@alfe.ai/gateway 0.7.2 → 0.7.4

package/dist/health.js

@@ -551,6 +551,18 @@ var AuthService = class {
 			body: JSON.stringify(input)
 		});
 	}
+	/**
+	* Change a personal (individual-tier) subscriber's platform plan in place on
+	* their existing Stripe subscription — no second Checkout, no duplicate sub,
+	* no double charge. Upgrades prorate immediately; downgrades apply with no
+	* immediate charge/refund. Returns the updated subscription.
+	*/
+	changePlatformPlan(input) {
+		return this.client.request(`${this.prefix}/subscription/change`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
 	updateSeats(seats) {
 		return this.client.request(`${this.prefix}/subscription/seats`, {
 			method: "POST",
@@ -5313,7 +5325,7 @@ function isIPCResponse(msg) {
 const PROTOCOL_VERSION = 1;
 //#endregion
 //#region src/runtime-gate.ts
-const log$5 = logger$1.child({ component: "RuntimeGate" });
+const log$6 = logger$1.child({ component: "RuntimeGate" });
 var RuntimeGate = class {
 	depth = 0;
 	wasRunning = false;
@@ -5331,8 +5343,8 @@ var RuntimeGate = class {
 		const rp = this.getRuntime();
 		this.wasRunning = rp?.isRunning ?? false;
 		if (rp && this.wasRunning) {
-			log$5.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
-			await rp.stop();
+			log$6.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
+			await rp.stopWhenIdle();
 		}
 	}
 	/**
@@ -5346,7 +5358,7 @@ var RuntimeGate = class {
 		if (this.depth < 0) this.depth = 0;
 		const rp = this.getRuntime();
 		if (rp && this.wasRunning) {
-			log$5.info("Resuming runtime after mutating reconcile");
+			log$6.info("Resuming runtime after mutating reconcile");
 			rp.resume();
 		}
 		this.wasRunning = false;
@@ -5361,12 +5373,12 @@ var RuntimeGate = class {
 	*/
 	requestRestart() {
 		if (this.depth > 0) {
-			log$5.info("Runtime restart requested while suspended — deferring to pending resume");
+			log$6.info("Runtime restart requested while suspended — deferring to pending resume");
 			return;
 		}
 		const rp = this.getRuntime();
 		if (rp) rp.restart().catch((err) => {
-			log$5.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to restart runtime");
+			log$6.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to restart runtime");
 		});
 	}
 };
@@ -5770,7 +5782,7 @@ function captureFatal(cause) {
 }
 //#endregion
 //#region src/reconciliation.ts
-const log$4 = logger$1.child({ component: "Reconciliation" });
+const log$5 = logger$1.child({ component: "Reconciliation" });
 /**
 * How many times reconcile will re-attempt activation of an intact integration
 * stuck in `error` (with no reinstall requested) before giving up and waiting
@@ -5840,7 +5852,7 @@ var ReconciliationEngine = class {
 		try {
 			localIntegrations = await this.manager.getInstalledIntegrations();
 		} catch (err) {
-			log$4.error({ err }, "Failed to get local integrations");
+			log$5.error({ err }, "Failed to get local integrations");
 			localIntegrations = [];
 		}
 		const localMap = new Map(localIntegrations.map((i) => [i.id, i]));
@@ -5859,10 +5871,10 @@ var ReconciliationEngine = class {
 		try {
 			if (!local) {
 				await this.ensureSuspended();
-				log$4.info(`Installing ${id}@${desired.version}`);
+				log$5.info(`Installing ${id}@${desired.version}`);
 				await this.manager.install(id, desired.version, desired.config, desired.customSource);
 				report.installed.push(id);
-				log$4.info(`Activating ${id}`);
+				log$5.info(`Activating ${id}`);
 				if ((await this.manager.activate(id)).configApplied) report.configApplied = true;
 				report.activated.push(id);
 				report.results.push({
@@ -5875,7 +5887,7 @@ var ReconciliationEngine = class {
 			if (local.version !== desired.version && desired.version !== "" && local.version !== "unknown") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$4.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
+					log$5.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5888,7 +5900,7 @@ var ReconciliationEngine = class {
 					});
 					return;
 				}
-				log$4.info(`Upgrading ${id} in place: ${local.version} → ${desired.version}`);
+				log$5.info(`Upgrading ${id} in place: ${local.version} → ${desired.version}`);
 				try {
 					if ((await this.manager.upgrade(id, desired.version, desired.config, desired.customSource, { onBeforeRuntimeMutation: () => this.ensureSuspended() })).configApplied) report.configApplied = true;
 					this.manager.resetReinstallAttempts(id);
