@alfe.ai/gateway 0.6.2 → 0.7.1

package/dist/health.js

@@ -493,6 +493,31 @@ var AuthService = class {
 	getMyPermissions() {
 		return this.client.request(`${this.prefix}/me/permissions`);
 	}
+	/**
+	* Preview what deleting the caller's own account will do. Drives the Danger
+	* Zone copy so the user sees an honest, kind-appropriate warning before the
+	* irreversible action (a last-admin cascade wipes the whole workspace).
+	*/
+	getDeletionPreview() {
+		return this.client.request(`${this.prefix}/me/deletion-preview`);
+	}
+	/**
+	* Permanently delete the caller's own account. Returns `{ status: "deleting" }`
+	* and tears the account down asynchronously — the Clerk user is deleted shortly
+	* after, so the caller's session dies. On success, sign out and route the user
+	* to a terminal "account is being deleted" state; do NOT retry.
+	*
+	* Pass `confirmKind` (the accountKind the user actually confirmed, from the
+	* deletion preview): if membership changed between preview and execute, the
+	* server answers 409 `account_kind_changed` instead of cascading a scope the
+	* user never agreed to.
+	*/
+	deleteAccount(confirmKind) {
+		return this.client.request(`${this.prefix}/me`, {
+			method: "DELETE",
+			...confirmKind ? { body: JSON.stringify({ confirmKind }) } : {}
+		});
+	}
 	getSubscriptionStatus() {
 		return this.client.request(`${this.prefix}/subscription`);
 	}
@@ -511,6 +536,15 @@ var AuthService = class {
 			body: JSON.stringify(input)
 		});
 	}
+	/**
+	* Accept an approved Startup Program invite. Call after the applicant has a
+	* card on file (confirmed or freshly added) — this mints the Professional
+	* grant subscription. Idempotent: a repeat call on an already-accepted
+	* application returns `{ status: "accepted" }` without re-charging.
+	*/
+	acceptStartup() {
+		return this.client.request(`${this.prefix}/subscription/accept-startup`, { method: "POST" });
+	}
 	createCheckoutSession(input) {
 		return this.client.request(`${this.prefix}/subscription/checkout`, {
 			method: "POST",
@@ -4459,6 +4493,7 @@ enumValues({
 enumValues({
 	Pending: "pending",
 	Approved: "approved",
+	Accepted: "accepted",
 	Denied: "denied"
 });
 enumValues({
@@ -5245,6 +5280,18 @@ function createReconciliationReport(results) {
 	};
 }
 /**
+* Create a config-only RECONCILIATION_REPORT (empty `results`) carrying just the
+* config-reconcile outcome. Sent immediately after the config pass so the
+* dashboard config chip updates without waiting for the integration passes.
+*/
+function createConfigReport(config) {
+	return {
+		type: "RECONCILIATION_REPORT",
+		results: [],
+		config
+	};
+}
+/**
 * Type guard: is this a cloud PING message?
 */
 function isCloudPing(msg) {
@@ -5266,7 +5313,7 @@ function isIPCResponse(msg) {
 const PROTOCOL_VERSION = 1;
 //#endregion
 //#region src/runtime-gate.ts
-const log$4 = logger$1.child({ component: "RuntimeGate" });
+const log$5 = logger$1.child({ component: "RuntimeGate" });
 var RuntimeGate = class {
 	depth = 0;
 	wasRunning = false;
@@ -5284,7 +5331,7 @@ var RuntimeGate = class {
 		const rp = this.getRuntime();
 		this.wasRunning = rp?.isRunning ?? false;
 		if (rp && this.wasRunning) {
-			log$4.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
+			log$5.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
 			await rp.stop();
 		}
 	}
@@ -5299,7 +5346,7 @@ var RuntimeGate = class {
 		if (this.depth < 0) this.depth = 0;
 		const rp = this.getRuntime();
 		if (rp && this.wasRunning) {
-			log$4.info("Resuming runtime after mutating reconcile");
+			log$5.info("Resuming runtime after mutating reconcile");
 			rp.resume();
 		}
 		this.wasRunning = false;
@@ -5314,12 +5361,12 @@ var RuntimeGate = class {
 	*/
 	requestRestart() {
 		if (this.depth > 0) {
-			log$4.info("Runtime restart requested while suspended — deferring to pending resume");
+			log$5.info("Runtime restart requested while suspended — deferring to pending resume");
 			return;
 		}
 		const rp = this.getRuntime();
 		if (rp) rp.restart().catch((err) => {
-			log$4.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to restart runtime");
+			log$5.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to restart runtime");
 		});
 	}
 };
@@ -5376,11 +5423,13 @@ const CLI_SENTRY_DSN = "https://82dde4631336561f2fcc89d7531623de@o45110082394521
 const AGENT_RUNTIME_SENTRY_DSN = "https://feb7fb2e3b8e723aec518e74715bfa6d@o4511008239452160.ingest.us.sentry.io/4511683667558400";
 /**
 * MCP tool/server failures on agent VMs — reported by the daemon-hosted MCP
-* bundler (tool errors, child crashes, stderr output). This is the SAME
-* project as the cloud MCP Fly service (`SENTRY_DSNS.mcp`); agent-side events
-* are distinguished by `source: agent-daemon` + `agentId` tags.
