@alfe.ai/gateway 0.10.6 → 0.10.8

package/dist/health.js

@@ -1,242 +1,52 @@
-import { a as ErrorLineDetector, c as createLogger, f as parseOpenClawVersion, h as __require, i as CaptureThrottle, m as __commonJSMin, n as OPENCLAW_EXTERNAL_SUPERVISOR_ENV, o as STRICT_ERROR_CAPTURE_PROFILE, r as RuntimeProcess, s as toFingerprintKey, t as DRAIN_GRACE_MS } from "./runtime-process.js";
+import { C as resolveOpenClawUpgradeTarget, E as __require, S as parseOpenClawVersion, T as __commonJSMin, _ as createLogger, a as recoverInterruptedRuntimeUpgrade, d as OPENCLAW_EXTERNAL_SUPERVISOR_ENV, f as RuntimeProcess, g as toFingerprintKey, h as STRICT_ERROR_CAPTURE_PROFILE, i as detectUpgradeIsolation, m as ErrorLineDetector, o as startBootUpgradeRecovery, p as CaptureThrottle, r as defaultRuntimeUpgradeMarkerPath, u as DRAIN_GRACE_MS } from "./runtime-upgrade-recovery.js";
 import { a as captureFatal, d as flushSentry, f as initAgentSentry, h as logger, o as captureIntegrationFailure, p as setAgentContext, s as captureMcpFailure } from "./sentry.js";
 import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { ClaudeCodeApplier, ClaudeCodeMcpSync, HermesApplier, HermesMcpSync, IntegrationManager, IntegrationManagerAdapter, LockManager, McpApplier, NoopOpenClawCliLock, OpenClawApplier, SerialOpenClawCliLock } from "@alfe.ai/integrations";
+import { execFile, execSync } from "node:child_process";
+import { promisify } from "node:util";
 import { getEndpointFromToken, readConfig } from "@alfe.ai/config";
 import { AgentApiClient } from "@alfe.ai/agent-api-client";
 import { parse } from "smol-toml";
 import WebSocket from "ws";
-import { execFile, execSync } from "node:child_process";
-import { promisify } from "node:util";
-import { ClaudeCodeApplier, ClaudeCodeMcpSync, HermesApplier, HermesMcpSync, IntegrationManager, IntegrationManagerAdapter, McpApplier, NoopOpenClawCliLock, OpenClawApplier, SerialOpenClawCliLock } from "@alfe.ai/integrations";
+import { createHash, randomUUID } from "node:crypto";
 import { Manager, McpBundler, defaultConnect, serverLaunchFingerprint } from "@alfe.ai/mcp-bundler";
 import { createConnection, createServer } from "node:net";
 import { pathToFileURL } from "node:url";
-import { randomUUID } from "node:crypto";
-//#region src/claude-code-host-version.ts
+//#region src/openclaw-plugin-ownership.ts
 /**
-* The `@alfe.ai/claude-code-host` version Alfe pins the claude-code runtime to —
-* the single source of truth for its install paths:
-*   - `@alfe.ai/cli` `installClaudeCodeHost` (fresh `alfe setup`)
-*   - the daemon `runtime.update` default (this package)
-*
-* Pinning (rather than floating `npm install -g @alfe.ai/claude-code-host` →
-* `latest`) is deliberate: the host is the claude-code runtime child on every
-* self-hosted claude-code agent, so a bad `latest` publish would auto-reach
-* every new `alfe setup` with no CLI gate. Bump deliberately after validating a
-* new host, then cut a CLI release so the pin travels with the CLI version. The
-* dashboard still surfaces npm-`latest` as an explicit opt-in upgrade.
+* Runtime-lock plugin ownership for the OpenClaw upgrade preflight.
 *
-* NOTE: claude-code is self-hosted-only (no managed Docker image), so — unlike
-* `PINNED_OPENCLAW_VERSION` — there is no `services/compute/Dockerfile` mirror to
-* keep in sync.
+* `~/.alfe/runtime-lock.json` (the integrations package's `LockManager`) records
+* which integration contributed each OpenClaw plugin. A plugin that is not in
+* it is owned by nothing the daemon manages. The upgrade only ever acts on such
+* a plugin when it is ALSO an `@alfe.ai/*` package and definitively
+* activate-only (see openclaw-plugin-compat.ts). A missing lock file or one
+* with no OpenClaw rows is "ownership unknown" (block, never sweep). The
+* residual risk is a lock that lists SOME plugins but dropped a row for one
+* still in use; that plugin is activate-only, so it would fail to load on the
+* target runtime anyway (`alfe remove` scope rule: only Alfe artifacts).