@@ -5902,7 +5914,7 @@ var ReconciliationEngine = class {
 					});
 				} catch (upgradeErr) {
 					const upgradeMsg = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
-					log$4.error({ err: upgradeErr }, `Upgrade failed for ${id}`);
+					log$5.error({ err: upgradeErr }, `Upgrade failed for ${id}`);
 					captureIntegrationFailure(id, "upgrade", upgradeErr);
 					report.errors.push({
 						integrationId: id,
@@ -5920,7 +5932,7 @@ var ReconciliationEngine = class {
 			if (local.status === "error") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$4.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+					log$5.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5936,7 +5948,7 @@ var ReconciliationEngine = class {
 				if (!await this.manager.isInstallIntact(id)) {
 					const attempts = this.manager.getReinstallAttempts(id);
 					if (attempts >= 3) {
-						log$4.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
+						log$5.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
 						captureIntegrationFailure(id, "reinstall", `Max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`);
 						report.errors.push({
 							integrationId: id,
@@ -5951,7 +5963,7 @@ var ReconciliationEngine = class {
 						return;
 					}
 					await this.ensureSuspended();
-					log$4.info(`Auto-reinstalling ${id} — install directory is corrupted or missing (attempt ${String(attempts + 1)}/3)`);
+					log$5.info(`Auto-reinstalling ${id} — install directory is corrupted or missing (attempt ${String(attempts + 1)}/3)`);
 					this.manager.incrementReinstallAttempts(id);
 					try {
 						if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -5966,7 +5978,7 @@ var ReconciliationEngine = class {
 						});
 					} catch (reinstallErr) {
 						const reinstallMsg = reinstallErr instanceof Error ? reinstallErr.message : String(reinstallErr);
-						log$4.error({ err: reinstallErr }, `Auto-reinstall failed for ${id}`);
+						log$5.error({ err: reinstallErr }, `Auto-reinstall failed for ${id}`);
 						captureIntegrationFailure(id, "reinstall", reinstallErr);
 						report.errors.push({
 							integrationId: id,
@@ -5985,7 +5997,7 @@ var ReconciliationEngine = class {
 				if (activateAttempts < MAX_ERROR_ACTIVATE_ATTEMPTS) {
 					this.activateAttempts.set(id, activateAttempts + 1);
 					await this.ensureSuspended();
-					log$4.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
+					log$5.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
 					try {
 						if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
 						this.activateAttempts.delete(id);
@@ -5998,7 +6010,7 @@ var ReconciliationEngine = class {
 						return;
 					} catch (reactivateErr) {
 						const reactivateMsg = reactivateErr instanceof Error ? reactivateErr.message : String(reactivateErr);
-						log$4.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
+						log$5.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
 						captureIntegrationFailure(id, "reactivate", reactivateErr);
 						report.errors.push({
 							integrationId: id,
@@ -6013,7 +6025,7 @@ var ReconciliationEngine = class {
 						return;
 					}
 				}
-				log$4.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
+				log$5.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
 				captureIntegrationFailure(id, "reactivate", `Integration ${id} stuck in error state — re-activation attempts exhausted`);
 				report.errors.push({
 					integrationId: id,
@@ -6030,7 +6042,7 @@ var ReconciliationEngine = class {
 			if (local.status === "installing") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$4.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+					log$5.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6046,7 +6058,7 @@ var ReconciliationEngine = class {
 				const attempts = this.manager.getReinstallAttempts(id);
 				if (attempts >= 3) {
 					const errorMessage = `Stale installing state — max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`;
-					log$4.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
+					log$5.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
 					captureIntegrationFailure(id, "reinstall", errorMessage);
 					report.errors.push({
 						integrationId: id,
@@ -6061,7 +6073,7 @@ var ReconciliationEngine = class {
 					return;
 				}
 				await this.ensureSuspended();
-				log$4.info(`Recovering ${id} from stale installing state via reinstall (attempt ${String(attempts + 1)}/3)`);