+* bundler (tool errors, child crashes, stderr output). Dedicated `local-mcp`
+* project for the locally-installed MCP surface: the cloud MCP Fly service
+* keeps the `mcp` project (`SENTRY_DSNS.mcp`), so planned daemon restarts
+* tearing down MCP children never pollute the remote service's signal.
+* The `source: agent-daemon` + `agentId` tags are kept for continuity.
 */
-const AGENT_MCP_SENTRY_DSN = "https://638309eac96146a945f46b578f10c806@o4511008239452160.ingest.us.sentry.io/4511146364174336";
+const AGENT_MCP_SENTRY_DSN = "https://b4c4b4e19135692206bacabcd12a7fd3@o4511008239452160.ingest.us.sentry.io/4511697094377472";
 /** Surface → Sentry project: `cli` and `agent-daemon` respectively. */
 const SURFACE_DSNS = {
 	cli: CLI_SENTRY_DSN,
@@ -5721,7 +5770,7 @@ function captureFatal(cause) {
 }
 //#endregion
 //#region src/reconciliation.ts
-const log$3 = logger$1.child({ component: "Reconciliation" });
+const log$4 = logger$1.child({ component: "Reconciliation" });
 /**
 * How many times reconcile will re-attempt activation of an intact integration
 * stuck in `error` (with no reinstall requested) before giving up and waiting
@@ -5791,7 +5840,7 @@ var ReconciliationEngine = class {
 		try {
 			localIntegrations = await this.manager.getInstalledIntegrations();
 		} catch (err) {
-			log$3.error({ err }, "Failed to get local integrations");
+			log$4.error({ err }, "Failed to get local integrations");
 			localIntegrations = [];
 		}
 		const localMap = new Map(localIntegrations.map((i) => [i.id, i]));
@@ -5810,10 +5859,10 @@ var ReconciliationEngine = class {
 		try {
 			if (!local) {
 				await this.ensureSuspended();
-				log$3.info(`Installing ${id}@${desired.version}`);
+				log$4.info(`Installing ${id}@${desired.version}`);
 				await this.manager.install(id, desired.version, desired.config, desired.customSource);
 				report.installed.push(id);
-				log$3.info(`Activating ${id}`);
+				log$4.info(`Activating ${id}`);
 				if ((await this.manager.activate(id)).configApplied) report.configApplied = true;
 				report.activated.push(id);
 				report.results.push({
@@ -5826,7 +5875,7 @@ var ReconciliationEngine = class {
 			if (local.version !== desired.version && desired.version !== "" && local.version !== "unknown") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$3.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
+					log$4.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5839,7 +5888,7 @@ var ReconciliationEngine = class {
 					});
 					return;
 				}
-				log$3.info(`Upgrading ${id} in place: ${local.version} → ${desired.version}`);
+				log$4.info(`Upgrading ${id} in place: ${local.version} → ${desired.version}`);
 				try {
 					if ((await this.manager.upgrade(id, desired.version, desired.config, desired.customSource, { onBeforeRuntimeMutation: () => this.ensureSuspended() })).configApplied) report.configApplied = true;
 					this.manager.resetReinstallAttempts(id);
@@ -5853,7 +5902,7 @@ var ReconciliationEngine = class {
 					});
 				} catch (upgradeErr) {
 					const upgradeMsg = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
-					log$3.error({ err: upgradeErr }, `Upgrade failed for ${id}`);
+					log$4.error({ err: upgradeErr }, `Upgrade failed for ${id}`);
 					captureIntegrationFailure(id, "upgrade", upgradeErr);
 					report.errors.push({
 						integrationId: id,
@@ -5871,7 +5920,7 @@ var ReconciliationEngine = class {
 			if (local.status === "error") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$3.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+					log$4.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5887,7 +5936,7 @@ var ReconciliationEngine = class {
 				if (!await this.manager.isInstallIntact(id)) {
 					const attempts = this.manager.getReinstallAttempts(id);
 					if (attempts >= 3) {
-						log$3.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
+						log$4.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
 						captureIntegrationFailure(id, "reinstall", `Max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`);
