SLACK_REASONING_CHANNEL_ID"`
 }
 
-func (v *slackConfigV0) ToSlackConfig() (SlackConfig, SlackSecurity) {
+func (v *slackConfigV0) ToSlackConfig() (SlackConfig, *SlackSecurity) {
+	var sec *SlackSecurity
+	if v.BotToken != "" || v.AppToken != "" {
+		sec = &SlackSecurity{
+			BotToken: v.BotToken,
+			AppToken: v.AppToken,
+		}
+	}
 	return SlackConfig{
 		Enabled:            v.Enabled,
 		botToken:           v.BotToken,
@@ -333,10 +362,7 @@ func (v *slackConfigV0) ToSlackConfig() (SlackConfig, SlackSecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, SlackSecurity{
-			BotToken: v.BotToken,
-			AppToken: v.AppToken,
-		}
+	}, sec
 }
 
 type matrixConfigV0 struct {
@@ -353,7 +379,13 @@ type matrixConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"     env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"`
 }
 
-func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, MatrixSecurity) {
+func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, *MatrixSecurity) {
+	var sec *MatrixSecurity
+	if v.AccessToken != "" {
+		sec = &MatrixSecurity{
+			AccessToken: v.AccessToken,
+		}
+	}
 	return MatrixConfig{
 		Enabled:            v.Enabled,
 		Homeserver:         v.Homeserver,
@@ -366,9 +398,7 @@ func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, MatrixSecurity) {
 		GroupTrigger:       v.GroupTrigger,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, MatrixSecurity{
-			AccessToken: v.AccessToken,
-		}
+	}, sec
 }
 
 type lineConfigV0 struct {
@@ -385,7 +415,14 @@ type lineConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_LINE_REASONING_CHANNEL_ID"`
 }
 
-func (v *lineConfigV0) ToLINEConfig() (LINEConfig, LINESecurity) {
+func (v *lineConfigV0) ToLINEConfig() (LINEConfig, *LINESecurity) {
+	var sec *LINESecurity
+	if v.ChannelSecret != "" || v.ChannelAccessToken != "" {
+		sec = &LINESecurity{
+			ChannelSecret:      v.ChannelSecret,
+			ChannelAccessToken: v.ChannelAccessToken,
+		}
+	}
 	return LINEConfig{
 		Enabled:            v.Enabled,
 		channelSecret:      v.ChannelSecret,
@@ -398,10 +435,7 @@ func (v *lineConfigV0) ToLINEConfig() (LINEConfig, LINESecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, LINESecurity{
-			ChannelSecret:      v.ChannelSecret,
-			ChannelAccessToken: v.ChannelAccessToken,
-		}
+	}, sec
 }
 
 type onebotConfigV0 struct {
@@ -417,7 +451,13 @@ type onebotConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_ONEBOT_REASONING_CHANNEL_ID"`
 }
 
-func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, OneBotSecurity) {
+func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, *OneBotSecurity) {
+	var sec *OneBotSecurity
+	if v.AccessToken != "" {
+		sec = &OneBotSecurity{
+			AccessToken: v.AccessToken,
+		}
+	}
 	return OneBotConfig{
 		Enabled:            v.Enabled,
 		WSUrl:              v.WSUrl,
@@ -429,9 +469,7 @@ func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, OneBotSecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, OneBotSecurity{
-			AccessToken: v.AccessToken,
-		}
+	}, sec
 }
 
 type wecomConfigV0 struct {
@@ -448,7 +486,14 @@ type wecomConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_WECOM_REASONING_CHANNEL_ID"`
 }
 
-func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, WeComSecurity) {
+func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, *WeComSecurity) {
+	var sec *WeComSecurity
+	if v.Token != "" || v.EncodingAESKey != "" {
+		sec = &WeComSecurity{
+			Token:          v.Token,
+			EncodingAESKey: v.EncodingAESKey,
+		}
+	}
 	return WeComConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -461,10 +506,7 @@ func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, WeComSecurity) {
 		ReplyTimeout:       v.ReplyTimeout,
 		GroupTrigger:       v.GroupTrigger,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeComSecurity{
-			Token:          v.Token,
-			EncodingAESKey: v.EncodingAESKey,
-		}
+	}, sec
 }
 
 type weixinConfigV0 struct {
@@ -477,7 +519,13 @@ type weixinConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WEIXIN_REASONING_CHANNEL_ID"`
 }
 