+				log$5.info(`Recovering ${id} from stale installing state via reinstall (attempt ${String(attempts + 1)}/3)`);
 				this.manager.incrementReinstallAttempts(id);
 				try {
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6076,7 +6088,7 @@ var ReconciliationEngine = class {
 					});
 				} catch (reinstallErr) {
 					const reinstallMsg = reinstallErr instanceof Error ? reinstallErr.message : String(reinstallErr);
-					log$4.error({ err: reinstallErr }, `Reinstall from stale installing state failed for ${id}`);
+					log$5.error({ err: reinstallErr }, `Reinstall from stale installing state failed for ${id}`);
 					captureIntegrationFailure(id, "reinstall", reinstallErr);
 					report.errors.push({
 						integrationId: id,
@@ -6093,7 +6105,7 @@ var ReconciliationEngine = class {
 			}
 			if (local.status !== "active") {
 				await this.ensureSuspended();
-				log$4.info(`Activating ${id}`);
+				log$5.info(`Activating ${id}`);
 				if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
 				report.activated.push(id);
 				report.results.push({
@@ -6105,7 +6117,7 @@ var ReconciliationEngine = class {
 			}
 			if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 				await this.ensureSuspended();
-				log$4.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+				log$5.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 				this.manager.resetReinstallAttempts(id);
 				this.activateAttempts.delete(id);
 				if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6126,7 +6138,7 @@ var ReconciliationEngine = class {
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			log$4.error({ err }, `Error reconciling ${id}`);
+			log$5.error({ err }, `Error reconciling ${id}`);
 			captureIntegrationFailure(id, "reconcile_active", err);
 			report.errors.push({
 				integrationId: id,
@@ -6151,7 +6163,7 @@ var ReconciliationEngine = class {
 		}
 		try {
 			await this.ensureSuspended();
-			log$4.info(`Removing ${id}`);
+			log$5.info(`Removing ${id}`);
 			if (local.status === "active") {
 				await this.manager.deactivate(id);
 				report.deactivated.push(id);
@@ -6165,7 +6177,7 @@ var ReconciliationEngine = class {
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			log$4.error({ err }, `Error removing ${id}`);
+			log$5.error({ err }, `Error removing ${id}`);
 			captureIntegrationFailure(id, "reconcile_removed", err);
 			report.errors.push({
 				integrationId: id,
@@ -6548,7 +6560,7 @@ var CloudClient = class {
 };
 //#endregion
 //#region src/config-reconciler.ts
-const log$3 = logger$1.child({ component: "ConfigReconciler" });
+const log$4 = logger$1.child({ component: "ConfigReconciler" });
 const DEFAULT_VERIFY_RETRIES = 3;
 const DEFAULT_VERIFY_RETRY_DELAY_MS = 750;
 const delay = (ms) => new Promise((resolve) => {
@@ -6570,7 +6582,7 @@ var ConfigReconciler = class {
 	async reconcile(desired) {
 		const applier = this.getApplier();
 		if (!applier?.setConfigRaw) {
-			log$3.debug("No applier with setConfigRaw — skipping config reconcile");
+			log$4.debug("No applier with setConfigRaw — skipping config reconcile");
 			return null;
 		}
 		const setConfigRaw = applier.setConfigRaw.bind(applier);
@@ -6584,7 +6596,7 @@ var ConfigReconciler = class {
 		for (const [key, want] of entries) try {
 			if (getConfigRaw) {
 				if (await getConfigRaw(key) === want) {
-					log$3.debug({ key }, "Config already at desired value — no-op");
+					log$4.debug({ key }, "Config already at desired value — no-op");
 					continue;
 				}
 			}
@@ -6594,12 +6606,19 @@ var ConfigReconciler = class {
 			}
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
+			if (getConfigRaw && await this.verify(getConfigRaw, key, want)) {
+				log$4.warn({
+					key,
+					err: msg
+				}, "config set errored but value landed — treating as applied");
+				continue;
+			}
 			failures.push(`${key}: ${msg}`);
 		}
 		if (failures.length > 0) {
 			const joined = failures.join("; ");
 			const reason = joined.length > 480 ? `${joined.slice(0, 480)}… (truncated)` : joined;
-			log$3.warn({
+			log$4.warn({
 				version: desired.version,
 				reason
 			}, "Config reconcile failed");
@@ -6609,7 +6628,7 @@ var ConfigReconciler = class {
 				reason
 			};
 		}
-		log$3.info({
+		log$4.info({
 			version: desired.version,
 			keys: entries.length
 		}, "Config reconcile applied");
@@ -22585,13 +22604,21 @@ var CaptureThrottle = class {
 * Spawns the runtime binary, pipes stdout/stderr to the daemon logger,
 * and restarts on crash with exponential backoff.
