@gguf/claw 2026.2.4 → 2026.2.5

package/dist/{gateway-cli-BCC0T5iY.js → gateway-cli-DHP5DRUH.js}

@@ -1,89 +1,94 @@
 import { $ as DEFAULT_CHAT_CHANNEL, A as getChildLogger, B as resolveConfigPath, C as setVerbose, D as colorize, F as CONFIG_PATH, L as STATE_DIR, M as getResolvedLoggerSettings, O as isRich, R as isNixMode, U as resolveGatewayLockDir, W as resolveGatewayPort, X as resolveStateDir, Z as CHANNEL_IDS, j as getLogger, k as theme, l as setConsoleSubsystemFilter, n as isTruthyEnvValue, o as createSubsystemLogger, p as defaultRuntime, r as logAcceptedEnvOption, s as runtimeForLogger, st as getActivePluginRegistry, u as setConsoleTimestampPrefix } from "./entry.js";
-import { I as resolveHooksGmailModel, N as resolveAllowedModelRef, O as getModelRefStatus, P as resolveConfiguredModelRef, R as resolveThinkingDefault, _t as DEFAULT_MODEL, gt as DEFAULT_CONTEXT_TOKENS, k as isCliProvider, vt as DEFAULT_PROVIDER } from "./auth-profiles-CfFGCDJa.js";
-import { t as formatCliCommand } from "./command-format-3xiXujG0.js";
-import { E as DEFAULT_ACCOUNT_ID, F as resolveAgentIdFromSessionKey, H as parseAgentSessionKey, N as normalizeAgentId, P as normalizeMainKey, R as toAgentRequestSessionKey, T as resolveWorkspaceTemplateDir, V as isSubagentSessionKey, _ as DEFAULT_MEMORY_FILENAME, b as DEFAULT_USER_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, g as DEFAULT_MEMORY_ALT_FILENAME, h as DEFAULT_IDENTITY_FILENAME, i as resolveAgentModelFallbacksOverride, k as buildAgentMainSessionKey, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, v as DEFAULT_SOUL_FILENAME, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-jm0ZdXwM.js";
-import { b as truncateUtf16Safe, g as shortenHomePath, m as resolveUserPath, o as ensureDir, t as CONFIG_DIR } from "./utils-PmTbZoD1.js";
-import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-BIMFe4XS.js";
-import { t as resolveOpenClawPackageRoot } from "./openclaw-root-Dean7Fp2.js";
-import "./github-copilot-token-rP-6QdKv.js";
-import "./pi-model-discovery-CsRo-xMp.js";
-import { A as resolveAgentMaxConcurrent, E as applyLegacyMigrations, M as VERSION, a as readConfigFileSnapshot, i as parseConfigJson5, j as resolveSubagentMaxConcurrent, l as validateConfigObjectWithPlugins, n as createConfigIO, o as resolveConfigSnapshotHash, r as loadConfig, s as writeConfigFile, t as migrateLegacyConfig, u as OpenClawSchema } from "./config-DCT1RAo6.js";
-import { o as isTestDefaultMemorySlotDisabled } from "./manifest-registry-tuAcHxrV.js";
-import "./server-context-CM_E6wD5.js";
-import { d as ensurePortAvailable, f as inspectPortUsage, m as formatPortDiagnostics, n as formatErrorMessage } from "./errors-DdT2Dtkb.js";
-import { t as rawDataToString } from "./ws-DlSkA_BG.js";
-import { r as startBrowserControlServiceFromConfig, t as createBrowserControlContext } from "./control-service-Ds9ompnU.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-CUhrC5DA.js";
-import { i as enableTailscaleServe, n as disableTailscaleServe, o as getTailnetHostname, r as enableTailscaleFunnel, t as disableTailscaleFunnel } from "./tailscale-BUcKO8Rr.js";
-import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BijMqkqa.js";
-import { a as resolveGatewayBindHost, n as isLoopbackHost$2, o as resolveGatewayClientIp, r as isTrustedProxyAddress, s as resolveGatewayListenHosts, t as isLoopbackAddress } from "./net-DaJz_a4n.js";
-import { i as resolveGatewayAuth, n as authorizeGatewayConnect, r as isLocalDirectRequest, t as assertGatewayAuthConfigured } from "./auth-viF_w60n.js";