-func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, WeixinSecurity) {
+func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, *WeixinSecurity) {
+	var sec *WeixinSecurity
+	if v.Token != "" {
+		sec = &WeixinSecurity{
+			Token: v.Token,
+		}
+	}
 	return WeixinConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -486,9 +534,7 @@ func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, WeixinSecurity) {
 		Proxy:              v.Proxy,
 		AllowFrom:          v.AllowFrom,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeixinSecurity{
-			Token: v.Token,
-		}
+	}, sec
 }
 
 type wecomappConfigV0 struct {
@@ -507,7 +553,15 @@ type wecomappConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_WECOM_APP_REASONING_CHANNEL_ID"`
 }
 
-func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, WeComAppSecurity) {
+func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, *WeComAppSecurity) {
+	var sec *WeComAppSecurity
+	if v.CorpSecret != "" || v.Token != "" || v.EncodingAESKey != "" {
+		sec = &WeComAppSecurity{
+			CorpSecret:     v.CorpSecret,
+			Token:          v.Token,
+			EncodingAESKey: v.EncodingAESKey,
+		}
+	}
 	return WeComAppConfig{
 		Enabled:            v.Enabled,
 		CorpID:             v.CorpID,
@@ -522,11 +576,7 @@ func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, WeComAppSecurity)
 		ReplyTimeout:       v.ReplyTimeout,
 		GroupTrigger:       v.GroupTrigger,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeComAppSecurity{
-			CorpSecret:     v.CorpSecret,
-			Token:          v.Token,
-			EncodingAESKey: v.EncodingAESKey,
-		}
+	}, sec
 }
 
 type wecomaibotConfigV0 struct {
@@ -542,7 +592,15 @@ type wecomaibotConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REASONING_CHANNEL_ID"`
 }
 
-func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, WeComAIBotSecurity) {
+func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, *WeComAIBotSecurity) {
+	var sec *WeComAIBotSecurity
+	if v.Token != "" || v.Secret != "" || v.EncodingAESKey != "" {
+		sec = &WeComAIBotSecurity{
+			Token:          v.Token,
+			Secret:         v.Secret,
+			EncodingAESKey: v.EncodingAESKey,
+		}
+	}
 	return WeComAIBotConfig{
 		Enabled:            v.Enabled,
 		WebhookPath:        v.WebhookPath,
@@ -551,11 +609,7 @@ func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, WeComAIBotS
 		MaxSteps:           v.MaxSteps,
 		WelcomeMessage:     v.WelcomeMessage,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeComAIBotSecurity{
-			Token:          v.Token,
-			Secret:         v.Secret,
-			EncodingAESKey: v.EncodingAESKey,
-		}
+	}, sec
 }
 
 type picoConfigV0 struct {
@@ -571,7 +625,13 @@ type picoConfigV0 struct {
 	Placeholder     PlaceholderConfig   `json:"placeholder,omitempty"`
 }
 
-func (v *picoConfigV0) ToPicoConfig() (PicoConfig, PicoSecurity) {
+func (v *picoConfigV0) ToPicoConfig() (PicoConfig, *PicoSecurity) {
+	var sec *PicoSecurity
+	if v.Token != "" {
+		sec = &PicoSecurity{
+			Token: v.Token,
+		}
+	}
 	return PicoConfig{
 		Enabled:         v.Enabled,
 		token:           v.Token,
@@ -583,9 +643,7 @@ func (v *picoConfigV0) ToPicoConfig() (PicoConfig, PicoSecurity) {
 		MaxConnections:  v.MaxConnections,
 		AllowFrom:       v.AllowFrom,
 		Placeholder:     v.Placeholder,
-		}, PicoSecurity{
-			Token: v.Token,
-		}
+	}, sec
 }
 
 type ircConfigV0 struct {
@@ -607,7 +665,15 @@ type ircConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_IRC_REASONING_CHANNEL_ID"`
 }
 