 */
-const log$2 = createLogger("RuntimeProcess");
+const log$3 = createLogger("RuntimeProcess");
 /** Quiet-period flush for a pending multi-line error block (e.g. a traceback
 * followed by silence — no closing line ever arrives to complete it). */
 const DETECTOR_FLUSH_DEBOUNCE_MS = 1500;
 const BACKOFF_INITIAL_MS = 1e3;
 const BACKOFF_MAX_MS = 3e4;
 const STABLE_UPTIME_MS = 6e4;
+/**
+* Max time a NON-crash restart waits for an in-flight chat turn to finish
+* before it forces the stop anyway. A turn that outlives this is almost
+* certainly wedged; a real reply streams in far less. Long enough to cover a
+* normal multi-tool turn, short enough that a stuck turn doesn't block a
+* platform-pushed `daemon.update` indefinitely.
+*/
+const DRAIN_GRACE_MS = 45e3;
 var RuntimeProcess = class {
 	child = null;
 	stopped = false;
@@ -22602,10 +22629,20 @@ var RuntimeProcess = class {
 	detector = new ErrorLineDetector();
 	throttle = new CaptureThrottle(STABLE_UPTIME_MS);
 	detectorFlushTimer = null;
+	turnActivityProbe = null;
 	constructor(options) {
 		this.options = options;
 	}
 	/**
+	* Attach the turn-activity probe used by drained restarts. The daemon calls
+	* this after the IPC server is up (plugins register there). Without it,
+	* {@link stopWhenIdle} and drained {@link restart} fall back to an immediate
+	* stop — safe, just not turn-aware.
+	*/
+	setTurnActivityProbe(probe) {
+		this.turnActivityProbe = probe;
+	}
+	/**
 	* Resolve the binary command and args for a given runtime type.
 	*/
 	resolveCommand() {
@@ -22632,7 +22669,7 @@ var RuntimeProcess = class {
 		if (this.stopped) return;
 		const { command, args } = this.resolveCommand();
 		this.lastStartTime = Date.now();
-		log$2.info({
+		log$3.info({
 			runtime: this.options.runtime,
 			command,
 			args,
@@ -22653,7 +22690,7 @@ var RuntimeProcess = class {
 		this.child.stdout?.on("data", (data) => {
 			const lines = data.toString().trim().split("\n");
 			for (const line of lines) {
-				log$2.info({
+				log$3.info({
 					runtime: this.options.runtime,
 					stream: "stdout"
 				}, line);
@@ -22663,7 +22700,7 @@ var RuntimeProcess = class {
 		this.child.stderr?.on("data", (data) => {
 			const lines = data.toString().trim().split("\n");
 			for (const line of lines) {
-				log$2.warn({
+				log$3.warn({
 					runtime: this.options.runtime,
 					stream: "stderr"
 				}, line);
@@ -22673,7 +22710,7 @@ var RuntimeProcess = class {
 		this.child.on("exit", (code, signal) => {
 			this.child = null;
 			if (this.stopped) {
-				log$2.info({
+				log$3.info({
 					runtime: this.options.runtime,
 					code,
 					signal
@@ -22681,7 +22718,7 @@ var RuntimeProcess = class {
 				return;
 			}
 			if (code === 0 && signal == null) {
-				log$2.info({
+				log$3.info({
 					runtime: this.options.runtime,
 					code
 				}, "Runtime exited gracefully — restarting");
@@ -22691,7 +22728,7 @@ var RuntimeProcess = class {
 				}, 500);
 				return;
 			}
-			log$2.warn({
+			log$3.warn({
 				runtime: this.options.runtime,
 				code,
 				signal,
@@ -22712,7 +22749,7 @@ var RuntimeProcess = class {
 				recentOutput: this.ringBuffer.snapshot(),
 				crashesSuppressed: crash.suppressedCount
 			});
-			else log$2.debug({
+			else log$3.debug({
 				runtime: this.options.runtime,
 				suppressed: crash.suppressedCount
 			}, "Crash capture suppressed by throttle");
@@ -22724,7 +22761,7 @@ var RuntimeProcess = class {
 			this.backoffMs = Math.min(this.backoffMs * 2, BACKOFF_MAX_MS);