-import { $ as validatePollParams, A as validateDevicePairListParams, B as validateLogsTailParams, C as validateCronListParams, Ct as ErrorCodes, D as validateCronStatusParams, Dt as buildDeviceAuthPayload, E as validateCronRunsParams, Et as parseSessionLabel, F as validateExecApprovalResolveParams, G as validateNodeInvokeResultParams, H as validateNodeDescribeParams, I as validateExecApprovalsGetParams, J as validateNodePairListParams, K as validateNodeListParams, L as validateExecApprovalsNodeGetParams, M as validateDeviceTokenRevokeParams, Mt as verifyDeviceSignature, N as validateDeviceTokenRotateParams, O as validateCronUpdateParams, P as validateExecApprovalRequestParams, Q as validateNodeRenameParams, R as validateExecApprovalsNodeSetParams, S as validateCronAddParams, St as PROTOCOL_VERSION, T as validateCronRunParams, U as validateNodeEventParams, V as validateModelsListParams, W as validateNodeInvokeParams, X as validateNodePairRequestParams, Y as validateNodePairRejectParams, Z as validateNodePairVerifyParams, _ as validateConfigGetParams, _t as validateWebLoginWaitParams, a as validateAgentWaitParams, at as validateSessionsPatchParams, b as validateConfigSetParams, bt as validateWizardStartParams, c as validateAgentsFilesSetParams, ct as validateSessionsResolveParams, d as validateChannelsStatusParams, dt as validateSkillsStatusParams, et as validateRequestFrame, f as validateChatAbortParams, ft as validateSkillsUpdateParams, g as validateConfigApplyParams, gt as validateWebLoginStartParams, h as validateChatSendParams, ht as validateWakeParams, i as validateAgentParams, it as validateSessionsListParams, j as validateDevicePairRejectParams, jt as normalizeDevicePublicKeyBase64Url, k as validateDevicePairApproveParams, kt as deriveDeviceIdFromPublicKey, l as validateAgentsListParams, lt as validateSkillsBinsParams, m as validateChatInjectParams, mt as validateUpdateRunParams, n as formatValidationErrors, nt as validateSessionsCompactParams, o as validateAgentsFilesGetParams, ot as validateSessionsPreviewParams, p as validateChatHistoryParams, pt as validateTalkModeParams, q as validateNodePairApproveParams, r as validateAgentIdentityParams, rt as validateSessionsDeleteParams, s as validateAgentsFilesListParams, st as validateSessionsResetParams, tt as validateSendParams, u as validateChannelsLogoutParams, ut as validateSkillsInstallParams, v as validateConfigPatchParams, vt as validateWizardCancelParams, w as validateCronRemoveParams, wt as errorShape, x as validateConnectParams, xt as validateWizardStatusParams, y as validateConfigSchemaParams, yt as validateWizardNextParams, z as validateExecApprovalsSetParams } from "./client-cU7Xg1MO.js";
-import { i as loadGatewayTlsRuntime$1, n as callGateway } from "./call-CfqL-4Nc.js";
-import { f as GATEWAY_CLIENT_IDS, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_NAMES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_MODES, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-CAFcg7mw.js";
-import { t as formatDocsLink } from "./links-jGisPfXW.js";
-import { r as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-CIVp3SAp.js";
-import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-TrKFfrLt.js";
-import "./logging-fywhKCmE.js";
-import "./accounts-B5QZU96b.js";