 */
-const PINNED_CLAUDE_CODE_HOST_VERSION = "0.1.6";
-//#endregion
-//#region ../../packages-internal/ids/dist/prefixes.js
-const ID_PREFIXES = {
-	agent: "agt",
-	organization: "org",
-	person: "per",
-	auditEvent: "evt",
-	token: "tok",
-	transaction: "txn",
-	subscription: "sub",
-	conversation: "conv",
-	referral: "ref",
-	promoCode: "prc",
-	promoRedemption: "prr",
-	pendingPromo: "pdp",
-	remoteSession: "rms",
-	webhook: "whk",
-	webhookDelivery: "wdl",
-	onboardingSession: "obs",
-	inviteToken: "inv",
-	claimToken: "clm",
-	usageLimit: "lim",
-	team: "team",
-	project: "proj",
-	goal: "goal",
-	memory: "mem",
-	knowledgeTriple: "kgt",
-	accessCode: "acc",
-	pendingInject: "pij",
-	identity: "idn",
-	identityNote: "ino",
-	identityTag: "itg",
-	identityAlias: "ial",
-	identityVerification: "ivf",
-	role: "role",
-	directGrant: "dgr",
-	revision: "rev",
-	fact: "kfc",
-	changeRequest: "chr",
-	oauthConnection: "con",
-	channel: "chn",
-	oauthConnectionRequest: "crq",
-	deviceCode: "dvc",
-	attachment: "att",
-	run: "run",
-	request: "req",
-	connection: "conn",
-	correlation: "cor",
-	command: "cmd",
-	message: "msg",
-	ipcRequest: "ipc",
-	pluginConnection: "plg"
-};
-//#endregion
-//#region ../../packages-internal/ids/dist/create.js
-var import_index_umd = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
-	(function(global, factory) {
-		typeof exports === "object" && typeof module !== "undefined" ? factory(exports) : typeof define === "function" && define.amd ? define(["exports"], factory) : (global = typeof globalThis !== "undefined" ? globalThis : global || self, factory(global.ULID = {}));
-	})(exports, (function(exports$1) {
-		"use strict";
-		function createError(message) {
-			const err = new Error(message);
-			err.source = "ulid";
-			return err;
-		}
-		const ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-		const ENCODING_LEN = 32;
-		const TIME_MAX = Math.pow(2, 48) - 1;
-		const TIME_LEN = 10;
-		const RANDOM_LEN = 16;
-		function replaceCharAt(str, index, char) {
-			if (index > str.length - 1) return str;
-			return str.substr(0, index) + char + str.substr(index + 1);
-		}
-		function incrementBase32(str) {
-			let done = void 0;
-			let index = str.length;
-			let char;
-			let charIndex;
-			const maxCharIndex = ENCODING_LEN - 1;
-			while (!done && index-- >= 0) {
-				char = str[index];
-				charIndex = ENCODING.indexOf(char);
-				if (charIndex === -1) throw createError("incorrectly encoded string");
-				if (charIndex === maxCharIndex) {
-					str = replaceCharAt(str, index, ENCODING[0]);
-					continue;
-				}
-				done = replaceCharAt(str, index, ENCODING[charIndex + 1]);
-			}
-			if (typeof done === "string") return done;
-			throw createError("cannot increment this string");
-		}
-		function randomChar(prng) {
-			let rand = Math.floor(prng() * ENCODING_LEN);
-			if (rand === ENCODING_LEN) rand = ENCODING_LEN - 1;
-			return ENCODING.charAt(rand);
-		}
-		function encodeTime(now, len) {
-			if (isNaN(now)) throw new Error(now + " must be a number");
-			if (now > TIME_MAX) throw createError("cannot encode time greater than " + TIME_MAX);
-			if (now < 0) throw createError("time must be positive");
-			if (Number.isInteger(Number(now)) === false) throw createError("time must be an integer");
-			let mod;
-			let str = "";
-			for (; len > 0; len--) {
-				mod = now % ENCODING_LEN;
-				str = ENCODING.charAt(mod) + str;
-				now = (now - mod) / ENCODING_LEN;
-			}
-			return str;
-		}
-		function encodeRandom(len, prng) {
-			let str = "";
-			for (; len > 0; len--) str = randomChar(prng) + str;
-			return str;
-		}
-		function decodeTime(id) {
-			if (id.length !== TIME_LEN + RANDOM_LEN) throw createError("malformed ulid");
-			var time = id.substr(0, TIME_LEN).split("").reverse().reduce((carry, char, index) => {
-				const encodingIndex = ENCODING.indexOf(char);
-				if (encodingIndex === -1) throw createError("invalid character found: " + char);
-				return carry += encodingIndex * Math.pow(ENCODING_LEN, index);
-			}, 0);
-			if (time > TIME_MAX) throw createError("malformed ulid, timestamp too large");
-			return time;
-		}
-		function detectPrng(allowInsecure = false, root) {
-			if (!root) root = typeof window !== "undefined" ? window : null;
-			const browserCrypto = root && (root.crypto || root.msCrypto);
-			if (browserCrypto) return () => {
-				const buffer = new Uint8Array(1);
-				browserCrypto.getRandomValues(buffer);
-				return buffer[0] / 255;
-			};
-			else try {
-				const nodeCrypto = __require("crypto");
-				return () => nodeCrypto.randomBytes(1).readUInt8() / 255;
-			} catch (e) {}
-			if (allowInsecure) {
-				try {
-					console.error("secure crypto unusable, falling back to insecure Math.random()!");
-				} catch (e) {}
-				return () => Math.random();
-			}
-			throw createError("secure crypto unusable, insecure Math.random not allowed");
