@analyticscli/growth-engineer 0.1.0-preview.9 → 0.1.0

package/dist/runtime/openclaw-growth-start.mjs

@@ -4,17 +4,67 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { getActionMode, getDefaultSourceCommand } from './openclaw-growth-shared.mjs';
+import { buildGrowthRunnerCommand, buildOpenClawCronAddCommand, deriveSchedulerProofPathFromStatePath, deriveStatePathFromConfigPath, getActionMode, getAutomationConfig, getDefaultSourceCommand, getOpenClawCronEditDeliveryCommandFromInspection, buildHermesCronCreateCommand, inspectHermesCronInstall, inspectOpenClawCronInstall, repairOpenClawCronDeliveryStore, } from './openclaw-growth-shared.mjs';
 import { applyOpenClawSecretRefs, loadOpenClawGrowthSecrets } from './openclaw-growth-env.mjs';
 const DEFAULT_CONFIG_PATH = 'data/openclaw-growth-engineer/config.json';
 const DEFAULT_TEMPLATE_PATH = 'data/openclaw-growth-engineer/config.example.json';
 const DEFAULT_HEARTBEAT_PATH = 'HEARTBEAT.md';
+const DEFAULT_SCHEDULER_PROOF_PATH = 'data/openclaw-growth-engineer/runtime/scheduler-proof.jsonl';
 const HEARTBEAT_MARKER_START = '<!-- openclaw-growth-engineer:start -->';
 const HEARTBEAT_MARKER_END = '<!-- openclaw-growth-engineer:end -->';
 const ANALYTICSCLI_PACKAGE_SPEC = process.env.ANALYTICSCLI_CLI_PACKAGE || '@analyticscli/cli@preview';
 const ANALYTICSCLI_NPM_PREFIX = process.env.ANALYTICSCLI_NPM_PREFIX ||
     (process.env.HOME ? path.join(process.env.HOME, '.local') : path.join(process.cwd(), '.analyticscli-npm'));
 const RUNTIME_DIR = path.dirname(fileURLToPath(import.meta.url));
+const ACCOUNT_SIGNAL_CONNECTORS = [
+    'stripe',
+    'lemonsqueezy',
+    'adapty',
+    'superwall',
+    'google-play',
+    'datadog',
+    'bugsnag',
+    'intercom',
+    'zendesk',
+    'apple-search-ads',
+    'google-ads',
+    'meta-ads',
+    'tiktok-ads',
+    'vercel',
+    'cloudflare',
+    'resend',
+    'customerio',
+    'mailchimp',
+    'appfollow',
+    'apptweak',
+    'linear',
+    'postiz',
+];
+const SUPPORTED_CONNECTORS = ['analytics', 'github', 'asc', 'revenuecat', 'paddle', 'seo', 'sentry', 'coolify', ...ACCOUNT_SIGNAL_CONNECTORS];
+const ACCOUNT_SIGNAL_SECRET_ENVS = {
+    stripe: ['STRIPE_API_KEY'],
+    lemonsqueezy: ['LEMON_SQUEEZY_API_KEY'],
+    adapty: ['ADAPTY_API_KEY'],
+    superwall: ['SUPERWALL_API_KEY'],
+    'google-play': ['GOOGLE_PLAY_SERVICE_ACCOUNT_JSON'],
+    datadog: ['DATADOG_API_KEY', 'DATADOG_APP_KEY'],
+    bugsnag: ['BUGSNAG_AUTH_TOKEN'],
+    intercom: ['INTERCOM_ACCESS_TOKEN'],
+    zendesk: ['ZENDESK_SUBDOMAIN', 'ZENDESK_EMAIL', 'ZENDESK_API_TOKEN'],
+    'apple-search-ads': ['APPLE_SEARCH_ADS_REFRESH_TOKEN'],
+    'google-ads': ['GOOGLE_ADS_DEVELOPER_TOKEN', 'GOOGLE_ADS_CLIENT_ID', 'GOOGLE_ADS_CLIENT_SECRET', 'GOOGLE_ADS_REFRESH_TOKEN'],
+    'meta-ads': ['META_ADS_ACCESS_TOKEN'],
+    'tiktok-ads': ['TIKTOK_ADS_ACCESS_TOKEN'],
+    vercel: ['VERCEL_ACCESS_TOKEN'],
+    cloudflare: ['CLOUDFLARE_API_TOKEN'],
+    resend: ['RESEND_API_KEY'],
+    customerio: ['CUSTOMERIO_APP_API_KEY'],
+    mailchimp: ['MAILCHIMP_API_KEY'],
+    appfollow: ['APPFOLLOW_API_TOKEN'],
+    apptweak: ['APPTWEAK_API_TOKEN'],
+    linear: ['LINEAR_API_KEY'],
+    postiz: ['POSTIZ_API_KEY'],
+};
 function printHelpAndExit(exitCode, reason = null) {
     if (reason) {
         process.stderr.write(`${reason}\n\n`);
@@ -34,25 +84,45 @@ Options:
   --config <file>        Config path (default: ${DEFAULT_CONFIG_PATH})
   --project <id>         Optional AnalyticsCLI project ID pin for generated source commands
   --asc-app <id>         Optional ASC app ID filter (defaults to all accessible apps)
-  --connectors <list>    Install/enable connector helpers (analytics,github,asc,revenuecat,sentry,all)
+  --connectors <list>    Install/enable connector helpers (${SUPPORTED_CONNECTORS.join(',')},all)
   --only-connectors <list>
-                         Limit live preflight checks to analytics,github,asc,revenuecat,sentry
+                         Limit live preflight checks to ${SUPPORTED_CONNECTORS.join(',')}
   --setup-only           Run bootstrap + preflight only (skip first run)
   --no-test-connections  Skip live API smoke checks in preflight
+  --openclaw-cron <mode> Configure OpenClaw Gateway cron: auto, enable, require, disable (default: auto)
+  --openclaw-cron-schedule <expr>
+                         Cron expression for OpenClaw Gateway cron (default: */30 * * * *)
+  --openclaw-cron-tz <tz>
+                         Timezone for OpenClaw Gateway cron (default: TZ or UTC)
   --progress-json        Emit machine-readable setup progress to stderr
   --help, -h             Show help
 `);
     process.exit(exitCode);
 }
+function resolveDefaultConfigPath() {
+    const explicit = String(process.env.OPENCLAW_GROWTH_CONFIG_PATH || '').trim();
+    if (explicit)
+        return explicit;
+    const homeConfigPath = process.env.HOME ? path.join(process.env.HOME, 'data/openclaw-growth-engineer/config.json') : '';
+    const homeStatePath = process.env.HOME ? path.join(process.env.HOME, 'data/openclaw-growth-engineer/state.json') : '';
+    if (homeConfigPath && existsSync(homeConfigPath) && existsSync(homeStatePath))
+        return homeConfigPath;
+    if (!existsSync(DEFAULT_CONFIG_PATH) && homeConfigPath && existsSync(homeConfigPath))
+        return homeConfigPath;
+    return DEFAULT_CONFIG_PATH;
+}
 function parseArgs(argv) {
     const args = {
-        config: DEFAULT_CONFIG_PATH,
+        config: resolveDefaultConfigPath(),
         project: '',
         ascApp: '',
         run: true,
         testConnections: true,
         connectors: [],
         onlyConnectors: [],
+        openclawCron: String(process.env.OPENCLAW_GROWTH_OPENCLAW_CRON || 'auto').trim().toLowerCase(),
+        openclawCronSchedule: '',
+        openclawCronTimezone: '',
         progressJson: false,
     };
     for (let i = 0; i < argv.length; i += 1) {