-import { $ as approveNodePairing, $n as resolveTtsPrefsPath, $t as listSessionsFromStore, An as consumeGatewaySigusr1RestartAuthorization, Bn as isSystemEventContextChanged, Bt as emitAgentEvent, C as buildControlUiAvatarUrl, Cn as resolveSessionDeliveryTarget, Cr as resolveAgentIdentity, Ct as normalizeMimeList, Dn as runWithModelFallback, Dr as createInternalHookEvent, Dt as runEmbeddedPiAgent, Er as clearInternalHooks, Et as stopSubagentsForRequester, Fn as normalizeCronJobPatch, Ft as getHookType, G as normalizeSendPolicy, Gn as OPENAI_TTS_MODELS, H as setCliSessionId, Hn as requestHeartbeatNow, Ht as onAgentEvent, I as getChannelActivity, In as migrateLegacyCronPayload, It as isExternalHookSession, J as primeRemoteSkillsCache, Jn as isTtsEnabled, Jt as loadProviderUsageSummary, K as resolveSendPolicy, Kn as OPENAI_TTS_VOICES, Kt as loadModelCatalog, Lt as initSubagentRegistry, M as onHeartbeatEvent, Mn as scheduleGatewaySigusr1Restart, Mt as createOpenClawTools, Nn as setGatewaySigusr1RestartPolicy, Nt as buildSafeExternalPrompt, O as buildHistoryContextFromEntries, Or as registerInternalHook, Ot as abortEmbeddedPiRun, Pn as normalizeCronJobCreate, Pt as detectSuspiciousPatterns, Q as setSkillsRemoteRegistry, Qn as resolveTtsConfig, Qt as listAgentsForGateway, R as dispatchInboundMessage, Rt as resolveAgentTimeoutMs, S as CONTROL_UI_AVATAR_PREFIX, Sn as resolveOutboundTarget, St as extractImageContentFromSource, T as resolveAssistantAvatarUrl, Tn as resetDirectoryCache, Tr as resolveIdentityName, Tt as isAbortTrigger, U as runCliAgent, Ut as registerAgentRunContext, V as getCliSessionId, Vt as getAgentRunContext, W as loadCostUsageSummary, Wn as getPluginToolMeta, Wt as resolveAnnounceTargetFromKey, X as refreshRemoteBinsForConnectedNodes, Xn as resolveTtsApiKey, Y as recordRemoteNodeInfo, Yn as isTtsProviderConfigured, Z as refreshRemoteNodeBins, Zn as resolveTtsAutoMode, _n as ensureOutboundSessionEntry, _r as formatUserTime, _t as DEFAULT_INPUT_PDF_MAX_PAGES, an as capArrayByJsonBytes, ar as setCommandLaneConcurrency, at as verifyNodeToken, bt as DEFAULT_INPUT_TIMEOUT_MS, cn as resolveSessionTranscriptCandidates, cr as stopDiagnosticHeartbeat, d as handleReset, dn as hasNonzeroUsage, dt as DEFAULT_INPUT_FILE_MAX_BYTES, en as loadCombinedSessionStoreForGateway, er as resolveTtsProviderOrder, et as listNodePairing, fn as lookupContextTokens, ft as DEFAULT_INPUT_FILE_MAX_CHARS, gr as normalizePollInput, gt as DEFAULT_INPUT_MAX_REDIRECTS, hn as normalizeGroupActivation, ht as DEFAULT_INPUT_IMAGE_MIMES, in as archiveFileOnDisk, it as updatePairedNodeMetadata, j as getLastHeartbeatEvent, jn as isGatewaySigusr1RestartExternallyAllowed, jt as registerUnhandledRejectionHandler, k as resolveHeartbeatVisibility, kn as authorizeGatewaySigusr1Restart, kr as triggerInternalHook, kt as waitForEmbeddedPiRunEnd, ln as stripEnvelopeFromMessages, lr as isDiagnosticsEnabled, lt as applyVerboseOverride, mn as clearSessionQueues, mr as stripHeartbeatToken, mt as DEFAULT_INPUT_IMAGE_MAX_BYTES, n as handleSlackHttpRequest, nn as resolveGatewaySessionStoreTarget, nr as setTtsProvider, nt as renamePairedNode, on as readSessionMessages, or as CommandLane, ot as getSkillsSnapshotVersion, pn as extractShortModelName, pt as DEFAULT_INPUT_FILE_MIMES, q as getRemoteSkillEligibility, qn as getTtsProvider, qt as applyModelOverrideToSessionEntry, rn as resolveSessionModelRef, rr as textToSpeech, rt as requestNodePairing, sn as readSessionPreviewItemsFromTranscript, sr as startDiagnosticHeartbeat, st as registerSkillsChangeListener, t as loadOpenClawPlugins, tn as loadSessionEntry, tr as setTtsEnabled, tt as rejectNodePairing, ur as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, ut as parseVerboseOverride, vn as resolveOutboundSessionRoute, vr as resolveUserTimeFormat, vt as DEFAULT_INPUT_PDF_MAX_PIXELS, w as normalizeControlUiBasePath, wr as resolveEffectiveMessagesConfig, wt as formatZonedTimestamp, xt as extractFileContentFromSource, yr as resolveUserTimezone, yt as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, z as createReplyDispatcher, zn as enqueueSystemEvent, zt as clearAgentRunContext } from "./loader-BYWxo-_j.js";