-func (v *ircConfigV0) ToIRCConfig() (IRCConfig, IRCSecurity) {
+func (v *ircConfigV0) ToIRCConfig() (IRCConfig, *IRCSecurity) {
+	var sec *IRCSecurity
+	if v.Password != "" || v.NickServPassword != "" || v.SASLPassword != "" {
+		sec = &IRCSecurity{
+			Password:         v.Password,
+			NickServPassword: v.NickServPassword,
+			SASLPassword:     v.SASLPassword,
+		}
+	}
 	return IRCConfig{
 		Enabled:            v.Enabled,
 		Server:             v.Server,
@@ -625,11 +691,7 @@ func (v *ircConfigV0) ToIRCConfig() (IRCConfig, IRCSecurity) {
 		GroupTrigger:       v.GroupTrigger,
 		Typing:             v.Typing,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, IRCSecurity{
-			Password:         v.Password,
-			NickServPassword: v.NickServPassword,
-			SASLPassword:     v.SASLPassword,
-		}
+	}, sec
 }
 
 type providersConfigV0 struct {
@@ -783,7 +845,7 @@ func (c *configV0) Migrate() (*Config, error) {
 	cfg.Tools.Web, secWeb = c.Tools.Web.ToWebToolsConfig()
 	cfg.Tools.Cron = c.Tools.Cron
 	cfg.Tools.Exec = c.Tools.Exec
-	var secSkills SkillsSecurity
+	var secSkills *SkillsSecurity
 	cfg.Tools.Skills, secSkills = c.Tools.Skills.ToSkillsToolsConfig()
 	cfg.Tools.MediaCleanup = c.Tools.MediaCleanup
 	cfg.Tools.MCP = c.Tools.MCP
@@ -835,16 +897,18 @@ func (c *configV0) Migrate() (*Config, error) {
 		for i, m := range c.ModelList {
 			// Merge APIKey and APIKeys, deduplicating
 			mergedKeys := MergeAPIKeys(m.APIKey, m.APIKeys)
+			if len(mergedKeys) > 0 {
 				secModels[names[i]] = ModelSecurityEntry{
 					APIKeys: mergedKeys,
 				}
 			}
 		}
+	}
 
 	cfg.WithSecurity(&SecurityConfig{
 		ModelList: secModels,
-		Channels:  secChannels,
-		Web:       secWeb,
+		Channels:  &secChannels,
+		Web:       &secWeb,
 		Skills:    secSkills,
 	})
 	cfg.Version = CurrentVersion
@@ -873,13 +937,17 @@ type braveConfigV0 struct {
 	MaxResults int      `json:"max_results" env:"PICOCLAW_TOOLS_WEB_BRAVE_MAX_RESULTS"`
 }
 
-func (v *braveConfigV0) ToBraveConfig() (BraveConfig, BraveSecurity) {
+func (v *braveConfigV0) ToBraveConfig() (BraveConfig, *BraveSecurity) {
+	var sec *BraveSecurity
+	if k := MergeAPIKeys(v.APIKey, v.APIKeys); len(k) > 0 {
+		sec = &BraveSecurity{
+			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
+		}
+	}
 	return BraveConfig{
 		Enabled:    v.Enabled,
 		MaxResults: v.MaxResults,
-		}, BraveSecurity{
-			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
-		}
+	}, sec
 }
 
 type tavilyConfigV0 struct {
@@ -890,14 +958,18 @@ type tavilyConfigV0 struct {
 	MaxResults int      `json:"max_results" env:"PICOCLAW_TOOLS_WEB_TAVILY_MAX_RESULTS"`
 }
 
-func (v *tavilyConfigV0) ToTavilyConfig() (TavilyConfig, TavilySecurity) {
+func (v *tavilyConfigV0) ToTavilyConfig() (TavilyConfig, *TavilySecurity) {
+	var sec *TavilySecurity
+	if k := MergeAPIKeys(v.APIKey, v.APIKeys); len(k) > 0 {
+		sec = &TavilySecurity{
+			APIKeys: k,
+		}
+	}
 	return TavilyConfig{
 		Enabled:    v.Enabled,
 		BaseURL:    v.BaseURL,
 		MaxResults: v.MaxResults,
-		}, TavilySecurity{
-			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
-		}
+	}, sec
 }
 
 type perplexityConfigV0 struct {
@@ -907,13 +979,17 @@ type perplexityConfigV0 struct {
 	MaxResults int      `json:"max_results" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_MAX_RESULTS"`
 }
 
