@agent-vm/agent-vm 0.0.96 → 0.0.98

package/dist/cli/manual-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual-templates.js","sourceRoot":"","sources":["../../src/cli/manual-templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,oDAAoD,CAAC;AAY5F,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IACjD,OAAO,QAAQ,uBAAuB;;IAEnC,KAAK;;EAEP,IAAI,CAAC,IAAI,EAAE;CACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA8B;IACxE,OAAO,aAAa,CACnB,oBAAoB,EACpB;;;;mBAIiB,OAAO,CAAC,gBAAgB;kBACzB,OAAO,CAAC,aAAa;;;;;;;;;;;;;;;CAetC,CACC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,OAA8B;IAE9B,OAAO;QACN;YACC,YAAY,EAAE,uBAAuB;YACrC,OAAO,EAAE,aAAa,CACrB,4BAA4B,EAC5B;;;;;;;;;;;;;;;;;;;;CAoBH,CACG;SACD;QACD;YACC,YAAY,EAAE,uBAAuB;YACrC,OAAO,EAAE,aAAa,CACrB,kBAAkB,EAClB;EACF,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;;;;;CAiBzB,CACG;SACD;QACD;YACC,YAAY,EAAE,iCAAiC;YAC/C,OAAO,EAAE,aAAa,CACrB,kBAAkB,EAClB;;;;;;;;;;;;;;;;;;;;CAoBH,CACG;SACD;QACD;YACC,YAAY,EAAE,+BAA+B;YAC7C,OAAO,EAAE,aAAa,CACrB,kCAAkC,EAClC;;;;;;;;;;;;;;;;CAgBH,CACG;SACD;QACD;YACC,YAAY,EAAE,2BAA2B;YACzC,OAAO,EAAE,aAAa,CACrB,YAAY,EACZ;;;oCAGgC,OAAO,CAAC,gBAAgB;;;;uCAIrB,OAAO,CAAC,gBAAgB,WAAW,OAAO,CAAC,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC9F,CACG;SACD;QACD;YACC,YAAY,EAAE,yBAAyB;YACvC,OAAO,EAAE,aAAa,CACrB,kBAAkB,EAClB;;;;;;;;;;;CAWH,CACG;SACD;QACD;YACC,YAAY,EAAE,gCAAgC;YAC9C,OAAO,EAAE,aAAa,CACrB,6BAA6B,EAC7B;;;;;;;;;;;;;;;EAeF,CACE;SACD;QACD;YACC,YAAY,EAAE,kCAAkC;YAChD,OAAO,EAAE,aAAa,CACrB,mBAAmB,EACnB;;;;;;;;;;;;;;;;;;;;;;;;EAwBF,CACE;SACD;QACD;YACC,YAAY,EAAE,2BAA2B;YACzC,OAAO,EAAE,aAAa,CACrB,YAAY,EACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BH,CACG;SACD;QACD;YACC,YAAY,EAAE,6BAA6B;YAC3C,OAAO,EAAE,aAAa,CACrB,sBAAsB,EACtB;;;;CAIH,CACG;SACD;QACD;YACC,YAAY,EAAE,wBAAwB;YACtC,OAAO,EAAE,aAAa,CACrB,0BAA0B,EAC1B;0BACsB,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;CAajD,CACG;SACD;QACD;YACC,YAAY,EAAE,4BAA4B;YAC1C,OAAO,EAAE,aAAa,CACrB,2BAA2B,EAC3B;;;;;;;;;;;;;;;;;CAiBH,CACG;SACD;QACD;YACC,YAAY,EAAE,yBAAyB;YACvC,OAAO,EAAE,aAAa,CACrB,mBAAmB,EACnB;;;;;6BAKyB,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;;;;CAgBpD,CACG;SACD;QACD;YACC,YAAY,EAAE,8BAA8B;YAC5C,OAAO,EAAE,aAAa,CACrB,eAAe,EACf;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BH,CACG;SACD;QACD;YACC,YAAY,EAAE,gCAAgC;YAC9C,OAAO,EAAE,aAAa,CACrB,iBAAiB,EACjB;;;;;;;;;;;;;;;;CAgBH,CACG;SACD;QACD;YACC,YAAY,EAAE,kCAAkC;YAChD,OAAO,EAAE,aAAa,CACrB,mBAAmB,EACnB;;;;;+BAK2B,OAAO,CAAC,gBAAgB;;;;;CAKtD,CACG;SACD;QACD;YACC,YAAY,EAAE,gCAAgC;YAC9C,OAAO,EAAE,aAAa,CACrB,iBAAiB,EACjB;;;;;;;;;;;CAWH,CACG;SACD;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"manual-templates.js","sourceRoot":"","sources":["../../src/cli/manual-templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,oDAAoD,CAAC;AAY5F,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IACjD,OAAO,QAAQ,uBAAuB;;IAEnC,KAAK;;EAEP,IAAI,CAAC,IAAI,EAAE;CACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA8B;IACxE,OAAO,aAAa,CACnB,oBAAoB,EACpB;;;;mBAIiB,OAAO,CAAC,gBAAgB;kBACzB,OAAO,CAAC,aAAa;;;;;;;;;;;;;;;;CAgBtC,CACC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,OAA8B;IAE9B,OAAO;QACN;YACC,YAAY,EAAE,uBAAuB;YACrC,OAAO,EAAE,aAAa,CACrB,4BAA4B,EAC5B;;;;;;;;;;;;;;;;;;;;;CAqBH,CACG;SACD;QACD;YACC,YAAY,EAAE,uBAAuB;YACrC,OAAO,EAAE,aAAa,CACrB,kBAAkB,EAClB;EACF,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;;;;;CAiBzB,CACG;SACD;QACD;YACC,YAAY,EAAE,iCAAiC;YAC/C,OAAO,EAAE,aAAa,CACrB,kBAAkB,EAClB;;;;;;;;;;;;;;;;;;;;CAoBH,CACG;SACD;QACD;YACC,YAAY,EAAE,+BAA+B;YAC7C,OAAO,EAAE,aAAa,CACrB,kCAAkC,EAClC;;;;;;;;;;;;;;;;CAgBH,CACG;SACD;QACD;YACC,YAAY,EAAE,2BAA2B;YACzC,OAAO,EAAE,aAAa,CACrB,YAAY,EACZ;;;oCAGgC,OAAO,CAAC,gBAAgB;;;;uCAIrB,OAAO,CAAC,gBAAgB,WAAW,OAAO,CAAC,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyC9F,CACG;SACD;QACD;YACC,YAAY,EAAE,yBAAyB;YACvC,OAAO,EAAE,aAAa,CACrB,kBAAkB,EAClB;;;;;;;;;;;CAWH,CACG;SACD;QACD;YACC,YAAY,EAAE,8BAA8B;YAC5C,OAAO,EAAE,aAAa,CACrB,oBAAoB,EACpB;4EACwE,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;;;;;CAiBnG,CACG;SACD;QACD;YACC,YAAY,EAAE,gCAAgC;YAC9C,OAAO,EAAE,aAAa,CACrB,6BAA6B,EAC7B;;;;;;;;;;;;;;;EAeF,CACE;SACD;QACD;YACC,YAAY,EAAE,kCAAkC;YAChD,OAAO,EAAE,aAAa,CACrB,mBAAmB,EACnB;;;;;;;;;;;;;;;;;;;;;;;;EAwBF,CACE;SACD;QACD;YACC,YAAY,EAAE,2BAA2B;YACzC,OAAO,EAAE,aAAa,CACrB,YAAY,EACZ;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BH,CACG;SACD;QACD;YACC,YAAY,EAAE,6BAA6B;YAC3C,OAAO,EAAE,aAAa,CACrB,sBAAsB,EACtB;;;;CAIH,CACG;SACD;QACD;YACC,YAAY,EAAE,wBAAwB;YACtC,OAAO,EAAE,aAAa,CACrB,0BAA0B,EAC1B;0BACsB,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;;CAcjD,CACG;SACD;QACD;YACC,YAAY,EAAE,4BAA4B;YAC1C,OAAO,EAAE,aAAa,CACrB,2BAA2B,EAC3B;;;;;;;;;;;;;;;;;CAiBH,CACG;SACD;QACD;YACC,YAAY,EAAE,yBAAyB;YACvC,OAAO,EAAE,aAAa,CACrB,mBAAmB,EACnB;;;;;6BAKyB,OAAO,CAAC,gBAAgB;;;;;;;;;;;;;;;;CAgBpD,CACG;SACD;QACD;YACC,YAAY,EAAE,8BAA8B;YAC5C,OAAO,EAAE,aAAa,CACrB,eAAe,EACf;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BH,CACG;SACD;QACD;YACC,YAAY,EAAE,gCAAgC;YAC9C,OAAO,EAAE,aAAa,CACrB,iBAAiB,EACjB;;;;;;;;;;;;;;;;CAgBH,CACG;SACD;QACD;YACC,YAAY,EAAE,kCAAkC;YAChD,OAAO,EAAE,aAAa,CACrB,mBAAmB,EACnB;;;;;+BAK2B,OAAO,CAAC,gBAAgB;;;;;CAKtD,CACG;SACD;QACD;YACC,YAAY,EAAE,gCAAgC;YAC9C,OAAO,EAAE,aAAa,CACrB,iBAAiB,EACjB;;;;;;;;;;;CAWH,CACG;SACD;KACD,CAAC;AACH,CAAC"}

package/dist/config/system-config.d.ts

@@ -28,6 +28,87 @@ declare const systemConfigSchema: z.ZodObject<{
             source: z.ZodLiteral<"config">;
             value: z.ZodString;
         }, z.core.$strict>], "source">>;
+        observability: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            enabled: z.ZodLiteral<false>;
+        }, z.core.$strict>, z.ZodObject<{
+            stack: z.ZodDefault<z.ZodObject<{
+                mode: z.ZodDefault<z.ZodLiteral<"managed">>;
+                scrubbing: z.ZodDefault<z.ZodObject<{
+                    responsibility: z.ZodDefault<z.ZodLiteral<"agent-vm-managed-collector">>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            runner: z.ZodDefault<z.ZodLiteral<"docker-compose">>;
+            dataDir: z.ZodString;
+            projectName: z.ZodOptional<z.ZodString>;
+            retention: z.ZodObject<{
+                metrics: z.ZodObject<{
+                    period: z.ZodString;
+                    minFreeDiskSpaceBytes: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                logs: z.ZodObject<{
+                    period: z.ZodString;
+                    minFreeDiskSpaceBytes: z.ZodOptional<z.ZodString>;
+                    maxDiskSpaceUsageBytes: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                traces: z.ZodObject<{
+                    period: z.ZodString;
+                    minFreeDiskSpaceBytes: z.ZodOptional<z.ZodString>;
+                    maxDiskSpaceUsageBytes: z.ZodOptional<z.ZodString>;
+                    maxDiskUsagePercent: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            enabled: z.ZodLiteral<true>;
+            mode: z.ZodDefault<z.ZodLiteral<"collector">>;
+            bindAddress: z.ZodDefault<z.ZodEnum<{
+                "127.0.0.1": "127.0.0.1";
+                "::1": "::1";
+            }>>;
+            prepareOnBuild: z.ZodDefault<z.ZodBoolean>;
+            waitOnBuild: z.ZodDefault<z.ZodBoolean>;
+            startupCheckTimeoutMs: z.ZodDefault<z.ZodNumber>;
+            ports: z.ZodDefault<z.ZodObject<{
+                collectorGrpc: z.ZodDefault<z.ZodNumber>;
+                collectorHttp: z.ZodDefault<z.ZodNumber>;
+                collectorHealth: z.ZodDefault<z.ZodNumber>;
+                metrics: z.ZodDefault<z.ZodNumber>;
+                logs: z.ZodDefault<z.ZodNumber>;
+                traces: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strict>>;
+            controllerStartPolicy: z.ZodDefault<z.ZodEnum<{
+                degraded: "degraded";
+                "require-ready": "require-ready";
+                off: "off";
+            }>>;
+        }, z.core.$strict>, z.ZodObject<{
+            stack: z.ZodObject<{
+                mode: z.ZodLiteral<"external">;
+                scrubbing: z.ZodObject<{
+                    responsibility: z.ZodLiteral<"external-collector">;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            enabled: z.ZodLiteral<true>;
+            mode: z.ZodDefault<z.ZodLiteral<"collector">>;