-		}
-		function factory(currPrng) {
-			if (!currPrng) currPrng = detectPrng();
-			return function ulid(seedTime) {
-				if (isNaN(seedTime)) seedTime = Date.now();
-				return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN, currPrng);
-			};
-		}
-		function monotonicFactory(currPrng) {
-			if (!currPrng) currPrng = detectPrng();
-			let lastTime = 0;
-			let lastRandom;
-			return function ulid(seedTime) {
-				if (isNaN(seedTime)) seedTime = Date.now();
-				if (seedTime <= lastTime) {
-					const incrementedRandom = lastRandom = incrementBase32(lastRandom);
-					return encodeTime(lastTime, TIME_LEN) + incrementedRandom;
-				}
-				lastTime = seedTime;
-				const newRandom = lastRandom = encodeRandom(RANDOM_LEN, currPrng);
-				return encodeTime(seedTime, TIME_LEN) + newRandom;
-			};
-		}
-		const ulid = factory();
-		exports$1.decodeTime = decodeTime;
-		exports$1.detectPrng = detectPrng;
-		exports$1.encodeRandom = encodeRandom;
-		exports$1.encodeTime = encodeTime;
-		exports$1.factory = factory;
-		exports$1.incrementBase32 = incrementBase32;
-		exports$1.monotonicFactory = monotonicFactory;
-		exports$1.randomChar = randomChar;
-		exports$1.replaceCharAt = replaceCharAt;
-		exports$1.ulid = ulid;
-	}));
-})))();
-function createId(prefix) {
-	return `${prefix}_${(0, import_index_umd.ulid)()}`;
+/** Bare npm package name from a manifest plugin spec (`@scope/name@1.2.3` → `@scope/name`). */
+function barePluginPackage(spec) {
+	const at = spec.lastIndexOf("@");
+	return at <= 0 ? spec : spec.slice(0, at);
 }
-function correlationId() {
-	return createId(ID_PREFIXES.correlation);
-}
-function pluginConnectionId() {
-	return createId(ID_PREFIXES.pluginConnection);
-}
-//#endregion
-//#region ../../packages-internal/types/dist/lib/enum-values.js
-/**
-* Converts a const enum object into a non-empty readonly tuple.
-*
-* Satisfies both `z.enum()` and ElectroDB `type` field requirements
-* (both need `readonly [string, ...string[]]`).
-*/
-function enumValues(obj) {
-	const values = Object.values(obj);
-	if (values.length === 0) throw new TypeError("enumValues requires at least one value");
-	return values;
+const DEFAULT_LOCK_PATH = join(homedir(), ".alfe", "runtime-lock.json");
+function buildOpenClawPluginOwnership(applier, lockPath = DEFAULT_LOCK_PATH, lock = new LockManager(lockPath)) {
+	return {
+		ownedPlugins() {
+			if (!existsSync(lockPath)) throw new Error(`runtime lock ${lockPath} does not exist`);
+			const plugins = lock.read().runtimes.openclaw?.plugins ?? [];
+			if (plugins.length === 0) throw new Error("runtime lock records no OpenClaw plugin owners");
+			const owned = /* @__PURE__ */ new Map();
+			for (const entry of plugins) owned.set(barePluginPackage(entry.package), entry.sourceIntegration);
+			return owned;
+		},
+		removePlugin: (pkg) => applier.removePlugin(pkg)
+	};
 }
 Object.freeze({ status: "aborted" });
 function $constructor(name, initializer, params) {
@@ -758,7 +568,7 @@ const _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
 //#region ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/regexes.js
 const cuid = /^[cC][^\s-]{8,}$/;
 const cuid2 = /^[0-9a-z]+$/;
-const ulid = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
+const ulid$1 = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
 const xid = /^[0-9a-vA-V]{20}$/;
 const ksuid = /^[A-Za-z0-9]{27}$/;
 const nanoid = /^[a-zA-Z0-9_-]{21}$/;
@@ -1405,7 +1215,7 @@ const $ZodCUID2 = /* @__PURE__ */ $constructor("$ZodCUID2", (inst, def) => {
 	$ZodStringFormat.init(inst, def);
 });
 const $ZodULID = /* @__PURE__ */ $constructor("$ZodULID", (inst, def) => {
-	def.pattern ?? (def.pattern = ulid);
+	def.pattern ?? (def.pattern = ulid$1);
 	$ZodStringFormat.init(inst, def);
 });
 const $ZodXID = /* @__PURE__ */ $constructor("$ZodXID", (inst, def) => {
@@ -3920,6 +3730,230 @@ function superRefine(fn) {
 	return /* @__PURE__ */ _superRefine(fn);
 }
 //#endregion
+//#region src/claude-code-host-version.ts
+/**
+* The `@alfe.ai/claude-code-host` version Alfe pins the claude-code runtime to —
+* the single source of truth for its install paths:
+*   - `@alfe.ai/cli` `installClaudeCodeHost` (fresh `alfe setup`)
+*   - the daemon `runtime.update` default (this package)
+*
+* Pinning (rather than floating `npm install -g @alfe.ai/claude-code-host` →
+* `latest`) is deliberate: the host is the claude-code runtime child on every
+* self-hosted claude-code agent, so a bad `latest` publish would auto-reach
+* every new `alfe setup` with no CLI gate. Bump deliberately after validating a
+* new host, then cut a CLI release so the pin travels with the CLI version. The
+* dashboard still surfaces npm-`latest` as an explicit opt-in upgrade.
+*
+* NOTE: claude-code is self-hosted-only (no managed Docker image), so — unlike
+* `PINNED_OPENCLAW_VERSION` — there is no `services/compute/Dockerfile` mirror to
+* keep in sync.
