@analyticscli/growth-engineer 0.1.0-preview.15 → 0.1.0-preview.18

package/dist/runtime/openclaw-growth-start.mjs

@@ -4,7 +4,7 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { buildGrowthRunnerCommand, buildOpenClawGrowthSystemEvent, deriveSchedulerProofPathFromStatePath, deriveStatePathFromConfigPath, getActionMode, getAutomationConfig, getDefaultSourceCommand, } from './openclaw-growth-shared.mjs';
+import { buildGrowthRunnerCommand, buildOpenClawCronAddCommand, deriveSchedulerProofPathFromStatePath, deriveStatePathFromConfigPath, getActionMode, getAutomationConfig, getDefaultSourceCommand, getOpenClawCronEditDeliveryCommandFromInspection, buildHermesCronCreateCommand, inspectHermesCronInstall, inspectOpenClawCronInstall, repairOpenClawCronDeliveryStore, } from './openclaw-growth-shared.mjs';
 import { applyOpenClawSecretRefs, loadOpenClawGrowthSecrets } from './openclaw-growth-env.mjs';
 const DEFAULT_CONFIG_PATH = 'data/openclaw-growth-engineer/config.json';
 const DEFAULT_TEMPLATE_PATH = 'data/openclaw-growth-engineer/config.example.json';
@@ -16,6 +16,55 @@ const ANALYTICSCLI_PACKAGE_SPEC = process.env.ANALYTICSCLI_CLI_PACKAGE || '@anal
 const ANALYTICSCLI_NPM_PREFIX = process.env.ANALYTICSCLI_NPM_PREFIX ||
     (process.env.HOME ? path.join(process.env.HOME, '.local') : path.join(process.cwd(), '.analyticscli-npm'));
 const RUNTIME_DIR = path.dirname(fileURLToPath(import.meta.url));
+const ACCOUNT_SIGNAL_CONNECTORS = [
+    'stripe',
+    'lemonsqueezy',
+    'adapty',
+    'superwall',
+    'google-play',
+    'datadog',
+    'bugsnag',
+    'intercom',
+    'zendesk',
+    'apple-search-ads',
+    'google-ads',
+    'meta-ads',
+    'tiktok-ads',
+    'vercel',
+    'cloudflare',
+    'resend',
+    'customerio',
+    'mailchimp',
+    'appfollow',
+    'apptweak',
+    'linear',
+    'postiz',
+];
+const SUPPORTED_CONNECTORS = ['analytics', 'github', 'asc', 'revenuecat', 'paddle', 'seo', 'sentry', 'coolify', ...ACCOUNT_SIGNAL_CONNECTORS];
+const ACCOUNT_SIGNAL_SECRET_ENVS = {
+    stripe: ['STRIPE_API_KEY'],
+    lemonsqueezy: ['LEMON_SQUEEZY_API_KEY'],
+    adapty: ['ADAPTY_API_KEY'],
+    superwall: ['SUPERWALL_API_KEY'],
+    'google-play': ['GOOGLE_PLAY_SERVICE_ACCOUNT_JSON'],
+    datadog: ['DATADOG_API_KEY', 'DATADOG_APP_KEY'],
+    bugsnag: ['BUGSNAG_AUTH_TOKEN'],
+    intercom: ['INTERCOM_ACCESS_TOKEN'],
+    zendesk: ['ZENDESK_SUBDOMAIN', 'ZENDESK_EMAIL', 'ZENDESK_API_TOKEN'],
+    'apple-search-ads': ['APPLE_SEARCH_ADS_REFRESH_TOKEN'],
+    'google-ads': ['GOOGLE_ADS_DEVELOPER_TOKEN', 'GOOGLE_ADS_CLIENT_ID', 'GOOGLE_ADS_CLIENT_SECRET', 'GOOGLE_ADS_REFRESH_TOKEN'],
+    'meta-ads': ['META_ADS_ACCESS_TOKEN'],
+    'tiktok-ads': ['TIKTOK_ADS_ACCESS_TOKEN'],
+    vercel: ['VERCEL_ACCESS_TOKEN'],
+    cloudflare: ['CLOUDFLARE_API_TOKEN'],
+    resend: ['RESEND_API_KEY'],
+    customerio: ['CUSTOMERIO_APP_API_KEY'],
+    mailchimp: ['MAILCHIMP_API_KEY'],
+    appfollow: ['APPFOLLOW_API_TOKEN'],
+    apptweak: ['APPTWEAK_API_TOKEN'],
+    linear: ['LINEAR_API_KEY'],
+    postiz: ['POSTIZ_API_KEY'],
+};
 function printHelpAndExit(exitCode, reason = null) {
     if (reason) {
         process.stderr.write(`${reason}\n\n`);
@@ -35,9 +84,9 @@ Options:
   --config <file>        Config path (default: ${DEFAULT_CONFIG_PATH})
   --project <id>         Optional AnalyticsCLI project ID pin for generated source commands
   --asc-app <id>         Optional ASC app ID filter (defaults to all accessible apps)
-  --connectors <list>    Install/enable connector helpers (analytics,github,asc,revenuecat,sentry,all)
+  --connectors <list>    Install/enable connector helpers (${SUPPORTED_CONNECTORS.join(',')},all)
   --only-connectors <list>
-                         Limit live preflight checks to analytics,github,asc,revenuecat,sentry
+                         Limit live preflight checks to ${SUPPORTED_CONNECTORS.join(',')}
   --setup-only           Run bootstrap + preflight only (skip first run)
   --no-test-connections  Skip live API smoke checks in preflight
   --openclaw-cron <mode> Configure OpenClaw Gateway cron: auto, enable, require, disable (default: auto)
@@ -50,9 +99,21 @@ Options:
 `);
     process.exit(exitCode);
 }
+function resolveDefaultConfigPath() {
+    const explicit = String(process.env.OPENCLAW_GROWTH_CONFIG_PATH || '').trim();
+    if (explicit)
+        return explicit;
+    const homeConfigPath = process.env.HOME ? path.join(process.env.HOME, 'data/openclaw-growth-engineer/config.json') : '';
+    const homeStatePath = process.env.HOME ? path.join(process.env.HOME, 'data/openclaw-growth-engineer/state.json') : '';
+    if (homeConfigPath && existsSync(homeConfigPath) && existsSync(homeStatePath))