-import { n as withProgress } from "./progress-Dn3kWpaL.js";
-import "./prompt-style-D5D7b3cX.js";
-import { t as WizardCancelledError } from "./prompts-CSlE5VZB.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-DfgBr1D5.js";
-import "./onboard-channels-CF7lTDNu.js";
-import "./archive-mFgwsll-.js";
-import "./installs-C5cjVarj.js";
-import "./manager-rDmdE7O9.js";
-import { o as resolveStorePath, r as resolveSessionTranscriptPath } from "./paths-RvF0P6tQ.js";
-import "./sqlite-B_L84oiu.js";
-import { m as detectMime, r as saveMediaBuffer } from "./routes-yI5QIzeL.js";
-import { B as normalizeVerboseLevel, H as supportsXHighThinking, I as normalizeElevatedLevel, L as normalizeReasoningLevel, M as formatThinkingLevels, N as formatXHighModelHint, R as normalizeThinkLevel, z as normalizeUsageDisplay } from "./pi-embedded-helpers-DJgCXZEz.js";
-import { a as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-eE21zdeQ.js";
-import { F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, J as expandPolicyWithPluginGroups, K as buildPluginToolGroups, L as resolveMainSessionKeyFromConfig, P as resolveAgentMainSessionKey, Q as stripPluginOnlyAllowlist, S as mergeDeliveryContext, X as normalizeToolName, Z as resolveToolProfilePolicy, b as deliveryContextFromSession, d as loadSessionStore, g as updateSessionStore, q as collectExplicitAllowlist, w as normalizeSessionDeliveryFields, z as snapshotSessionOrigin } from "./sandbox-Cnq9TXEn.js";
-import { m as formatUsd, p as formatTokenCount } from "./channel-summary-BkqO8zZ9.js";
-import { i as getMachineDisplayName, r as createBrowserRouteDispatcher } from "./wsl-DASmek7h.js";
-import { d as hasBinary, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-DtwGIkTI.js";
-import "./image-CXg7Z0WD.js";
-import { c as normalizeExecApprovals, g as saveExecApprovals, l as readExecApprovalsSnapshot, m as resolveExecApprovalsSocketPath, r as ensureExecApprovals } from "./exec-approvals-WdYFyy5N.js";
-import "./redact-CDPAzwi8.js";
-import "./tool-display-BMYWrp0L.js";
-import { t as parseAbsoluteTimeMs } from "./parse-BB0Cqon8.js";
-import { a as summarizeRestartSentinel, n as formatDoctorNonInteractiveHint, r as formatRestartSentinelMessage, s as writeRestartSentinel, t as consumeRestartSentinel } from "./restart-sentinel-DywisDen.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-BAwiO0li.js";
-import { c as resolveSubagentToolPolicy, i as filterToolsByPolicy, o as resolveEffectiveToolPolicy, s as resolveGroupToolPolicy } from "./commands-DMKDOFmC.js";
-import "./pairing-store-DMex6WWe.js";
-import "./login-qr-sEcxw1_U.js";
-import { r as runCommandWithRuntime } from "./cli-utils-DFbPmfWB.js";
-import "./pairing-labels-C6I3dD-m.js";
-import { t as buildChannelAccountSnapshot } from "./status-IDW1pkc0.js";
-import "./channels-status-issues-DRXQXvhY.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-wXkiMwLZ.js";
-import "./daemon-runtime-ELWW7q0C.js";
-import "./service-BoDHq_LN.js";
-import "./systemd-DAgZTW06.js";
-import "./shared-DBGw227P.js";