+*/
+const PINNED_CLAUDE_CODE_HOST_VERSION = "0.1.6";
+//#endregion
+//#region ../../packages-internal/ids/dist/prefixes.js
+const ID_PREFIXES = {
+	agent: "agt",
+	organization: "org",
+	person: "per",
+	auditEvent: "evt",
+	token: "tok",
+	transaction: "txn",
+	subscription: "sub",
+	conversation: "conv",
+	referral: "ref",
+	promoCode: "prc",
+	promoRedemption: "prr",
+	pendingPromo: "pdp",
+	remoteSession: "rms",
+	webhook: "whk",
+	webhookDelivery: "wdl",
+	onboardingSession: "obs",
+	inviteToken: "inv",
+	claimToken: "clm",
+	usageLimit: "lim",
+	team: "team",
+	project: "proj",
+	goal: "goal",
+	memory: "mem",
+	knowledgeTriple: "kgt",
+	accessCode: "acc",
+	pendingInject: "pij",
+	identity: "idn",
+	identityNote: "ino",
+	identityTag: "itg",
+	identityAlias: "ial",
+	identityVerification: "ivf",
+	role: "role",
+	directGrant: "dgr",
+	revision: "rev",
+	fact: "kfc",
+	changeRequest: "chr",
+	oauthConnection: "con",
+	channel: "chn",
+	oauthConnectionRequest: "crq",
+	deviceCode: "dvc",
+	attachment: "att",
+	run: "run",
+	request: "req",
+	connection: "conn",
+	correlation: "cor",
+	command: "cmd",
+	message: "msg",
+	ipcRequest: "ipc",
+	pluginConnection: "plg"
+};
+//#endregion
+//#region ../../packages-internal/ids/dist/create.js
+var import_index_umd = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	(function(global, factory) {
+		typeof exports === "object" && typeof module !== "undefined" ? factory(exports) : typeof define === "function" && define.amd ? define(["exports"], factory) : (global = typeof globalThis !== "undefined" ? globalThis : global || self, factory(global.ULID = {}));
+	})(exports, (function(exports$1) {
+		"use strict";
+		function createError(message) {
+			const err = new Error(message);
+			err.source = "ulid";
+			return err;
+		}
+		const ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+		const ENCODING_LEN = 32;
+		const TIME_MAX = Math.pow(2, 48) - 1;
+		const TIME_LEN = 10;
+		const RANDOM_LEN = 16;
+		function replaceCharAt(str, index, char) {
+			if (index > str.length - 1) return str;
+			return str.substr(0, index) + char + str.substr(index + 1);
+		}
+		function incrementBase32(str) {
+			let done = void 0;
+			let index = str.length;
+			let char;
+			let charIndex;
+			const maxCharIndex = ENCODING_LEN - 1;
+			while (!done && index-- >= 0) {
+				char = str[index];
+				charIndex = ENCODING.indexOf(char);
+				if (charIndex === -1) throw createError("incorrectly encoded string");
+				if (charIndex === maxCharIndex) {
+					str = replaceCharAt(str, index, ENCODING[0]);
+					continue;
+				}
+				done = replaceCharAt(str, index, ENCODING[charIndex + 1]);
+			}
+			if (typeof done === "string") return done;
+			throw createError("cannot increment this string");
+		}
+		function randomChar(prng) {
+			let rand = Math.floor(prng() * ENCODING_LEN);
+			if (rand === ENCODING_LEN) rand = ENCODING_LEN - 1;
+			return ENCODING.charAt(rand);
+		}
+		function encodeTime(now, len) {
+			if (isNaN(now)) throw new Error(now + " must be a number");
+			if (now > TIME_MAX) throw createError("cannot encode time greater than " + TIME_MAX);
+			if (now < 0) throw createError("time must be positive");
+			if (Number.isInteger(Number(now)) === false) throw createError("time must be an integer");
+			let mod;
+			let str = "";
+			for (; len > 0; len--) {
+				mod = now % ENCODING_LEN;
+				str = ENCODING.charAt(mod) + str;
+				now = (now - mod) / ENCODING_LEN;
+			}
+			return str;
+		}
+		function encodeRandom(len, prng) {
+			let str = "";
+			for (; len > 0; len--) str = randomChar(prng) + str;
+			return str;
+		}
+		function decodeTime(id) {
+			if (id.length !== TIME_LEN + RANDOM_LEN) throw createError("malformed ulid");
+			var time = id.substr(0, TIME_LEN).split("").reverse().reduce((carry, char, index) => {
+				const encodingIndex = ENCODING.indexOf(char);
+				if (encodingIndex === -1) throw createError("invalid character found: " + char);
+				return carry += encodingIndex * Math.pow(ENCODING_LEN, index);
+			}, 0);
+			if (time > TIME_MAX) throw createError("malformed ulid, timestamp too large");
+			return time;
+		}
+		function detectPrng(allowInsecure = false, root) {
+			if (!root) root = typeof window !== "undefined" ? window : null;
+			const browserCrypto = root && (root.crypto || root.msCrypto);
+			if (browserCrypto) return () => {
+				const buffer = new Uint8Array(1);
+				browserCrypto.getRandomValues(buffer);
+				return buffer[0] / 255;
+			};
+			else try {
+				const nodeCrypto = __require("crypto");
+				return () => nodeCrypto.randomBytes(1).readUInt8() / 255;
+			} catch (e) {}
+			if (allowInsecure) {
+				try {