+        return homeConfigPath;
+    if (!existsSync(DEFAULT_CONFIG_PATH) && homeConfigPath && existsSync(homeConfigPath))
+        return homeConfigPath;
+    return DEFAULT_CONFIG_PATH;
+}
 function parseArgs(argv) {
     const args = {
-        config: DEFAULT_CONFIG_PATH,
+        config: resolveDefaultConfigPath(),
         project: '',
         ascApp: '',
         run: true,
@@ -147,8 +208,58 @@ function normalizeConnectorKey(value) {
         return 'asc';
     if (['revenuecat', 'revenue-cat', 'rc', 'revenuecat-mcp'].includes(normalized))
         return 'revenuecat';
+    if (['paddle', 'paddle-billing', 'billing-metrics', 'web-revenue'].includes(normalized))
+        return 'paddle';
+    if (['seo', 'gsc', 'google-search-console', 'search-console', 'dataforseo', 'organic-search'].includes(normalized))
+        return 'seo';
     if (['sentry', 'sentry-api', 'sentry-mcp', 'crashes', 'errors', 'crash-reporting'].includes(normalized))
         return 'sentry';
+    if (['coolify', 'coolify-api', 'deployment', 'deployments', 'hosting', 'infra', 'infrastructure'].includes(normalized))
+        return 'coolify';
+    if (['stripe', 'stripe-billing', 'stripe-payments'].includes(normalized))
+        return 'stripe';
+    if (['lemonsqueezy', 'lemon-squeezy', 'lemon', 'ls'].includes(normalized))
+        return 'lemonsqueezy';
+    if (['adapty', 'adapty-paywalls', 'adapty-subscriptions'].includes(normalized))
+        return 'adapty';
+    if (['superwall', 'superwall-paywalls'].includes(normalized))
+        return 'superwall';
+    if (['google-play', 'google-play-console', 'play-console', 'play-store', 'android-store'].includes(normalized))
+        return 'google-play';
+    if (['datadog', 'datadog-rum', 'datadog-apm', 'datadog-logs'].includes(normalized))
+        return 'datadog';
+    if (['bugsnag', 'bugsnag-crashes'].includes(normalized))
+        return 'bugsnag';
+    if (['intercom', 'intercom-support'].includes(normalized))
+        return 'intercom';
+    if (['zendesk', 'zendesk-support'].includes(normalized))
+        return 'zendesk';
+    if (['apple-search-ads', 'apple-ads', 'asa', 'search-ads'].includes(normalized))
+        return 'apple-search-ads';
+    if (['google-ads', 'adwords'].includes(normalized))
+        return 'google-ads';
+    if (['meta-ads', 'facebook-ads', 'instagram-ads', 'fb-ads'].includes(normalized))
+        return 'meta-ads';
+    if (['tiktok-ads', 'tiktok-business', 'tiktok-business-api'].includes(normalized))
+        return 'tiktok-ads';
+    if (['vercel', 'vercel-deployments', 'vercel-hosting'].includes(normalized))
+        return 'vercel';
+    if (['cloudflare', 'cf', 'cloudflare-workers', 'cloudflare-pages'].includes(normalized))
+        return 'cloudflare';
+    if (['resend', 'resend-email'].includes(normalized))
+        return 'resend';
+    if (['customerio', 'customer-io', 'customer.io', 'cio'].includes(normalized))
+        return 'customerio';
+    if (['mailchimp', 'mailchimp-marketing'].includes(normalized))
+        return 'mailchimp';
+    if (['appfollow', 'app-follow'].includes(normalized))
+        return 'appfollow';
+    if (['apptweak', 'app-tweak'].includes(normalized))
+        return 'apptweak';
+    if (['linear', 'linear-issues', 'linear-planning'].includes(normalized))
+        return 'linear';
+    if (['postiz', 'postiz-api', 'social-publishing', 'social-scheduler'].includes(normalized))
+        return 'postiz';
     return null;
 }
 function parseConnectorList(value) {
@@ -158,14 +269,10 @@ function parseConnectorList(value) {
     for (const entry of String(value).split(',')) {
         const connector = normalizeConnectorKey(entry);
         if (!connector) {
-            printHelpAndExit(1, `Unknown connector: ${entry.trim()}. Use analytics, github, asc, revenuecat, sentry, or all.`);
+            printHelpAndExit(1, `Unknown connector: ${entry.trim()}. Use ${SUPPORTED_CONNECTORS.join(', ')}, or all.`);
         }
         if (connector === 'all') {
-            connectors.add('analytics');
-            connectors.add('github');
-            connectors.add('asc');
-            connectors.add('revenuecat');
-            connectors.add('sentry');
+            SUPPORTED_CONNECTORS.forEach((supported) => connectors.add(supported));
         }
         else {
             connectors.add(connector);
@@ -198,9 +305,18 @@ function getRuntimeSourceCommand(sourceName) {
     if (normalized === 'revenuecat' || normalized === 'revenue-cat') {
         return nodeRuntimeScriptCommand('export-revenuecat-summary.mjs');
     }
+    if (normalized === 'paddle') {
+        return nodeRuntimeScriptCommand('export-paddle-summary.mjs');
+    }