@@ -87,6 +157,24 @@ function parseArgs(argv) {
         else if (token === '--no-test-connections') {
             args.testConnections = false;
         }
+        else if (token === '--openclaw-cron') {
+            args.openclawCron = String(next || '').trim().toLowerCase() || 'auto';
+            i += 1;
+        }
+        else if (token === '--enable-openclaw-cron') {
+            args.openclawCron = 'enable';
+        }
+        else if (token === '--no-openclaw-cron') {
+            args.openclawCron = 'disable';
+        }
+        else if (token === '--openclaw-cron-schedule') {
+            args.openclawCronSchedule = String(next || '').trim();
+            i += 1;
+        }
+        else if (token === '--openclaw-cron-tz') {
+            args.openclawCronTimezone = String(next || '').trim();
+            i += 1;
+        }
         else if (token === '--progress-json') {
             args.progressJson = true;
         }
@@ -97,8 +185,15 @@ function parseArgs(argv) {
             printHelpAndExit(1, `Unknown argument: ${token}`);
         }
     }
+    args.openclawCron = validateOpenClawCronMode(args.openclawCron);
     return args;
 }
+function validateOpenClawCronMode(value) {
+    const mode = String(value || 'auto').trim().toLowerCase();
+    if (['auto', 'enable', 'require', 'disable'].includes(mode))
+        return mode;
+    printHelpAndExit(1, `Invalid --openclaw-cron mode: ${value}. Use auto, enable, require, or disable.`);
+}
 function normalizeConnectorKey(value) {
     const normalized = String(value || '').trim().toLowerCase().replace(/[_\s]+/g, '-');
     if (!normalized)
@@ -113,8 +208,58 @@ function normalizeConnectorKey(value) {
         return 'asc';
     if (['revenuecat', 'revenue-cat', 'rc', 'revenuecat-mcp'].includes(normalized))
         return 'revenuecat';
+    if (['paddle', 'paddle-billing', 'billing-metrics', 'web-revenue'].includes(normalized))
+        return 'paddle';
+    if (['seo', 'gsc', 'google-search-console', 'search-console', 'dataforseo', 'organic-search'].includes(normalized))
+        return 'seo';
     if (['sentry', 'sentry-api', 'sentry-mcp', 'crashes', 'errors', 'crash-reporting'].includes(normalized))
         return 'sentry';
+    if (['coolify', 'coolify-api', 'deployment', 'deployments', 'hosting', 'infra', 'infrastructure'].includes(normalized))
+        return 'coolify';
+    if (['stripe', 'stripe-billing', 'stripe-payments'].includes(normalized))
+        return 'stripe';
+    if (['lemonsqueezy', 'lemon-squeezy', 'lemon', 'ls'].includes(normalized))
+        return 'lemonsqueezy';
+    if (['adapty', 'adapty-paywalls', 'adapty-subscriptions'].includes(normalized))
+        return 'adapty';
+    if (['superwall', 'superwall-paywalls'].includes(normalized))
+        return 'superwall';
+    if (['google-play', 'google-play-console', 'play-console', 'play-store', 'android-store'].includes(normalized))
+        return 'google-play';
+    if (['datadog', 'datadog-rum', 'datadog-apm', 'datadog-logs'].includes(normalized))
+        return 'datadog';
+    if (['bugsnag', 'bugsnag-crashes'].includes(normalized))
+        return 'bugsnag';
+    if (['intercom', 'intercom-support'].includes(normalized))
+        return 'intercom';
+    if (['zendesk', 'zendesk-support'].includes(normalized))
+        return 'zendesk';
+    if (['apple-search-ads', 'apple-ads', 'asa', 'search-ads'].includes(normalized))
+        return 'apple-search-ads';
+    if (['google-ads', 'adwords'].includes(normalized))
+        return 'google-ads';
+    if (['meta-ads', 'facebook-ads', 'instagram-ads', 'fb-ads'].includes(normalized))
+        return 'meta-ads';
+    if (['tiktok-ads', 'tiktok-business', 'tiktok-business-api'].includes(normalized))
+        return 'tiktok-ads';
+    if (['vercel', 'vercel-deployments', 'vercel-hosting'].includes(normalized))
+        return 'vercel';
+    if (['cloudflare', 'cf', 'cloudflare-workers', 'cloudflare-pages'].includes(normalized))
+        return 'cloudflare';
+    if (['resend', 'resend-email'].includes(normalized))
+        return 'resend';
+    if (['customerio', 'customer-io', 'customer.io', 'cio'].includes(normalized))
+        return 'customerio';
+    if (['mailchimp', 'mailchimp-marketing'].includes(normalized))
+        return 'mailchimp';
+    if (['appfollow', 'app-follow'].includes(normalized))
+        return 'appfollow';
+    if (['apptweak', 'app-tweak'].includes(normalized))
+        return 'apptweak';
+    if (['linear', 'linear-issues', 'linear-planning'].includes(normalized))
+        return 'linear';
+    if (['postiz', 'postiz-api', 'social-publishing', 'social-scheduler'].includes(normalized))
+        return 'postiz';
     return null;
 }
 function parseConnectorList(value) {
@@ -124,14 +269,10 @@ function parseConnectorList(value) {
     for (const entry of String(value).split(',')) {
         const connector = normalizeConnectorKey(entry);
         if (!connector) {
-            printHelpAndExit(1, `Unknown connector: ${entry.trim()}. Use analytics, github, asc, revenuecat, sentry, or all.`);
+            printHelpAndExit(1, `Unknown connector: ${entry.trim()}. Use ${SUPPORTED_CONNECTORS.join(', ')}, or all.`);
         }
         if (connector === 'all') {
-            connectors.add('analytics');
-            connectors.add('github');
-            connectors.add('asc');
-            connectors.add('revenuecat');
-            connectors.add('sentry');
+            SUPPORTED_CONNECTORS.forEach((supported) => connectors.add(supported));
         }
         else {
             connectors.add(connector);
@@ -156,6 +297,72 @@ function resolveRuntimeScriptPath(scriptName) {
 function nodeRuntimeScriptCommand(scriptName) {
     return `node ${quote(resolveRuntimeScriptPath(scriptName))}`;
 }
+function getRuntimeSourceCommand(sourceName) {
+    const normalized = String(sourceName || '').trim().toLowerCase();