 						report.errors.push({
 							integrationId: id,
@@ -5902,7 +5951,7 @@ var ReconciliationEngine = class {
 						return;
 					}
 					await this.ensureSuspended();
-					log$3.info(`Auto-reinstalling ${id} — install directory is corrupted or missing (attempt ${String(attempts + 1)}/3)`);
+					log$4.info(`Auto-reinstalling ${id} — install directory is corrupted or missing (attempt ${String(attempts + 1)}/3)`);
 					this.manager.incrementReinstallAttempts(id);
 					try {
 						if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5917,7 +5966,7 @@ var ReconciliationEngine = class {
 						});
 					} catch (reinstallErr) {
 						const reinstallMsg = reinstallErr instanceof Error ? reinstallErr.message : String(reinstallErr);
-						log$3.error({ err: reinstallErr }, `Auto-reinstall failed for ${id}`);
+						log$4.error({ err: reinstallErr }, `Auto-reinstall failed for ${id}`);
 						captureIntegrationFailure(id, "reinstall", reinstallErr);
 						report.errors.push({
 							integrationId: id,
@@ -5936,7 +5985,7 @@ var ReconciliationEngine = class {
 				if (activateAttempts < MAX_ERROR_ACTIVATE_ATTEMPTS) {
 					this.activateAttempts.set(id, activateAttempts + 1);
 					await this.ensureSuspended();
-					log$3.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
+					log$4.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
 					try {
 						if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
 						this.activateAttempts.delete(id);
@@ -5949,7 +5998,7 @@ var ReconciliationEngine = class {
 						return;
 					} catch (reactivateErr) {
 						const reactivateMsg = reactivateErr instanceof Error ? reactivateErr.message : String(reactivateErr);
-						log$3.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
+						log$4.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
 						captureIntegrationFailure(id, "reactivate", reactivateErr);
 						report.errors.push({
 							integrationId: id,
@@ -5964,7 +6013,7 @@ var ReconciliationEngine = class {
 						return;
 					}
 				}
-				log$3.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
+				log$4.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
 				captureIntegrationFailure(id, "reactivate", `Integration ${id} stuck in error state — re-activation attempts exhausted`);
 				report.errors.push({
 					integrationId: id,
@@ -5981,7 +6030,7 @@ var ReconciliationEngine = class {
 			if (local.status === "installing") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$3.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+					log$4.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5997,7 +6046,7 @@ var ReconciliationEngine = class {
 				const attempts = this.manager.getReinstallAttempts(id);
 				if (attempts >= 3) {
 					const errorMessage = `Stale installing state — max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`;
-					log$3.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
+					log$4.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
 					captureIntegrationFailure(id, "reinstall", errorMessage);
 					report.errors.push({
 						integrationId: id,
@@ -6012,7 +6061,7 @@ var ReconciliationEngine = class {
 					return;
 				}
 				await this.ensureSuspended();
-				log$3.info(`Recovering ${id} from stale installing state via reinstall (attempt ${String(attempts + 1)}/3)`);
+				log$4.info(`Recovering ${id} from stale installing state via reinstall (attempt ${String(attempts + 1)}/3)`);
 				this.manager.incrementReinstallAttempts(id);
 				try {
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6027,7 +6076,7 @@ var ReconciliationEngine = class {
 					});
 				} catch (reinstallErr) {
 					const reinstallMsg = reinstallErr instanceof Error ? reinstallErr.message : String(reinstallErr);
-					log$3.error({ err: reinstallErr }, `Reinstall from stale installing state failed for ${id}`);
+					log$4.error({ err: reinstallErr }, `Reinstall from stale installing state failed for ${id}`);
 					captureIntegrationFailure(id, "reinstall", reinstallErr);