+            bindAddress: z.ZodDefault<z.ZodEnum<{
+                "127.0.0.1": "127.0.0.1";
+                "::1": "::1";
+            }>>;
+            prepareOnBuild: z.ZodDefault<z.ZodBoolean>;
+            waitOnBuild: z.ZodDefault<z.ZodBoolean>;
+            startupCheckTimeoutMs: z.ZodDefault<z.ZodNumber>;
+            ports: z.ZodDefault<z.ZodObject<{
+                collectorGrpc: z.ZodDefault<z.ZodNumber>;
+                collectorHttp: z.ZodDefault<z.ZodNumber>;
+                collectorHealth: z.ZodDefault<z.ZodNumber>;
+                metrics: z.ZodDefault<z.ZodNumber>;
+                logs: z.ZodDefault<z.ZodNumber>;
+                traces: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strict>>;
+            controllerStartPolicy: z.ZodDefault<z.ZodEnum<{
+                degraded: "degraded";
+                "require-ready": "require-ready";
+                off: "off";
+            }>>;
+        }, z.core.$strict>]>>;
     }, z.core.$strip>;
     controller: z.ZodDefault<z.ZodObject<{
         health: z.ZodDefault<z.ZodObject<{
@@ -214,36 +295,54 @@ declare const systemConfigSchema: z.ZodObject<{
             value: z.ZodString;
             injection: z.ZodLiteral<"env">;
             audience: z.ZodLiteral<"gateway">;
+        }, z.core.$strict>, z.ZodObject<{
+            source: z.ZodLiteral<"1password">;
+            ref: z.ZodString;
+            injection: z.ZodLiteral<"http-mediation">;
+            audience: z.ZodLiteral<"gateway">;
+            hosts: z.ZodArray<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             source: z.ZodLiteral<"1password">;
             ref: z.ZodString;
             injection: z.ZodLiteral<"http-mediation">;
             audience: z.ZodEnum<{
-                gateway: "gateway";
                 "tool-vm": "tool-vm";
                 both: "both";
             }>;
             hosts: z.ZodArray<z.ZodString>;
+            agentAccess: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
+        }, z.core.$strict>, z.ZodObject<{
+            source: z.ZodLiteral<"environment">;
+            envVar: z.ZodString;
+            injection: z.ZodLiteral<"http-mediation">;
+            audience: z.ZodLiteral<"gateway">;
+            hosts: z.ZodArray<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             source: z.ZodLiteral<"environment">;
             envVar: z.ZodString;
             injection: z.ZodLiteral<"http-mediation">;
             audience: z.ZodEnum<{
-                gateway: "gateway";
                 "tool-vm": "tool-vm";
                 both: "both";
             }>;
             hosts: z.ZodArray<z.ZodString>;
+            agentAccess: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
+        }, z.core.$strict>, z.ZodObject<{
+            source: z.ZodLiteral<"config">;
+            value: z.ZodString;
+            injection: z.ZodLiteral<"http-mediation">;
+            audience: z.ZodLiteral<"gateway">;
+            hosts: z.ZodArray<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             source: z.ZodLiteral<"config">;
             value: z.ZodString;
             injection: z.ZodLiteral<"http-mediation">;
             audience: z.ZodEnum<{
-                gateway: "gateway";
                 "tool-vm": "tool-vm";
                 both: "both";
             }>;
             hosts: z.ZodArray<z.ZodString>;
+            agentAccess: z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>;
         }, z.core.$strict>]>>;
         runtimeAuthHints: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"service-token">;
@@ -252,6 +351,23 @@ declare const systemConfigSchema: z.ZodObject<{
             hosts: z.ZodArray<z.ZodString>;
             tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>], "kind">>>;
+        observability: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            enabled: z.ZodLiteral<false>;
+        }, z.core.$strict>, z.ZodObject<{
+            enabled: z.ZodLiteral<true>;
+            openclaw: z.ZodObject<{
+                serviceName: z.ZodString;
+                traces: z.ZodDefault<z.ZodBoolean>;
+                metrics: z.ZodDefault<z.ZodBoolean>;
