@clawkeepers/kernel 0.1.0-beta.1

package/dist/index.js

@@ -0,0 +1,1205 @@
+// src/index.ts
+import { Type as Type2 } from "typebox";
+
+// src/upstream/sdk.ts
+import { definePluginEntry, buildJsonPluginConfigSchema } from "openclaw/plugin-sdk/plugin-entry";
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+
+// src/config-schema.ts
+import { readFileSync } from "fs";
+var schema = JSON.parse(readFileSync(new URL("../config.schema.json", import.meta.url), "utf8"));
+
+// src/upstream/cli.ts
+import { spawnSync } from "child_process";
+import { homedir } from "os";
+import { join, resolve } from "path";
+function operatorCell(env, home = homedir()) {
+  const cell2 = env.CLAWOS_CELL ?? env.OPENCLAW_PROFILE ?? "default";
+  if (!/^[a-z](?:[a-z0-9-]{0,30}[a-z0-9])?$/.test(cell2)) throw new Error("Invalid operator cell.");
+  if (env.CLAWOS_CELL && env.OPENCLAW_PROFILE && env.CLAWOS_CELL !== env.OPENCLAW_PROFILE) throw new Error("Conflicting operator cell selectors.");
+  const state = join(home, cell2 === "default" ? ".openclaw" : `.openclaw-${cell2}`);
+  if (env.OPENCLAW_STATE_DIR && resolve(env.OPENCLAW_STATE_DIR) !== state || env.OPENCLAW_CONFIG_PATH && resolve(env.OPENCLAW_CONFIG_PATH) !== join(state, "openclaw.json")) {
+    throw new Error("Operator CLI requires a registered canonical cell; explicit state/config does not match.");
+  }
+  return cell2;
+}
+function runOperatorCli(cell2, args) {
+  const result = spawnSync("clawos", [...args, "--cell", cell2, "--json"], {
+    env: process.env,
+    encoding: "utf8",
+    timeout: 9e4,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  if (result.status !== 0 || result.error) throw new Error("Kernel CLI unavailable or unauthorized; verify clawos installation and cell pairing.");
+  try {
+    process.stdout.write(`${JSON.stringify(JSON.parse(result.stdout))}
+`);
+  } catch {
+    throw new Error("Kernel CLI returned an invalid response.");
+  }
+}
+function mountOperatorCli(program) {
+  const cell2 = operatorCell(process.env);
+  const os = program.command("os").description("OpenClaw OS kernel administration");
+  os.command("status").option("--json").action(() => runOperatorCli(cell2, ["kernel", "status"]));
+  os.command("grants").option("--json").action(() => runOperatorCli(cell2, ["grant", "list"]));
+  os.command("approvals").option("--json").action(() => runOperatorCli(cell2, ["approvals", "list"]));
+  os.command("audit").option("--json").option("--limit <n>").action((o) => runOperatorCli(cell2, ["audit", "tail", "--limit", o.limit ?? "100"]));
+}
+
+// src/kernel.ts
+import { randomBytes } from "crypto";
+import { join as join4 } from "path";
+import { existsSync, readFileSync as readFileSync4, writeFileSync, renameSync, unlinkSync } from "fs";
+import { evaluateInstall, ApprovalDecisionParams, ConnectGatekeeperParams, IntroduceParams, ListGrantsParams, RevokeGrantParams } from "@clawkeepers/shared";
+import { Type } from "typebox";
+import { Value as Value5 } from "typebox/value";
+
+// src/store.ts
+import { mkdirSync } from "fs";
+import { createRequire } from "module";
+import { dirname } from "path";
+var { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+var SCHEMA = `
+CREATE TABLE IF NOT EXISTS meta(k TEXT PRIMARY KEY,v TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS grants(handle TEXT PRIMARY KEY,agentId TEXT NOT NULL,cellId TEXT NOT NULL,vendor TEXT NOT NULL,resourceType TEXT NOT NULL,resourceKey TEXT NOT NULL,operatorId TEXT NOT NULL,scope TEXT NOT NULL,audience TEXT NOT NULL,status TEXT NOT NULL,createdAt INTEGER NOT NULL,createdBy TEXT NOT NULL,expiresAt INTEGER,title TEXT);
+CREATE UNIQUE INDEX IF NOT EXISTS grant_identity ON grants(agentId,vendor,resourceType,resourceKey,operatorId,scope);
+CREATE TABLE IF NOT EXISTS instances(id TEXT PRIMARY KEY,vendor TEXT NOT NULL,resourceKey TEXT NOT NULL,operatorId TEXT NOT NULL,observerStrategy TEXT NOT NULL,lockdown INTEGER NOT NULL DEFAULT 0);
+CREATE TABLE IF NOT EXISTS actions(id INTEGER PRIMARY KEY AUTOINCREMENT,gatekeeperInstance TEXT NOT NULL,actionId INTEGER NOT NULL,descriptionJson TEXT NOT NULL,status TEXT NOT NULL,submittedAt INTEGER NOT NULL,decidedBy TEXT,decidedAt INTEGER,appliedAt INTEGER,error TEXT,UNIQUE(gatekeeperInstance,actionId));
+CREATE TABLE IF NOT EXISTS notifications(runId TEXT PRIMARY KEY,createdAt INTEGER NOT NULL);
+CREATE TABLE IF NOT EXISTS action_bindings(id INTEGER PRIMARY KEY,handle TEXT NOT NULL,agentId TEXT NOT NULL,sessionKey TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS introductions(id INTEGER PRIMARY KEY AUTOINCREMENT,agentId TEXT NOT NULL,sessionKey TEXT,url TEXT NOT NULL,reason TEXT,status TEXT NOT NULL,createdAt INTEGER NOT NULL,requestedBy TEXT);
+CREATE TABLE IF NOT EXISTS observers(sessionKey TEXT NOT NULL,observerId TEXT NOT NULL,tainted INTEGER NOT NULL DEFAULT 0,PRIMARY KEY(sessionKey,observerId));
+CREATE TABLE IF NOT EXISTS approval_decisions(toolCallId TEXT PRIMARY KEY,tool TEXT NOT NULL,paramsJson TEXT NOT NULL,decision TEXT NOT NULL,operatorId TEXT,decidedAt INTEGER NOT NULL);
+CREATE TABLE IF NOT EXISTS audit_index(ts TEXT NOT NULL,kind TEXT NOT NULL,agentId TEXT,handle TEXT,file TEXT NOT NULL,line INTEGER NOT NULL);
+INSERT OR REPLACE INTO meta(k,v) VALUES('schema','1');`;
+var Store = class {
+  db;
+  constructor(path) {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    this.db = new DatabaseSync(path);
+    this.db.exec("PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000;");
+  }
+  /** Refuse forward-schema rollback; an existing current schema is never rewritten at startup. */
+  migrate() {
+    const exists = this.db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='meta'").get();
+    if (exists) {
+      const schema2 = this.db.prepare("SELECT v FROM meta WHERE k='schema'").get();
+      if (schema2?.v !== "1") throw new Error("Kernel schema incompatible.");
+      return;
+    }
+    this.db.exec(SCHEMA);
+  }
+  close() {
+    this.db.close();
+  }
+  getGrant(handle) {
+    return grantRow(this.db.prepare("SELECT * FROM grants WHERE handle=?").get(handle));
+  }
+  isActiveHandle(handle, now = Date.now()) {
+    if (typeof handle !== "string") return false;
+    const g = this.getGrant(handle);
+    return g?.status === "active" && (g.expiresAt === void 0 || g.expiresAt > now);
+  }
+  authorizeGrant(expected, agentId, sessionKey, cellId, now = Date.now()) {
+    const current = this.getGrant(expected.handle);
+    if (!current || current.status !== "active" || current.audience !== "owner-only" || current.expiresAt !== void 0 && current.expiresAt <= now || current.agentId !== agentId || current.cellId !== cellId || current.scope !== "agent" && current.scope !== `session:${sessionKey}` || current.vendor !== expected.vendor || current.resourceType !== expected.resourceType || current.resourceKey !== expected.resourceKey || current.operatorId !== expected.operatorId) return null;
+    return current;
+  }
+  listGrants(agentId, activeOnly = true) {
+    return this.db.prepare(`SELECT * FROM grants WHERE agentId=?${activeOnly ? " AND status='active'" : ""} ORDER BY createdAt,handle`).all(agentId).map((r) => grantRow(r));
+  }
+  allGrants(agentId) {
+    const rows = agentId ? this.db.prepare("SELECT * FROM grants WHERE agentId=? ORDER BY createdAt").all(agentId) : this.db.prepare("SELECT * FROM grants ORDER BY createdAt").all();
+    return rows.map((r) => grantRow(r));
+  }
+  insertGrant(g) {
+    this.db.prepare(`INSERT OR IGNORE INTO grants(handle,agentId,cellId,vendor,resourceType,resourceKey,operatorId,scope,audience,status,createdAt,createdBy,expiresAt,title) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(g.handle, g.agentId, g.cellId, g.vendor, g.resourceType, g.resourceKey, g.operatorId, g.scope, g.audience, g.status, g.createdAt, g.createdBy, g.expiresAt ?? null, g.title ?? null);
+    return grantRow(this.db.prepare("SELECT * FROM grants WHERE agentId=? AND vendor=? AND resourceType=? AND resourceKey=? AND operatorId=? AND scope=?").get(g.agentId, g.vendor, g.resourceType, g.resourceKey, g.operatorId, g.scope));
+  }
+  setGrantStatus(handle, status) {
+    return Number(this.db.prepare("UPDATE grants SET status=? WHERE handle=?").run(status, handle).changes) === 1;
+  }
+  upsertInstance(r) {
+    this.db.prepare(`INSERT INTO instances(id,vendor,resourceKey,operatorId,observerStrategy,lockdown) VALUES(?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET observerStrategy=excluded.observerStrategy,lockdown=MAX(instances.lockdown,excluded.lockdown)`).run(r.id, r.vendor, r.resourceKey, r.operatorId, r.observerStrategy, r.lockdown);
+  }
+  getInstance(id) {