 					report.errors.push({
 						integrationId: id,
@@ -6044,7 +6093,7 @@ var ReconciliationEngine = class {
 			}
 			if (local.status !== "active") {
 				await this.ensureSuspended();
-				log$3.info(`Activating ${id}`);
+				log$4.info(`Activating ${id}`);
 				if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
 				report.activated.push(id);
 				report.results.push({
@@ -6056,7 +6105,7 @@ var ReconciliationEngine = class {
 			}
 			if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 				await this.ensureSuspended();
-				log$3.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+				log$4.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 				this.manager.resetReinstallAttempts(id);
 				this.activateAttempts.delete(id);
 				if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6077,7 +6126,7 @@ var ReconciliationEngine = class {
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			log$3.error({ err }, `Error reconciling ${id}`);
+			log$4.error({ err }, `Error reconciling ${id}`);
 			captureIntegrationFailure(id, "reconcile_active", err);
 			report.errors.push({
 				integrationId: id,
@@ -6102,7 +6151,7 @@ var ReconciliationEngine = class {
 		}
 		try {
 			await this.ensureSuspended();
-			log$3.info(`Removing ${id}`);
+			log$4.info(`Removing ${id}`);
 			if (local.status === "active") {
 				await this.manager.deactivate(id);
 				report.deactivated.push(id);
@@ -6116,7 +6165,7 @@ var ReconciliationEngine = class {
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			log$3.error({ err }, `Error removing ${id}`);
+			log$4.error({ err }, `Error removing ${id}`);
 			captureIntegrationFailure(id, "reconcile_removed", err);
 			report.errors.push({
 				integrationId: id,
@@ -6154,6 +6203,7 @@ var CloudClient = class {
 	onRuntimeRestartNeeded = null;
 	onReconciliationComplete = null;
 	reconciliationEngine = null;
+	configReconciler = null;
 	reconciling = false;
 	pendingDesiredState = null;
 	constructor(config) {
@@ -6202,6 +6252,14 @@ var CloudClient = class {
 		this.reconciliationEngine = new ReconciliationEngine(manager, gate);
 	}
 	/**
+	* Set the config reconciler for the DESIRED_STATE `config` block (plan A4).
+	* When set, a DESIRED_STATE carrying `config` runs a config-reconcile pass
+	* BEFORE the integrations loop and reports config status immediately.
+	*/
+	setConfigReconciler(reconciler) {
+		this.configReconciler = reconciler;
+	}
+	/**
 	* Start the cloud connection with auto-reconnect.
 	*/
 	start() {
@@ -6424,6 +6482,19 @@ var CloudClient = class {
 		}
 	}
 	async runReconciliation(msg) {
+		if (msg.config && this.configReconciler) try {
+			const configReport = await this.configReconciler.reconcile(msg.config);
+			if (configReport) {
+				this.send(createConfigReport(configReport));
+				logger$1.info({
+					version: configReport.appliedVersion,
+					status: configReport.status
+				}, "Cloud: sent config reconcile report");
+			}
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			logger$1.error({ err: message }, "Cloud: config reconcile failed");
+		}
 		if (!this.reconciliationEngine) return;
 		const report = await this.reconciliationEngine.reconcile(msg.integrations);
 		logger$1.info({
@@ -6476,6 +6547,86 @@ var CloudClient = class {
 	}
 };
 //#endregion
+//#region src/config-reconciler.ts
+const log$3 = logger$1.child({ component: "ConfigReconciler" });
+const DEFAULT_VERIFY_RETRIES = 3;
+const DEFAULT_VERIFY_RETRY_DELAY_MS = 750;
+const delay = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+var ConfigReconciler = class {
+	getApplier;
+	verifyRetries;
+	verifyRetryDelayMs;
+	constructor(options) {
+		this.getApplier = options.getApplier;
+		this.verifyRetries = options.verifyRetries ?? DEFAULT_VERIFY_RETRIES;
+		this.verifyRetryDelayMs = options.verifyRetryDelayMs ?? DEFAULT_VERIFY_RETRY_DELAY_MS;
+	}
+	/**
+	* Reconcile the desired config block. Returns the outcome to report, or `null`
+	* when there is nothing to report (no applier able to apply config).