+					console.error("secure crypto unusable, falling back to insecure Math.random()!");
+				} catch (e) {}
+				return () => Math.random();
+			}
+			throw createError("secure crypto unusable, insecure Math.random not allowed");
+		}
+		function factory(currPrng) {
+			if (!currPrng) currPrng = detectPrng();
+			return function ulid(seedTime) {
+				if (isNaN(seedTime)) seedTime = Date.now();
+				return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN, currPrng);
+			};
+		}
+		function monotonicFactory(currPrng) {
+			if (!currPrng) currPrng = detectPrng();
+			let lastTime = 0;
+			let lastRandom;
+			return function ulid(seedTime) {
+				if (isNaN(seedTime)) seedTime = Date.now();
+				if (seedTime <= lastTime) {
+					const incrementedRandom = lastRandom = incrementBase32(lastRandom);
+					return encodeTime(lastTime, TIME_LEN) + incrementedRandom;
+				}
+				lastTime = seedTime;
+				const newRandom = lastRandom = encodeRandom(RANDOM_LEN, currPrng);
+				return encodeTime(seedTime, TIME_LEN) + newRandom;
+			};
+		}
+		const ulid = factory();
+		exports$1.decodeTime = decodeTime;
+		exports$1.detectPrng = detectPrng;
+		exports$1.encodeRandom = encodeRandom;
+		exports$1.encodeTime = encodeTime;
+		exports$1.factory = factory;
+		exports$1.incrementBase32 = incrementBase32;
+		exports$1.monotonicFactory = monotonicFactory;
+		exports$1.randomChar = randomChar;
+		exports$1.replaceCharAt = replaceCharAt;
+		exports$1.ulid = ulid;
+	}));
+})))();
+function createId(prefix) {
+	return `${prefix}_${(0, import_index_umd.ulid)()}`;
+}
+function correlationId() {
+	return createId(ID_PREFIXES.correlation);
+}
+function pluginConnectionId() {
+	return createId(ID_PREFIXES.pluginConnection);
+}
+//#endregion
+//#region ../../packages-internal/types/dist/lib/enum-values.js
+/**
+* Converts a const enum object into a non-empty readonly tuple.
+*
+* Satisfies both `z.enum()` and ElectroDB `type` field requirements
+* (both need `readonly [string, ...string[]]`).
+*/
+function enumValues(obj) {
+	const values = Object.values(obj);
+	if (values.length === 0) throw new TypeError("enumValues requires at least one value");
+	return values;
+}
+//#endregion
 //#region ../../packages-internal/types/dist/lib/usd.js
 function isWholeUsdCentAmount(amountUsd) {
 	const roundedCents = Math.round(amountUsd * 100);
@@ -4885,7 +4919,33 @@ var AlfeApiClient = class {
 	}
 };
 //#endregion
+//#region ../../packages-internal/api-client/dist/services/billing.js
+/** Sizes every deployed billing API returns. */
+const BASE_MANAGED_AGENT_SIZES = [
+	"small",
+	"medium",
+	"large"
+];
+/**
+* Fill `agentAddonSizesCovered` for an API that predates it. Such an API
+* predates xl too, so the all-sizes flag meant the sizes that existed then;
+* xl stays uncovered (an undiscounted price is the safe display).
+*/
+function normalizeSubscriptionDiscount(wire) {
+	return {
+		...wire,
+		agentAddonSizesCovered: wire.agentAddonSizesCovered ?? (wire.appliesToAgentAddons ? [...BASE_MANAGED_AGENT_SIZES] : [])
+	};
+}
+//#endregion
 //#region ../../packages-internal/api-client/dist/services/auth.js
+function normalizePlatformSubscriptionStatus(wire) {
+	const { discount, ...rest } = wire;
+	return discount ? {
+		...rest,
+		discount: normalizeSubscriptionDiscount(discount)
+	} : rest;
+}
 var AuthService = class {
 	client;
 	constructor(client) {
@@ -5040,7 +5100,10 @@ var AuthService = class {
 		});
 	}
 	getSubscriptionStatus() {
-		return this.client.request(`${this.prefix}/subscription`);
+		return this.client.request(`${this.prefix}/subscription`).then((r) => r.ok ? {
+			...r,
+			data: normalizePlatformSubscriptionStatus(r.data)
+		} : r);
 	}
 	/**
 	* Mint a short-lived, single-use Clerk sign-in token for the calling user so
@@ -5868,6 +5931,13 @@ const log$6 = logger.child({ component: "RuntimeGate" });
 var RuntimeGate = class {
 	depth = 0;
 	wasRunning = false;
+	/**
+	* True once the OUTERMOST `enter()` has finished stopping the runtime child
+	* (its `stopWhenIdle()` resolved, i.e. the process exited), until the gate
+	* fully reopens. `depth > 0` alone is not enough: depth is bumped before the
+	* stop is awaited, so it is already set while the old child is draining.
+	*/
+	stopSettled = false;
 	exclusive = false;
 	/** Brackets parked behind an exclusive hold (or an exclusive request parked behind open brackets). */
 	waiters = [];
@@ -5882,6 +5952,14 @@ var RuntimeGate = class {
 	get isSuspended() {
 		return this.depth > 0;
 	}
+	/**
+	* Whether the runtime child is PROVABLY down right now: a bracket is open and
+	* its stop has completed. The OpenClaw applier's one direct openclaw.json
+	* write (the dangling channel-ref repair) is allow-listed on this.