+    if (['seo', 'gsc', 'google-search-console', 'search-console', 'dataforseo'].includes(normalized)) {
+        return nodeRuntimeScriptCommand('export-seo-summary.mjs');
+    }
     if (normalized === 'sentry' || normalized === 'glitchtip') {
         return nodeRuntimeScriptCommand('export-sentry-summary.mjs');
     }
+    if (normalized === 'coolify') {
+        return nodeRuntimeScriptCommand('export-coolify-summary.mjs');
+    }
     if (['asc', 'asc-cli', 'app-store-connect', 'app_store_connect'].includes(normalized)) {
         return nodeRuntimeScriptCommand('export-asc-summary.mjs');
     }
@@ -210,7 +326,7 @@ function replaceLegacyRuntimeScriptCommand(command) {
     const trimmed = String(command || '').trim();
     if (!trimmed)
         return trimmed;
-    return trimmed.replace(/^node\s+scripts\/(export-analytics-summary\.mjs|export-revenuecat-summary\.mjs|export-sentry-summary\.mjs|export-asc-summary\.mjs|openclaw-growth-start\.mjs|openclaw-growth-status\.mjs|openclaw-growth-preflight\.mjs|openclaw-growth-runner\.mjs|openclaw-growth-engineer\.mjs)(?=\s|$)/, (_match, scriptName) => nodeRuntimeScriptCommand(scriptName));
+    return trimmed.replace(/^node\s+scripts\/(export-analytics-summary\.mjs|export-revenuecat-summary\.mjs|export-paddle-summary\.mjs|export-seo-summary\.mjs|export-sentry-summary\.mjs|export-coolify-summary\.mjs|export-asc-summary\.mjs|openclaw-growth-start\.mjs|openclaw-growth-status\.mjs|openclaw-growth-preflight\.mjs|openclaw-growth-runner\.mjs|openclaw-growth-engineer\.mjs)(?=\s|$)/, (_match, scriptName) => nodeRuntimeScriptCommand(scriptName));
 }
 function normalizeSourceCommand(sourceName, source) {
     return replaceLegacyRuntimeScriptCommand(source?.command || '') || getRuntimeSourceCommand(sourceName);
@@ -220,7 +336,7 @@ function migrateRuntimeSourceCommands(config) {
         return config;
     const sources = config.sources && typeof config.sources === 'object' ? config.sources : {};
     const nextSources = { ...sources };
-    for (const sourceName of ['analytics', 'revenuecat', 'sentry']) {
+    for (const sourceName of ['analytics', 'revenuecat', 'paddle', 'seo', 'sentry', 'coolify']) {
         if (nextSources[sourceName]?.mode === 'command') {
             nextSources[sourceName] = {
                 ...nextSources[sourceName],
@@ -275,10 +391,19 @@ function emitProgress(enabled, event) {
         return;
     process.stderr.write(`OPENCLAW_PROGRESS ${JSON.stringify(event)}\n`);
 }
+function hardenUnattendedShellCommand(command) {
+    return String(command || '').replace(/(^|[;&|]\s*)sudo(?!\s+-n(?:\s|$))(?=\s|$)/g, '$1sudo -n');
+}
 function runShellCommand(command, timeoutMs = 120_000, options = {}) {
     return new Promise((resolve) => {
-        const child = spawn(resolveShellCommand(), ['-c', command], {
+        const child = spawn(resolveShellCommand(), ['-c', hardenUnattendedShellCommand(command)], {
             stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                DEBIAN_FRONTEND: 'noninteractive',
+                SUDO_ASKPASS: '/bin/false',
+                SUDO_PROMPT: '',
+            },
         });
         let stdout = '';
         let stderr = '';
@@ -561,12 +686,13 @@ function renderHeartbeatBlock(configPath, config) {
     const displayConfigPath = relativeWorkspacePath(configPath);
     const displayStatePath = deriveStatePathFromConfigPath(displayConfigPath);
     const runnerCommand = buildGrowthRunnerCommand(displayConfigPath, displayStatePath);
+    const wizardCommand = 'npx -y @analyticscli/growth-engineer@preview wizard --connectors';
     return `${HEARTBEAT_MARKER_START}
 tasks:
 
 - name: openclaw-growth-engineer-run
   interval: ${interval}
-  prompt: "Run \`${runnerCommand}\` from the workspace if the config and runtime files exist. The runner owns schedule.cadences, connectorHealthCheckIntervalMinutes, skipIfNoDataChange, and skipIfIssueSetUnchanged. If it reports connector-health alerts, production crashes, generated issues, or actionable growth findings, summarize only the action and evidence. If setup files are missing, tell the user to run \`node scripts/openclaw-growth-wizard.mjs --connectors --config ${displayConfigPath}\`. If there is no actionable output, reply HEARTBEAT_OK."
+  prompt: "Run \`${runnerCommand}\` from the workspace if the config and runtime files exist. The runner owns schedule.cadences, connectorHealthCheckIntervalMinutes, skipIfNoDataChange, and skipIfIssueSetUnchanged. If it reports connector-health alerts, production crashes, generated issues, or actionable growth findings, summarize only the action and evidence. If setup files are missing, tell the user to run \`${wizardCommand}\`. If there is no actionable output, reply HEARTBEAT_OK."
 