+    return this.db.prepare("SELECT * FROM instances WHERE id=?").get(id) ?? null;
+  }
+  lockdownInstance(id) {
+    this.db.prepare("UPDATE instances SET lockdown=1 WHERE id=?").run(id);
+  }
+  addIntroduction(v) {
+    return Number(this.db.prepare("INSERT INTO introductions(agentId,sessionKey,url,reason,status,createdAt,requestedBy) VALUES(?,?,?,?,?,?,?)").run(v.agentId, v.sessionKey ?? null, v.url, v.reason ?? null, "pending", Date.now(), v.requestedBy ?? null).lastInsertRowid);
+  }
+  /** Operator-visible pending resource introductions, bounded by the caller. */
+  listIntroductions() {
+    return this.db.prepare("SELECT id,agentId,sessionKey,url,reason FROM introductions WHERE status='pending' ORDER BY id LIMIT 100").all();
+  }
+  /** Claim before awaiting grant creation, so overlapping operator decisions cannot duplicate it. */
+  claimIntroduction(id) {
+    return Number(this.db.prepare("UPDATE introductions SET status='resolving' WHERE id=? AND status='pending'").run(id).changes) === 1;
+  }
+  /** Complete an already-claimed introduction without changing its bound agent or resource. */
+  finishIntroduction(id, status) {
+    this.db.prepare("UPDATE introductions SET status=? WHERE id=? AND status='resolving'").run(status, id);
+  }
+  /** Claim a run digest before delivery: uncertain sends are not repeated. */
+  claimNotification(runId) {
+    return Number(this.db.prepare("INSERT OR IGNORE INTO notifications(runId,createdAt) VALUES(?,?)").run(runId, Date.now()).changes) === 1;
+  }
+  countPendingRequests() {
+    return this.count("introductions");
+  }
+  addAction(instance, actionId, d) {
+    this.db.prepare("INSERT OR IGNORE INTO actions(gatekeeperInstance,actionId,descriptionJson,status,submittedAt) VALUES(?,?,?,?,?)").run(instance, actionId, JSON.stringify(d), "pending", Date.now());
+    return this.db.prepare("SELECT * FROM actions WHERE gatekeeperInstance=? AND actionId=?").get(instance, actionId);
+  }
+  listActions(pendingOnly = true) {
+    return this.db.prepare(`SELECT * FROM actions${pendingOnly ? " WHERE status='pending'" : ""} ORDER BY id`).all();
+  }
+  getAction(id) {
+    return this.db.prepare("SELECT * FROM actions WHERE id=?").get(id) ?? null;
+  }
+  decideAction(id, status, operatorId, error) {
+    const now = Date.now();
+    return Number(this.db.prepare("UPDATE actions SET status=?,decidedBy=?,decidedAt=?,appliedAt=CASE WHEN ?='applied' THEN ? ELSE appliedAt END,error=? WHERE id=?").run(status, operatorId, now, status, now, error ?? null, id).changes) === 1;
+  }
+  /** Persist the originating capability separately; duplicate submissions cannot rebind it. */
+  bindAction(id, handle, agentId, sessionKey) {
+    this.db.prepare("INSERT OR IGNORE INTO action_bindings(id,handle,agentId,sessionKey) VALUES(?,?,?,?)").run(id, handle, agentId, sessionKey);
+  }
+  /** Only an original binding may authorize an external approval effect. */
+  actionBinding(id) {
+    return this.db.prepare("SELECT handle,agentId,sessionKey FROM action_bindings WHERE id=?").get(id) ?? null;
+  }
+  /** A crash during an effect leaves a terminal, non-retryable uncertain record. */
+  claimAction(id, expected, operator) {
+    return Number(this.db.prepare("UPDATE actions SET status='failed',decidedBy=?,decidedAt=?,error='Outcome unconfirmed; reconcile before retry' WHERE id=? AND status=?").run(operator, Date.now(), id, expected).changes) === 1;
+  }
+  countPending() {
+    return this.count("actions");
+  }
+  setObservers(sessionKey, observers) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.db.prepare("DELETE FROM observers WHERE sessionKey=? AND tainted=0").run(sessionKey);
+      const q = this.db.prepare("INSERT OR IGNORE INTO observers(sessionKey,observerId,tainted) VALUES(?,?,0)");
+      for (const id of observers) q.run(sessionKey, id);
+      this.db.exec("COMMIT");
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  observers(sessionKey) {
+    return this.db.prepare("SELECT observerId FROM observers WHERE sessionKey=? ORDER BY observerId").all(sessionKey).map((r) => r.observerId);
+  }
+  taintObserver(sessionKey, observerId) {
+    this.db.prepare("INSERT INTO observers(sessionKey,observerId,tainted) VALUES(?,?,1) ON CONFLICT(sessionKey,observerId) DO UPDATE SET tainted=1").run(sessionKey, observerId);
+  }
+  recordToolDecision(toolCallId, tool, params, decision, operatorId) {
+    this.db.prepare("INSERT OR REPLACE INTO approval_decisions(toolCallId,tool,paramsJson,decision,operatorId,decidedAt) VALUES(?,?,?,?,?,?)").run(toolCallId, tool, JSON.stringify(params), decision, operatorId ?? null, Date.now());
+  }
+  consumeToolApproval(toolCallId, tool, params) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const r = this.db.prepare("SELECT tool,paramsJson,decision FROM approval_decisions WHERE toolCallId=?").get(toolCallId);
+      this.db.prepare("DELETE FROM approval_decisions WHERE toolCallId=?").run(toolCallId);
+      const ok = !!r && r.tool === tool && r.paramsJson === JSON.stringify(params) && r.decision.startsWith("allow");
+      this.db.exec("COMMIT");
+      return ok;
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  count(table) {
+    return Number(this.db.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE status='pending'`).get().n);
+  }
+};
+function grantRow(row) {
+  if (!row) return null;
+  const r = row;
+  const { expiresAt, title, ...base } = r;
+  return { ...base, ...expiresAt === null ? {} : { expiresAt }, ...title === null ? {} : { title } };
+}
+
+// src/registry.ts
+import { readFileSync as readFileSync2, realpathSync } from "fs";
+import { Value } from "typebox/value";
+import { GatekeeperToolDefSchema, SupportedResourceSchema } from "@clawkeepers/shared";
+import { gatekeeperRuntimeSlot } from "@clawkeepers/gatekeeper-kit";
+var Registry = class {
+  constructor(catalogPath, stateDir2) {
+    this.catalogPath = catalogPath;
+    this.stateDir = stateDir2;
+    this.load();
+  }
+  entries = /* @__PURE__ */ new Map();
+  tools = [];
+  toolNames() {
+    return this.tools.map((t) => t.name);
+  }
+  resources() {
+    return [...this.entries.values()].flatMap((entry) => entry.resources.map((resource) => ({ entry, resource })));
+  }
+  entryForTool(name) {
+    return [...this.entries.values()].find((e) => e.tools.some((t) => t.name === name));
+  }
+  load() {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync2(this.catalogPath, "utf8"));
+    } catch {
+      return;
+    }
+    if (parsed.version !== 1 || !Array.isArray(parsed.gatekeepers)) throw new Error("Invalid gatekeeper catalog.");
+    const names = /* @__PURE__ */ new Set();
+    for (const raw of parsed.gatekeepers) {
+      if (raw.enabled === false) continue;
+      if (!/^gatekeeper-[a-z][a-z0-9_]*$/.test(raw.pluginId) || raw.pluginId !== `gatekeeper-${raw.vendor}` || raw.apiVersion !== 1 || this.entries.has(raw.vendor)) throw new Error("Invalid gatekeeper catalog identity.");
+      const root = realpathSync(raw.root);
+      if (!Array.isArray(raw.tools) || !Array.isArray(raw.resources)) throw new Error("Invalid gatekeeper catalog metadata.");
+      for (const tool of raw.tools) {
+        if (!Value.Check(GatekeeperToolDefSchema, tool) || names.has(tool.name) || !tool.name.startsWith(`gk_${raw.vendor}_`)) throw new Error("Invalid gatekeeper catalog tool.");
+        names.add(tool.name);
+      }
+      for (const resource of raw.resources) if (!Value.Check(SupportedResourceSchema, resource) || resource.tools.some((n) => !raw.tools.some((t) => t.name === n && t.resourceType === resource.type))) throw new Error("Invalid gatekeeper catalog resource.");
+      const entry = { ...raw, root, tools: structuredClone(raw.tools), resources: structuredClone(raw.resources) };
+      this.entries.set(entry.vendor, entry);
+      this.tools.push(...entry.tools);
+    }
+  }
+  live(vendor) {
+    const entry = this.entries.get(vendor);
+    if (!entry) throw new Error("Gatekeeper unavailable.");
+    const runtime = gatekeeperRuntimeSlot(entry.pluginId).tryGetRuntime();
+    if (!runtime || runtime.pluginId !== entry.pluginId || runtime.vendor !== entry.vendor || runtime.apiVersion !== entry.apiVersion || realpathSync(runtime.root) !== entry.root || realpathSync(runtime.stateDir) !== realpathSync(this.stateDir)) throw new Error("Gatekeeper unavailable.");
+    return { entry, vendor: runtime.getVendor() };
+  }
+  /** Resolve a live vendor for operator-only account setup, never for resource access. */
+  connection(vendorName) {
+    return this.live(vendorName).vendor;
+  }
+  /** Resolve account and resource afresh; this is called only by Kernel.resolveGrant. */