+	*/
+	async reconcile(desired) {
+		const applier = this.getApplier();
+		if (!applier?.setConfigRaw) {
+			log$3.debug("No applier with setConfigRaw — skipping config reconcile");
+			return null;
+		}
+		const setConfigRaw = applier.setConfigRaw.bind(applier);
+		const getConfigRaw = applier.getConfigRaw?.bind(applier);
+		const entries = Object.entries(desired.values).filter((e) => e[1] !== null);
+		if (entries.length === 0) return {
+			appliedVersion: desired.version,
+			status: "applied"
+		};
+		const failures = [];
+		for (const [key, want] of entries) try {
+			if (getConfigRaw) {
+				if (await getConfigRaw(key) === want) {
+					log$3.debug({ key }, "Config already at desired value — no-op");
+					continue;
+				}
+			}
+			await setConfigRaw(key, want);
+			if (getConfigRaw) {
+				if (!await this.verify(getConfigRaw, key, want)) failures.push(`${key}: verify failed (read-back did not match)`);
+			}
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			failures.push(`${key}: ${msg}`);
+		}
+		if (failures.length > 0) {
+			const joined = failures.join("; ");
+			const reason = joined.length > 480 ? `${joined.slice(0, 480)}… (truncated)` : joined;
+			log$3.warn({
+				version: desired.version,
+				reason
+			}, "Config reconcile failed");
+			return {
+				appliedVersion: desired.version,
+				status: "failed",
+				reason
+			};
+		}
+		log$3.info({
+			version: desired.version,
+			keys: entries.length
+		}, "Config reconcile applied");
+		return {
+			appliedVersion: desired.version,
+			status: "applied"
+		};
+	}
+	async verify(getConfigRaw, key, want) {
+		for (let attempt = 0; attempt <= this.verifyRetries; attempt++) {
+			if (await getConfigRaw(key) === want) return true;
+			if (attempt < this.verifyRetries && this.verifyRetryDelayMs > 0) await delay(this.verifyRetryDelayMs * 2 ** attempt);
+		}
+		return false;
+	}
+};
+//#endregion
 //#region src/ipc-server.ts
 /**
 * IPC Server — Unix socket server for local plugin connections.
@@ -6823,12 +6974,12 @@ var IPCServer = class {
 };
 //#endregion
 //#region src/command-queue.ts
-const DEFAULT_TTL_MS = 300 * 1e3;
+const DEFAULT_TTL_MS$1 = 300 * 1e3;
 var CommandQueue = class {
 	queues = /* @__PURE__ */ new Map();
 	ttlMs;
 	gcTimer = null;
-	constructor(ttlMs = DEFAULT_TTL_MS) {
+	constructor(ttlMs = DEFAULT_TTL_MS$1) {
 		this.ttlMs = ttlMs;
 	}
 	/**
@@ -7025,6 +7176,12 @@ Type=simple
 ExecStart=${alfeBin} gateway daemon
 Restart=always
 RestartSec=10
+# SIGTERM only the daemon on stop/restart; it closes its MCP/runtime children
+# itself. The default (control-group) SIGTERMs the children simultaneously, so
+# they die before the daemon's orderly dispose reaches them and every planned
+# restart reports MCP "server-crash" noise to Sentry. Stragglers still get
+# SIGKILL when the stop timeout expires.
+KillMode=mixed
 Environment=NODE_ENV=production${root ? "\nEnvironment=HOME=/root\nWorkingDirectory=/root" : ""}
 ${envLines}
 
@@ -22838,6 +22995,73 @@ var CommandRegistry = class {
 	}
 };
 //#endregion
+//#region src/command-dedupe.ts
+const DEFAULT_MAX_ENTRIES = 200;
+const DEFAULT_TTL_MS = 600 * 1e3;
+var CommandDedupe = class {
+	entries = /* @__PURE__ */ new Map();
+	maxEntries;
+	ttlMs;
+	now;
+	constructor(opts = {}) {
+		this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+		this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+		this.now = opts.now ?? (() => Date.now());
+	}
+	/**
+	* Run `exec` for `commandId` exactly once within the dedupe window. A repeat
+	* call with the same id (while still remembered) returns the FIRST call's
+	* promise — either the in-flight execution or the settled replayable ACK — so
+	* the command body never runs twice.