 # Keep this section small. Do not put secrets in HEARTBEAT.md.
 ${HEARTBEAT_MARKER_END}`;
@@ -658,47 +784,162 @@ async function ensureOpenClawCronSchedule(configPath, config, mode = 'auto') {
             proof,
         };
     }
-    const list = await runShellCommand('openclaw cron list', 30_000);
-    if (list.ok && list.stdout.includes(automation.openclawCron.name)) {
+    const displayConfigPath = relativeWorkspacePath(configPath);
+    const addCommand = buildOpenClawCronAddCommand(displayConfigPath, config);
+    const inspection = await inspectOpenClawCronInstall({
+        configPath: displayConfigPath,
+        config,
+        runCommand: runShellCommand,
+        readFile: fs.readFile,
+    });
+    if (inspection.exists && inspection.verified) {
         return {
             ok: true,
             enabled: true,
             installed: true,
-            status: 'already_configured',
-            detail: `OpenClaw cron job already exists: ${automation.openclawCron.name}`,
+            status: 'already_configured_verified',
+            detail: `OpenClaw cron job already exists and matches the Growth Engineer runner contract: ${automation.openclawCron.name}`,
             schedule: automation.openclawCron.schedule,
             timezone: automation.openclawCron.timezone,
+            source: inspection.source,
             proof,
         };
     }
-    const displayConfigPath = relativeWorkspacePath(configPath);
-    const eventText = buildOpenClawGrowthSystemEvent(displayConfigPath, config);
-    const addCommand = [
-        'openclaw cron add',
-        '--name',
-        quote(automation.openclawCron.name),
-        '--cron',
-        quote(automation.openclawCron.schedule),
-        '--tz',
-        quote(automation.openclawCron.timezone),
-        '--session',
-        automation.openclawCron.mode === 'isolated' ? 'isolated' : 'main',
-        automation.openclawCron.mode === 'isolated' ? '--message' : '--system-event',
-        quote(eventText),
-        automation.openclawCron.mode === 'isolated' ? '--announce' : '--wake now',
-    ].join(' ');
+    if (inspection.exists && inspection.reason === 'delivery_mismatch') {
+        const editCommand = getOpenClawCronEditDeliveryCommandFromInspection(inspection, config);
+        if (editCommand) {
+            const edit = await runShellCommand(editCommand, 60_000);
+            if (edit.ok) {
+                return {
+                    ok: true,
+                    enabled: true,
+                    installed: true,
+                    status: 'repaired_delivery_cli',
+                    detail: `Repaired OpenClaw cron delivery with: ${editCommand}`,
+                    schedule: automation.openclawCron.schedule,
+                    timezone: automation.openclawCron.timezone,
+                    command: editCommand,
+                    source: inspection.source,
+                    proof,
+                };
+            }
+        }
+        const repair = await repairOpenClawCronDeliveryStore({
+            configPath: displayConfigPath,
+            config,
+            readFile: fs.readFile,
+            writeFile: fs.writeFile,
+        });
+        if (repair.repaired) {
+            return {
+                ok: true,
+                enabled: true,
+                installed: true,
+                status: 'repaired_delivery',
+                detail: `Repaired OpenClaw cron delivery for "${automation.openclawCron.name}" in ${repair.path}`,
+                schedule: automation.openclawCron.schedule,
+                timezone: automation.openclawCron.timezone,
+                source: repair.path,
+                command: editCommand || undefined,
+                proof,
+            };
+        }
+    }
     const add = await runShellCommand(addCommand, 60_000);
+    const existingDetail = inspection.exists
+        ? `Existing OpenClaw cron job "${automation.openclawCron.name}" was not verifiably wired to the current runner contract (${inspection.reason} via ${inspection.source}). `
+        : '';
     return {
-        ok: add.ok || normalizedMode === 'auto',
+        ok: add.ok || (normalizedMode === 'auto' && !inspection.exists),
         enabled: true,
         installed: add.ok,
-        status: add.ok ? 'configured' : 'failed',
+        status: add.ok ? (inspection.exists ? 'reconfigured' : 'configured') : inspection.exists ? 'needs_repair' : 'failed',
         detail: add.ok
-            ? `Configured OpenClaw cron job "${automation.openclawCron.name}" (${automation.openclawCron.schedule}, ${automation.openclawCron.timezone})`
-            : add.stderr.trim() || add.stdout.trim() || `openclaw cron add exited ${add.code}`,
+            ? `${existingDetail}Configured OpenClaw cron job "${automation.openclawCron.name}" (${automation.openclawCron.schedule}, ${automation.openclawCron.timezone})`
+            : `${existingDetail}${add.stderr.trim() || add.stdout.trim() || `openclaw cron add exited ${add.code}`}`,
         schedule: automation.openclawCron.schedule,
         timezone: automation.openclawCron.timezone,
         command: addCommand,
+        remediation: inspection.exists && !add.ok
+            ? `Remove the stale OpenClaw cron job named "${automation.openclawCron.name}" with your installed OpenClaw CLI, then rerun: ${addCommand}`
+            : undefined,
+        proof,
+    };
+}
+async function ensureHermesCronSchedule(configPath, config, mode = 'auto') {
+    const normalizedMode = validateOpenClawCronMode(mode);
+    const automation = getAutomationConfig(config);
+    const displayConfigPath = relativeWorkspacePath(configPath);
+    const statePath = deriveStatePathFromConfigPath(displayConfigPath);
+    const proofPath = deriveSchedulerProofPathFromStatePath(statePath);
+    const workdir = path.resolve(automation.hermesCron.workdir || process.cwd());
+    const proof = {
+        listCommand: 'hermes cron list',
+        statusCommand: 'hermes cron status <job-id>',
+        stateCommand: `jq '.connectorHealth, .cadences, .lastRunAt, .skippedReason' ${quote(statePath)}`,
+        proofCommand: `tail -n 20 ${quote(proofPath)}`,
+    };
+    if (normalizedMode === 'disable' || automation.hermesCron.enabled === false) {
+        return {
+            ok: true,
+            enabled: false,
+            installed: false,
+            status: 'disabled',
+            detail: 'Hermes cron setup disabled',
+            proof,
+        };
+    }
+    const hermesPath = await resolveCommandPath('hermes');
+    if (!hermesPath) {
+        return {
+            ok: normalizedMode === 'auto',
+            enabled: true,
+            installed: false,
+            status: normalizedMode === 'auto' ? 'skipped' : 'failed',
+            detail: 'hermes CLI not found on PATH; skipping Hermes cron setup',