+    if (normalized === 'analytics' || normalized === 'analyticscli') {
+        return nodeRuntimeScriptCommand('export-analytics-summary.mjs');
+    }
+    if (normalized === 'revenuecat' || normalized === 'revenue-cat') {
+        return nodeRuntimeScriptCommand('export-revenuecat-summary.mjs');
+    }
+    if (normalized === 'paddle') {
+        return nodeRuntimeScriptCommand('export-paddle-summary.mjs');
+    }
+    if (['seo', 'gsc', 'google-search-console', 'search-console', 'dataforseo'].includes(normalized)) {
+        return nodeRuntimeScriptCommand('export-seo-summary.mjs');
+    }
+    if (normalized === 'sentry' || normalized === 'glitchtip') {
+        return nodeRuntimeScriptCommand('export-sentry-summary.mjs');
+    }
+    if (normalized === 'coolify') {
+        return nodeRuntimeScriptCommand('export-coolify-summary.mjs');
+    }
+    if (['asc', 'asc-cli', 'app-store-connect', 'app_store_connect'].includes(normalized)) {
+        return nodeRuntimeScriptCommand('export-asc-summary.mjs');
+    }
+    return getDefaultSourceCommand(sourceName);
+}
+function replaceLegacyRuntimeScriptCommand(command) {
+    const trimmed = String(command || '').trim();
+    if (!trimmed)
+        return trimmed;
+    return trimmed.replace(/^node\s+scripts\/(export-analytics-summary\.mjs|export-revenuecat-summary\.mjs|export-paddle-summary\.mjs|export-seo-summary\.mjs|export-sentry-summary\.mjs|export-coolify-summary\.mjs|export-asc-summary\.mjs|openclaw-growth-start\.mjs|openclaw-growth-status\.mjs|openclaw-growth-preflight\.mjs|openclaw-growth-runner\.mjs|openclaw-growth-engineer\.mjs)(?=\s|$)/, (_match, scriptName) => nodeRuntimeScriptCommand(scriptName));
+}
+function normalizeSourceCommand(sourceName, source) {
+    return replaceLegacyRuntimeScriptCommand(source?.command || '') || getRuntimeSourceCommand(sourceName);
+}
+function migrateRuntimeSourceCommands(config) {
+    if (!config || typeof config !== 'object')
+        return config;
+    const sources = config.sources && typeof config.sources === 'object' ? config.sources : {};
+    const nextSources = { ...sources };
+    for (const sourceName of ['analytics', 'revenuecat', 'paddle', 'seo', 'sentry', 'coolify']) {
+        if (nextSources[sourceName]?.mode === 'command') {
+            nextSources[sourceName] = {
+                ...nextSources[sourceName],
+                command: normalizeSourceCommand(sourceName, nextSources[sourceName]),
+            };
+        }
+    }
+    if (Array.isArray(nextSources.extra)) {
+        nextSources.extra = nextSources.extra.map((source) => {
+            if (!source || source.mode !== 'command')
+                return source;
+            const service = String(source.service || source.key || '').toLowerCase();
+            const sourceName = ['asc', 'asc-cli', 'app-store-connect', 'app_store_connect'].includes(service)
+                ? 'asc'
+                : service;
+            return {
+                ...source,
+                command: normalizeSourceCommand(sourceName, source),
+            };
+        });
+    }
+    return {
+        ...config,
+        sources: nextSources,
+    };
+}
 function truncate(value, max = 240) {
     const text = String(value || '');
     if (text.length <= max)
@@ -184,10 +391,19 @@ function emitProgress(enabled, event) {
         return;
     process.stderr.write(`OPENCLAW_PROGRESS ${JSON.stringify(event)}\n`);
 }
+function hardenUnattendedShellCommand(command) {
+    return String(command || '').replace(/(^|[;&|]\s*)sudo(?!\s+-n(?:\s|$))(?=\s|$)/g, '$1sudo -n');
+}
 function runShellCommand(command, timeoutMs = 120_000, options = {}) {
     return new Promise((resolve) => {
-        const child = spawn(resolveShellCommand(), ['-c', command], {
+        const child = spawn(resolveShellCommand(), ['-c', hardenUnattendedShellCommand(command)], {
             stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                DEBIAN_FRONTEND: 'noninteractive',
+                SUDO_ASKPASS: '/bin/false',
+                SUDO_PROMPT: '',
+            },
         });
         let stdout = '';
         let stderr = '';
@@ -468,12 +684,15 @@ function isEffectivelyEmptyHeartbeat(value) {
 function renderHeartbeatBlock(configPath, config) {
     const interval = formatHeartbeatInterval(getHeartbeatInterval(config));
     const displayConfigPath = relativeWorkspacePath(configPath);
+    const displayStatePath = deriveStatePathFromConfigPath(displayConfigPath);
+    const runnerCommand = buildGrowthRunnerCommand(displayConfigPath, displayStatePath);
+    const wizardCommand = 'npx -y @analyticscli/growth-engineer@preview wizard --connectors';
     return `${HEARTBEAT_MARKER_START}
 tasks:
 
 - name: openclaw-growth-engineer-run
   interval: ${interval}
-  prompt: "Run \`node scripts/openclaw-growth-runner.mjs --config ${displayConfigPath}\` from the workspace if the config and runtime files exist. The runner owns schedule.cadences, connectorHealthCheckIntervalMinutes, skipIfNoDataChange, and skipIfIssueSetUnchanged. If it reports connector-health alerts, production crashes, generated issues, or actionable growth findings, summarize only the action and evidence. If setup files are missing, tell the user to run \`node scripts/openclaw-growth-wizard.mjs --connectors\`. If there is no actionable output, reply HEARTBEAT_OK."
+  prompt: "Run \`${runnerCommand}\` from the workspace if the config and runtime files exist. The runner owns schedule.cadences, connectorHealthCheckIntervalMinutes, skipIfNoDataChange, and skipIfIssueSetUnchanged. If it reports connector-health alerts, production crashes, generated issues, or actionable growth findings, summarize only the action and evidence. If setup files are missing, tell the user to run \`${wizardCommand}\`. If there is no actionable output, reply HEARTBEAT_OK."
 