+	*/
+	async run(commandId, exec) {
+		this.evictExpired();
+		const existing = this.entries.get(commandId);
+		if (existing) return {
+			ack: await existing.promise,
+			duplicate: true
+		};
+		const promise = exec();
+		this.entries.set(commandId, {
+			insertedAt: this.now(),
+			promise
+		});
+		this.evictOverCap();
+		promise.catch(() => {
+			this.entries.delete(commandId);
+		});
+		return {
+			ack: await promise,
+			duplicate: false
+		};
+	}
+	/** Test/inspection helper. */
+	size() {
+		this.evictExpired();
+		return this.entries.size;
+	}
+	has(commandId) {
+		const e = this.entries.get(commandId);
+		if (!e) return false;
+		if (this.now() - e.insertedAt > this.ttlMs) {
+			this.entries.delete(commandId);
+			return false;
+		}
+		return true;
+	}
+	evictExpired() {
+		const cutoff = this.now() - this.ttlMs;
+		for (const [id, entry] of this.entries) if (entry.insertedAt <= cutoff) this.entries.delete(id);
+	}
+	evictOverCap() {
+		while (this.entries.size > this.maxEntries) {
+			const oldest = this.entries.keys().next().value;
+			if (oldest === void 0) break;
+			this.entries.delete(oldest);
+		}
+	}
+};
+//#endregion
 //#region src/pairing-approval.ts
 /**
 * Pairing approval poller — auto-approves pending OpenClaw scope-upgrade
@@ -23134,7 +23358,15 @@ function createMcpErrorHooks() {
 	const throttleFor = (kind) => kind === "tool-result-error" ? resultErrorThrottle : kind === "server-crash" ? crashThrottle : errorThrottle;
 	const detectors = /* @__PURE__ */ new Map();
 	const flushTimers = /* @__PURE__ */ new Map();
+	let shuttingDown = false;
 	const capture = (opts) => {
+		if (shuttingDown) {
+			log.debug({
+				server: opts.server,
+				kind: opts.kind
+			}, "MCP failure capture suppressed — daemon shutting down");
+			return;
+		}
 		const { allow, suppressedCount } = throttleFor(opts.kind).allowErrorCapture(opts.fingerprintKey);
 		if (!allow) {
 			log.debug({
@@ -23206,6 +23438,9 @@ function createMcpErrorHooks() {
 		dispose: () => {
 			for (const timer of flushTimers.values()) clearTimeout(timer);
 			flushTimers.clear();
+		},
+		beginShutdown: () => {
+			shuttingDown = true;
 		}
 	};
 }
@@ -23245,6 +23480,13 @@ let runtimeProcess = null;
 let aiProxyUrl = null;
 let aiProxyRunning = false;
 let cloudConnected = false;
+/**
+* Dedupe for at-least-once durable command delivery (Phase B). The cloud may
+* push a command over the live WS AND re-drain the same commandId on the next
+* SERVICE_REGISTER; both hit handleCloudCommand. This remembers recent outcomes
+* so a duplicate is ACKed with the prior result without re-executing.
+*/
+const commandDedupe = new CommandDedupe();
 let shuttingDown = false;
 let commandRegistry;
 let resolvedCliVersion;
@@ -23641,6 +23883,7 @@ async function startDaemon() {
 	const integrationAdapter = new IntegrationManagerAdapter(integrationManager);
 	const runtimeGate = new RuntimeGate(() => runtimeProcess);
 	cloudClient.setIntegrationManager(integrationAdapter, runtimeGate);
+	cloudClient.setConfigReconciler(new ConfigReconciler({ getApplier: () => runtimeAppliers.get(config.runtime) }));
 	const requestRuntimeRestart = () => {
 		logger$1.info("Runtime state changed — requesting runtime restart");
 		runtimeGate.requestRestart();
@@ -23705,6 +23948,7 @@ async function startDaemon() {
 	const shutdown = async (signal) => {
 		if (shuttingDown) return;
 		shuttingDown = true;
+		mcpErrorHooks.beginShutdown();
 		logger$1.info({ signal }, "Shutting down...");
 		if (stopPairingApprovalPoller) {
 			stopPairingApprovalPoller();
@@ -23767,7 +24011,34 @@ async function startDaemon() {
 		agentId: config.agentId
 	}, "Alfe Gateway Daemon started ✅");
 }
+/**
+* Single command choke point. Dedupes at-least-once durable deliveries
+* (Phase B) — a repeat commandId within the dedupe window is ACKed with the
+* prior outcome (tagged `duplicate: true`) and NOT re-executed.