+            remediation: 'Run this setup inside the host shell where Hermes Gateway is installed, or install the hermes CLI.',
+            proof,
+        };
+    }
+    const createCommand = buildHermesCronCreateCommand(displayConfigPath, config, { workdir });
+    const inspection = await inspectHermesCronInstall({
+        configPath: displayConfigPath,
+        config,
+        runCommand: runShellCommand,
+        readFile: fs.readFile,
+        workdir,
+    });
+    if (inspection.exists && inspection.verified) {
+        return {
+            ok: true,
+            enabled: true,
+            installed: true,
+            status: 'already_configured_verified',
+            detail: `Hermes cron job already exists and matches the Growth Engineer runner contract: ${automation.hermesCron.name}`,
+            schedule: automation.hermesCron.schedule,
+            workdir,
+            source: inspection.source,
+            proof,
+        };
+    }
+    const create = await runShellCommand(createCommand, 60_000);
+    const existingDetail = inspection.exists
+        ? `Existing Hermes cron job "${automation.hermesCron.name}" was not verifiably wired to the current runner contract (${inspection.reason} via ${inspection.source}). `
+        : '';
+    return {
+        ok: create.ok || (normalizedMode === 'auto' && !inspection.exists),
+        enabled: true,
+        installed: create.ok,
+        status: create.ok ? (inspection.exists ? 'reconfigured' : 'configured') : inspection.exists ? 'needs_repair' : 'failed',
+        detail: create.ok
+            ? `${existingDetail}Configured Hermes cron job "${automation.hermesCron.name}" (${automation.hermesCron.schedule})`
+            : `${existingDetail}${create.stderr.trim() || create.stdout.trim() || `hermes cron create exited ${create.code}`}`,
+        schedule: automation.hermesCron.schedule,
+        workdir,
+        command: createCommand,
+        remediation: inspection.exists && !create.ok
+            ? `Remove the stale Hermes cron job named "${automation.hermesCron.name}" with your installed Hermes CLI, then rerun: ${createCommand}`
+            : undefined,
         proof,
     };
 }
@@ -960,6 +1201,13 @@ async function installSentryConnector() {
     details.push('Sentry direct API exporter enabled via node scripts/export-sentry-summary.mjs');
     return { connector: 'sentry', ok: true, detail: details.join('; ') };
 }
+async function installCoolifyConnector() {
+    return {
+        connector: 'coolify',
+        ok: true,
+        detail: 'Coolify uses the built-in read-only API exporter; create a token in Coolify Keys & Tokens / API tokens and store COOLIFY_BASE_URL plus COOLIFY_API_TOKEN with the connector wizard',
+    };
+}
 async function installGitHubConnector() {
     const details = [];
     await installClawHubSkill('github', details);
@@ -1000,6 +1248,20 @@ async function installAnalyticsConnector() {
             : 'analyticscli binary missing after dependency setup',
     };
 }
+function isAccountSignalConnector(connector) {
+    return ACCOUNT_SIGNAL_CONNECTORS.includes(connector);
+}
+async function installAccountSignalConnector(connector) {
+    const envs = ACCOUNT_SIGNAL_SECRET_ENVS[connector] || [];
+    const missing = envs.filter((envName) => !String(process.env[envName] || '').trim());
+    return {
+        connector,
+        ok: missing.length === 0,
+        detail: missing.length === 0
+            ? 'account-wide credential is present; project/app/product scope is discovered later'
+            : `missing account-wide credential(s): ${missing.join(', ')}`,
+    };
+}
 async function enableConnectorConfig(configPath, connectors) {
     if (connectors.length === 0 || !(await fileExists(configPath)))
         return;
@@ -1015,12 +1277,30 @@ async function enableConnectorConfig(configPath, connectors) {
             revenuecat: connectors.includes('revenuecat')
                 ? { ...(config.sources?.revenuecat || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('revenuecat', config.sources?.revenuecat) }
                 : config.sources?.revenuecat,
+            paddle: connectors.includes('paddle')
+                ? { ...(config.sources?.paddle || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('paddle', config.sources?.paddle) }
+                : config.sources?.paddle,
+            seo: connectors.includes('seo')
+                ? { ...(config.sources?.seo || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('seo', config.sources?.seo) }
+                : config.sources?.seo,
             sentry: connectors.includes('sentry')
                 ? { ...(config.sources?.sentry || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('sentry', config.sources?.sentry) }
                 : config.sources?.sentry,
+            coolify: connectors.includes('coolify')
+                ? {
+                    ...(config.sources?.coolify || {}),
+                    enabled: true,
+                    mode: 'command',
+                    command: normalizeSourceCommand('coolify', config.sources?.coolify),
+                    baseUrl: config.sources?.coolify?.baseUrl || process.env.COOLIFY_BASE_URL || 'https://coolify.wotaso.com',
+                    tokenEnv: config.sources?.coolify?.tokenEnv || 'COOLIFY_API_TOKEN',
+                }
+                : config.sources?.coolify,
             extra: extra.map((source) => connectors.includes('asc') && source?.service === 'asc-cli'
                 ? { ...source, enabled: true, mode: 'command', command: normalizeSourceCommand('asc', source) }
-                : source),
+                : connectors.includes(String(source?.key || source?.service || '')) && isAccountSignalConnector(String(source?.key || source?.service || ''))
+                    ? { ...source, enabled: true, mode: source.mode || 'file' }
+                    : source),
         },
     };
     await writeJson(configPath, next);
@@ -1037,8 +1317,16 @@ async function installConnectorHelpers(configPath, connectors) {
             results.push(await installAscConnector());
         if (connector === 'revenuecat')
             results.push(await installRevenueCatConnector());
+        if (connector === 'paddle')
+            results.push({ connector, ok: true, detail: 'Paddle uses the built-in metrics exporter; token is checked during preflight' });
+        if (connector === 'seo')
+            results.push({ connector, ok: true, detail: 'SEO/GSC uses the built-in exporter; credentials or CSV inputs are checked during preflight' });
         if (connector === 'sentry')
             results.push(await installSentryConnector());
+        if (connector === 'coolify')
+            results.push(await installCoolifyConnector());
+        if (isAccountSignalConnector(connector))
+            results.push(await installAccountSignalConnector(connector));