 		});
 		this.child.on("error", (err) => {
-			log$2.error({
+			log$3.error({
 				runtime: this.options.runtime,
 				err: err.message
 			}, "Runtime process error");
@@ -22763,7 +22800,7 @@ var RuntimeProcess = class {
 				this.emitErrorBlock(this.detector.flush());
 			}, DETECTOR_FLUSH_DEBOUNCE_MS);
 		} catch (err) {
-			log$2.debug({
+			log$3.debug({
 				runtime: this.options.runtime,
 				err: err instanceof Error ? err.message : String(err)
 			}, "Runtime output observation failed");
@@ -22774,7 +22811,7 @@ var RuntimeProcess = class {
 		if (!block) return;
 		const { allow, suppressedCount } = this.throttle.allowErrorCapture(block.fingerprintKey);
 		if (!allow) {
-			log$2.debug({
+			log$3.debug({
 				runtime: this.options.runtime,
 				kind: block.kind,
 				suppressed: suppressedCount
@@ -22808,7 +22845,7 @@ var RuntimeProcess = class {
 		if (!child) return;
 		return new Promise((resolve) => {
 			const killTimer = setTimeout(() => {
-				log$2.warn({ runtime: this.options.runtime }, "Runtime did not exit in time — sending SIGKILL");
+				log$3.warn({ runtime: this.options.runtime }, "Runtime did not exit in time — sending SIGKILL");
 				child.kill("SIGKILL");
 			}, 5e3);
 			child.on("exit", () => {
@@ -22819,6 +22856,54 @@ var RuntimeProcess = class {
 		});
 	}
 	/**
+	* Stop the runtime, but first wait for any in-flight chat turn to finish
+	* (up to a grace deadline). This is the entry point for NON-crash restarts —
+	* a mid-turn SIGTERM turns a healthy reply into an "unknown error" for the
+	* user, so a planned stop drains first.
+	*
+	* Semantics:
+	*  - No probe attached, or probe reports idle up-front → stops immediately
+	*    (no added latency for the common case).
+	*  - A turn is in flight → polls the probe every {@link DRAIN_POLL_INTERVAL_MS}
+	*    until it reports idle, then stops.
+	*  - The turn never ends within `graceMs` → logs and forces the stop anyway
+	*    (a wedged turn must not block a platform-pushed restart forever).
+	*
+	* Crash restarts must NOT call this — the child is already dead/broken and
+	* the probe would just burn the grace window. They keep using {@link stop}.
+	*/
+	async stopWhenIdle(opts) {
+		const probe = opts?.probe ?? this.turnActivityProbe;
+		const graceMs = opts?.graceMs ?? 45e3;
+		if (!this.child || !probe) {
+			await this.stop();
+			return;
+		}
+		const deadline = Date.now() + graceMs;
+		let deferred = false;
+		for (;;) {
+			if (!await probe.isTurnActive()) break;
+			if (Date.now() >= deadline) {
+				log$3.warn({
+					runtime: this.options.runtime,
+					graceMs
+				}, "Runtime still mid-turn at drain grace deadline — forcing stop");
+				break;
+			}
+			if (!deferred) {
+				deferred = true;
+				log$3.info({
+					runtime: this.options.runtime,
+					graceMs
+				}, "Runtime is mid-turn — deferring planned stop until idle");
+			}
+			await new Promise((resolve) => setTimeout(resolve, 500));
+			if (!this.isRunning) return;
+		}
+		if (deferred) log$3.info({ runtime: this.options.runtime }, "Runtime idle — proceeding with planned stop");
+		await this.stop();
+	}
+	/**
 	* Resume after a suspend (stop). `start()` alone is a no-op while stopped
 	* because `stop()` latches `this.stopped = true`; resume clears that latch,
 	* resets the crash backoff, and re-spawns. Used by the RuntimeGate to bring
@@ -22831,10 +22916,20 @@ var RuntimeProcess = class {
 	}
 	/**
 	* Restart the runtime process (stop then start with fresh backoff).