 # Keep this section small. Do not put secrets in HEARTBEAT.md.
 ${HEARTBEAT_MARKER_END}`;
@@ -511,6 +730,219 @@ async function ensureGrowthHeartbeat(configPath, config) {
         updated: false,
     };
 }
+function applyOpenClawCronOverrides(config, args) {
+    const automation = getAutomationConfig(config);
+    const cron = {
+        ...automation.openclawCron,
+        ...(args.openclawCronSchedule ? { schedule: args.openclawCronSchedule } : {}),
+        ...(args.openclawCronTimezone ? { timezone: args.openclawCronTimezone } : {}),
+    };
+    return {
+        ...config,
+        automation: {
+            ...(config?.automation || {}),
+            openclawCron: cron,
+        },
+    };
+}
+function getOpenClawCronProofCommands(configPath) {
+    const displayConfigPath = relativeWorkspacePath(configPath);
+    const statePath = deriveStatePathFromConfigPath(displayConfigPath);
+    const proofPath = deriveSchedulerProofPathFromStatePath(statePath);
+    return {
+        listCommand: 'openclaw cron list',
+        runsCommand: 'openclaw cron runs --id <job-id>',
+        stateCommand: `jq '.connectorHealth, .cadences, .lastRunAt, .skippedReason' ${quote(statePath)}`,
+        proofCommand: `tail -n 20 ${quote(proofPath)}`,
+        manualWakeCommand: `openclaw system event --text ${quote(`Run OpenClaw Growth Engineer now using config ${relativeWorkspacePath(configPath)} and inspect scheduler proof.`)} --mode now`,
+    };
+}
+async function ensureOpenClawCronSchedule(configPath, config, mode = 'auto') {
+    const normalizedMode = validateOpenClawCronMode(mode);
+    const automation = getAutomationConfig(config);
+    const proof = getOpenClawCronProofCommands(configPath);
+    if (normalizedMode === 'disable' || automation.openclawCron.enabled === false) {
+        return {
+            ok: true,
+            enabled: false,
+            installed: false,
+            status: 'disabled',
+            detail: 'OpenClaw Gateway cron setup disabled',
+            proof,
+        };
+    }
+    const openclawPath = await resolveCommandPath('openclaw');
+    if (!openclawPath) {
+        const detail = 'openclaw CLI not found on PATH; skipping OpenClaw Gateway cron setup';
+        return {
+            ok: normalizedMode === 'auto',
+            enabled: true,
+            installed: false,
+            status: normalizedMode === 'auto' ? 'skipped' : 'failed',
+            detail,
+            remediation: 'Run this setup inside the VPS shell where OpenClaw Gateway is installed, or install the openclaw CLI.',
+            proof,
+        };
+    }
+    const displayConfigPath = relativeWorkspacePath(configPath);
+    const addCommand = buildOpenClawCronAddCommand(displayConfigPath, config);
+    const inspection = await inspectOpenClawCronInstall({
+        configPath: displayConfigPath,
+        config,
+        runCommand: runShellCommand,
+        readFile: fs.readFile,
+    });
+    if (inspection.exists && inspection.verified) {
+        return {
+            ok: true,
+            enabled: true,
+            installed: true,
+            status: 'already_configured_verified',
+            detail: `OpenClaw cron job already exists and matches the Growth Engineer runner contract: ${automation.openclawCron.name}`,
+            schedule: automation.openclawCron.schedule,
+            timezone: automation.openclawCron.timezone,
+            source: inspection.source,
+            proof,
+        };
+    }
+    if (inspection.exists && inspection.reason === 'delivery_mismatch') {
+        const editCommand = getOpenClawCronEditDeliveryCommandFromInspection(inspection, config);
+        if (editCommand) {
+            const edit = await runShellCommand(editCommand, 60_000);
+            if (edit.ok) {
+                return {
+                    ok: true,
+                    enabled: true,
+                    installed: true,
+                    status: 'repaired_delivery_cli',
+                    detail: `Repaired OpenClaw cron delivery with: ${editCommand}`,
+                    schedule: automation.openclawCron.schedule,
+                    timezone: automation.openclawCron.timezone,
+                    command: editCommand,
+                    source: inspection.source,
+                    proof,
+                };
+            }
+        }
+        const repair = await repairOpenClawCronDeliveryStore({
+            configPath: displayConfigPath,
+            config,
+            readFile: fs.readFile,
+            writeFile: fs.writeFile,
+        });
+        if (repair.repaired) {
+            return {
+                ok: true,
+                enabled: true,
+                installed: true,
+                status: 'repaired_delivery',
+                detail: `Repaired OpenClaw cron delivery for "${automation.openclawCron.name}" in ${repair.path}`,
+                schedule: automation.openclawCron.schedule,
+                timezone: automation.openclawCron.timezone,
+                source: repair.path,
+                command: editCommand || undefined,
+                proof,
+            };
+        }
+    }
+    const add = await runShellCommand(addCommand, 60_000);
+    const existingDetail = inspection.exists
+        ? `Existing OpenClaw cron job "${automation.openclawCron.name}" was not verifiably wired to the current runner contract (${inspection.reason} via ${inspection.source}). `
+        : '';
+    return {
+        ok: add.ok || (normalizedMode === 'auto' && !inspection.exists),
+        enabled: true,
+        installed: add.ok,
+        status: add.ok ? (inspection.exists ? 'reconfigured' : 'configured') : inspection.exists ? 'needs_repair' : 'failed',
+        detail: add.ok
+            ? `${existingDetail}Configured OpenClaw cron job "${automation.openclawCron.name}" (${automation.openclawCron.schedule}, ${automation.openclawCron.timezone})`
+            : `${existingDetail}${add.stderr.trim() || add.stdout.trim() || `openclaw cron add exited ${add.code}`}`,
+        schedule: automation.openclawCron.schedule,
+        timezone: automation.openclawCron.timezone,
+        command: addCommand,
+        remediation: inspection.exists && !add.ok
+            ? `Remove the stale OpenClaw cron job named "${automation.openclawCron.name}" with your installed OpenClaw CLI, then rerun: ${addCommand}`
+            : undefined,
+        proof,
+    };
+}
+async function ensureHermesCronSchedule(configPath, config, mode = 'auto') {
+    const normalizedMode = validateOpenClawCronMode(mode);
+    const automation = getAutomationConfig(config);
+    const displayConfigPath = relativeWorkspacePath(configPath);
+    const statePath = deriveStatePathFromConfigPath(displayConfigPath);
+    const proofPath = deriveSchedulerProofPathFromStatePath(statePath);
+    const workdir = path.resolve(automation.hermesCron.workdir || process.cwd());
+    const proof = {
+        listCommand: 'hermes cron list',
+        statusCommand: 'hermes cron status <job-id>',
+        stateCommand: `jq '.connectorHealth, .cadences, .lastRunAt, .skippedReason' ${quote(statePath)}`,
+        proofCommand: `tail -n 20 ${quote(proofPath)}`,
+    };
+    if (normalizedMode === 'disable' || automation.hermesCron.enabled === false) {
+        return {
+            ok: true,
+            enabled: false,
+            installed: false,
+            status: 'disabled',
+            detail: 'Hermes cron setup disabled',
+            proof,
+        };
+    }
+    const hermesPath = await resolveCommandPath('hermes');
+    if (!hermesPath) {
+        return {
+            ok: normalizedMode === 'auto',
+            enabled: true,
+            installed: false,
+            status: normalizedMode === 'auto' ? 'skipped' : 'failed',
+            detail: 'hermes CLI not found on PATH; skipping Hermes cron setup',
+            remediation: 'Run this setup inside the host shell where Hermes Gateway is installed, or install the hermes CLI.',
+            proof,
+        };
+    }
+    const createCommand = buildHermesCronCreateCommand(displayConfigPath, config, { workdir });
+    const inspection = await inspectHermesCronInstall({
+        configPath: displayConfigPath,
+        config,
+        runCommand: runShellCommand,
+        readFile: fs.readFile,
+        workdir,
+    });