     }
     return results;
 }
@@ -1127,6 +1415,14 @@ async function ensureConfig(configPath) {
                 mode: 'command',
                 command: getRuntimeSourceCommand('sentry'),
             },
+            coolify: {
+                ...(template.sources?.coolify || {}),
+                enabled: false,
+                mode: 'command',
+                command: getRuntimeSourceCommand('coolify'),
+                baseUrl: template.sources?.coolify?.baseUrl || process.env.COOLIFY_BASE_URL || 'https://coolify.wotaso.com',
+                tokenEnv: template.sources?.coolify?.tokenEnv || 'COOLIFY_API_TOKEN',
+            },
             feedback: {
                 ...(template.sources?.feedback || {}),
                 enabled: false,
@@ -1218,6 +1514,15 @@ function appendProjectFlag(command, projectId) {
 function commandHasAscAppFlag(command) {
     return /(^|\s)--app(\s|=|$)/.test(String(command || ''));
 }
+function removeAscAppFlag(command) {
+    const raw = String(command || '').trim();
+    if (!raw || !commandHasAscAppFlag(raw))
+        return raw;
+    return raw
+        .replace(/(^|\s)--app(?:=(?:"[^"]*"|'[^']*'|\S+)|\s+(?:"[^"]*"|'[^']*'|\S+))/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
 function appendAscAppFlag(command, appId) {
     const raw = String(command || '').trim();
     if (!raw || commandHasAscAppFlag(raw))
@@ -1287,6 +1592,34 @@ async function configureAscApp(configPath, appId) {
     process.env.ASC_APP_ID = normalizedAppId;
     return changed;
 }
+async function configureAscAllApps(configPath) {
+    const config = await readJson(configPath);
+    let changed = false;
+    const extraSources = Array.isArray(config?.sources?.extra) ? config.sources.extra : [];
+    for (const source of extraSources) {
+        if (!source || typeof source !== 'object')
+            continue;
+        const service = String(source.service || source.key || '').trim().toLowerCase();
+        if (!['asc', 'asc-cli', 'app-store-connect', 'app_store_connect'].includes(service))
+            continue;
+        if (source.mode === 'command' && source.command) {
+            const nextCommand = removeAscAppFlag(source.command);
+            if (nextCommand !== source.command) {
+                source.command = nextCommand;
+                changed = true;
+            }
+        }
+    }
+    if (config.project && typeof config.project === 'object' && config.project.ascAppId) {
+        delete config.project.ascAppId;
+        changed = true;
+    }
+    if (changed) {
+        await writeJson(configPath, config);
+    }
+    delete process.env.ASC_APP_ID;
+    return changed;
+}
 function configHasEnabledAscSource(config) {
     const extraSources = Array.isArray(config?.sources?.extra) ? config.sources.extra : [];
     return extraSources.some((source) => {
@@ -1362,11 +1695,7 @@ async function ensureAscAppConfigured(configPath, explicitAppId) {
     if (!configHasEnabledAscSource(config)) {
         return { ok: true, configured: false, changed: false, appId: null, appScope: 'disabled', needsUserInput: false };
     }
-    const configuredAppId = normalizeString(config.project?.ascAppId) || normalizeString(process.env.ASC_APP_ID);
-    if (configuredAppId) {
-        const changed = await configureAscApp(configPath, configuredAppId);
-        return { ok: true, configured: true, changed, appId: configuredAppId, appScope: 'single_app', needsUserInput: false };
-    }
+    const changed = await configureAscAllApps(configPath);
     const appList = await listAscApps();
     if (!appList.ok) {
         return {
@@ -1381,7 +1710,7 @@ async function ensureAscAppConfigured(configPath, explicitAppId) {
     return {
         ok: true,
         configured: true,
-        changed: false,
+        changed,
         appId: null,
         appScope: 'all_accessible_apps',
         apps: appList.apps,
@@ -1389,6 +1718,131 @@ async function ensureAscAppConfigured(configPath, explicitAppId) {
         needsUserInput: false,
     };
 }
+function extractAscAnalyticsRequestIds(payload) {
+    const candidates = (() => {
+        if (Array.isArray(payload))
+            return payload;
+        if (payload && typeof payload === 'object') {
+            if (Array.isArray(payload.requests))
+                return payload.requests;
+            if (Array.isArray(payload.analyticsReportRequests))
+                return payload.analyticsReportRequests;
+            if (Array.isArray(payload.items))
+                return payload.items;
+            if (Array.isArray(payload.data))
+                return payload.data;
+        }
+        return [];
+    })();
+    const ids = [];
+    for (const candidate of candidates) {
+        if (!candidate || typeof candidate !== 'object')
+            continue;
+        const id = normalizeString(candidate.id) || normalizeString(candidate.requestId) || normalizeString(candidate.request_id);
+        if (id)
+            ids.push(id);
+    }
+    return [...new Set(ids)];
+}
+function extractAscAnalyticsRequestId(payload) {
+    if (payload && typeof payload === 'object') {
+        const id = normalizeString(payload.id) || normalizeString(payload.requestId) || normalizeString(payload.request_id);
+        if (id)
+            return id;
+    }
+    return extractAscAnalyticsRequestIds(payload)[0] || null;
+}
+async function listAscAnalyticsRequests(appId, state = '') {
+    const stateArg = state ? ` --state ${quote(state)}` : '';
+    const result = await runShellCommand(`asc analytics requests --app ${quote(appId)}${stateArg} --output json`, 60_000);
+    if (!result.ok) {
+        return { ok: false, ids: [], error: result.stderr || `exit ${result.code}` };
+    }
+    return { ok: true, ids: extractAscAnalyticsRequestIds(parseJsonFromStdout(result.stdout)), error: null };
+}
+async function ensureAscAnalyticsRequest(appId) {
+    const normalizedAppId = normalizeString(appId);
+    if (!normalizedAppId) {
+        return { ok: true, status: 'skipped', requestId: null, detail: 'no single ASC app configured' };
+    }
+    const completedRequests = await listAscAnalyticsRequests(normalizedAppId, 'COMPLETED');
+    if (!completedRequests.ok) {
+        return { ok: false, status: 'query_failed', requestId: null, error: completedRequests.error };
+    }
+    if (completedRequests.ids.length > 0) {
+        return { ok: true, status: 'completed', requestId: completedRequests.ids[0], detail: `completed request ${completedRequests.ids[0]}` };
+    }
+    const existingRequests = await listAscAnalyticsRequests(normalizedAppId);
+    if (!existingRequests.ok) {
+        return { ok: false, status: 'query_failed', requestId: null, error: existingRequests.error };
+    }
+    if (existingRequests.ids.length > 0) {