+  async openSession(grant, queue) {
+    const { vendor } = this.live(grant.vendor);
+    const account = await vendor.getAccount(grant.operatorId) ?? await vendor.createAccount?.(grant.operatorId);
+    if (!account) throw new Error("Gatekeeper unavailable.");
+    const resolved = await account.getGatekeeperFor(grant.resourceKey);
+    if (resolved.resource.type !== grant.resourceType || resolved.resourceKey !== grant.resourceKey) throw new Error("Gatekeeper unavailable.");
+    return { session: await resolved.gatekeeper.startSession(queue), gatekeeper: resolved.gatekeeper, instanceId: instanceId(grant) };
+  }
+  /** Validate an introduction through the operator's live account. */
+  async introduce(vendorName, operatorId, url) {
+    const { entry, vendor } = this.live(vendorName);
+    let account = await vendor.getAccount(operatorId);
+    if (!account && vendor.createAccount) account = await vendor.createAccount(operatorId);
+    if (!account) throw new Error("Gatekeeper account unavailable.");
+    const resolved = await account.getGatekeeperFor(url);
+    if (!entry.resources.some((r) => r.type === resolved.resource.type)) throw new Error("Unsupported resource.");
+    return resolved;
+  }
+  /** Return safe health metadata without exposing resource identities. */
+  health() {
+    return [...this.entries.values()].map((entry) => {
+      try {
+        this.live(entry.vendor);
+        return { vendor: entry.vendor, healthy: true, accounts: 0 };
+      } catch {
+        return { vendor: entry.vendor, healthy: false, accounts: 0 };
+      }
+    });
+  }
+};
+function instanceId(g) {
+  return `${g.vendor}\0${g.operatorId}\0${g.resourceKey}`;
+}
+
+// src/audit.ts
+import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync } from "fs";
+import { join as join2 } from "path";
+import { Value as Value2 } from "typebox/value";
+import { AuditRecordSchema } from "@clawkeepers/shared";
+var AuditLog = class {
+  constructor(dir) {
+    this.dir = dir;
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+  }
+  write(record) {
+    if (!Value2.Check(AuditRecordSchema, record)) throw new Error("Invalid audit record.");
+    const day = record.ts.slice(0, 10);
+    appendFileSync(join2(this.dir, `${day}.jsonl`), `${JSON.stringify(record)}
+`, { mode: 384 });
+  }
+  query(limit = 100) {
+    const files = readdirSync(this.dir).filter((f) => /^\d{4}-\d{2}-\d{2}\.jsonl$/.test(f)).sort().reverse();
+    const out = [];
+    for (const file of files) {
+      for (const line of readFileSync3(join2(this.dir, file), "utf8").trim().split("\n").reverse()) {
+        if (!line) continue;
+        const value = JSON.parse(line);
+        if (Value2.Check(AuditRecordSchema, value)) out.push(value);
+        if (out.length >= Math.min(1e3, Math.max(1, limit))) return out;
+      }
+    }
+    return out;
+  }
+  async flush() {
+  }
+};
+
+// src/oauth.ts
+import { OAuthNonceMachine } from "@clawkeepers/gatekeeper-kit";
+var namespace = /^[a-z][a-z0-9_]{0,63}$/;
+var noncePattern = /^[A-Za-z0-9_-]{32}$/;
+var denied = () => new Error("Account connection unavailable.");
+var OAuthRouter = class {
+  constructor(registry, now = Date.now) {
+    this.registry = registry;
+    this.now = now;
+  }
+  flows = /* @__PURE__ */ new Map();
+  /** Issue a private local browser URL; callers must supply operator identity from authenticated RPC, not request data. */
+  async connect(vendorName, operatorId, resourceTypes) {
+    try {
+      if (!namespace.test(vendorName) || !operatorId || operatorId.length > 512 || /[\u0000-\u001f\u007f]/u.test(operatorId)) throw denied();
+      const entry = this.registry.entries.get(vendorName);
+      if (!entry || resourceTypes !== void 0 && (!Array.isArray(resourceTypes) || resourceTypes.length > 32 || new Set(resourceTypes).size !== resourceTypes.length || resourceTypes.some((type) => typeof type !== "string" || !namespace.test(type) || !entry.resources.some((resource) => resource.type === type)))) throw denied();
+      const flow = this.flow(vendorName);
+      if (!flow.vendor.completeConnection && !await this.staticAccount(flow.vendor)) throw denied();
+      const binding = { operatorId, ...resourceTypes ? { resourceTypes: [...resourceTypes] } : {} };
+      const state = flow.nonces.issue(JSON.stringify(binding));
+      return { url: `/os/gatekeeper/${vendorName}/oauth/start?state=${state}` };
+    } catch {
+      throw denied();
+    }
+  }
+  /** Handle GET start/callback only; malformed, replayed, expired and cross-vendor nonces fail without vendor details. */
+  async handle(req, res) {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Content-Type", "text/plain; charset=utf-8");
+    const finish = (status, body) => {
+      res.statusCode = status;
+      res.end(body);
+      return true;
+    };
+    if (req.method !== "GET") {
+      res.setHeader("Allow", "GET");
+      return finish(405, "Method not allowed.");
+    }
+    try {
+      const raw = req.url ?? "";
+      if (raw.length > 8192) throw denied();
+      const match = /^\/os\/gatekeeper\/([a-z][a-z0-9_]{0,63})\/oauth\/(start|callback)(?:\?([^#]*))?$/.exec(raw);
+      if (!match) return finish(404, "Not found.");
+      const vendorName = match[1], stage = match[2], query = new URLSearchParams(match[3] ?? "");
+      const allowed = stage === "start" ? ["state"] : ["state", "code", "error"];
+      for (const key of query.keys()) if (!allowed.includes(key) || query.getAll(key).length !== 1) throw denied();
+      const state = query.get("state") ?? "";
+      if (!noncePattern.test(state)) throw denied();
+      const flow = this.flow(vendorName);
+      if (stage === "start") {
+        const advanced = flow.nonces.advanceBound(state);
+        if (!advanced) throw denied();
+        const binding2 = JSON.parse(advanced.operatorId);
+        try {
+          if (!flow.vendor.completeConnection && await this.staticAccount(flow.vendor)) {
+            if (!flow.nonces.consume(advanced.nonce)) throw denied();
+            const account = await flow.vendor.getAccount(binding2.operatorId) ?? await flow.vendor.createAccount(binding2.operatorId);
+            if (!account) throw denied();
+            return finish(200, "Account connected. You may close this window.");
+          }
+          const result = await flow.vendor.connectAccount(binding2.operatorId, {
+            ...binding2.resourceTypes ? { resourceTypes: binding2.resourceTypes } : {},
+            state: advanced.nonce,
+            callbackPath: `/os/gatekeeper/${vendorName}/oauth/callback`
+          });
+          const location = authorizationUrl(result.url, advanced.nonce);
+          res.setHeader("Location", location);
+          return finish(303, "Continue account connection in your browser.");
+        } catch {
+          flow.nonces.consume(advanced.nonce);
+          throw denied();
+        }
+      }
+      const bound = flow.nonces.consume(state);
+      if (!bound || !flow.vendor.completeConnection) throw denied();
+      const code = query.get("code");
+      if (query.has("error") || !code || code.length > 4096 || /[\u0000-\u0020\u007f]/u.test(code)) throw denied();
+      const binding = JSON.parse(bound);
+      await flow.vendor.completeConnection(binding.operatorId, { code, state, ...binding.resourceTypes ? { resourceTypes: binding.resourceTypes } : {} });
+      if (!await flow.vendor.getAccount(binding.operatorId)) throw denied();
+      return finish(200, "Account connected. You may close this window.");
+    } catch {
+      return finish(400, "Account connection unavailable. Start a new connection from your operator client.");
+    }
+  }
+  /** Revoke every outstanding connection on kernel shutdown. */
+  clear() {
+    this.flows.clear();
+  }
+  flow(vendorName) {
+    const vendor = this.registry.connection(vendorName);
+    let flow = this.flows.get(vendorName);
+    if (!flow || flow.vendor !== vendor) {
+      flow = { vendor, nonces: new OAuthNonceMachine(6e5, this.now) };
+      this.flows.set(vendorName, flow);
+    }
+    return flow;
+  }
+  async staticAccount(vendor) {
+    return !!vendor.createAccount && (await vendor.describe()).autoProvisionsAccount === true;
+  }
+};
+function authorizationUrl(value, state) {
+  if (typeof value !== "string" || value.length > 8192 || /[\u0000-\u0020\u007f]/u.test(value)) throw denied();
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.hash || url.searchParams.getAll("state").length !== 1 || url.searchParams.get("state") !== state) throw denied();
+  for (const key of url.searchParams.keys()) if (/^(?:access_token|refresh_token|id_token|client_secret|password|authorization|code)$/i.test(key)) throw denied();