+                logs: z.ZodDefault<z.ZodBoolean>;
+                sampleRate: z.ZodDefault<z.ZodNumber>;
+                flushIntervalMs: z.ZodDefault<z.ZodNumber>;
+                captureContent: z.ZodDefault<z.ZodObject<{
+                    enabled: z.ZodDefault<z.ZodLiteral<false>>;
+                }, z.core.$strict>>;
+                diagnosticsFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "enabled">>;
         egressHosts: z.ZodArray<z.ZodObject<{
             host: z.ZodString;
             audience: z.ZodEnum<{

package/dist/config/system-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-config.d.ts","sourceRoot":"","sources":["../../src/config/system-config.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,aAAa,aAMxB,CAAC;AACH,eAAO,MAAM,YAAY,aAMvB,CAAC;AAofH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4WrB,CAAC;AAEJ,KAAK,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACvD,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK1E;AAED,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACvD,GAAG,sBAAsB,CAEzB;AAgCD,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAC5C,kBAAkB,CAOpB;AAyGD,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQtF"}
+{"version":3,"file":"system-config.d.ts","sourceRoot":"","sources":["../../src/config/system-config.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,aAAa,aAMxB,CAAC;AACH,eAAO,MAAM,YAAY,aAMvB,CAAC;AAiuBH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgdrB,CAAC;AAEJ,KAAK,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAO7D,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACvD,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK1E;AAED,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACvD,GAAG,sBAAsB,CAEzB;AA2DD,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAC5C,kBAAkB,CAOpB;AAkHD,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQtF"}

package/dist/config/system-config.js

@@ -32,6 +32,8 @@ function hostMatchesPattern(host, pattern) {
     return patternRegex.test(host.toLowerCase());
 }
 const vmAudienceSchema = z.enum(vmAudienceValues);
+const toolVmReachableAudienceSchema = z.enum(['tool-vm', 'both']);
+const agentAccessSchema = z.union([z.literal('all'), z.array(agentIdSchema).min(1)]);
 const secretNameSchema = z
     .string()
     .min(1)
@@ -67,40 +69,73 @@ const configEnvSecretSchema = z
     audience: z.literal('gateway'),
 })
     .strict();
-const onePasswordMediatedSecretSchema = z
+const onePasswordGatewayMediatedSecretSchema = z
     .object({
     source: z.literal('1password'),
     ref: z.string().min(1),
     injection: z.literal('http-mediation'),
-    audience: vmAudienceSchema,
+    audience: z.literal('gateway'),
+    hosts: z.array(z.string().min(1)).min(1),
+})
+    .strict();
+const onePasswordToolVmMediatedSecretSchema = z
+    .object({
+    source: z.literal('1password'),
+    ref: z.string().min(1),
+    injection: z.literal('http-mediation'),
+    audience: toolVmReachableAudienceSchema,
     hosts: z.array(z.string().min(1)).min(1),
+    agentAccess: agentAccessSchema,
 })
     .strict();
-const environmentMediatedSecretSchema = z
+const environmentGatewayMediatedSecretSchema = z
     .object({
     source: z.literal('environment'),
     envVar: z.string().min(1),
     injection: z.literal('http-mediation'),
-    audience: vmAudienceSchema,
+    audience: z.literal('gateway'),
     hosts: z.array(z.string().min(1)).min(1),
 })
     .strict();
-const configMediatedSecretSchema = z
+const environmentToolVmMediatedSecretSchema = z
+    .object({
+    source: z.literal('environment'),
+    envVar: z.string().min(1),
+    injection: z.literal('http-mediation'),
+    audience: toolVmReachableAudienceSchema,
+    hosts: z.array(z.string().min(1)).min(1),
+    agentAccess: agentAccessSchema,
+})
+    .strict();
+const configGatewayMediatedSecretSchema = z
     .object({
     source: z.literal('config'),
     value: z.string().min(1),
     injection: z.literal('http-mediation'),
-    audience: vmAudienceSchema,
+    audience: z.literal('gateway'),
     hosts: z.array(z.string().min(1)).min(1),
 })
     .strict();
+const configToolVmMediatedSecretSchema = z
+    .object({