+	*
+	* This is a PLANNED restart (`runtime.restart`, post-upgrade cycle, gate
+	* request), so by default it drains any in-flight chat turn before stopping
+	* — see {@link stopWhenIdle}. Pass `{ drain: false }` to force an immediate
+	* stop (e.g. when the caller has already established the child is unhealthy).
 	*/
-	async restart() {
-		log$2.info({ runtime: this.options.runtime }, "Restarting runtime...");
-		await this.stop();
+	async restart(opts) {
+		const drain = opts?.drain ?? true;
+		log$3.info({
+			runtime: this.options.runtime,
+			drain
+		}, "Restarting runtime...");
+		if (drain) await this.stopWhenIdle();
+		else await this.stop();
 		this.stopped = false;
 		this.backoffMs = BACKOFF_INITIAL_MS;
 		this.start();
@@ -22847,6 +22942,78 @@ var RuntimeProcess = class {
 	}
 };
 //#endregion
+//#region src/turn-activity.ts
+/**
+* Turn-activity probe — lets a NON-crash runtime restart wait for the runtime
+* to finish any in-flight chat turn before the child is SIGTERM'd.
+*
+* ## Why this exists
+*
+* Every non-crash restart path (`runtime.restart`, `daemon.update`,
+* `daemon.restart`, the RuntimeGate resume after a mutating reconcile) used to
+* route straight into {@link RuntimeProcess.stop}, which is SIGTERM →
+* SIGKILL-after-5s with zero turn-awareness. A platform-pushed `daemon.update`
+* that landed mid-turn killed the runtime child while it was streaming a reply,
+* and the user saw an "unknown error" for a turn that was otherwise healthy.
+*
+* The fix is a small "is a turn active?" signal that the daemon can consult
+* before a *planned* stop, deferring the SIGTERM until the runtime reports idle
+* (or a grace deadline elapses). Crash restarts do NOT consult it — the child is
+* already dead or wedged, so there is nothing to drain.
+*
+* ## The runtime-side contract (the boundary)
+*
+* The runtime's activity is a property of the chat plugin's active-turn state,
+* which lives INSIDE the runtime child (e.g. `openclaw-chat`'s per-turn run
+* gate). The daemon cannot see it directly. The daemon reaches it over the same
+* IPC socket the plugin already uses to register:
+*
+*   daemon → plugin request:  { method: 'runtime.activity' }
+*   plugin → daemon response: { ok: true, payload: { active: boolean } }
+*
+* `runtime.activity` is on the daemon→plugin method allowlist (see
+* protocol.ts). A plugin answers `active: true` while it is dispatching a turn
+* and `active: false` otherwise. This is the ONE thing the runtime must provide;
+* everything else in the drain lives on the gateway side.
+*
+* ## Fail-open to idle
+*
+* If NO connected plugin answers `runtime.activity` (older plugin build, the
+* chat plugin isn't loaded, the request times out), the probe reports **idle**.
+* A planned restart must never hang forever waiting on a signal that will never
+* arrive — the grace deadline is a backstop, but fail-open-to-idle means the
+* common "nothing to drain" case restarts immediately with no added latency.
+*/
+const log$2 = logger$1.child({ component: "TurnActivity" });
+/** The IPC method the daemon calls on plugins to ask "is a turn active?". */
+const RUNTIME_ACTIVITY_METHOD = "runtime.activity";
+/**
+* IPC-backed probe. Broadcasts `runtime.activity` to every registered plugin
+* and reports active if ANY plugin claims an in-flight turn. Fails open to idle
+* on any error / timeout / non-answer so a planned restart is never wedged.
+*/
+var IpcTurnActivityProbe = class {
+	constructor(getIpcServer, probeTimeoutMs = 2e3) {
+		this.getIpcServer = getIpcServer;
+		this.probeTimeoutMs = probeTimeoutMs;
+	}
+	async isTurnActive() {
+		const ipc = this.getIpcServer();
+		if (!ipc || ipc.registeredCount === 0) return false;
+		try {
+			const responses = await ipc.broadcastRequest(RUNTIME_ACTIVITY_METHOD, {}, this.probeTimeoutMs);
+			for (const [pluginId, res] of responses) if (res.ok && res.payload != null && typeof res.payload === "object" && res.payload.active === true) {
+				log$2.debug({ pluginId }, "Plugin reports an in-flight turn");
+				return true;
+			}
+			return false;
+		} catch (err) {
+			log$2.debug({ err: err instanceof Error ? err.message : String(err) }, "Turn-activity probe failed — assuming idle");
+			return false;
+		}
+	}
+};
+//#endregion
 //#region src/command-registry.ts
 /**
 * Command Registry — maps integration command names to local handler files.