-func (v *perplexityConfigV0) ToPerplexityConfig() (PerplexityConfig, PerplexitySecurity) {
+func (v *perplexityConfigV0) ToPerplexityConfig() (PerplexityConfig, *PerplexitySecurity) {
+	var sec *PerplexitySecurity
+	if k := MergeAPIKeys(v.APIKey, v.APIKeys); len(k) > 0 {
+		sec = &PerplexitySecurity{
+			APIKeys: k,
+		}
+	}
 	return PerplexityConfig{
 		Enabled:    v.Enabled,
 		MaxResults: v.MaxResults,
-		}, PerplexitySecurity{
-			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
-		}
+	}, sec
 }
 
 type glmSearchConfigV0 struct {
@@ -923,15 +999,19 @@ type glmSearchConfigV0 struct {
 	SearchEngine string `json:"search_engine" env:"PICOCLAW_TOOLS_WEB_GLM_SEARCH_ENGINE"`
 }
 
-func (v *glmSearchConfigV0) ToGLMSearchConfig() (GLMSearchConfig, GLMSearchSecurity) {
+func (v *glmSearchConfigV0) ToGLMSearchConfig() (GLMSearchConfig, *GLMSearchSecurity) {
+	var sec *GLMSearchSecurity
+	if v.APIKey != "" {
+		sec = &GLMSearchSecurity{
+			APIKey: v.APIKey,
+		}
+	}
 	return GLMSearchConfig{
 		Enabled:      v.Enabled,
 		apiKey:       v.APIKey,
 		BaseURL:      v.BaseURL,
 		SearchEngine: v.SearchEngine,
-		}, GLMSearchSecurity{
-			APIKey: v.APIKey,
-		}
+	}, sec
 }
 
 func (v *webToolsConfigV0) ToWebToolsConfig() (WebToolsConfig, WebToolsSecurity) {
@@ -954,10 +1034,10 @@ func (v *webToolsConfigV0) ToWebToolsConfig() (WebToolsConfig, WebToolsSecurity)
 			Format:               v.Format,
 			PrivateHostWhitelist: v.PrivateHostWhitelist,
 		}, WebToolsSecurity{
-			Brave:      &braveSecurity,
-			Tavily:     &tavilySecurity,
-			Perplexity: &perplexitySecurity,
-			GLMSearch:  &glmSearchSecurity,
+			Brave:      braveSecurity,
+			Tavily:     tavilySecurity,
+			Perplexity: perplexitySecurity,
+			GLMSearch:  glmSearchSecurity,
 		}
 }
 
@@ -981,16 +1061,20 @@ type clawHubRegistryConfigV0 struct {
 	SkillsPath string `json:"skills_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_SKILLS_PATH"`
 }
 
-func (v *clawHubRegistryConfigV0) ToClawHubRegistryConfig() (ClawHubRegistryConfig, ClawHubSecurity) {
+func (v *clawHubRegistryConfigV0) ToClawHubRegistryConfig() (ClawHubRegistryConfig, *ClawHubSecurity) {
+	var sec *ClawHubSecurity
+	if v.AuthToken != "" {
+		sec = &ClawHubSecurity{
+			AuthToken: v.AuthToken,
+		}
+	}
 	return ClawHubRegistryConfig{
 		Enabled:    v.Enabled,
 		BaseURL:    v.BaseURL,
 		authToken:  v.AuthToken,
 		SearchPath: v.SearchPath,
 		SkillsPath: v.SkillsPath,
-		}, ClawHubSecurity{
-			AuthToken: v.AuthToken,
-		}
+	}, sec
 }
 
 type skillsGithubConfigV0 struct {
@@ -998,13 +1082,17 @@ type skillsGithubConfigV0 struct {
 	Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_PROXY"`
 }
 