+	*/
+	get isRuntimeStopped() {
+		return this.depth > 0 && this.stopSettled;
+	}
 	/** True while an exclusive bracket is open. */
 	get isExclusive() {
 		return this.exclusive;
@@ -5934,12 +6012,14 @@ var RuntimeGate = class {
 	}
 	async enter() {
 		if (this.depth++ > 0) return;
+		this.stopSettled = false;
 		const rp = this.getRuntime();
 		this.wasRunning = rp?.isActive ?? false;
 		if (rp && this.wasRunning) {
 			log$6.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
 			await rp.stopWhenIdle();
 		}
+		if (this.depth > 0) this.stopSettled = true;
 	}
 	/**
 	* Resume the runtime child. Only the outermost call (depth 1 → 0) actually
@@ -5956,6 +6036,7 @@ var RuntimeGate = class {
 			rp.resume();
 		}
 		this.wasRunning = false;
+		this.stopSettled = false;
 		if (this.exclusive) this.exclusive = false;
 		this.wakeWaiters();
 		return Promise.resolve();
@@ -6027,6 +6108,22 @@ var NoopRuntimeGate = class {
 };
 //#endregion
 //#region src/reconciliation.ts
+/**
+* ReconciliationEngine — converges local integration state toward cloud desired state.
+*
+* Takes: desired integrations from cloud + reference to the local integration manager.
+* Produces: a ReconciliationReport of actions taken and resulting actual statuses.
+*
+* For each desired integration with desiredStatus="active":
+*   1. Check if installed at correct version (from ~/.alfe/integrations.json)
+*   2. If not installed or wrong version: call integrationManager.install()
+*   3. If installed but not active: call integrationManager.activate()
+*
+* For each locally installed integration NOT in desired list (or desiredStatus="removed"):
+*   1. Call integrationManager.deactivate() then integrationManager.uninstall()
+*
+* Returns ReconciliationReport with results for each integration processed.
+*/
 const log$5 = logger.child({ component: "Reconciliation" });
 /**
 * How many times reconcile will re-attempt activation of an intact integration
@@ -6055,6 +6152,25 @@ var ReconciliationEngine = class {
 	*/
 	heldSuspension = false;
 	/**
+	* Most recent per-attempt re-activation error per integration. Becomes the
+	* error signature of the "re-activation attempts exhausted" report, so the
+	* terminal event says WHY the integration is stuck.
+	*/
+	lastReactivateError = /* @__PURE__ */ new Map();
+	/**
+	* Sentry dedupe for reconcile outcomes that RECUR on every DESIRED_STATE
+	* push once a budget is spent (re-activation exhausted, auto-reinstall
+	* blocked) or that repeat identically across attempts. Keyed on
+	* integration + phase + error signature, for one stuck EPISODE: the keys
+	* are cleared by {@link resetSelfHealBudget} whenever the retry budget
+	* resets (reinstall, upgrade, successful activation, healthy pass), so a
+	* manual reinstall that fails with the same error reports again. The engine
+	* lives as long as the daemon process (owned by `CloudClient`). Without it
+	* a single stuck integration produced one event per push (51 for one agent).
+	* Logs and the cloud-facing report are NOT deduped, only the Sentry capture.
+	*/
+	reportedFailures = /* @__PURE__ */ new Set();
+	/**
 	* @param manager The integration manager to converge.
 	* @param gate    Runtime gate used to suspend the runtime child around
 	*                mutating branches so `openclaw` CLI subprocesses don't write
@@ -6067,6 +6183,29 @@ var ReconciliationEngine = class {
 		this.gate = gate;
 	}
 	/**
+	* Capture an integration failure to Sentry at most once per
+	* `(integration, phase, signature)` within the current stuck episode. A new
+	* signature (a different underlying error) reports again.
+	*/
+	captureFailureOnce(integrationId, phase, signature, cause, fingerprint) {
+		const key = `${integrationId}\u0000${phase}\u0000${createHash("sha256").update(signature).digest("hex")}`;
+		if (this.reportedFailures.has(key)) return;
+		this.reportedFailures.add(key);
+		if (fingerprint) captureIntegrationFailure(integrationId, phase, cause, { fingerprint });
+		else captureIntegrationFailure(integrationId, phase, cause);
+	}
+	/**
+	* Start a fresh self-heal episode for an integration: a new re-activation
+	* budget, and a cleared Sentry dedupe so a repeat of the same failure in the
+	* new episode is reported again.
+	*/
+	resetSelfHealBudget(integrationId) {
+		this.activateAttempts.delete(integrationId);
+		this.lastReactivateError.delete(integrationId);
+		const prefix = `${integrationId}\u0000`;
+		for (const key of this.reportedFailures) if (key.startsWith(prefix)) this.reportedFailures.delete(key);
+	}
+	/**
 	* Suspend the runtime on the first mutating branch of a reconcile pass.
 	* Idempotent within a pass — subsequent mutating branches are covered by the
 	* single suspend held until the `finally` in {@link reconcile}.