+    source: z.literal('config'),
+    value: z.string().min(1),
+    injection: z.literal('http-mediation'),
+    audience: toolVmReachableAudienceSchema,
+    hosts: z.array(z.string().min(1)).min(1),
+    agentAccess: agentAccessSchema,
+})
+    .strict();
 const secretReferenceSchema = z.union([
     onePasswordEnvSecretSchema,
     environmentEnvSecretSchema,
     configEnvSecretSchema,
-    onePasswordMediatedSecretSchema,
-    environmentMediatedSecretSchema,
-    configMediatedSecretSchema,
+    onePasswordGatewayMediatedSecretSchema,
+    onePasswordToolVmMediatedSecretSchema,
+    environmentGatewayMediatedSecretSchema,
+    environmentToolVmMediatedSecretSchema,
+    configGatewayMediatedSecretSchema,
+    configToolVmMediatedSecretSchema,
 ]);
 const runtimeAuthHintSchema = z.discriminatedUnion('kind', [
     z
@@ -427,6 +462,17 @@ const imageConfigSchema = z
 const gatewayImageProfileSchema = imageConfigSchema.extend({
     type: z.enum(gatewayTypeValues),
 });
+function isManagedOpenClawObservabilityProfile(profileName, profile) {
+    if (!profile || profile.type !== 'openclaw') {
+        return false;
+    }
+    if (profile.source?.base === 'openclaw-gateway') {
+        return true;
+    }
+    return (profile.source === undefined &&
+        profileName === 'openclaw' &&
+        /(?:^|\/)vm-images\/gateways\/openclaw\/build-config\.jsonc?$/u.test(profile.buildConfig));
+}
 const toolVmImageProfileSchema = imageConfigSchema.extend({
     type: z.literal('toolVm'),
 });
@@ -445,6 +491,157 @@ const zoneMcpConfigSchema = z
     configDir: z.string().min(1),
 })
     .strict();
+const victoriaRetentionPeriodSchema = z
+    .string()
+    .min(1)
+    .regex(/^[1-9][0-9]*(?:ms|s|m|h|d|w|M|y)$/u, 'retention period must be a positive Victoria duration such as 30d, 12h, or 1M');
+const victoriaByteSizeSchema = z
+    .string()
+    .min(1)
+    .regex(/^[1-9][0-9]*(?:B|KB|MB|GB|TB|KiB|MiB|GiB|TiB)$/u, 'retention byte size must be a positive value with a unit such as 5GiB or 50GB');
+const observabilityRetentionBaseSchema = z
+    .object({
+    period: victoriaRetentionPeriodSchema,
+    minFreeDiskSpaceBytes: victoriaByteSizeSchema.optional(),
+})
+    .strict();
+const observabilityByteBoundedRetentionPolicySchema = observabilityRetentionBaseSchema
+    .extend({
+    maxDiskSpaceUsageBytes: victoriaByteSizeSchema.optional(),
+})
+    .strict();
+const observabilityDiskBoundedRetentionPolicySchema = observabilityRetentionBaseSchema
+    .extend({
+    maxDiskSpaceUsageBytes: victoriaByteSizeSchema.optional(),
+    maxDiskUsagePercent: z.number().int().min(1).max(100).optional(),
+})
+    .strict()
+    .refine((value) => value.maxDiskSpaceUsageBytes === undefined || value.maxDiskUsagePercent === undefined, 'maxDiskSpaceUsageBytes and maxDiskUsagePercent are mutually exclusive');
+const hostObservabilityPortSchema = z.number().int().min(1).max(65_535);
+const hostObservabilityPortsSchema = z
+    .object({
+    collectorGrpc: hostObservabilityPortSchema.default(4317),
+    collectorHttp: hostObservabilityPortSchema.default(4318),
+    collectorHealth: hostObservabilityPortSchema.default(13_133),
+    metrics: hostObservabilityPortSchema.default(8428),
+    logs: hostObservabilityPortSchema.default(9428),
+    traces: hostObservabilityPortSchema.default(10_428),
+})
+    .strict()
+    .refine((ports) => new Set(Object.values(ports)).size === Object.values(ports).length, {
+    message: 'host observability ports must be unique',
+})
+    .default({
+    collectorGrpc: 4317,
+    collectorHttp: 4318,
+    collectorHealth: 13_133,
+    metrics: 8428,
+    logs: 9428,
+    traces: 10_428,
+});
+const managedHostObservabilityStackSchema = z
+    .object({
+    mode: z.literal('managed').default('managed'),
+    scrubbing: z
+        .object({
+        responsibility: z
+            .literal('agent-vm-managed-collector')
+            .default('agent-vm-managed-collector'),
+    })
+        .strict()
+        .default({ responsibility: 'agent-vm-managed-collector' }),
+})
+    .strict()
+    .default({
+    mode: 'managed',
+    scrubbing: { responsibility: 'agent-vm-managed-collector' },