+    if (inspection.exists && inspection.verified) {
+        return {
+            ok: true,
+            enabled: true,
+            installed: true,
+            status: 'already_configured_verified',
+            detail: `Hermes cron job already exists and matches the Growth Engineer runner contract: ${automation.hermesCron.name}`,
+            schedule: automation.hermesCron.schedule,
+            workdir,
+            source: inspection.source,
+            proof,
+        };
+    }
+    const create = await runShellCommand(createCommand, 60_000);
+    const existingDetail = inspection.exists
+        ? `Existing Hermes cron job "${automation.hermesCron.name}" was not verifiably wired to the current runner contract (${inspection.reason} via ${inspection.source}). `
+        : '';
+    return {
+        ok: create.ok || (normalizedMode === 'auto' && !inspection.exists),
+        enabled: true,
+        installed: create.ok,
+        status: create.ok ? (inspection.exists ? 'reconfigured' : 'configured') : inspection.exists ? 'needs_repair' : 'failed',
+        detail: create.ok
+            ? `${existingDetail}Configured Hermes cron job "${automation.hermesCron.name}" (${automation.hermesCron.schedule})`
+            : `${existingDetail}${create.stderr.trim() || create.stdout.trim() || `hermes cron create exited ${create.code}`}`,
+        schedule: automation.hermesCron.schedule,
+        workdir,
+        command: createCommand,
+        remediation: inspection.exists && !create.ok
+            ? `Remove the stale Hermes cron job named "${automation.hermesCron.name}" with your installed Hermes CLI, then rerun: ${createCommand}`
+            : undefined,
+        proof,
+    };
+}
 async function appendHelperDetail(details, label, result) {
     if (result.ok) {
         details.push(`${label}: ok`);
@@ -769,6 +1201,13 @@ async function installSentryConnector() {
     details.push('Sentry direct API exporter enabled via node scripts/export-sentry-summary.mjs');
     return { connector: 'sentry', ok: true, detail: details.join('; ') };
 }
+async function installCoolifyConnector() {
+    return {
+        connector: 'coolify',
+        ok: true,
+        detail: 'Coolify uses the built-in read-only API exporter; create a token in Coolify Keys & Tokens / API tokens and store COOLIFY_BASE_URL plus COOLIFY_API_TOKEN with the connector wizard',
+    };
+}
 async function installGitHubConnector() {
     const details = [];
     await installClawHubSkill('github', details);
@@ -809,6 +1248,20 @@ async function installAnalyticsConnector() {
             : 'analyticscli binary missing after dependency setup',
     };
 }
+function isAccountSignalConnector(connector) {
+    return ACCOUNT_SIGNAL_CONNECTORS.includes(connector);
+}
+async function installAccountSignalConnector(connector) {
+    const envs = ACCOUNT_SIGNAL_SECRET_ENVS[connector] || [];
+    const missing = envs.filter((envName) => !String(process.env[envName] || '').trim());
+    return {
+        connector,
+        ok: missing.length === 0,
+        detail: missing.length === 0
+            ? 'account-wide credential is present; project/app/product scope is discovered later'
+            : `missing account-wide credential(s): ${missing.join(', ')}`,
+    };
+}
 async function enableConnectorConfig(configPath, connectors) {
     if (connectors.length === 0 || !(await fileExists(configPath)))
         return;
@@ -819,17 +1272,35 @@ async function enableConnectorConfig(configPath, connectors) {
         sources: {
             ...(config.sources || {}),
             analytics: connectors.includes('analytics')
-                ? { ...(config.sources?.analytics || {}), enabled: true, mode: 'command', command: config.sources?.analytics?.command || getDefaultSourceCommand('analytics') }
+                ? { ...(config.sources?.analytics || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('analytics', config.sources?.analytics) }
                 : config.sources?.analytics,
             revenuecat: connectors.includes('revenuecat')
-                ? { ...(config.sources?.revenuecat || {}), enabled: true, mode: 'command', command: getDefaultSourceCommand('revenuecat') }
+                ? { ...(config.sources?.revenuecat || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('revenuecat', config.sources?.revenuecat) }
                 : config.sources?.revenuecat,
+            paddle: connectors.includes('paddle')
+                ? { ...(config.sources?.paddle || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('paddle', config.sources?.paddle) }
+                : config.sources?.paddle,
+            seo: connectors.includes('seo')
+                ? { ...(config.sources?.seo || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('seo', config.sources?.seo) }
+                : config.sources?.seo,
             sentry: connectors.includes('sentry')
-                ? { ...(config.sources?.sentry || {}), enabled: true, mode: 'command', command: getDefaultSourceCommand('sentry') }
+                ? { ...(config.sources?.sentry || {}), enabled: true, mode: 'command', command: normalizeSourceCommand('sentry', config.sources?.sentry) }
                 : config.sources?.sentry,
+            coolify: connectors.includes('coolify')
+                ? {
+                    ...(config.sources?.coolify || {}),
+                    enabled: true,
+                    mode: 'command',
+                    command: normalizeSourceCommand('coolify', config.sources?.coolify),
+                    baseUrl: config.sources?.coolify?.baseUrl || process.env.COOLIFY_BASE_URL || 'https://coolify.wotaso.com',
+                    tokenEnv: config.sources?.coolify?.tokenEnv || 'COOLIFY_API_TOKEN',
+                }
+                : config.sources?.coolify,
             extra: extra.map((source) => connectors.includes('asc') && source?.service === 'asc-cli'
-                ? { ...source, enabled: true, mode: 'command', command: source.command || getDefaultSourceCommand('asc') }
-                : source),
+                ? { ...source, enabled: true, mode: 'command', command: normalizeSourceCommand('asc', source) }
+                : connectors.includes(String(source?.key || source?.service || '')) && isAccountSignalConnector(String(source?.key || source?.service || ''))
+                    ? { ...source, enabled: true, mode: source.mode || 'file' }
+                    : source),
         },
     };
     await writeJson(configPath, next);
@@ -846,8 +1317,16 @@ async function installConnectorHelpers(configPath, connectors) {
             results.push(await installAscConnector());
         if (connector === 'revenuecat')
             results.push(await installRevenueCatConnector());
+        if (connector === 'paddle')
+            results.push({ connector, ok: true, detail: 'Paddle uses the built-in metrics exporter; token is checked during preflight' });
+        if (connector === 'seo')
+            results.push({ connector, ok: true, detail: 'SEO/GSC uses the built-in exporter; credentials or CSV inputs are checked during preflight' });
         if (connector === 'sentry')
             results.push(await installSentryConnector());
+        if (connector === 'coolify')
+            results.push(await installCoolifyConnector());
+        if (isAccountSignalConnector(connector))
+            results.push(await installAccountSignalConnector(connector));
     }
     return results;
 }
@@ -878,7 +1357,9 @@ async function detectGitHubRepo() {
 }
 async function ensureConfig(configPath) {
     if (await fileExists(configPath)) {
-        const config = await readJson(configPath);
+        const originalConfig = await readJson(configPath);
+        const config = migrateRuntimeSourceCommands(originalConfig);
+        let changed = JSON.stringify(originalConfig.sources || {}) !== JSON.stringify(config.sources || {});
         if (!isConfiguredGitHubRepo(config?.project?.githubRepo)) {
             const detectedRepo = await detectGitHubRepo();
             if (detectedRepo) {
@@ -886,14 +1367,17 @@ async function ensureConfig(configPath) {
                     ...(config.project || {}),
                     githubRepo: detectedRepo,
                 };
-                await writeJson(configPath, config);
-                return {
-                    created: false,