+        return { ok: true, status: 'pending', requestId: existingRequests.ids[0], detail: `existing request ${existingRequests.ids[0]} is not completed yet` };
+    }
+    const created = await runShellCommand(`asc analytics request --app ${quote(normalizedAppId)} --access-type ONGOING --output json`, 60_000);
+    if (!created.ok) {
+        return { ok: false, status: 'create_failed', requestId: null, error: created.stderr || `exit ${created.code}` };
+    }
+    const requestId = extractAscAnalyticsRequestId(parseJsonFromStdout(created.stdout));
+    return {
+        ok: true,
+        status: 'created',
+        requestId,
+        detail: requestId
+            ? `created ongoing request ${requestId}; report instances will appear after Apple processing`
+            : 'created ongoing request; report instances will appear after Apple processing',
+    };
+}
+async function ensureAscAnalyticsRequestsForAppScope(ascAppSetup) {
+    if (!ascAppSetup?.ok || ascAppSetup.appScope === 'disabled') {
+        return { ok: true, status: 'skipped', requestId: null, requestIds: [], detail: 'ASC source is not enabled', results: [] };
+    }
+    const apps = ascAppSetup.appId
+        ? [{ id: ascAppSetup.appId }]
+        : Array.isArray(ascAppSetup.apps)
+            ? ascAppSetup.apps.filter((app) => normalizeString(app?.id))
+            : [];
+    if (apps.length === 0) {
+        return { ok: true, status: 'skipped', requestId: null, requestIds: [], detail: 'no accessible ASC apps found', results: [] };
+    }
+    const results = [];
+    for (const app of apps) {
+        const result = await ensureAscAnalyticsRequest(app.id);
+        results.push({
+            appId: app.id,
+            appName: app.name || null,
+            ...result,
+        });
+    }
+    const failures = results.filter((result) => !result.ok);
+    if (failures.length > 0) {
+        return {
+            ok: false,
+            status: failures.length === results.length ? 'failed' : 'partial_failed',
+            requestId: null,
+            requestIds: results.map((result) => result.requestId).filter(Boolean),
+            results,
+            error: failures
+                .map((failure) => `${failure.appName || failure.appId}: ${failure.error || failure.status || 'unknown error'}`)
+                .join('; '),
+        };
+    }
+    const counts = results.reduce((memo, result) => {
+        memo[result.status] = (memo[result.status] || 0) + 1;
+        return memo;
+    }, {});
+    const detail = Object.entries(counts)
+        .map(([status, count]) => `${count} ${status}`)
+        .join(', ');
+    return {
+        ok: true,
+        status: 'ok',
+        requestId: results[0]?.requestId || null,
+        requestIds: results.map((result) => result.requestId).filter(Boolean),
+        detail: `checked ${results.length} ASC app(s): ${detail}`,
+        results,
+    };
+}
 async function listAnalyticsProjects() {
     const result = await runShellCommand('analyticscli projects list --format json', 60_000);
     if (!result.ok) {
@@ -1482,7 +1936,7 @@ function remediationForCheck(checkName, configPath) {
         return 'Write `data/openclaw-growth-engineer/analytics_summary.json` via your analytics refresh step (API-key based source command/file generation).';
     }
     if (checkName === 'connection:analytics') {
-        return 'Run `node scripts/openclaw-growth-wizard.mjs --connectors analytics` and paste a fresh AnalyticsCLI readonly CLI token into the local terminal wizard.';
+        return 'Run `npx -y @analyticscli/growth-engineer@preview wizard --connectors analytics` and paste a fresh AnalyticsCLI readonly CLI token into the local terminal wizard.';
     }
     if (checkName === 'connection:github') {
         return 'Verify `GITHUB_TOKEN` and repo access to `/repos/<owner>/<repo>` + issues API.';
@@ -1491,7 +1945,7 @@ function remediationForCheck(checkName, configPath) {
         return 'Verify `GITHUB_TOKEN` and repo access to `/repos/<owner>/<repo>/pulls`, plus `Pull requests: Read/Write` and `Contents: Read/Write` scopes.';
     }
     if (checkName === 'connection:asc_cli') {
-        return 'ASC setup should list App Store Connect apps and persist the selected app automatically. Rerun the connector wizard; if this repeats, update the skill/CLI rather than setting ASC_APP_ID by hand.';
+        return 'ASC setup should list all App Store Connect apps the API key can access. Rerun the connector wizard with an API key scoped to the whole account; do not set ASC_APP_ID for normal Growth Engineer runs.';
     }
     return 'Fix this blocker and rerun start.';
 }
@@ -1556,6 +2010,7 @@ async function main() {
     await applyOpenClawSecretRefs(initialConfig);
     const heartbeat = await ensureGrowthHeartbeat(configPath, initialConfig);
     const openclawCron = await ensureOpenClawCronSchedule(configPath, initialConfig, args.openclawCron);
+    const hermesCron = await ensureHermesCronSchedule(configPath, initialConfig, args.openclawCron);
     if (!openclawCron.ok) {
         process.stdout.write(`${JSON.stringify({
             ok: false,
@@ -1564,6 +2019,7 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             blockers: [
                 {
                     check: 'scheduler:openclaw-cron',
@@ -1575,6 +2031,26 @@ async function main() {
         process.exitCode = 1;
         return;
     }
+    if (!hermesCron.ok) {
+        process.stdout.write(`${JSON.stringify({
+            ok: false,
+            phase: 'hermes_cron_setup',
+            configCreated: configResult.created,
+            configPath,
+            heartbeat,
+            openclawCron,
+            hermesCron,
+            blockers: [
+                {
+                    check: 'scheduler:hermes-cron',
+                    detail: hermesCron.detail,
+                    remediation: hermesCron.remediation || 'Fix Hermes cron setup and rerun start.',
+                },
+            ],
+        }, null, 2)}\n`);
+        process.exitCode = 1;
+        return;
+    }
     const projectConfigured = await configureAnalyticsProject(configPath, args.project);
     const ascAppConfiguredFromArg = await configureAscApp(configPath, args.ascApp);
     const analyticscliEnsure = await ensureAnalyticsCliInstalled();
@@ -1586,6 +2062,7 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             projectConfigured,
             ascAppConfigured: ascAppConfiguredFromArg,
             blockers: [
@@ -1628,6 +2105,7 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             projectConfigured,
             ascAppConfigured: ascAppConfiguredFromArg,
             connectorSetup,
@@ -1642,7 +2120,9 @@ async function main() {
                             ? 'Install the ASC CLI and provide ASC_KEY_ID, ASC_ISSUER_ID, and ASC_PRIVATE_KEY_PATH or ASC_PRIVATE_KEY. Resolve the app after auth succeeds.'