@@ -6182,6 +6321,7 @@ var ReconciliationEngine = class {
 		try {
 			if (!local) {
 				await this.ensureSuspended();
+				this.resetSelfHealBudget(id);
 				log$5.info(`Installing ${id}@${desired.version}`);
 				await this.manager.install(id, desired.version, desired.config, desired.customSource);
 				report.installed.push(id);
@@ -6200,7 +6340,7 @@ var ReconciliationEngine = class {
 					await this.ensureSuspended();
 					log$5.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
 					this.manager.resetReinstallAttempts(id);
-					this.activateAttempts.delete(id);
+					this.resetSelfHealBudget(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
 					report.installed.push(id);
 					report.activated.push(id);
@@ -6215,7 +6355,7 @@ var ReconciliationEngine = class {
 				try {
 					if ((await this.manager.upgrade(id, desired.version, desired.config, desired.customSource, { onBeforeRuntimeMutation: () => this.ensureSuspended() })).configApplied) report.configApplied = true;
 					this.manager.resetReinstallAttempts(id);
-					this.activateAttempts.delete(id);
+					this.resetSelfHealBudget(id);
 					report.installed.push(id);
 					report.activated.push(id);
 					report.results.push({
@@ -6245,7 +6385,7 @@ var ReconciliationEngine = class {
 					await this.ensureSuspended();
 					log$5.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
-					this.activateAttempts.delete(id);
+					this.resetSelfHealBudget(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
 					report.installed.push(id);
 					report.activated.push(id);
@@ -6260,7 +6400,8 @@ var ReconciliationEngine = class {
 					const attempts = this.manager.getReinstallAttempts(id);
 					if (attempts >= 3) {
 						log$5.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
-						captureIntegrationFailure(id, "reinstall", `Max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`);
+						const blockedMessage = `Max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`;
+						this.captureFailureOnce(id, "reinstall", `blocked:${blockedMessage}`, blockedMessage);
 						report.errors.push({
 							integrationId: id,
 							error: `Max auto-reinstall attempts (${String(attempts)}) reached`
@@ -6279,7 +6420,7 @@ var ReconciliationEngine = class {
 					try {
 						if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
 						this.manager.resetReinstallAttempts(id);
-						this.activateAttempts.delete(id);
+						this.resetSelfHealBudget(id);
 						report.installed.push(id);
 						report.activated.push(id);
 						report.results.push({
@@ -6311,7 +6452,7 @@ var ReconciliationEngine = class {
 					log$5.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
 					try {
 						if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
-						this.activateAttempts.delete(id);
+						this.resetSelfHealBudget(id);
 						report.activated.push(id);
 						report.results.push({
 							integrationId: id,
@@ -6322,7 +6463,8 @@ var ReconciliationEngine = class {
 					} catch (reactivateErr) {
 						const reactivateMsg = reactivateErr instanceof Error ? reactivateErr.message : String(reactivateErr);
 						log$5.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
-						captureIntegrationFailure(id, "reactivate", reactivateErr);
+						this.lastReactivateError.set(id, reactivateMsg);
+						this.captureFailureOnce(id, "reactivate", `attempt:${reactivateMsg}`, reactivateErr);
 						report.errors.push({
 							integrationId: id,
 							error: reactivateMsg
@@ -6337,7 +6479,8 @@ var ReconciliationEngine = class {
 					}
 				}
 				log$5.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
-				captureIntegrationFailure(id, "reactivate", `Integration ${id} stuck in error state — re-activation attempts exhausted`);
+				const lastReactivateError = this.lastReactivateError.get(id);
+				this.captureFailureOnce(id, "reactivate", `exhausted:${lastReactivateError ?? ""}`, `Integration ${id} stuck in error state — re-activation attempts exhausted${lastReactivateError ? ` (last error: ${lastReactivateError})` : ""}`, ["integration-reactivate-exhausted", id]);
 				report.errors.push({
 					integrationId: id,
 					error: "Integration is in error state"
@@ -6355,7 +6498,7 @@ var ReconciliationEngine = class {
 					await this.ensureSuspended();
 					log$5.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
-					this.activateAttempts.delete(id);
+					this.resetSelfHealBudget(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
 					report.installed.push(id);
 					report.activated.push(id);
@@ -6370,7 +6513,7 @@ var ReconciliationEngine = class {
 				if (attempts >= 3) {
 					const errorMessage = `Stale installing state — max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`;
 					log$5.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
-					captureIntegrationFailure(id, "reinstall", errorMessage);
+					this.captureFailureOnce(id, "reinstall", `blocked:${errorMessage}`, errorMessage);
 					report.errors.push({
 						integrationId: id,
 						error: `Max auto-reinstall attempts (${String(attempts)}) reached`
@@ -6389,7 +6532,7 @@ var ReconciliationEngine = class {
 				try {
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
 					this.manager.resetReinstallAttempts(id);
-					this.activateAttempts.delete(id);
+					this.resetSelfHealBudget(id);
 					report.installed.push(id);
 					report.activated.push(id);
 					report.results.push({
@@ -6418,6 +6561,7 @@ var ReconciliationEngine = class {
 				await this.ensureSuspended();
 				log$5.info(`Activating ${id}`);
 				if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
+				this.resetSelfHealBudget(id);
 				report.activated.push(id);
 				report.results.push({
 					integrationId: id,
@@ -6430,7 +6574,7 @@ var ReconciliationEngine = class {
 				await this.ensureSuspended();
 				log$5.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 				this.manager.resetReinstallAttempts(id);
-				this.activateAttempts.delete(id);
+				this.resetSelfHealBudget(id);
 				if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
 				report.installed.push(id);
 				report.activated.push(id);
@@ -6441,7 +6585,7 @@ var ReconciliationEngine = class {
 				});
 				return;
 			}
-			this.activateAttempts.delete(id);
+			this.resetSelfHealBudget(id);
 			report.results.push({
 				integrationId: id,
 				action: "up_to_date",
@@ -6480,6 +6624,7 @@ var ReconciliationEngine = class {
 				report.deactivated.push(id);
 			}
 			await this.manager.uninstall(id);
+			this.resetSelfHealBudget(id);
 			report.uninstalled.push(id);
 			report.results.push({
 				integrationId: id,
@@ -9885,6 +10030,45 @@ let runtimeGateRef = null;
 let firstRuntimeStart = null;
 const LEGACY_CONFIG_SET_KEYS = new Set(["agents.defaults.model"]);
 const MAX_LEGACY_CONFIG_VALUE_LENGTH = 16 * 1024;
+/** Daemon-only `upgradeRuntime` options for OpenClaw (see runtime-upgrade.ts). */
+function openClawUpgradeExtras() {
+	const applier = runtimeAppliersRef?.get("openclaw");
+	const isolation = detectUpgradeIsolation();
+	return {
+		markerPath: defaultRuntimeUpgradeMarkerPath(),
+		...applier ? { pluginOwnership: buildOpenClawPluginOwnership(applier) } : {},
+		...isolation ? { isolation } : {}
+	};
+}
+/**
+* Boot-time repair of an interrupted OpenClaw upgrade (see
+* `startBootUpgradeRecovery`). Must be called BEFORE the runtime's first
+* `requestStart()`.