+*
+* Non-idempotent, replay-ordering-hazardous commands (daemon.update /
+* daemon.restart / runtime.restart) benefit most: a re-drained restart must not
+* bounce the box a second time.
+*/
 async function handleCloudCommand(command) {
+	const { ack, duplicate } = await commandDedupe.run(command.commandId, () => executeCloudCommand(command));
+	if (duplicate) {
+		logger$1.info({
+			commandId: command.commandId,
+			command: command.command
+		}, "Duplicate command — replaying prior ACK without re-executing");
+		const priorResult = ack.result && typeof ack.result === "object" && !Array.isArray(ack.result) ? ack.result : { result: ack.result };
+		return {
+			...ack,
+			result: {
+				...priorResult,
+				duplicate: true
+			}
+		};
+	}
+	return ack;
+}
+async function executeCloudCommand(command) {
 	if (command.command === "daemon.update") {
 		const version = command.payload?.version ?? "latest";
 		setTimeout(() => {

package/dist/src/index.d.ts

@@ -28,6 +28,15 @@ declare const PROTOCOL_VERSION = 1;
 //#region src/daemon.d.ts
 
 declare function startDaemon(): Promise<void>;
+/**
+ * Single command choke point. Dedupes at-least-once durable deliveries
+ * (Phase B) — a repeat commandId within the dedupe window is ACKed with the
+ * prior outcome (tagged `duplicate: true`) and NOT re-executed.
+ *
+ * Non-idempotent, replay-ordering-hazardous commands (daemon.update /
+ * daemon.restart / runtime.restart) benefit most: a re-drained restart must not
+ * bounce the box a second time.
+ */
 //#endregion
 //#region src/openclaw-version.d.ts
 /**
@@ -83,11 +92,13 @@ declare const AGENT_DAEMON_SENTRY_DSN = "https://a47f010d8d39fb4350f913492189f28
 declare const AGENT_RUNTIME_SENTRY_DSN = "https://feb7fb2e3b8e723aec518e74715bfa6d@o4511008239452160.ingest.us.sentry.io/4511683667558400";
 /**
  * MCP tool/server failures on agent VMs — reported by the daemon-hosted MCP
- * bundler (tool errors, child crashes, stderr output). This is the SAME
- * project as the cloud MCP Fly service (`SENTRY_DSNS.mcp`); agent-side events
- * are distinguished by `source: agent-daemon` + `agentId` tags.
+ * bundler (tool errors, child crashes, stderr output). Dedicated `local-mcp`
+ * project for the locally-installed MCP surface: the cloud MCP Fly service
+ * keeps the `mcp` project (`SENTRY_DSNS.mcp`), so planned daemon restarts
+ * tearing down MCP children never pollute the remote service's signal.
+ * The `source: agent-daemon` + `agentId` tags are kept for continuity.
  */
-declare const AGENT_MCP_SENTRY_DSN = "https://638309eac96146a945f46b578f10c806@o4511008239452160.ingest.us.sentry.io/4511146364174336";
+declare const AGENT_MCP_SENTRY_DSN = "https://b4c4b4e19135692206bacabcd12a7fd3@o4511008239452160.ingest.us.sentry.io/4511697094377472";
 /** Which surface initialised Sentry — tagged on every event. */
 type SentrySurface = "cli" | "daemon";
 interface InitAgentSentryOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "@alfe.ai/ai-proxy-local": "^0.0.13",
     "@alfe.ai/config": "^0.3.0",
     "@alfe.ai/integration-manifest": "^0.3.1",
-    "@alfe.ai/integrations": "^0.3.2",
+    "@alfe.ai/integrations": "^0.4.0",
     "@alfe.ai/mcp-bundler": "^0.3.0"
   },
   "license": "UNLICENSED",