-                    configPath,
-                    githubRepo: detectedRepo,
-                };
+                changed = true;
             }
         }
+        if (changed) {
+            await writeJson(configPath, config);
+            return {
+                created: false,
+                configPath,
+                githubRepo: config.project?.githubRepo || null,
+            };
+        }
         return {
             created: false,
             configPath,
@@ -917,19 +1401,27 @@ async function ensureConfig(configPath) {
             analytics: {
                 enabled: true,
                 mode: 'command',
-                command: getDefaultSourceCommand('analytics'),
+                command: getRuntimeSourceCommand('analytics'),
             },
             revenuecat: {
                 ...(template.sources?.revenuecat || {}),
                 enabled: false,
                 mode: 'command',
-                command: getDefaultSourceCommand('revenuecat'),
+                command: getRuntimeSourceCommand('revenuecat'),
             },
             sentry: {
                 ...(template.sources?.sentry || {}),
                 enabled: false,
                 mode: 'command',
-                command: getDefaultSourceCommand('sentry'),
+                command: getRuntimeSourceCommand('sentry'),
+            },
+            coolify: {
+                ...(template.sources?.coolify || {}),
+                enabled: false,
+                mode: 'command',
+                command: getRuntimeSourceCommand('coolify'),
+                baseUrl: template.sources?.coolify?.baseUrl || process.env.COOLIFY_BASE_URL || 'https://coolify.wotaso.com',
+                tokenEnv: template.sources?.coolify?.tokenEnv || 'COOLIFY_API_TOKEN',
             },
             feedback: {
                 ...(template.sources?.feedback || {}),
@@ -940,7 +1432,7 @@ async function ensureConfig(configPath) {
         actions: {
             ...template.actions,
             mode: 'issue',
-            autoCreateIssues: false,
+            autoCreateIssues: true,
             autoCreatePullRequests: false,
             draftPullRequests: true,
             proposalBranchPrefix: 'openclaw/proposals',
@@ -1022,6 +1514,15 @@ function appendProjectFlag(command, projectId) {
 function commandHasAscAppFlag(command) {
     return /(^|\s)--app(\s|=|$)/.test(String(command || ''));
 }
+function removeAscAppFlag(command) {
+    const raw = String(command || '').trim();
+    if (!raw || !commandHasAscAppFlag(raw))
+        return raw;
+    return raw
+        .replace(/(^|\s)--app(?:=(?:"[^"]*"|'[^']*'|\S+)|\s+(?:"[^"]*"|'[^']*'|\S+))/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
 function appendAscAppFlag(command, appId) {
     const raw = String(command || '').trim();
     if (!raw || commandHasAscAppFlag(raw))
@@ -1091,6 +1592,34 @@ async function configureAscApp(configPath, appId) {
     process.env.ASC_APP_ID = normalizedAppId;
     return changed;
 }
+async function configureAscAllApps(configPath) {
+    const config = await readJson(configPath);
+    let changed = false;
+    const extraSources = Array.isArray(config?.sources?.extra) ? config.sources.extra : [];
+    for (const source of extraSources) {
+        if (!source || typeof source !== 'object')
+            continue;
+        const service = String(source.service || source.key || '').trim().toLowerCase();
+        if (!['asc', 'asc-cli', 'app-store-connect', 'app_store_connect'].includes(service))
+            continue;
+        if (source.mode === 'command' && source.command) {
+            const nextCommand = removeAscAppFlag(source.command);
+            if (nextCommand !== source.command) {
+                source.command = nextCommand;
+                changed = true;
+            }
+        }
+    }
+    if (config.project && typeof config.project === 'object' && config.project.ascAppId) {
+        delete config.project.ascAppId;
+        changed = true;
+    }
+    if (changed) {
+        await writeJson(configPath, config);
+    }
+    delete process.env.ASC_APP_ID;
+    return changed;
+}
 function configHasEnabledAscSource(config) {
     const extraSources = Array.isArray(config?.sources?.extra) ? config.sources.extra : [];
     return extraSources.some((source) => {
@@ -1166,11 +1695,7 @@ async function ensureAscAppConfigured(configPath, explicitAppId) {
     if (!configHasEnabledAscSource(config)) {
         return { ok: true, configured: false, changed: false, appId: null, appScope: 'disabled', needsUserInput: false };
     }
-    const configuredAppId = normalizeString(config.project?.ascAppId) || normalizeString(process.env.ASC_APP_ID);
-    if (configuredAppId) {
-        const changed = await configureAscApp(configPath, configuredAppId);
-        return { ok: true, configured: true, changed, appId: configuredAppId, appScope: 'single_app', needsUserInput: false };
-    }
+    const changed = await configureAscAllApps(configPath);
     const appList = await listAscApps();
     if (!appList.ok) {
         return {
@@ -1185,7 +1710,7 @@ async function ensureAscAppConfigured(configPath, explicitAppId) {
     return {
         ok: true,
         configured: true,
-        changed: false,
+        changed,
         appId: null,
         appScope: 'all_accessible_apps',
         apps: appList.apps,
@@ -1193,6 +1718,131 @@ async function ensureAscAppConfigured(configPath, explicitAppId) {
         needsUserInput: false,
     };
 }
+function extractAscAnalyticsRequestIds(payload) {
+    const candidates = (() => {
+        if (Array.isArray(payload))
+            return payload;
+        if (payload && typeof payload === 'object') {
+            if (Array.isArray(payload.requests))
+                return payload.requests;
+            if (Array.isArray(payload.analyticsReportRequests))
+                return payload.analyticsReportRequests;
+            if (Array.isArray(payload.items))
+                return payload.items;
+            if (Array.isArray(payload.data))
+                return payload.data;
+        }
+        return [];
+    })();
+    const ids = [];
+    for (const candidate of candidates) {
+        if (!candidate || typeof candidate !== 'object')
+            continue;
+        const id = normalizeString(candidate.id) || normalizeString(candidate.requestId) || normalizeString(candidate.request_id);
+        if (id)
+            ids.push(id);
+    }
+    return [...new Set(ids)];
+}
+function extractAscAnalyticsRequestId(payload) {
+    if (payload && typeof payload === 'object') {
+        const id = normalizeString(payload.id) || normalizeString(payload.requestId) || normalizeString(payload.request_id);
+        if (id)
+            return id;
+    }
+    return extractAscAnalyticsRequestIds(payload)[0] || null;
+}
+async function listAscAnalyticsRequests(appId, state = '') {
+    const stateArg = state ? ` --state ${quote(state)}` : '';
+    const result = await runShellCommand(`asc analytics requests --app ${quote(appId)}${stateArg} --output json`, 60_000);
+    if (!result.ok) {
+        return { ok: false, ids: [], error: result.stderr || `exit ${result.code}` };
+    }
+    return { ok: true, ids: extractAscAnalyticsRequestIds(parseJsonFromStdout(result.stdout)), error: null };
+}
+async function ensureAscAnalyticsRequest(appId) {
+    const normalizedAppId = normalizeString(appId);
+    if (!normalizedAppId) {
+        return { ok: true, status: 'skipped', requestId: null, detail: 'no single ASC app configured' };
+    }
+    const completedRequests = await listAscAnalyticsRequests(normalizedAppId, 'COMPLETED');
+    if (!completedRequests.ok) {
+        return { ok: false, status: 'query_failed', requestId: null, error: completedRequests.error };
+    }
+    if (completedRequests.ids.length > 0) {
+        return { ok: true, status: 'completed', requestId: completedRequests.ids[0], detail: `completed request ${completedRequests.ids[0]}` };
+    }
+    const existingRequests = await listAscAnalyticsRequests(normalizedAppId);
+    if (!existingRequests.ok) {
+        return { ok: false, status: 'query_failed', requestId: null, error: existingRequests.error };
+    }
+    if (existingRequests.ids.length > 0) {