-func (v *skillsGithubConfigV0) ToSkillsGithubConfig() (SkillsGithubConfig, GithubSecurity) {
+func (v *skillsGithubConfigV0) ToSkillsGithubConfig() (SkillsGithubConfig, *GithubSecurity) {
+	var sec *GithubSecurity
+	if v.Token != "" {
+		sec = &GithubSecurity{
+			Token: v.Token,
+		}
+	}
 	return SkillsGithubConfig{
 		token: v.Token,
 		Proxy: v.Proxy,
-		}, GithubSecurity{
-			Token: v.Token,
-		}
+	}, sec
 }
 
 func (v *skillsRegistriesConfigV0) ToSkillsRegistriesConfig() (SkillsRegistriesConfig, *ClawHubSecurity) {
@@ -1012,21 +1100,25 @@ func (v *skillsRegistriesConfigV0) ToSkillsRegistriesConfig() (SkillsRegistriesC
 
 	return SkillsRegistriesConfig{
 		ClawHub: clawHub,
-	}, &clawHubSecurity
+	}, clawHubSecurity
 }
 
-func (v *skillsToolsConfigV0) ToSkillsToolsConfig() (SkillsToolsConfig, SkillsSecurity) {
+func (v *skillsToolsConfigV0) ToSkillsToolsConfig() (SkillsToolsConfig, *SkillsSecurity) {
 	registries, registriesSecurity := v.Registries.ToSkillsRegistriesConfig()
 	github, githubSecurity := v.Github.ToSkillsGithubConfig()
 
+	var sec *SkillsSecurity
+	if githubSecurity != nil || registriesSecurity != nil {
+		sec = &SkillsSecurity{
+			Github:  githubSecurity,
+			ClawHub: registriesSecurity,
+		}
+	}
 	return SkillsToolsConfig{
 		ToolConfig:            v.ToolConfig,
 		Registries:            registries,
 		Github:                github,
 		MaxConcurrentSearches: v.MaxConcurrentSearches,
 		SearchCache:           v.SearchCache,
-		}, SkillsSecurity{
-			Github:  &githubSecurity,
-			ClawHub: registriesSecurity,
-		}
+	}, sec
 }

pkg/config/config_test.go

@@ -1364,7 +1364,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) {
 			"test-model": {APIKeys: []string{"sk-model-key-12345"}},
 		},
 		// Channel tokens
-		Channels: ChannelsSecurity{
+		Channels: &ChannelsSecurity{
 			Telegram: &TelegramSecurity{Token: "telegram-bot-token-abcdef"},
 			Discord:  &DiscordSecurity{Token: "discord-bot-token-xyz789"},
 			Slack:    &SlackSecurity{BotToken: "xoxb-slack-bot-token", AppToken: "xapp-slack-app-token"},
@@ -1382,7 +1382,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) {
 			},
 		},
 		// Web tool API keys
-		Web: WebToolsSecurity{
+		Web: &WebToolsSecurity{
 			Brave:       &BraveSecurity{APIKeys: []string{"brave-api-key"}},
 			Tavily:      &TavilySecurity{APIKeys: []string{"tavily-api-key"}},
 			Perplexity:  &PerplexitySecurity{APIKeys: []string{"perplexity-api-key"}},
@@ -1390,7 +1390,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) {
 			BaiduSearch: &BaiduSearchSecurity{APIKey: "baidu-search-key"},
 		},
 		// Skills tokens
-		Skills: SkillsSecurity{
+		Skills: &SkillsSecurity{
 			Github:  &GithubSecurity{Token: "github-token-xyz"},
 			ClawHub: &ClawHubSecurity{AuthToken: "clawhub-auth-token"},
 		},

pkg/config/defaults.go

@@ -539,8 +539,9 @@ func DefaultConfig() *Config {
 		},
 		security: &SecurityConfig{
 			ModelList: map[string]ModelSecurityEntry{},
-			Channels:  ChannelsSecurity{},
-			Web:       WebToolsSecurity{},
+			Channels:  &ChannelsSecurity{},
+			Web:       &WebToolsSecurity{},
+			Skills:    &SkillsSecurity{},
 		},
 	}
 }

pkg/config/security.go

@@ -34,10 +34,10 @@ type SecurityConfig struct {
 	ModelList map[string]ModelSecurityEntry `yaml:"model_list,omitempty"`
 