+  return url.href;
+}
+
+// src/upstream/notify.ts
+import { execFile } from "child_process";
+function sendOperatorDigest(target, actions, requests) {
+  if (!target.channel || !target.target || target.channel.length > 64 || target.target.length > 512 || /[\u0000-\u001f\u007f]/u.test(target.channel + target.target) || ![actions, requests].every((n) => Number.isSafeInteger(n) && n >= 0)) return Promise.reject(new Error("Invalid notification configuration."));
+  const message = `OpenClaw OS: ${actions} pending action(s), ${requests} access request(s). Use /approvals in your private operator conversation or clawos approvals list.`;
+  return new Promise((resolve2, reject) => {
+    execFile("openclaw", ["message", "send", "--channel", target.channel, "--target", target.target, "--message", message, "--json"], { env: process.env, timeout: 3e4, maxBuffer: 65536 }, (error) => {
+      if (error) reject(new Error("Operator digest delivery unconfirmed."));
+      else resolve2();
+    });
+  });
+}
+
+// src/commands.ts
+function isOperatorCommand(body) {
+  return /^\/(approvals|reject|grants|grant)(?:\s|$)/u.test(body);
+}
+function operatorCommand(body) {
+  if (!isOperatorCommand(body)) return;
+  if (body.length > 2048) throw new Error("Command too long.");
+  let [surface, verb = "list", argument, ...extra] = body.trim().slice(1).split(/\s+/u);
+  if (surface === "reject") {
+    argument = verb;
+    verb = "reject";
+    surface = "approvals";
+    if (body.trim().split(/\s+/u).length !== 2) throw new Error("Invalid command.");
+  }
+  if (surface === "grant") {
+    if (body.trim().split(/\s+/u).length !== 2) throw new Error("Invalid command.");
+    const url = new URL(verb);
+    if (!["https:", "http:", "file:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error("Invalid resource URL.");
+    return { surface: "grants", verb: "introduce", url: verb };
+  }
+  if (extra.length) throw new Error("Invalid command.");
+  if (verb === "list" && !argument) return { surface, verb };
+  if (surface === "grants" && verb === "revoke" && /^grant:[a-z0-9]{8}$/.test(argument ?? "")) return { surface, verb, handle: argument };
+  if (surface === "approvals" && ["preview", "apply", "reject", "revert", "grant", "reject-request"].includes(verb) && argument) {
+    if (argument !== "all" && !/^[1-9][0-9]*(?:,[1-9][0-9]*)*$/.test(argument)) throw new Error("Invalid action IDs.");
+    const ids = argument === "all" ? "all" : argument.split(",").map(Number);
+    if (ids !== "all" && (ids.length > 100 || ids.some((id) => !Number.isSafeInteger(id)) || new Set(ids).size !== ids.length)) throw new Error("Invalid action IDs.");
+    return { surface, verb, ids };
+  }
+  throw new Error("Use /approvals list|preview|apply|reject|revert [IDs or all], /reject IDs, /grants, or /grant URL.");
+}
+
+// src/upstream/lifecycle.ts
+function enqueueRejectionNote(api, binding, id) {
+  return api.session.workflow.enqueueNextTurnInjection({ ...binding, text: `Action ${id} was rejected. Discard its simulated effects and re-read the resource before continuing.`, idempotencyKey: `clawos-reject-${id}`, placement: "prepend_context" });
+}
+function finishOperatorCommand(event, ctx, text2) {
+  const queuedFinal = text2.length > 0 && event.sendPolicy !== "deny" && !event.suppressUserDelivery ? ctx.dispatcher.sendFinalReply({ text: text2.slice(0, 8192) }) : false;
+  ctx.recordProcessed("completed", { reason: "clawos operator command" });
+  ctx.markIdle("clawos operator command");
+  return { handled: true, queuedFinal, counts: ctx.dispatcher.getQueuedCounts() };
+}
+
+// src/actions.ts
+import { ActionDescriptionSchema } from "@clawkeepers/shared";
+import { Value as Value3 } from "typebox/value";
+var ActionCoordinator = class {
+  constructor(store, audit, cell2, resolve2, restart) {
+    this.store = store;
+    this.audit = audit;
+    this.cell = cell2;
+    this.resolve = resolve2;
+    this.restart = restart;
+  }
+  flights = /* @__PURE__ */ new Map();
+  stopped = false;
+  /** Explicit decisions are ordered and share the drainer's per-instance mutex. */
+  async decide(ids, verb, operator) {
+    const selected = ids === "all" ? this.store.listActions(false).filter((a) => a.status === (verb === "revert" ? "applied" : "pending")).map((a) => a.id) : [...ids].sort((a, b) => a - b);
+    for (const id of selected) {
+      const action = this.store.getAction(id);
+      if (!action) throw new Error("No such action.");
+      await this.serial(action.gatekeeperInstance, () => this.perform(id, verb, operator));
+    }
+    return { ids: selected };
+  }
+  /** Drain independent instances; never skip an ineligible or uncertain action. */
+  async drain(tags) {
+    if (this.stopped) return;
+    const instances = new Set(this.store.listActions().map((a) => a.gatekeeperInstance));
+    await Promise.allSettled([...instances].map((instance) => this.serial(instance, async () => {
+      for (const action of this.store.listActions(false).filter((a) => a.gatekeeperInstance === instance)) {
+        if (this.stopped || action.status === "failed") break;
+        if (action.status !== "pending") continue;
+        const d = description(action);
+        if (!d || d.autoApprovable !== true || d.awaitDecision || !d.actionKind || !tags.includes(d.actionKind.tag)) break;
+        try {
+          await this.perform(action.id, "apply", "auto-approval");
+        } catch {
+          break;
+        }
+      }
+    })));
+  }
+  /** Outstanding serialized approval effects, used by the update admission barrier. */
+  get activeEffects() {
+    return this.flights.size;
+  }
+  /** Stop new work and wait for existing effects before SQLite is closed. */
+  async stop() {
+    this.stopped = true;
+    await Promise.allSettled([...this.flights.values()]);
+  }
+  serial(instance, task) {
+    if (this.stopped) return Promise.reject(new Error("Approvals unavailable."));
+    const result = (this.flights.get(instance) ?? Promise.resolve()).catch(() => {
+    }).then(task);
+    this.flights.set(instance, result);
+    void result.finally(() => {
+      if (this.flights.get(instance) === result) this.flights.delete(instance);
+    }).catch(() => {
+    });
+    return result;
+  }
+  async perform(id, verb, operator) {
+    const action = this.store.getAction(id), expected = verb === "revert" ? "applied" : "pending";
+    if (!action || action.status !== expected) throw new Error("Action is not eligible.");
+    if (verb === "apply" && this.store.listActions(false).some((a) => a.gatekeeperInstance === action.gatekeeperInstance && a.id < id && (a.status === "pending" || a.status === "failed"))) throw new Error("Earlier actions require a decision or reconciliation.");
+    const d = description(action);
+    if (!d || verb === "revert" && !d.implementsRevert) throw new Error("Action is not eligible.");
+    const authority = await this.resolve(action);
+    try {
+      if (verb === "revert" && !authority.gatekeeper.revertAction) throw new Error("Revert unavailable.");
+      authority.authorize();
+      if (!this.store.claimAction(id, expected, operator)) throw new Error("Action already decided.");
+      this.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: this.cell, kind: "action.decide", actionId: id, title: "Action decision", decision: verb, by: operator, ok: true });
+      let restart = false;
+      try {
+        if (verb === "apply") await authority.gatekeeper.applyAction(action.actionId);
+        else if (verb === "reject") restart = (await authority.gatekeeper.rejectAction(action.actionId))?.restart === true;
+        else await authority.gatekeeper.revertAction(action.actionId);
+        this.store.decideAction(id, verb === "apply" ? "applied" : verb === "reject" ? "rejected" : "reverted", operator);
+        this.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: this.cell, kind: verb === "revert" ? "action.revert" : verb === "apply" ? "action.apply" : "action.decide", actionId: id, title: "Action completed", decision: verb, by: operator, ok: true });
+      } catch {
+        this.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: this.cell, kind: "action.decide", actionId: id, title: "Action outcome unconfirmed; automatic retry disabled", decision: "failed", by: operator, ok: false });
+        throw new Error("Action outcome unconfirmed; reconciliation required.");
+      }
+      if (restart) await this.restart(action).catch(() => {
+      });
+    } finally {
+      await authority.close().catch(() => {
+      });
+    }
+  }
+};