                             : entry.connector === 'sentry'
                                 ? 'Set SENTRY_AUTH_TOKEN plus SENTRY_ORG in the connector wizard. Defer project scope to app/repo context, or configure sources.sentry.accounts[].projects[] only when a fixed mapping is known.'
-                                : 'Set REVENUECAT_API_KEY and rerun connector setup to write RevenueCat MCP config.',
+                                : entry.connector === 'coolify'
+                                    ? 'Set COOLIFY_BASE_URL and COOLIFY_API_TOKEN from Coolify Keys & Tokens / API tokens in the connector wizard.'
+                                    : 'Set REVENUECAT_API_KEY and rerun connector setup to write RevenueCat MCP config.',
             })),
         }, null, 2)}\n`);
         process.exitCode = 1;
@@ -1696,6 +2176,7 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             projectConfigured: projectConfigured || analyticsProjectSetup.configured,
             analyticsProjectId: analyticsProjectSetup.projectId || null,
             ascAppConfigured: false,
@@ -1715,6 +2196,51 @@ async function main() {
         process.exitCode = 1;
         return;
     }
+    emitProgress(args.progressJson, {
+        phase: 'start',
+        key: 'ascAnalyticsRequest',
+        label: 'ASC analytics reports',
+        detail: 'checking ongoing Analytics Report Request',
+    });
+    const ascAnalyticsRequestSetup = await ensureAscAnalyticsRequestsForAppScope(ascAppSetup);
+    emitProgress(args.progressJson, {
+        phase: 'finish',
+        key: 'ascAnalyticsRequest',
+        label: 'ASC analytics reports',
+        detail: ascAnalyticsRequestSetup.ok
+            ? ascAnalyticsRequestSetup.detail
+            : `could not ensure Analytics Report Request (${truncate(ascAnalyticsRequestSetup.error, 240)})`,
+        status: ascAnalyticsRequestSetup.ok ? 'pass' : 'fail',
+    });
+    if (!ascAnalyticsRequestSetup.ok) {
+        process.stdout.write(`${JSON.stringify({
+            ok: false,
+            phase: 'asc_analytics_request_setup',
+            configCreated: configResult.created,
+            configPath,
+            heartbeat,
+            openclawCron,
+            hermesCron,
+            projectConfigured: projectConfigured || analyticsProjectSetup.configured,
+            analyticsProjectId: analyticsProjectSetup.projectId || null,
+            ascAppConfigured: ascAppSetup.configured,
+            ascAppId: ascAppSetup.appId || null,
+            ascAppScope: ascAppSetup.appScope || null,
+            ascAnalyticsRequestResults: ascAnalyticsRequestSetup.results || [],
+            connectorSetup,
+            needsUserInput: false,
+            question: null,
+            blockers: [
+                {
+                    check: 'connection:asc_analytics_request',
+                    detail: `Could not ensure App Store Connect Analytics Report Request: ${truncate(ascAnalyticsRequestSetup.error, 800)}`,
+                    remediation: 'Use an ASC API key with Admin for first setup so Growth Engineer can create the ongoing Analytics Report Request. After the request exists, rotate to Sales and Reports for steady-state downloads.',
+                },
+            ],
+        }, null, 2)}\n`);
+        process.exitCode = 1;
+        return;
+    }
     const preflightResult = await runPreflight(configPath, args.testConnections, args.progressJson, args.onlyConnectors);
     const preflightPayload = preflightResult.payload;
     if (!preflightPayload) {
@@ -1736,11 +2262,15 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             projectConfigured: projectConfigured || analyticsProjectSetup.configured,
             analyticsProjectId: analyticsProjectSetup.projectId || null,
             ascAppConfigured: ascAppSetup.configured,
             ascAppId: ascAppSetup.appId || null,
             ascAppScope: ascAppSetup.appScope || null,
+            ascAnalyticsRequestStatus: ascAnalyticsRequestSetup.status,
+            ascAnalyticsRequestId: ascAnalyticsRequestSetup.requestId || null,
+            ascAnalyticsRequestIds: ascAnalyticsRequestSetup.requestIds || [],
             githubRepo: configResult.githubRepo,
             connectorSetup,
             checks: preflightPayload.checks || [],
@@ -1757,11 +2287,15 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             projectConfigured: projectConfigured || analyticsProjectSetup.configured,
             analyticsProjectId: analyticsProjectSetup.projectId || null,
             ascAppConfigured: ascAppSetup.configured,
             ascAppId: ascAppSetup.appId || null,
             ascAppScope: ascAppSetup.appScope || null,
+            ascAnalyticsRequestStatus: ascAnalyticsRequestSetup.status,
+            ascAnalyticsRequestId: ascAnalyticsRequestSetup.requestId || null,
+            ascAnalyticsRequestIds: ascAnalyticsRequestSetup.requestIds || [],
             connectorSetup,
             schedulerProofPath,
             message: 'Preflight passed. First run skipped due to --setup-only.',
@@ -1787,6 +2321,7 @@ async function main() {
             configPath,
             heartbeat,
             openclawCron,
+            hermesCron,
             projectConfigured,
             error: rawError,
         }, null, 2)}\n`);
@@ -1801,6 +2336,7 @@ async function main() {
         configPath,
         heartbeat,
         openclawCron,
+        hermesCron,
         projectConfigured,
         actionMode,
         runnerOutput: runResult.stdout.trim(),