 	// Channel tokens/secrets
-	Channels ChannelsSecurity `yaml:"channels,omitempty"`
+	Channels *ChannelsSecurity `yaml:"channels,omitempty"`
 
-	Web    WebToolsSecurity `yaml:"web,omitempty"`
-	Skills SkillsSecurity   `yaml:"skills,omitempty"`
+	Web    *WebToolsSecurity `yaml:"web,omitempty"`
+	Skills *SkillsSecurity   `yaml:"skills,omitempty"`
 
 	// cache for sensitive values and compiled regex (computed once)
 	sensitiveCache *SensitiveDataCache

pkg/config/security_test.go

@@ -59,12 +59,12 @@ func TestSaveAndLoadSecurityConfig(t *testing.T) {
 				APIKeys: []string{"key1", "key2"},
 			},
 		},
-		Channels: ChannelsSecurity{
+		Channels: &ChannelsSecurity{
 			Telegram: &TelegramSecurity{
 				Token: "telegram-token",
 			},
 		},
-		Web: WebToolsSecurity{
+		Web: &WebToolsSecurity{
 			Brave: &BraveSecurity{
 				APIKeys: []string{"brave-api-key"},
 			},

pkg/fileutil/file.go

@@ -117,3 +117,11 @@ func WriteFileAtomic(path string, data []byte, perm os.FileMode) error {
 	cleanup = false
 	return nil
 }
+
+func CopyFile(src, dst string, perm os.FileMode) error {
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return err
+	}
+	return WriteFileAtomic(dst, data, perm)
+}

web/backend/api/models.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 
 	"github.com/sipeed/picoclaw/pkg/config"
+	"github.com/sipeed/picoclaw/pkg/logger"
 )
 
 // registerModelRoutes binds model list management endpoints to the ServeMux.
@@ -158,7 +159,12 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) {
 	}
 	defer r.Body.Close()
 
-	var mc config.ModelConfig
+	type custom struct {
+		config.ModelConfig
+		APIKey string `json:"api_key"`
+	}
+
+	var mc custom
 	if err = json.Unmarshal(body, &mc); err != nil {
 		http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest)
 		return
@@ -182,14 +188,18 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) {
 
 	// Preserve the existing API key when the caller omits it (empty string).
 	// This lets the UI update api_base / proxy without clearing the stored secret.
-	if mc.APIKey() == "" {
-		mc.SetAPIKey(cfg.ModelList[idx].APIKey())
+	if mc.APIKey == "" {
+		mc.ModelConfig.SetAPIKey(cfg.ModelList[idx].APIKey())
+	} else {
+		mc.ModelConfig.SetAPIKey(mc.APIKey)
 	}
 	if mc.ExtraBody == nil {
 		mc.ExtraBody = cfg.ModelList[idx].ExtraBody
 	}
 
-	cfg.ModelList[idx] = &mc
+	cfg.ModelList[idx] = &mc.ModelConfig
+
+	logger.Debugf("update model config: %#v", mc.ModelConfig)
 
 	if err := config.SaveConfig(h.configPath, cfg); err != nil {
 		http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError)

web/frontend/src/components/secret-placeholder.ts

@@ -4,13 +4,20 @@ export function maskedSecretPlaceholder(value: unknown, fallback = ""): string {
     return fallback
   }
 
-  if (secret.length < 7) {
+  // ensure at least 40% of the characters are masked for secrets of length 4 or more
+  if (secret.length <= 6) {
     const first = secret[0]
     const last = secret[secret.length - 1]
     return `${first}***${last}`
   }
 
-  const prefix = secret.slice(0, Math.min(3, secret.length))
-  const suffix = secret.slice(-Math.min(4, secret.length))
-  return `${prefix}***${suffix}`
+  if (secret.length <= 12) {
+    const firstTwo = secret.slice(0, 2)
+    const lastTwo = secret.slice(-2)
+    return `${firstTwo}****${lastTwo}`
+  }
+
+  const prefix = secret.slice(0, 3)
+  const suffix = secret.slice(-4)
+  return `${prefix}*****${suffix}`
 }