+*/
+function recoverInterruptedOpenClawUpgrade(gate, cliLock) {
+	const recovery = startBootUpgradeRecovery({
+		gate,
+		cliLock,
+		markerPath: defaultRuntimeUpgradeMarkerPath(),
+		recover: (markerPath) => {
+			const isolation = detectUpgradeIsolation();
+			return recoverInterruptedRuntimeUpgrade({
+				markerPath,
+				...isolation ? { isolation } : {}
+			});
+		},
+		onRecovered: (version) => {
+			if (version === resolvedRuntimeVersion) return;
+			resolvedRuntimeVersion = version;
+			cloudClient.updateRuntimeVersionAndReRegister(version);
+		}
+	});
+	if (!recovery) return;
+	upgradingRuntime = true;
+	recovery.finally(() => {
+		upgradingRuntime = false;
+	});
+}
 async function startDaemon() {
 	startedAt = Date.now();
 	const managed = isManagedMode();
@@ -9981,7 +10165,8 @@ async function startDaemon() {
 		runtimeAppliers.set(name, new OpenClawApplier({
 			home: runtimeCfg.workspace,
 			agentWorkspace: runtimeCfg.agentWorkspace,
-			cliLock: openclawCliLock
+			cliLock: openclawCliLock,
+			isRuntimeStopped: () => name === config.runtime && runtimeGateRef instanceof RuntimeGate && runtimeGateRef.isRuntimeStopped && runtimeProcess !== null && !runtimeProcess.isActive
 		}));
 		logger.info({
 			runtime: name,
@@ -10123,6 +10308,7 @@ async function startDaemon() {
 			});
 		}
 	}
+	if (config.autoStartRuntime && config.runtime === "openclaw") recoverInterruptedOpenClawUpgrade(runtimeGate, openclawCliLock);
 	cloudClient.start();
 	logger.debug("Cloud client started");
 	if (!config.autoStartRuntime && config.runtime) logger.warn({ runtime: config.runtime }, "Runtime configured but auto_start_runtime=false — runtime will not be spawned; in-runtime plugins (chat/console/sync) will be offline until you start it manually");
@@ -10348,7 +10534,15 @@ async function executeCloudCommand(command) {
 		};
 		const payload = command.payload;
 		const runtime = config.runtime;
-		const version = payload?.version ?? (runtime === "openclaw" ? "2026.9.5" : runtime === "claude-code" ? "0.1.6" : void 0);
+		let version;
+		if (runtime === "openclaw") {
+			const target = resolveOpenClawUpgradeTarget(payload?.version);
+			if (target.clamped) logger.warn({
+				requestedVersion: payload?.version,
+				pinnedVersion: target.version
+			}, "runtime.update requested an OpenClaw version above the pin — upgrading to the pin instead");
+			version = target.version;
+		} else version = payload?.version ?? (runtime === "claude-code" ? "0.1.6" : void 0);
 		upgradingRuntime = true;
 		setTimeout(() => {
 			(async () => {
@@ -10357,7 +10551,8 @@ async function executeCloudCommand(command) {
 					const result = await upgradeRuntime(runtime, version, runtimeProcess, {
 						...runtime === "openclaw" && openclawCliLockRef ? { cliLock: openclawCliLockRef } : {},
 						...runtime === "openclaw" && isManagedMode() && process.env.ALFE_PRIVATE_DATA_PLANE !== "true" ? { nodeRemediation: {} } : {},
-						...runtime === "openclaw" && runtimeGateRef ? { gate: runtimeGateRef } : {}
+						...runtime === "openclaw" && runtimeGateRef ? { gate: runtimeGateRef } : {},
+						...runtime === "openclaw" ? openClawUpgradeExtras() : {}
 					});
 					if (result.success || result.runtimeChanged) {
 						resolvedRuntimeVersion = await getRuntimeVersion(runtime);