+        return { ok: true, status: 'pending', requestId: existingRequests.ids[0], detail: `existing request ${existingRequests.ids[0]} is not completed yet` };
+    }
+    const created = await runShellCommand(`asc analytics request --app ${quote(normalizedAppId)} --access-type ONGOING --output json`, 60_000);
+    if (!created.ok) {
+        return { ok: false, status: 'create_failed', requestId: null, error: created.stderr || `exit ${created.code}` };
+    }
+    const requestId = extractAscAnalyticsRequestId(parseJsonFromStdout(created.stdout));
+    return {
+        ok: true,
+        status: 'created',
+        requestId,
+        detail: requestId
+            ? `created ongoing request ${requestId}; report instances will appear after Apple processing`
+            : 'created ongoing request; report instances will appear after Apple processing',
+    };
+}
+async function ensureAscAnalyticsRequestsForAppScope(ascAppSetup) {
+    if (!ascAppSetup?.ok || ascAppSetup.appScope === 'disabled') {
+        return { ok: true, status: 'skipped', requestId: null, requestIds: [], detail: 'ASC source is not enabled', results: [] };
+    }
+    const apps = ascAppSetup.appId
+        ? [{ id: ascAppSetup.appId }]
+        : Array.isArray(ascAppSetup.apps)
+            ? ascAppSetup.apps.filter((app) => normalizeString(app?.id))
+            : [];
+    if (apps.length === 0) {
+        return { ok: true, status: 'skipped', requestId: null, requestIds: [], detail: 'no accessible ASC apps found', results: [] };
+    }
+    const results = [];
+    for (const app of apps) {
+        const result = await ensureAscAnalyticsRequest(app.id);
+        results.push({
+            appId: app.id,
+            appName: app.name || null,
+            ...result,
+        });
+    }
+    const failures = results.filter((result) => !result.ok);
+    if (failures.length > 0) {
+        return {
+            ok: false,
+            status: failures.length === results.length ? 'failed' : 'partial_failed',
+            requestId: null,
+            requestIds: results.map((result) => result.requestId).filter(Boolean),
+            results,
+            error: failures
+                .map((failure) => `${failure.appName || failure.appId}: ${failure.error || failure.status || 'unknown error'}`)
+                .join('; '),
+        };
+    }
+    const counts = results.reduce((memo, result) => {
+        memo[result.status] = (memo[result.status] || 0) + 1;
+        return memo;
+    }, {});
+    const detail = Object.entries(counts)
+        .map(([status, count]) => `${count} ${status}`)
+        .join(', ');
+    return {
+        ok: true,
+        status: 'ok',
+        requestId: results[0]?.requestId || null,
+        requestIds: results.map((result) => result.requestId).filter(Boolean),
+        detail: `checked ${results.length} ASC app(s): ${detail}`,
+        results,
+    };
+}
 async function listAnalyticsProjects() {
     const result = await runShellCommand('analyticscli projects list --format json', 60_000);
     if (!result.ok) {
@@ -1286,7 +1936,7 @@ function remediationForCheck(checkName, configPath) {
         return 'Write `data/openclaw-growth-engineer/analytics_summary.json` via your analytics refresh step (API-key based source command/file generation).';
     }
     if (checkName === 'connection:analytics') {
-        return 'Run `node scripts/openclaw-growth-wizard.mjs --connectors analytics` and paste a fresh AnalyticsCLI readonly CLI token into the local terminal wizard.';
+        return 'Run `npx -y @analyticscli/growth-engineer@preview wizard --connectors analytics` and paste a fresh AnalyticsCLI readonly CLI token into the local terminal wizard.';
     }
     if (checkName === 'connection:github') {
         return 'Verify `GITHUB_TOKEN` and repo access to `/repos/<owner>/<repo>` + issues API.';
@@ -1295,7 +1945,7 @@ function remediationForCheck(checkName, configPath) {
         return 'Verify `GITHUB_TOKEN` and repo access to `/repos/<owner>/<repo>/pulls`, plus `Pull requests: Read/Write` and `Contents: Read/Write` scopes.';
     }
     if (checkName === 'connection:asc_cli') {
-        return 'ASC setup should list App Store Connect apps and persist the selected app automatically. Rerun the connector wizard; if this repeats, update the skill/CLI rather than setting ASC_APP_ID by hand.';
+        return 'ASC setup should list all App Store Connect apps the API key can access. Rerun the connector wizard with an API key scoped to the whole account; do not set ASC_APP_ID for normal Growth Engineer runs.';
     }
     return 'Fix this blocker and rerun start.';
 }
@@ -1346,17 +1996,61 @@ async function runPreflight(configPath, testConnections, progressJson = false, o
     };
 }
 async function runFirstPass(configPath) {
-    const command = `${nodeRuntimeScriptCommand('openclaw-growth-runner.mjs')} --config ${quote(configPath)}`;
+    const statePath = path.resolve(deriveStatePathFromConfigPath(configPath));
+    const command = `${nodeRuntimeScriptCommand('openclaw-growth-runner.mjs')} --config ${quote(configPath)} --state ${quote(statePath)}`;
     return runShellCommand(command, 300_000);
 }
 async function main() {
     await loadOpenClawGrowthSecrets();
     const args = parseArgs(process.argv.slice(2));
     const configPath = path.resolve(args.config);
+    const schedulerProofPath = path.resolve(deriveSchedulerProofPathFromStatePath(deriveStatePathFromConfigPath(configPath)));
     const configResult = await ensureConfig(configPath);
-    const initialConfig = await readJson(configPath);
+    const initialConfig = applyOpenClawCronOverrides(await readJson(configPath), args);
     await applyOpenClawSecretRefs(initialConfig);
     const heartbeat = await ensureGrowthHeartbeat(configPath, initialConfig);
+    const openclawCron = await ensureOpenClawCronSchedule(configPath, initialConfig, args.openclawCron);
+    const hermesCron = await ensureHermesCronSchedule(configPath, initialConfig, args.openclawCron);
+    if (!openclawCron.ok) {
+        process.stdout.write(`${JSON.stringify({
+            ok: false,
+            phase: 'openclaw_cron_setup',
+            configCreated: configResult.created,
+            configPath,
+            heartbeat,
+            openclawCron,
+            hermesCron,
+            blockers: [
+                {
+                    check: 'scheduler:openclaw-cron',
+                    detail: openclawCron.detail,
+                    remediation: openclawCron.remediation || 'Fix OpenClaw cron setup and rerun start.',
+                },
+            ],
+        }, null, 2)}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!hermesCron.ok) {
+        process.stdout.write(`${JSON.stringify({
+            ok: false,
+            phase: 'hermes_cron_setup',
+            configCreated: configResult.created,
+            configPath,
+            heartbeat,
+            openclawCron,
+            hermesCron,
+            blockers: [
+                {
+                    check: 'scheduler:hermes-cron',
+                    detail: hermesCron.detail,
+                    remediation: hermesCron.remediation || 'Fix Hermes cron setup and rerun start.',
+                },
+            ],
+        }, null, 2)}\n`);
+        process.exitCode = 1;
+        return;
+    }
     const projectConfigured = await configureAnalyticsProject(configPath, args.project);
     const ascAppConfiguredFromArg = await configureAscApp(configPath, args.ascApp);
     const analyticscliEnsure = await ensureAnalyticsCliInstalled();
@@ -1367,6 +2061,8 @@ async function main() {
             configCreated: configResult.created,
             configPath,
             heartbeat,
+            openclawCron,
+            hermesCron,
             projectConfigured,
             ascAppConfigured: ascAppConfiguredFromArg,
             blockers: [
@@ -1408,6 +2104,8 @@ async function main() {
             configCreated: configResult.created,
             configPath,
             heartbeat,
+            openclawCron,
+            hermesCron,
             projectConfigured,
             ascAppConfigured: ascAppConfiguredFromArg,
             connectorSetup,
@@ -1422,7 +2120,9 @@ async function main() {
                             ? 'Install the ASC CLI and provide ASC_KEY_ID, ASC_ISSUER_ID, and ASC_PRIVATE_KEY_PATH or ASC_PRIVATE_KEY. Resolve the app after auth succeeds.'