@@ -23477,6 +23644,7 @@ let mcpManagerRef = null;
 let hermesMcpSync = null;
 let aiProxyServer = null;
 let runtimeProcess = null;
+let turnActivityProbe = null;
 let aiProxyUrl = null;
 let aiProxyRunning = false;
 let cloudConnected = false;
@@ -23770,6 +23938,7 @@ async function startDaemon() {
 	logger$1.debug({ socketPath: config.socketPath }, "Starting IPC server...");
 	ipcServer = new IPCServer(config.socketPath);
 	ipcServer.setRequestHandler(handlePluginRequest);
+	turnActivityProbe = new IpcTurnActivityProbe(() => ipcServer);
 	try {
 		await ipcServer.start();
 		logger$1.debug("IPC server started");
@@ -23933,6 +24102,7 @@ async function startDaemon() {
 				workspace: runtimeCfg.workspace,
 				env: {}
 			});
+			runtimeProcess.setTurnActivityProbe(turnActivityProbe);
 			runtimeProcess.start();
 			logger$1.debug("Runtime process started");
 			if (config.runtime === "openclaw") {
@@ -24038,11 +24208,46 @@ async function handleCloudCommand(command) {
 	}
 	return ack;
 }
+/**
+* Wait for any in-flight chat turn to finish before a daemon PROCESS exit
+* (daemon.update / daemon.restart). Those paths don't stop the runtime via
+* `RuntimeProcess.stop` — they exit the daemon, and systemd/launchd cgroup-kill
+* the runtime child underneath. That kill is just as turn-destroying as a
+* SIGTERM, so we drain here too. Grace-deadline backstopped; fails open to
+* "proceed" so a wedged turn can't strand a platform-pushed update.
+*/
+async function drainRuntimeBeforeExit(reason) {
+	const probe = turnActivityProbe;
+	if (!probe || !runtimeProcess?.isRunning) return;
+	const deadline = Date.now() + DRAIN_GRACE_MS;
+	let deferred = false;
+	while (Date.now() < deadline) {
+		let active;
+		try {
+			active = await probe.isTurnActive();
+		} catch {
+			return;
+		}
+		if (!active) {
+			if (deferred) logger$1.info({ reason }, "Runtime idle — proceeding with planned daemon exit");
+			return;
+		}
+		if (!deferred) {
+			deferred = true;
+			logger$1.info({ reason }, "Runtime is mid-turn — deferring planned daemon exit until idle");
+		}
+		await new Promise((resolve) => setTimeout(resolve, 500));
+	}
+	logger$1.warn({
+		reason,
+		graceMs: DRAIN_GRACE_MS
+	}, "Runtime still mid-turn at drain grace deadline — proceeding with daemon exit");
+}
 async function executeCloudCommand(command) {
 	if (command.command === "daemon.update") {
 		const version = command.payload?.version ?? "latest";
 		setTimeout(() => {
-			import("./upgrade.js").then(({ upgradeAndExit }) => upgradeAndExit(version)).catch((err) => {
+			drainRuntimeBeforeExit("daemon.update").then(() => import("./upgrade.js")).then(({ upgradeAndExit }) => upgradeAndExit(version)).catch((err) => {
 				logger$1.error({ err: err instanceof Error ? err.message : String(err) }, "Upgrade failed");
 				process.exit(1);
 			});
@@ -24060,7 +24265,9 @@ async function executeCloudCommand(command) {
 	if (command.command === "daemon.restart") {
 		logger$1.info("Restart requested — exiting for systemd restart");
 		setTimeout(() => {
-			process.exit(0);
+			drainRuntimeBeforeExit("daemon.restart").then(() => {
+				process.exit(0);
+			});
 		}, 500);
 		return {
 			type: "COMMAND_ACK",
@@ -24437,17 +24644,41 @@ function handleMcpListServers(manager = mcpManagerRef) {
 			message: "MCP manager not initialized"
 		}
 	};
+	const statuses = manager.serverStatuses ? manager.serverStatuses() : [];
+	const byName = new Map(statuses.map((s) => [s.name, s]));
 	return {
 		ok: true,
-		payload: { servers: manager.listServers() }
+		payload: { servers: manager.listServers().map(({ id, entry }) => ({
+			id,
+			entry,
+			status: byName.get(id) ?? {
+				name: id,
+				connected: false,
+				toolCount: 0,
+				consecutiveFailures: 0
+			}
+		})) }
 	};
 }
 /**
-* Register a new MCP server in the alfe bundler store on behalf of the
-* agent. Owned as `'manual'` so the agent can later remove it without
-* an expectedOwner conflict — matches what `alfe mcp add` does from the
-* CLI. The daemon's bundler will pick the change up via the manager's
-* store watcher and spawn the child on the next tool-factory call.