+});
+const externalHostObservabilityStackSchema = z
+    .object({
+    mode: z.literal('external'),
+    scrubbing: z
+        .object({
+        responsibility: z.literal('external-collector'),
+    })
+        .strict(),
+})
+    .strict();
+const hostObservabilityCommonShape = {
+    enabled: z.literal(true),
+    mode: z.literal('collector').default('collector'),
+    bindAddress: z.enum(['127.0.0.1', '::1']).default('127.0.0.1'),
+    prepareOnBuild: z.boolean().default(true),
+    waitOnBuild: z.boolean().default(true),
+    startupCheckTimeoutMs: z.number().int().positive().default(30_000),
+    ports: hostObservabilityPortsSchema,
+    controllerStartPolicy: z.enum(['degraded', 'require-ready', 'off']).default('degraded'),
+};
+const hostObservabilityRetentionSchema = z
+    .object({
+    metrics: observabilityRetentionBaseSchema,
+    logs: observabilityByteBoundedRetentionPolicySchema,
+    traces: observabilityDiskBoundedRetentionPolicySchema,
+})
+    .strict();
+const managedHostObservabilitySchema = z
+    .object({
+    ...hostObservabilityCommonShape,
+    stack: managedHostObservabilityStackSchema,
+    runner: z.literal('docker-compose').default('docker-compose'),
+    dataDir: z.string().min(1),
+    projectName: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9][a-z0-9_-]*$/u, 'projectName must use lowercase letters, numbers, hyphens, and underscores, and start with a letter or number')
+        .optional(),
+    retention: hostObservabilityRetentionSchema,
+})
+    .strict();
+const externalHostObservabilitySchema = z
+    .object({
+    ...hostObservabilityCommonShape,
+    stack: externalHostObservabilityStackSchema,
+})
+    .strict();
+const hostObservabilitySchema = z.union([
+    z
+        .object({
+        enabled: z.literal(false),
+    })
+        .strict(),
+    managedHostObservabilitySchema,
+    externalHostObservabilitySchema,
+]);
+const zoneOpenClawObservabilitySchema = z
+    .object({
+    serviceName: z.string().min(1),
+    traces: z.boolean().default(true),
+    metrics: z.boolean().default(true),
+    logs: z.boolean().default(true),
+    sampleRate: z.number().min(0).max(1).default(1),
+    flushIntervalMs: z.number().int().positive().default(10_000),
+    captureContent: z
+        .object({
+        enabled: z.literal(false).default(false),
+    })
+        .strict()
+        .default({ enabled: false }),
+    diagnosticsFlags: z.array(z.string().min(1)).default([]),
+})
+    .strict();
+const zoneObservabilitySchema = z.discriminatedUnion('enabled', [
+    z
+        .object({
+        enabled: z.literal(false),
+    })
+        .strict(),
+    z
+        .object({
+        enabled: z.literal(true),
+        openclaw: zoneOpenClawObservabilitySchema,
+    })
+        .strict(),
+]);
 const systemConfigSchema = z
     .object({
     $schema: z.string().min(1).optional(),
@@ -462,6 +659,7 @@ const systemConfigSchema = z
         })
             .optional(),
         githubToken: hostSecretReferenceSchema.optional(),
+        observability: hostObservabilitySchema.optional(),
     }),
     controller: controllerConfigSchema.default({ health: defaultControllerHealthConfig }),
     cacheDir: z.string().min(1).default('./cache'),
@@ -478,6 +676,7 @@ const systemConfigSchema = z
         resources: zoneResourcesPolicySchema.optional(),
         secrets: z.record(secretNameSchema, secretReferenceSchema),
         runtimeAuthHints: z.array(runtimeAuthHintSchema).optional(),
+        observability: zoneObservabilitySchema.optional(),
         egressHosts: z.array(egressHostSchema).min(1),
         websocketBypass: z.array(z.string().min(1)).default([]),
         defaultToolVmProfile: z.string().min(1).optional(),
@@ -547,6 +746,59 @@ const systemConfigSchema = z
         }
     }
     for (const [zoneIndex, zone] of config.zones.entries()) {
+        const zoneAgents = zone.agents ?? [];
+        const zoneAgentIds = new Set(zoneAgents.map((agent) => agent.id));
+        if (zone.observability?.enabled === true && config.host.observability?.enabled !== true) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `Zone '${zone.id}' observability requires host.observability.enabled to be true.`,