+function description(action) {
+  try {
+    const d = JSON.parse(action.descriptionJson);
+    return Value3.Check(ActionDescriptionSchema, d) ? d : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/approvals.ts
+import { ActionDescriptionSchema as ActionDescriptionSchema2 } from "@clawkeepers/shared";
+import { Value as Value4 } from "typebox/value";
+var ApprovalQueueImpl = class {
+  constructor(store, audit, cell2) {
+    this.store = store;
+    this.audit = audit;
+    this.cell = cell2;
+  }
+  forGrant(grant, sessionKey) {
+    const instance = instanceId(grant);
+    const authorize = () => {
+      if (!this.store.authorizeGrant(grant, grant.agentId, sessionKey, this.cell)) throw new Error("Grant is not active.");
+    };
+    return {
+      authorizeObservation: async (d) => {
+        authorize();
+        const observers = this.store.observers(sessionKey);
+        if (this.store.getInstance(instance)?.lockdown) throw new Error("Resource is locked down.");
+        if (observers.length && (grant.audience === "owner-only" || d.prohibitAllSharing || d.excludeObservers?.some((id) => observers.includes(id)))) {
+          if (d.prohibitAllSharing) {
+            this.store.lockdownInstance(instance);
+            this.store.setGrantStatus(grant.handle, "lockdown");
+          }
+          throw new Error("Observation denied for this audience.");
+        }
+        this.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: this.cell, agentId: grant.agentId, sessionKey, kind: "observation", vendor: grant.vendor, resourceType: grant.resourceType, handle: grant.handle, title: d.title, ok: true });
+      },
+      submitAction: async (actionId, d) => {
+        authorize();
+        if (grant.audience === "owner-only" && this.store.observers(sessionKey).length) throw new Error("Action denied for this audience.");
+        if (this.store.getInstance(instance)?.lockdown) throw new Error("Resource is locked down.");
+        if (!Number.isSafeInteger(actionId) || actionId < 1 || !Value4.Check(ActionDescriptionSchema2, d)) throw new Error("Invalid action description.");
+        const action = this.store.addAction(instance, actionId, d);
+        this.store.bindAction(action.id, grant.handle, grant.agentId, sessionKey);
+        this.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: this.cell, agentId: grant.agentId, sessionKey, kind: "action.submit", vendor: grant.vendor, resourceType: grant.resourceType, handle: grant.handle, actionId: action.id, title: d.title, ok: true });
+      }
+    };
+  }
+};
+
+// src/upstream/channel-authority.ts
+import { resolveCommandAuthorization } from "openclaw/plugin-sdk/command-auth";
+import { resolveSessionAgentIdStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+function resolveChannelTurnAuthority(event, context) {
+  const inbound = event.ctx;
+  const channel = inbound.Provider;
+  const sessionKey = event.sessionKey;
+  if (context.dispatchKind !== "agent" || event.isTailDispatch || context.abortSignal?.aborted || !channel || inbound.InternalTurnSource || inbound.InputProvenance || typeof inbound.commandText !== "string" || !sessionKey || inbound.SessionKey !== sessionKey) return;
+  if (!inbound.AgentId?.trim() && !parseAgentSessionKey(sessionKey)?.agentId) return;
+  if (channel !== "webchat" && (inbound.GatewayClientScopes !== void 0 || !inbound.SenderId)) return;
+  try {
+    if (channel === "webchat") {
+      if (inbound.SenderId || !inbound.ApprovalReviewerDeviceId?.trim() || !inbound.GatewayClientScopes?.includes("operator.admin")) return;
+      const agentId2 = resolveSessionAgentIdStrict({ sessionKey, config: context.cfg, ...inbound.AgentId ? { agentId: inbound.AgentId } : {} });
+      if (inbound.AgentId && agentId2 !== inbound.AgentId) return;
+      return {
+        channel,
+        senderId: `gateway-device:${inbound.ApprovalReviewerDeviceId}`,
+        senderIsOwner: true,
+        privateAudience: inbound.ChatType !== "group" && inbound.ChatType !== "channel",
+        agentId: agentId2,
+        sessionKey,
+        text: inbound.commandText
+      };
+    }
+    const authorization = resolveCommandAuthorization({
+      ctx: inbound,
+      cfg: context.cfg,
+      commandAuthorized: inbound.CommandAuthorized === true
+    });
+    const senderId = inbound.SenderId;
+    if (!senderId) return;
+    if (authorization.providerId !== channel || authorization.senderId !== senderId) return;
+    const agentId = resolveSessionAgentIdStrict({ sessionKey, config: context.cfg, ...inbound.AgentId ? { agentId: inbound.AgentId } : {} });
+    if (inbound.AgentId && agentId !== inbound.AgentId) return;
+    return {
+      channel,
+      senderId,
+      senderIsOwner: authorization.senderIsOwner === true,
+      privateAudience: inbound.ChatType === "direct",
+      agentId,
+      sessionKey,
+      text: inbound.commandText
+    };
+  } catch {
+    return;
+  }
+}
+
+// src/upstream/runtime-version.ts
+function runtimeVersion(api) {
+  return api.runtime?.version ?? "unavailable";
+}
+
+// src/upstream/paths.ts
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+function stateDir() {
+  if (process.env.OPENCLAW_STATE_DIR) return process.env.OPENCLAW_STATE_DIR;
+  const profile = process.env.OPENCLAW_PROFILE;
+  return join3(process.env.OPENCLAW_HOME ?? homedir2(), profile ? `.openclaw-${profile}` : ".openclaw");
+}
+function osPaths() {
+  const os = join3(stateDir(), "os");
+  return {
+    stateDir: stateDir(),
+    os,
+    sqlite: join3(os, "clawos.sqlite"),
+    auditDir: join3(os, "audit"),
+    configD: join3(os, "config.d"),
+    lock: join3(os, "clawos.lock.json"),
+    gatekeepers: join3(os, "gatekeepers"),
+    cellKey: join3(os, "cell.key"),
+    logs: join3(os, "logs")
+  };
+}
+
+// src/kernel.ts
+var slot = createPluginRuntimeStore({ pluginId: "clawos-kernel", errorMessage: "Kernel unavailable." });
+var text = (value) => ({ content: [{ type: "text", text: value }], details: {} });
+var kernelVersion = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
+var EmptyParams = Type.Object({}, { additionalProperties: false });
+var ApprovalListParams = Type.Object({ includeDecided: Type.Optional(Type.Boolean()) }, { additionalProperties: false });
+var AuditQueryParams = Type.Object({ limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 1e3 })) }, { additionalProperties: false });
+var Kernel = class {
+  constructor(api) {
+    this.api = api;
+  }
+  paths = osPaths();
+  activeRuns = /* @__PURE__ */ new Set();
+  unknownRuns = 0;
+  maintenance() {
+    return this.config().maintenance === true || existsSync(join4(this.paths.os, "update-maintenance.json"));
+  }
+  /** Operator-only persistent admission barrier; a crash never silently reopens the cell. */
+  setMaintenance(enabled) {
+    const path = join4(this.paths.os, "update-maintenance.json");
+    if (enabled) {
+      writeFileSync(path + ".tmp", JSON.stringify({ maintenance: true }), { mode: 384 });
+      renameSync(path + ".tmp", path);
+    } else if (existsSync(path)) unlinkSync(path);
+    return this.status();
+  }
+  catalog = new Registry(process.env.CLAWOS_GATEKEEPER_CATALOG ?? join4(this.paths.os, "gatekeepers.json"), this.paths.stateDir);
+  async start() {
+    if (slot.tryGetRuntime()) throw new Error("Kernel runtime already started.");
+    const pin = existsSync(this.paths.lock) ? JSON.parse(readFileSync4(this.paths.lock, "utf8")) : void 0;
+    if (pin && pin.kernelSchema !== 1) throw new Error("Kernel schema pin incompatible.");
+    const store = new Store(this.paths.sqlite);
+    try {
+      store.migrate();
+    } catch (error) {
+      store.close();
+      throw error;
+    }
+    const audit = new AuditLog(this.paths.auditDir);
+    slot.setRuntime({ store, registry: this.catalog, audit, oauth: new OAuthRouter(this.catalog), approvals: new ApprovalQueueImpl(store, audit, cell()), actions: new ActionCoordinator(store, audit, cell(), async (action) => {
+      const binding = store.actionBinding(action.id);
+      if (!binding) throw new Error("Action has no authority.");
+      const resolved = await this.resolveGrant(binding.agentId, binding.sessionKey, binding.handle);
+      return { gatekeeper: resolved.gatekeeper, authorize: () => {
+        if (this.maintenance() || !store.authorizeGrant(resolved.grant, binding.agentId, binding.sessionKey, cell()) || store.observers(binding.sessionKey).length || store.getInstance(action.gatekeeperInstance)?.lockdown || instanceId(resolved.grant) !== action.gatekeeperInstance) throw new Error("Action authority changed.");
+      }, close: async () => {