                             : entry.connector === 'sentry'
                                 ? 'Set SENTRY_AUTH_TOKEN plus SENTRY_ORG in the connector wizard. Defer project scope to app/repo context, or configure sources.sentry.accounts[].projects[] only when a fixed mapping is known.'
-                                : 'Set REVENUECAT_API_KEY and rerun connector setup to write RevenueCat MCP config.',
+                                : entry.connector === 'coolify'
+                                    ? 'Set COOLIFY_BASE_URL and COOLIFY_API_TOKEN from Coolify Keys & Tokens / API tokens in the connector wizard.'
+                                    : 'Set REVENUECAT_API_KEY and rerun connector setup to write RevenueCat MCP config.',
             })),
         }, null, 2)}\n`);
         process.exitCode = 1;
@@ -1475,6 +2175,8 @@ async function main() {
             configCreated: configResult.created,
             configPath,
             heartbeat,
+            openclawCron,
+            hermesCron,
             projectConfigured: projectConfigured || analyticsProjectSetup.configured,
             analyticsProjectId: analyticsProjectSetup.projectId || null,
             ascAppConfigured: false,
@@ -1494,6 +2196,51 @@ async function main() {
         process.exitCode = 1;
         return;
     }
+    emitProgress(args.progressJson, {
+        phase: 'start',
+        key: 'ascAnalyticsRequest',
+        label: 'ASC analytics reports',
+        detail: 'checking ongoing Analytics Report Request',
+    });
+    const ascAnalyticsRequestSetup = await ensureAscAnalyticsRequestsForAppScope(ascAppSetup);
+    emitProgress(args.progressJson, {
+        phase: 'finish',
+        key: 'ascAnalyticsRequest',
+        label: 'ASC analytics reports',
+        detail: ascAnalyticsRequestSetup.ok
+            ? ascAnalyticsRequestSetup.detail
+            : `could not ensure Analytics Report Request (${truncate(ascAnalyticsRequestSetup.error, 240)})`,
+        status: ascAnalyticsRequestSetup.ok ? 'pass' : 'fail',
+    });
+    if (!ascAnalyticsRequestSetup.ok) {
+        process.stdout.write(`${JSON.stringify({
+            ok: false,
+            phase: 'asc_analytics_request_setup',
+            configCreated: configResult.created,
+            configPath,
+            heartbeat,
+            openclawCron,
+            hermesCron,
+            projectConfigured: projectConfigured || analyticsProjectSetup.configured,
+            analyticsProjectId: analyticsProjectSetup.projectId || null,
+            ascAppConfigured: ascAppSetup.configured,
+            ascAppId: ascAppSetup.appId || null,
+            ascAppScope: ascAppSetup.appScope || null,
+            ascAnalyticsRequestResults: ascAnalyticsRequestSetup.results || [],
+            connectorSetup,
+            needsUserInput: false,
+            question: null,
+            blockers: [
+                {
+                    check: 'connection:asc_analytics_request',
+                    detail: `Could not ensure App Store Connect Analytics Report Request: ${truncate(ascAnalyticsRequestSetup.error, 800)}`,
+                    remediation: 'Use an ASC API key with Admin for first setup so Growth Engineer can create the ongoing Analytics Report Request. After the request exists, rotate to Sales and Reports for steady-state downloads.',
+                },
+            ],
+        }, null, 2)}\n`);
+        process.exitCode = 1;
+        return;
+    }
     const preflightResult = await runPreflight(configPath, args.testConnections, args.progressJson, args.onlyConnectors);
     const preflightPayload = preflightResult.payload;
     if (!preflightPayload) {
@@ -1514,11 +2261,16 @@ async function main() {
             configCreated: configResult.created,
             configPath,
             heartbeat,
+            openclawCron,
+            hermesCron,
             projectConfigured: projectConfigured || analyticsProjectSetup.configured,
             analyticsProjectId: analyticsProjectSetup.projectId || null,
             ascAppConfigured: ascAppSetup.configured,
             ascAppId: ascAppSetup.appId || null,
             ascAppScope: ascAppSetup.appScope || null,
+            ascAnalyticsRequestStatus: ascAnalyticsRequestSetup.status,
+            ascAnalyticsRequestId: ascAnalyticsRequestSetup.requestId || null,
+            ascAnalyticsRequestIds: ascAnalyticsRequestSetup.requestIds || [],
             githubRepo: configResult.githubRepo,
             connectorSetup,
             checks: preflightPayload.checks || [],
@@ -1534,12 +2286,18 @@ async function main() {
             configCreated: configResult.created,
             configPath,
             heartbeat,
+            openclawCron,
+            hermesCron,
             projectConfigured: projectConfigured || analyticsProjectSetup.configured,
             analyticsProjectId: analyticsProjectSetup.projectId || null,
             ascAppConfigured: ascAppSetup.configured,
             ascAppId: ascAppSetup.appId || null,
             ascAppScope: ascAppSetup.appScope || null,
+            ascAnalyticsRequestStatus: ascAnalyticsRequestSetup.status,
+            ascAnalyticsRequestId: ascAnalyticsRequestSetup.requestId || null,
+            ascAnalyticsRequestIds: ascAnalyticsRequestSetup.requestIds || [],
             connectorSetup,
+            schedulerProofPath,
             message: 'Preflight passed. First run skipped due to --setup-only.',
         }, null, 2)}\n`);
         return;
@@ -1562,6 +2320,8 @@ async function main() {
             configCreated: configResult.created,
             configPath,
             heartbeat,
+            openclawCron,
+            hermesCron,
             projectConfigured,
             error: rawError,
         }, null, 2)}\n`);
@@ -1575,9 +2335,12 @@ async function main() {
         configCreated: configResult.created,
         configPath,
         heartbeat,
+        openclawCron,
+        hermesCron,
         projectConfigured,
         actionMode,
         runnerOutput: runResult.stdout.trim(),
+        schedulerProofPath,
     }, null, 2)}\n`);
 }
 main().catch((error) => {