+                path: ['zones', zoneIndex, 'observability'],
+            });
+        }
+        if (zone.observability?.enabled === true && zone.gateway.type !== 'openclaw') {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `Zone '${zone.id}' observability is supported only for OpenClaw gateways in v1.`,
+                path: ['zones', zoneIndex, 'observability'],
+            });
+        }
+        if (zone.observability?.enabled === true && zone.gateway.type === 'openclaw') {
+            const gatewayImageProfile = config.imageProfiles.gateways[zone.gateway.imageProfile];
+            if (!isManagedOpenClawObservabilityProfile(zone.gateway.imageProfile, gatewayImageProfile)) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `Zone '${zone.id}' observability requires OpenClaw gateway image profile '${zone.gateway.imageProfile}' to use managed base 'openclaw-gateway' so @openclaw/diagnostics-otel is installed.`,
+                    path: ['zones', zoneIndex, 'gateway', 'imageProfile'],
+                });
+            }
+        }
+        if (zone.observability?.enabled === true) {
+            const forbiddenDiagnosticsFlagPattern = /[*=]|^(?:1|all|everything)$|(?:body|content|payload|prompt|secret|token|authorization|cookie|transcript|query|header|url)/iu;
+            for (const [flagIndex, diagnosticsFlag,] of zone.observability.openclaw.diagnosticsFlags.entries()) {
+                if (forbiddenDiagnosticsFlagPattern.test(diagnosticsFlag)) {
+                    context.addIssue({
+                        code: z.ZodIssueCode.custom,
+                        message: `Zone '${zone.id}' observability diagnostics flag '${diagnosticsFlag}' is too broad or can capture sensitive content.`,
+                        path: [
+                            'zones',
+                            zoneIndex,
+                            'observability',
+                            'openclaw',
+                            'diagnosticsFlags',
+                            flagIndex,
+                        ],
+                    });
+                }
+            }
+            if (zone.gateway.type === 'openclaw' &&
+                zone.gateway.rawEnvSecrets?.includes('OPENCLAW_DIAGNOSTICS') === true) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `Zone '${zone.id}' observability owns diagnostics configuration; do not list OPENCLAW_DIAGNOSTICS in gateway.rawEnvSecrets.`,
+                    path: ['zones', zoneIndex, 'gateway', 'rawEnvSecrets'],
+                });
+            }
+        }
         const openClawControlAuthSecretName = zone.gateway.type === 'openclaw' ? zone.gateway.controlAuth.secret : undefined;
         const openClawGatewayToken = openClawControlAuthSecretName
             ? zone.secrets[openClawControlAuthSecretName]
@@ -611,6 +863,41 @@ const systemConfigSchema = z
                 });
             }
         }
+        for (const [secretName, secret] of Object.entries(zone.secrets)) {
+            if (secret.injection !== 'http-mediation' ||
+                !targetsAudience(secret.audience, 'tool-vm') ||
+                !('agentAccess' in secret)) {
+                continue;
+            }
+            if (zone.gateway.type !== 'openclaw') {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `Worker zone '${zone.id}' secret '${secretName}' must not declare agentAccess because worker zones do not boot OpenClaw Tool VMs.`,
+                    path: ['zones', zoneIndex, 'secrets', secretName, 'agentAccess'],
+                });
+                continue;
+            }
+            if (zoneAgentIds.size === 0) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `OpenClaw zone '${zone.id}' secret '${secretName}' uses Tool VM agentAccess but zones[].agents is empty. Declare at least one zone agent so agentAccess can be evaluated.`,
+                    path: ['zones', zoneIndex, 'agents'],
+                });
+                continue;
+            }
+            if (Array.isArray(secret.agentAccess)) {
+                for (const [agentAccessIndex, agentId] of secret.agentAccess.entries()) {
+                    if (zoneAgentIds.has(agentId)) {