+        this.runtime().sessions.get(binding.sessionKey)?.delete(resolved.session);
+        await resolved.session.close();
+      } };
+    }, async (action) => {
+      const b = store.actionBinding(action.id);
+      if (b) await enqueueRejectionNote(this.api, b, action.id);
+    }), stash: /* @__PURE__ */ new Map(), inflight: /* @__PURE__ */ new Map(), notes: /* @__PURE__ */ new Map(), sessions: /* @__PURE__ */ new Map() });
+    this.startDrainer();
+  }
+  async stop() {
+    const r = slot.tryGetRuntime();
+    if (!r) return;
+    this.stopDrainer();
+    r.oauth.clear();
+    await r.actions.stop();
+    for (const sessions of r.sessions.values()) for (const session of sessions.keys()) await session.close().catch(() => {
+    });
+    await r.audit.flush();
+    r.store.close();
+    if (slot.tryGetRuntime() === r) slot.clearRuntime();
+  }
+  runtime() {
+    return slot.getRuntime();
+  }
+  config() {
+    return this.api.pluginConfig ?? {};
+  }
+  operator(channel, sender) {
+    return !!channel && !!sender && this.config().operators?.some((x) => x.channel === channel && x.senderId === sender) === true;
+  }
+  async resolveGrant(agentId, sessionKey, handle) {
+    const r = this.runtime(), candidate = r.store.getGrant(handle), grant = candidate && r.store.authorizeGrant(candidate, agentId, sessionKey, cell());
+    if (!grant || r.store.getInstance(instanceId(grant))?.lockdown) throw new Error("No such grant.");
+    if (grant.audience === "owner-only" && r.store.observers(sessionKey).length) throw new Error("Grant unavailable for this audience.");
+    const queue = r.approvals.forGrant(grant, sessionKey);
+    const opened = { ...await r.registry.openSession(grant, queue), queue };
+    r.store.upsertInstance({ id: opened.instanceId, vendor: grant.vendor, resourceKey: grant.resourceKey, operatorId: grant.operatorId, observerStrategy: r.registry.entries.get(grant.vendor)?.resources.find((x) => x.type === grant.resourceType)?.observerStrategy ?? "private-only", lockdown: 0 });
+    let sessions = r.sessions.get(sessionKey);
+    if (!sessions) {
+      sessions = /* @__PURE__ */ new Map();
+      r.sessions.set(sessionKey, sessions);
+    }
+    sessions.set(opened.session, grant.handle);
+    return { grant, ...opened };
+  }
+  capabilityPolicy() {
+    return { id: "clawos-capability-policy", description: "Deny gatekeeper calls without an active capability.", ...this.catalog.toolNames().length ? { matcher: this.catalog.toolNames() } : {}, evaluate: (event, ctx) => {
+      if (!event.toolName.startsWith("gk_")) return;
+      const r = slot.tryGetRuntime();
+      const grant = typeof event.params.grant === "string" ? r?.store.getGrant(event.params.grant) : null;
+      if (r && grant && ctx.agentId && ctx.sessionKey && r.store.authorizeGrant(grant, ctx.agentId, ctx.sessionKey, cell()) && (grant.audience === "shared" || !r.store.observers(ctx.sessionKey).length)) return;
+      r?.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: cell(), ...ctx.agentId ? { agentId: ctx.agentId } : {}, ...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {}, kind: "tool", title: "Capability policy denied call", decision: "deny", ok: false });
+      return { block: true, blockReason: "No such grant." };
+    } };
+  }
+  registerGatekeeperTools(api) {
+    for (const d of this.catalog.tools) api.registerTool({ name: d.name, label: d.name, description: d.description, parameters: d.parameters, execute: async (id, p) => toolResult(await this.exec(id, d.name, p)) });
+  }
+  async exec(id, tool, params) {
+    const r = this.runtime(), s = r.stash.get(id);
+    r.stash.delete(id);
+    if (!s || s.expiresAt < Date.now() || !s.session || !s.queue || s.tool !== tool || s.paramsJson !== JSON.stringify(params) || !s.grant || !r.store.authorizeGrant(s.grant, s.agentId, s.sessionKey, cell()) || s.grant.audience === "owner-only" && r.store.observers(s.sessionKey).length) throw new Error("Operation denied.");
+    r.inflight.set(id, s);
+    try {
+      const approved = r.store.consumeToolApproval(id, tool, params);
+      return await s.session.call(tool, params, { agentId: s.agentId, sessionKey: s.sessionKey, ...s.runId ? { runId: s.runId } : {}, toolCallId: id, queue: s.queue, observers: r.store.observers(s.sessionKey), ...approved ? { actionApproval: { toolCallId: id, tool, params: structuredClone(params) } } : {} });
+    } catch {
+      throw new Error("Operation denied.");
+    }
+  }
+  /** Admit operator URLs before prompt construction, without taking over reply dispatch. */
+  async onReplyDispatch(e, ctx) {
+    if (this.maintenance()) return;
+    const turn = resolveChannelTurnAuthority(e, ctx);
+    if (!turn) {
+      if (ctx.dispatchKind === "agent" && !e.isTailDispatch && !ctx.abortSignal?.aborted && typeof e.ctx?.commandText === "string" && isOperatorCommand(e.ctx.commandText)) return finishOperatorCommand(e, ctx, "");
+      return;
+    }
+    const command = isOperatorCommand(turn.text);
+    const silence = () => command ? finishOperatorCommand(e, ctx, "") : void 0;
+    if (!turn.privateAudience) {
+      this.runtime().store.taintObserver(turn.sessionKey, "clawos:shared-audience");
+      this.runtime().notes.delete(turn.sessionKey);
+      return silence();
+    }
+    if (!turn.senderIsOwner) {
+      const r = this.runtime(), observers = new Set(r.store.observers(turn.sessionKey));
+      observers.add(turn.senderId);
+      r.store.setObservers(turn.sessionKey, [...observers]);
+      return silence();
+    }
+    if (turn.channel !== "webchat" && !this.operator(turn.channel, turn.senderId)) return silence();
+    if (this.runtime().store.observers(turn.sessionKey).length) return silence();
+    if (command) {
+      let reply = "Operation denied.";
+      try {
+        const c = operatorCommand(turn.text);
+        const r = this.runtime();
+        const result = c.surface === "grants" ? c.verb === "list" ? r.store.allGrants(turn.agentId) : c.verb === "introduce" ? await this.introduce(turn.agentId, turn.sessionKey, c.url, turn.senderId, "operator") : await this.revoke(c.handle, turn.senderId) : c.verb === "list" ? this.pending() : c.verb === "preview" ? this.preview(c.ids) : c.verb === "grant" || c.verb === "reject-request" ? await this.decideRequests({ ids: c.ids }, c.verb === "grant", turn.senderId) : await this.decide({ ids: c.ids }, c.verb, turn.senderId);
+        reply = JSON.stringify(result);
+      } catch {
+      }
+      return finishOperatorCommand(e, ctx, reply);
+    }
+    for (const url of urls(turn.text)) await this.introduce(turn.agentId, turn.sessionKey, url, turn.senderId, "operator").catch(() => {
+    });
+  }
+  async onBeforeAgentRun(e, ctx) {
+    if (this.maintenance()) return { outcome: "block", reason: "maintenance", message: "OpenClaw OS is being maintained." };
+    if (ctx.runId) this.activeRuns.add(ctx.runId);
+    else this.unknownRuns++;
+    if (ctx.sessionKey && e.senderId && !e.senderIsOwner) {
+      const r = this.runtime(), observers = new Set(r.store.observers(ctx.sessionKey));
+      observers.add(e.senderId);
+      r.store.setObservers(ctx.sessionKey, [...observers]);
+    }
+  }
+  /** Keep operator-authorized native tools in the narrowing cap; upstream policy still intersects it. Never pass through group:plugins or ungranted gk tools. */
+  async onBeforePromptBuild(_e, ctx) {
+    const r = slot.tryGetRuntime();
+    if (!r || !ctx.agentId || !ctx.sessionKey) return { toolsAllow: ["os_request_access", "os_list_grants"] };
+    const sessionKey = ctx.sessionKey;
+    const grants = r.store.listGrants(ctx.agentId).filter((g) => r.store.authorizeGrant(g, ctx.agentId, sessionKey, cell()) && (g.scope === "agent" || g.scope === `session:${sessionKey}`) && (g.audience === "shared" || !r.store.observers(sessionKey).length));
+    const allowed = /* @__PURE__ */ new Set(["group:openclaw", "group:fs", "group:runtime", "os_request_access", "os_list_grants"]);
+    for (const g of grants) for (const t of r.registry.entries.get(g.vendor)?.tools ?? []) if (t.resourceType === g.resourceType) allowed.add(t.name);
+    const rows = grants.slice(0, 100).map((g) => `${g.handle} ${g.vendor}/${g.resourceType}${g.title ? ` ${g.title}` : ""}`);
+    const notes = r.store.observers(sessionKey).length ? [] : r.notes.get(sessionKey) ?? [];
+    r.notes.delete(sessionKey);
+    const context = [...notes, rows.length ? `Available grants:
+${rows.join("\n")}` : ""].filter(Boolean).join("\n").slice(0, 8192);
+    return { toolsAllow: [...allowed], ...context ? { appendContext: context } : {} };
+  }
+  async onBeforeToolCall(e, ctx) {
+    if (!e.toolName.startsWith("gk_") && !e.toolName.startsWith("os_")) return;
