Why does onboarding ask me to accept TRUST_MODEL.md?
HybridClaw enforces explicit trust-model acceptance before runtime starts. Acceptance is recorded in config.json with policy version and timestamp so operators can prove security acknowledgement. Technical runtime controls are documented separately in SECURITY.md.
Do I still configure everything through .env?
No. Runtime behavior lives in typed config.json and runtime secrets live in ~/.hybridclaw/credentials.json. If .env exists in the current working directory, supported secrets are imported into ~/.hybridclaw/credentials.json once for compatibility.
Is it safe to let the agent run shell commands?
By default, tools execute inside ephemeral Docker containers with read-only filesystems, memory caps, dropped capabilities, no-new-privileges, PID limits, and a deny-list of dangerous command patterns. When HybridClaw itself already runs inside a container, operators can switch to host sandbox mode to avoid Docker-in-Docker, trading container isolation for workspace fencing and command guardrails.
Can browser tools test real login flows?
Yes, when explicitly requested by the user for the intended site. Runtime guidance allows authenticated browser-flow testing, while sensitive credential values are redacted from structured audit tool-argument logs.
How does HybridClaw choose web_fetch vs browser tools?
Default is web_fetch for static/read-only retrieval. HybridClaw escalates to browser automation for JavaScript-heavy apps, auth-gated flows, interaction steps, or when web_fetch reports hints like javascript_required, spa_shell_only, empty_extraction, boilerplate_only, or bot_blocked.
Is the audit trail immutable?
Audit logs are append-only and hash-chained per session, so modifications are tamper-evident. Use hybridclaw audit verify <sessionId> to validate integrity, and hybridclaw audit approvals --denied to review denied actions.
What happens if instruction files are changed?
HybridClaw keeps runtime copies of SECURITY.md and TRUST_MODEL.md under ~/.hybridclaw/instructions/. TUI checks them before startup. Use hybridclaw audit instructions to review drift and hybridclaw audit instructions --sync to restore them from installed sources. Sync actions are audit logged.
Can I use it without Discord?
Absolutely. Run hybridclaw tui for the terminal UI. The same assistant behavior and context model is shared across supported interfaces.
How are screenshots returned in Discord?
HybridClaw attaches generated screenshots directly to the reply and keeps the text concise (for example: "Here it is.") instead of exposing internal workspace file paths.
What is the heartbeat system?
A configurable periodic poll (default every 30 minutes) where the agent wakes up, checks its HEARTBEAT.md file for tasks, and proactively reaches out if something needs attention. Silent acknowledgments are discarded to avoid noise.
Can different Discord channels use different bots?
Yes. Each channel can be independently configured with its own HybridAI chatbot, model, and RAG setting using the bot set and model set commands. You can also control reply activation per channel with /channel-mode and guild policy via /channel-policy.
How do I allow free-response in only one Discord channel?
Set guild policy to allowlist using /channel-policy policy:allowlist, then run /channel-mode mode:free in the one channel you want active. Leave other channels unlisted (or set them to off).
How does HybridClaw avoid over-replying in busy channels?
In free-response channels, HybridClaw can selectively stay silent when a peer likely already answered, react instead of replying to short acknowledgments (for example "thanks"), and slow pacing during nights/weekends or long back-and-forth exchanges.
How does scheduling work?
Two layers: chat-created tasks (schedule add) and config-backed scheduler.jobs[]. Both support cron, one-shot at, and interval semantics. Config jobs also support agent_turn/system_event actions plus channel/last-channel/webhook delivery, with persisted metadata and auto-disable after repeated failures.
What is HybridAI?
HybridAI is the bot platform that powers HybridClaw. It provides managed chatbots with document knowledge bases, retrieval-augmented generation (RAG), and multi-model support through an OpenAI-compatible API. You create and configure bots on the HybridAI platform, then connect them to HybridClaw.
What AI models does it support?
HybridClaw works with any model available through the HybridAI API. You can list available models with model list and switch per channel at any time.
Does the agent remember things between conversations?
Yes. The agent writes daily memory files (memory/YYYY-MM-DD.md) and curates long-term insights into MEMORY.md. It also maintains canonical cross-channel context per user/agent pair so continuity survives channel switches. Before session compaction, a dedicated flush turn ensures durable notes are persisted. These files plus SOUL.md are injected into every request.
Can I switch the assistant personality at runtime?
Yes. Use /personality (or /personality list) to view profiles, /personality <name> to activate one, and /personality reset to go back to default. HybridClaw persists the active persona in SOUL.md as a managed block with Name, Definition, and Rules.
Can I use skills from CLAUDE.md or OpenClaw?
Yes. HybridClaw supports OpenClaw/CLAUDE-compatible SKILL.md frontmatter, including always, requires, and metadata fields. Skills can be loaded from workspace, project .agents/skills, personal (~/.codex/~/.claude/~/.agents), bundled, or enterprise extra directories; higher-priority tiers override lower ones. Trust-aware scanning blocks risky personal/community skills while allowing vetted bundled skills.