+                        continue;
+                    }
+                    context.addIssue({
+                        code: z.ZodIssueCode.custom,
+                        message: `Zone '${zone.id}' secret '${secretName}' agentAccess references unknown agent '${agentId}'.`,
+                        path: ['zones', zoneIndex, 'secrets', secretName, 'agentAccess', agentAccessIndex],
+                    });
+                }
+            }
+        }
         // Keep zone gateway type readable at the use site while image profiles
         // remain the source of boot-image details. This cross-check prevents
         // a worker lifecycle from accidentally booting an OpenClaw image, or
@@ -637,7 +924,6 @@ const systemConfigSchema = z
                 path: ['zones', zoneIndex, 'defaultToolVmProfile'],
             });
         }
-        const zoneAgents = zone.agents ?? [];
         if (zone.gateway.type !== 'openclaw' &&
             (zoneAgents.length > 0 || zone.mcpPortal !== undefined)) {
             context.addIssue({
@@ -772,7 +1058,7 @@ export const systemConfigSchemaId = 'agent-vm:system:1';
 export function createSystemConfigSchemaArtifact() {
     return {
         $id: systemConfigSchemaId,
-        ...z.toJSONSchema(systemConfigSchema, { target: 'draft-07' }),
+        ...z.toJSONSchema(systemConfigSchema, { io: 'input', target: 'draft-07' }),
     };
 }
 export function resolveControllerHealthConfig(config) {
@@ -788,10 +1074,23 @@ function pathsOverlap(firstPath, secondPath) {
         (!firstToSecond.startsWith('..') && !path.isAbsolute(firstToSecond)) ||
         (!secondToFirst.startsWith('..') && !path.isAbsolute(secondToFirst)));
 }
+function isManagedHostObservabilityConfig(observability) {
+    return observability?.enabled === true && observability.stack.mode === 'managed';
+}
 function assertResolvedRuntimePathIsolation(config) {
     if (pathsOverlap(config.runtimeDir, config.cacheDir)) {
         throw new Error('runtimeDir must not overlap cacheDir.');
     }
+    const observability = config.host.observability;
+    if (isManagedHostObservabilityConfig(observability)) {
+        const { dataDir } = observability;
+        if (pathsOverlap(dataDir, config.cacheDir)) {
+            throw new Error('observability dataDir must not overlap cacheDir.');
+        }
+        if (pathsOverlap(dataDir, config.runtimeDir)) {
+            throw new Error('observability dataDir must not overlap runtimeDir.');
+        }
+    }
     for (const zone of config.zones) {
         if (pathsOverlap(config.runtimeDir, zone.gateway.stateDir)) {
             throw new Error(`runtimeDir must not overlap stateDir for zone '${zone.id}'.`);
@@ -800,6 +1099,15 @@ function assertResolvedRuntimePathIsolation(config) {
             pathsOverlap(config.runtimeDir, zone.gateway.zoneFilesDir)) {
             throw new Error(`runtimeDir must not overlap zoneFilesDir for zone '${zone.id}'.`);
         }
+        if (isManagedHostObservabilityConfig(observability)) {
+            const { dataDir } = observability;
+            if (pathsOverlap(dataDir, zone.gateway.stateDir)) {
+                throw new Error(`observability dataDir must not overlap stateDir for zone '${zone.id}'.`);
+            }
+            if (zone.gateway.type === 'openclaw' && pathsOverlap(dataDir, zone.gateway.zoneFilesDir)) {
+                throw new Error(`observability dataDir must not overlap zoneFilesDir for zone '${zone.id}'.`);
+            }
+        }
     }
 }
 export function createLoadedSystemConfig(config, options) {
@@ -841,6 +1149,15 @@ function resolveRelativePaths(config, configDir) {
     };
     return {
         ...config,
+        host: isManagedHostObservabilityConfig(config.host.observability)
+            ? {
+                ...config.host,
+                observability: {
+                    ...config.host.observability,
+                    dataDir: resolvePath(config.host.observability.dataDir),
+                },
+            }
+            : config.host,
         cacheDir: resolvePath(config.cacheDir),
         runtimeDir: resolvePath(config.runtimeDir),
         imageProfiles: {