+* How long the add-confirm probe waits for the freshly-added server to
+* connect before replying. This is effectively the whole budget for
+* `bundler.warmServer`: the `Manager.warmServer` pre-reconcile is cheap here
+* because `addServer` already queued the Connection object into the store +
+* bundler before we probe, so `reconcileBundler()` finds no diff and returns
+* fast. Kept well under the plugin caller's 30s IPC timeout. A slower server
+* still connects in the background and surfaces on the next
+* `alfe_mcp_list_tools` — the probe just reports what it saw within the window.
+*/
+const MCP_ADD_WARM_TIMEOUT_MS = 12e3;
+/**
+* Register a new MCP server in the alfe bundler store on behalf of the agent,
+* then CONFIRM the connect before replying so the agent learns whether the
+* server actually works. Owned as `'manual'` so the agent can later remove it
+* without an expectedOwner conflict — matches what `alfe mcp add` does from the
+* CLI. Registration is durable regardless of the probe outcome: a probe
+* failure (or a runtime with no daemon bundler, e.g. hermes) still returns
+* `ok` with `connected: false`; the store watcher / runtime picks the entry up.
 */
 async function handleMcpAddServer(params, manager = mcpManagerRef) {
 	if (!manager) return {
@@ -24478,10 +24709,6 @@ async function handleMcpAddServer(params, manager = mcpManagerRef) {
 			id: p.id,
 			owner: "manual"
 		});
-		return {
-			ok: true,
-			payload: { id: p.id }
-		};
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		logger$1.warn({
@@ -24496,6 +24723,24 @@ async function handleMcpAddServer(params, manager = mcpManagerRef) {
 			}
 		};
 	}
+	let status = null;
+	if (manager.warmServer) try {
+		status = await manager.warmServer(p.id, MCP_ADD_WARM_TIMEOUT_MS);
+	} catch (err) {
+		logger$1.warn({
+			id: p.id,
+			err: err instanceof Error ? err.message : String(err)
+		}, "mcp.add_server warm probe threw");
+	}
+	return {
+		ok: true,
+		payload: {
+			id: p.id,
+			connected: status?.connected ?? false,
+			toolCount: status?.toolCount ?? 0,
+			...status?.lastError !== void 0 ? { error: status.lastError } : {}
+		}
+	};
 }
 function buildServerConfig(p) {
 	if (typeof p.command === "string" && p.command.length > 0) {

package/dist/runtime-upgrade.js

@@ -67,7 +67,7 @@ async function upgradeRuntime(runtime, version, runtimeProcess) {
 	}, "Upgrading runtime...");
 	if (runtimeProcess) {
 		logger.info("Stopping runtime for upgrade...");
-		await runtimeProcess.stop();
+		await runtimeProcess.stopWhenIdle();
 	}
 	try {
 		const { stdout, stderr } = await execFileAsync(cmd.command, cmd.args, { timeout: 12e4 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -23,12 +23,12 @@
     "pino-roll": "^1.2.0",
     "smol-toml": ">=1.6.1",
     "ws": "^8.18.0",
-    "@alfe.ai/agent-api-client": "^0.8.0",
+    "@alfe.ai/agent-api-client": "^0.10.0",
     "@alfe.ai/ai-proxy-local": "^0.0.13",
     "@alfe.ai/config": "^0.3.0",
     "@alfe.ai/integration-manifest": "^0.3.1",
-    "@alfe.ai/integrations": "^0.4.1",
-    "@alfe.ai/mcp-bundler": "^0.3.0"
+    "@alfe.ai/integrations": "^0.4.2",
+    "@alfe.ai/mcp-bundler": "^0.3.1"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",