+    const id = e.toolCallId;
+    if (!id || !ctx.agentId || !ctx.sessionKey) return { block: true, blockReason: "Missing call identity." };
+    const r = this.runtime();
+    for (const [key, value] of r.stash) if (value.expiresAt < Date.now()) r.stash.delete(key);
+    const base = { agentId: ctx.agentId, sessionKey: ctx.sessionKey, ...ctx.runId ? { runId: ctx.runId } : {}, expiresAt: Date.now() + 18e5, startedAt: Date.now() };
+    if (e.toolName.startsWith("os_")) {
+      r.stash.set(id, { ...base, tool: e.toolName, paramsJson: JSON.stringify(e.params) });
+      return {};
+    }
+    try {
+      const params = e.params;
+      if (typeof params.grant !== "string") throw new Error();
+      const resolved = await this.resolveGrant(ctx.agentId, ctx.sessionKey, params.grant);
+      const dry = await resolved.session.call(e.toolName, params, { agentId: ctx.agentId, sessionKey: ctx.sessionKey, ...ctx.runId ? { runId: ctx.runId } : {}, toolCallId: id, queue: resolved.queue, observers: r.store.observers(ctx.sessionKey), dryRun: true });
+      r.stash.set(id, { ...base, session: resolved.session, queue: resolved.queue, grant: resolved.grant, tool: e.toolName, paramsJson: JSON.stringify(params) });
+      if (dry.kind === "action" && dry.description.awaitDecision) return { requireApproval: { title: dry.description.title, description: dry.description.description, severity: "critical", allowedDecisions: ["allow-once", "deny"], onResolution: (decision) => r.store.recordToolDecision(id, e.toolName, params, decision) } };
+      return {};
+    } catch {
+      return { block: true, blockReason: "No such grant." };
+    }
+  }
+  async onAfterToolCall(e, _ctx) {
+    if (!e.toolCallId) return;
+    const r = slot.tryGetRuntime(), s = r?.inflight.get(e.toolCallId) ?? r?.stash.get(e.toolCallId);
+    if (!r || !s) return;
+    r.stash.delete(e.toolCallId);
+    r.inflight.delete(e.toolCallId);
+    r.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: cell(), agentId: s.agentId, sessionKey: s.sessionKey, kind: "tool", ...s.grant ? { vendor: s.grant.vendor, resourceType: s.grant.resourceType, handle: s.grant.handle } : {}, title: s.tool ?? "kernel tool", durationMs: Date.now() - s.startedAt, ok: !e.error });
+  }
+  async requestAccess(id, p) {
+    const r = this.runtime(), s = this.consumeStash(id, "os_request_access", p);
+    const url = new URL(p.url);
+    if (p.url.length > 4096 || p.reason.length > 4096 || url.username || url.password || url.search || url.hash) throw new Error("Invalid resource request.");
+    r.store.addIntroduction({ agentId: s.agentId, sessionKey: s.sessionKey, url: p.url, reason: p.reason, requestedBy: "agent" });
+    return text("Access requested; you will be told when it is granted.");
+  }
+  async listGrantsForCall(id) {
+    const r = this.runtime(), s = this.consumeStash(id, "os_list_grants", {});
+    return text(JSON.stringify(r.store.listGrants(s.agentId).filter((g) => r.store.authorizeGrant(g, s.agentId, s.sessionKey, cell()) && (g.audience === "shared" || !r.store.observers(s.sessionKey).length)).map((g) => ({ handle: g.handle, vendor: g.vendor, type: g.resourceType, title: g.title }))));
+  }
+  consumeStash(id, tool, params) {
+    const r = this.runtime(), s = r.stash.get(id);
+    r.stash.delete(id);
+    if (!s || s.tool !== tool || s.expiresAt < Date.now() || s.paramsJson !== JSON.stringify(params)) throw new Error("Operation denied.");
+    r.inflight.set(id, s);
+    return s;
+  }
+  async introduce(agentId, sessionKey, url, operatorId, createdBy, title, audience = "owner-only") {
+    if (!agentId || !sessionKey || audience !== "owner-only") throw new Error("Shared grants are unavailable in beta.");
+    const r = this.runtime();
+    for (const { entry, resource } of r.registry.resources()) {
+      if (!matches(resource.urlPattern, url)) continue;
+      const resolved = await r.registry.introduce(entry.vendor, operatorId, url);
+      const grant = r.store.insertGrant({ handle: newHandle(), agentId, cellId: cell(), vendor: entry.vendor, resourceType: resolved.resource.type, resourceKey: resolved.resourceKey, operatorId, scope: "agent", audience, status: "active", createdAt: Date.now(), createdBy, title: title ?? resolved.resource.title });
+      r.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: cell(), agentId, sessionKey, kind: "grant", vendor: grant.vendor, resourceType: grant.resourceType, handle: grant.handle, title: "Grant activated", decision: "active", by: operatorId, ok: true });
+      r.notes.set(sessionKey, [...r.notes.get(sessionKey) ?? [], `You now have access to ${grant.vendor} ${grant.resourceType} as ${grant.handle}.`]);
+      return grant;
+    }
+    throw new Error();
+  }
+  gatewayMethods() {
+    const wrap = (schema2, scopes, fn) => async (o) => {
+      try {
+        const params = checked(schema2, o.params ?? {}), operator = operatorIdentity(o, scopes);
+        if (this.maintenance() && (scopes === write || scopes === approvals)) throw new Error();
+        o.respond(true, await fn(params, operator));
+      } catch {
+        o.respond(false, void 0, { code: "UNAUTHORIZED", message: "Operator authorization required." });
+      }
+    };
+    const read = ["operator.read", "operator.write", "operator.admin"], write = ["operator.write", "operator.admin"], approvals = ["operator.approvals", "operator.admin"];
+    return [["os.maintenance.set", wrap(Type.Object({ enabled: Type.Boolean() }, { additionalProperties: false }), ["operator.admin"], (p) => this.setMaintenance(p.enabled))], ["os.status", wrap(EmptyParams, read, () => this.status())], ["os.grants.list", wrap(ListGrantsParams, read, (p) => this.runtime().store.allGrants(p.agentId))], ["os.grants.introduce", wrap(IntroduceParams, write, (p, op) => this.introduce(p.agentId, `rpc:${p.agentId}`, p.url, op, "operator", p.title, p.audience))], ["os.grants.revoke", wrap(RevokeGrantParams, write, (p, op) => this.revoke(p.handle, op))], ["os.approvals.list", wrap(ApprovalListParams, read, (p) => this.pending(p.includeDecided))], ["os.approvals.apply", wrap(ApprovalDecisionParams, approvals, (p, op) => this.decide(p, "apply", op))], ["os.approvals.reject", wrap(ApprovalDecisionParams, approvals, (p, op) => this.decide(p, "reject", op))], ["os.approvals.revert", wrap(ApprovalDecisionParams, approvals, (p, op) => this.decide(p, "revert", op))], ["os.requests.approve", wrap(ApprovalDecisionParams, approvals, (p, op) => this.decideRequests(p, true, op))], ["os.requests.reject", wrap(ApprovalDecisionParams, approvals, (p, op) => this.decideRequests(p, false, op))], ["os.gatekeepers.list", wrap(EmptyParams, read, () => this.runtime().registry.health())], ["os.gatekeepers.connect", wrap(ConnectGatekeeperParams, write, (p, op) => this.runtime().oauth.connect(p.vendor, op, p.resourceTypes))], ["os.audit.query", wrap(AuditQueryParams, read, (p) => this.runtime().audit.query(p.limit))]];
+  }
+  /** Revoke authority before awaiting cleanup; no retained session may continue using it. */
+  async revoke(handle, operator) {
+    const r = this.runtime(), grant = r.store.getGrant(handle);
+    if (!grant) throw new Error();
+    r.store.setGrantStatus(handle, "revoked");
+    for (const [id, call] of r.stash) if (call.grant?.handle === handle) r.stash.delete(id);
+    for (const sessions of r.sessions.values()) for (const [session, boundHandle] of sessions) if (boundHandle === handle) {
+      sessions.delete(session);
+      await session.close().catch(() => {
+      });
+    }
+    r.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: cell(), agentId: grant.agentId, kind: "grant", handle, title: "Grant revoked", decision: "revoked", by: operator, ok: true });
+    return { revoked: true };
+  }
+  pending(includeDecided = false) {
+    const r = this.runtime();
+    const actions = r.store.listActions(!includeDecided);
+    return { actions: actions.slice(0, 100), requests: r.store.listIntroductions(), truncated: actions.length > 100 };
+  }
+  preview(ids) {
+    const rows = this.runtime().store.listActions(false);
+    const selected = ids === "all" ? rows : ids.map((id) => {
+      const row = rows.find((a) => a.id === id);
+      if (!row) throw new Error("No such action.");
+      return row;
+    });
+    return { actions: selected.slice(0, 100), truncated: selected.length > 100 };
+  }
+  async decideRequests(params, allow, operator) {
+    const r = this.runtime(), pending = r.store.listIntroductions(), ids = params.ids === "all" ? pending.map((p) => p.id) : [...params.ids].sort((a, b) => a - b);
+    for (const id of ids) {
+      const request = pending.find((p) => p.id === id);
+      if (!request || !r.store.claimIntroduction(id)) throw new Error("Request unavailable.");
+      try {
+        if (allow) {
+          if (!request.sessionKey || r.store.observers(request.sessionKey).length) throw new Error();
+          await this.introduce(request.agentId, request.sessionKey, request.url, operator, "agent-request");
+        }
+        r.store.finishIntroduction(id, allow ? "granted" : "rejected");
+      } catch {
+        r.store.finishIntroduction(id, "failed");
+        throw new Error("Request could not be resolved.");
+      }
+    }
+    return { ids };
+  }
+  async decide(params, verb, operator) {
+    const r = this.runtime();
+    const result = await r.actions.decide(params.ids, verb, operator);
+    await r.actions.drain(this.maintenance() ? [] : this.config().autoApprove ?? []);
+    return result;
+  }
+  async oauthRouter(req, res) {
+    const r = slot.tryGetRuntime();
+    if (!r) {
+      res.statusCode = 503;
+      res.end("Kernel unavailable.");
+      return true;
+    }
+    return r.oauth.handle(req, res);
+  }
+  /** Start one shared-runtime timer; lifecycle order does not grant authority. */
+  startDrainer(_ctx) {
+    const r = slot.tryGetRuntime();
+    if (!r || r.timer) return;
+    r.timer = setInterval(() => {
+      void r.actions.drain(this.maintenance() ? [] : this.config().autoApprove ?? []);
+    }, 3e4);
+    r.timer.unref();
+  }
+  /** Stop timer immediately; stop() subsequently awaits in-flight effects. */
+  stopDrainer() {
+    const r = slot.tryGetRuntime();
+    if (r?.timer) {
+      clearInterval(r.timer);
+      delete r.timer;
+    }
+  }
+  /** This late hook carries no trustworthy owner authority; only deny command fallthrough here. */
+  async onBeforeAgentReply(e, _ctx) {
+    if (isOperatorCommand(e.cleanedBody)) return { handled: true, reply: { text: "" }, reason: "clawos command requires trusted dispatch" };
+  }
+  async onMessageSending(e, ctx) {
+    for (const source of this.config().egress?.denyPatterns ?? []) {
+      let re;
+      try {
+        re = new RegExp(source, "iu");
+      } catch {
+        return { cancel: true, cancelReason: "Invalid egress policy." };
+      }
+      if (re.test(typeof e.content === "string" ? e.content : "")) {
+        this.runtime().audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: cell(), ...ctx.sessionKey ? { sessionKey: ctx.sessionKey } : {}, kind: "egress", title: "Outbound message blocked", decision: "deny", ok: false });
+        return { cancel: true, cancelReason: "Outbound policy denied this message." };
+      }
+    }
+    if (ctx.sessionKey) for (const id of this.runtime().store.observers(ctx.sessionKey)) this.runtime().store.taintObserver(ctx.sessionKey, id);
+  }
+  async onBeforeInstall(e, _ctx) {
+    const verdict = evaluateInstall(this.config().install, e);
+    return verdict.decision === "allow" ? void 0 : { block: true, blockReason: verdict.reason };
+  }
+  async onAgentEnd(_e, ctx) {
+    if (ctx.runId) this.activeRuns.delete(ctx.runId);
+    const r = slot.tryGetRuntime();
+    if (!r) return;
+    await r.actions.drain(this.maintenance() ? [] : this.config().autoApprove ?? []);
+    const notify = this.config().notify, actions = r.store.countPending(), requests = r.store.countPendingRequests();
+    if (!notify || !ctx.runId || !(actions + requests) || !r.store.claimNotification(ctx.runId)) return;
+    try {
+      await sendOperatorDigest(notify, actions, requests);
+    } catch {
+      r.audit.write({ ts: (/* @__PURE__ */ new Date()).toISOString(), cell: cell(), kind: "tool", title: "Operator digest delivery unconfirmed", ok: false });
+    }
+  }
+  async onSessionEnd(_e, ctx) {
+    if (!ctx.sessionKey) return;
+    const r = slot.tryGetRuntime(), sessions = r?.sessions.get(ctx.sessionKey);
+    if (!sessions) return;
+    for (const session of sessions.keys()) await session.close().catch(() => {
+    });
+    r.sessions.delete(ctx.sessionKey);
+  }
+  async status() {
+    const r = this.runtime();
+    return { cell: cell(), upstreamVersion: runtimeVersion(this.api), kernelVersion, healthy: true, kernelSchema: 1, activeRuns: this.activeRuns.size + this.unknownRuns, activeEffects: r.actions.activeEffects, activeRunTrackingComplete: this.unknownRuns === 0, maintenance: this.maintenance() === true, gatekeepers: r.registry.health(), pendingApprovals: r.store.countPending(), pendingRequests: r.store.countPendingRequests() };
+  }
+};
+function toolResult(result) {
+  if ("content" in result) return { content: result.content, details: result.details ?? {} };
+  return text(JSON.stringify(result));
+}
+function checked(schema2, value) {
+  if (!Value5.Check(schema2, value)) throw new Error();
+  return value;
+}
+function operatorIdentity(o, allowedScopes) {
+  const c = o.client;
+  if (!c || c.connect?.role !== "operator" || !Array.isArray(c.connect.scopes) || !c.connect.scopes.some((scope) => allowedScopes.includes(scope)) || !c.connect.device?.id || c.isDeviceTokenAuth !== true) throw new Error();
+  return c.connect.device.id;
+}
+function cell() {
+  return process.env.CLAWOS_CELL ?? "default";
+}
+function urls(v) {
+  return v.match(/(?:https?:\/\/|file:\/\/\/)[^\s<>"']+/gu) ?? [];
+}
+function matches(pattern, url) {
+  if (pattern.startsWith("file:///")) return url.startsWith("file:///");
+  try {
+    return new URL(url).protocol === new URL(pattern.replace(/:[a-z][a-z0-9_]*[+]?/gi, "x")).protocol;
+  } catch {
+    return false;
+  }
+}
+function newHandle() {
+  const a = "0123456789abcdefghjkmnpqrstvwxyz", b = randomBytes(8);
+  let out = "grant:";
+  for (const x of b) out += a[x % a.length];
+  return out;
+}
+
+// src/index.ts
+var index_default = definePluginEntry({
+  id: "clawos-kernel",
+  name: "OpenClaw OS Kernel",
+  description: "Capability model, gatekeeper registry, approval queue, and audit for OpenClaw OS.",
+  configSchema: buildJsonPluginConfigSchema(schema),
+  register(api) {
+    if (["cli-metadata", "discovery", "full"].includes(api.registrationMode)) {
+      api.registerCli(({ program }) => mountOperatorCli(program), { descriptors: [{ name: "os", description: "OpenClaw OS kernel administration", hasSubcommands: true, machineOutput: ({ argv }) => argv.includes("--json") }] });
+    }
+    if (!["full", "discovery", "tool-discovery"].includes(api.registrationMode)) return;
+    const kernel = new Kernel(api);
+    api.registerTrustedToolPolicy(kernel.capabilityPolicy());
+    api.on("reply_dispatch", (e, ctx) => kernel.onReplyDispatch(e, ctx), { priority: 1e3, eligibleDispatchKinds: ["agent"] });
+    api.on("before_agent_run", (e, ctx) => kernel.onBeforeAgentRun(e, ctx), { priority: 1e3 });
+    api.on("before_prompt_build", (e, ctx) => kernel.onBeforePromptBuild(e, ctx), { priority: 1e3 });
+    api.on("before_tool_call", (e, ctx) => kernel.onBeforeToolCall(e, ctx), { priority: 1e3, timeoutMs: 1e4 });
+    api.on("after_tool_call", (e, ctx) => kernel.onAfterToolCall(e, ctx));
+    api.on("before_agent_reply", (e, ctx) => kernel.onBeforeAgentReply(e, ctx));
+    api.on("message_sending", (e, ctx) => kernel.onMessageSending(e, ctx));
+    api.on("before_install", (e, ctx) => kernel.onBeforeInstall(e, ctx));
+    api.on("agent_end", (e, ctx) => kernel.onAgentEnd(e, ctx));
+    api.on("session_end", (e, ctx) => kernel.onSessionEnd(e, ctx));
+    api.registerTool({
+      name: "os_request_access",
+      label: "Request access",
+      description: "Ask the operator for access to a resource by URL.",
+      parameters: Type2.Object({ url: Type2.String(), reason: Type2.String() }),
+      execute: (toolCallId, params) => kernel.requestAccess(toolCallId, params)
+    });
+    api.registerTool({
+      name: "os_list_grants",
+      label: "List grants",
+      description: "List the resources you currently have access to.",
+      parameters: Type2.Object({}),
+      execute: (toolCallId) => kernel.listGrantsForCall(toolCallId)
+    });
+    kernel.registerGatekeeperTools(api);
+    if (api.registrationMode !== "full") return;
+    api.on("gateway_start", () => kernel.start());
+    api.on("gateway_stop", () => kernel.stop());
+    for (const [name, handler] of kernel.gatewayMethods()) api.registerGatewayMethod(name, handler, { profileAccess: "required" });
+    api.registerHttpRoute({ path: "/os/gatekeeper/", match: "prefix", auth: "plugin", handler: (req, res) => kernel.oauthRouter(req, res) });
+    api.registerService({ id: "clawos-drainer", start: (ctx) => kernel.startDrainer(ctx), stop: () => kernel.stopDrainer() });
+  }
+});
+export {
+  index_default as default
+};