-import { a as runDaemonStop, i as runDaemonStart, n as runDaemonStatus, o as runDaemonUninstall, r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-yy_MAYxv.js";
-import "./service-audit-Bf33pqEM.js";
-import "./table-f0EgX-YI.js";
-import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-D4yoSNNw.js";
-import { a as toOptionString, i as parsePort$1, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-D42-KbPa.js";
-import { i as probeGateway } from "./audit-D-OqdjQu.js";
-import { _ as resolveControlUiRootSync, g as resolveControlUiRootOverrideSync, h as ensureControlUiAssetsBuilt, n as installSkill, v as discoverGatewayBeacons } from "./onboard-skills-DdFGj9pt.js";
-import { c as startHeartbeatRunner, n as formatHealthChannelLines, o as runHeartbeatOnce, r as getHealthSnapshot, s as setHeartbeatsEnabled } from "./health-format-Ct8J0fwc.js";
-import { c as compareSemverStrings, f as DEFAULT_PACKAGE_CHANNEL, h as normalizeUpdateChannel, s as checkUpdateStatus, t as runGatewayUpdate, u as resolveNpmChannelTag } from "./update-runner-8XFxQglY.js";
-import "./github-copilot-auth-BHLcQ1sN.js";
-import "./logging-BnUUuH3y.js";
-import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-I3Y60zVN.js";
-import { f as runOnboardingWizard, n as getStatusSummary, s as loadAgentIdentity, u as loadAgentIdentityFromWorkspace } from "./status-BIWeu5mN.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-CWkBweWW.js";
-import "./tui-DBmFYQTk.js";
-import { i as setGatewayWsLogStyle, n as logWs, r as summarizeAgentEventForWsLog, t as formatForLog } from "./ws-log-C4IerKk4.js";
-import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-4czdWNCN.js";
-import { a as createOutboundSendDeps$1, i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-BBI-UGkN.js";
-import "./node-service-BW_LhY5w.js";
-import "./status.update-ChwCPLBt.js";
-import { n as forceFreePortAndWait } from "./ports-B27T1uRn.js";
+import { D as isCliProvider, E as getModelRefStatus, F as resolveHooksGmailModel, L as resolveThinkingDefault, N as resolveConfiguredModelRef, P as resolveDefaultModelForAgent, _t as DEFAULT_PROVIDER, gt as DEFAULT_MODEL, ht as DEFAULT_CONTEXT_TOKENS, j as resolveAllowedModelRef } from "./auth-profiles-CYBuGiBb.js";
+import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { _ as parseAgentSessionKey, c as normalizeAgentId, g as isSubagentSessionKey, i as buildAgentMainSessionKey, l as normalizeMainKey, p as toAgentRequestSessionKey, t as DEFAULT_ACCOUNT_ID, u as resolveAgentIdFromSessionKey } from "./session-key-CZkcvAtx.js";
+import { b as truncateUtf16Safe, g as shortenHomePath, m as resolveUserPath, o as ensureDir, t as CONFIG_DIR } from "./utils-DX85MiPR.js";
+import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
+import { t as resolveOpenClawPackageRoot } from "./openclaw-root-9ILYSmJ9.js";
+import { T as resolveWorkspaceTemplateDir, _ as DEFAULT_MEMORY_FILENAME, b as DEFAULT_USER_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, g as DEFAULT_MEMORY_ALT_FILENAME, h as DEFAULT_IDENTITY_FILENAME, i as resolveAgentModelFallbacksOverride, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, v as DEFAULT_SOUL_FILENAME, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-C9VjJXEK.js";
+import "./github-copilot-token-SLWintYd.js";
+import "./pi-model-discovery-DzEIEgHL.js";
+import { A as resolveSubagentMaxConcurrent, T as applyLegacyMigrations, a as parseConfigJson5, c as writeConfigFile, i as loadConfig, j as VERSION, k as resolveAgentMaxConcurrent, l as validateConfigObjectWithPlugins, n as migrateLegacyConfig, o as readConfigFileSnapshot, r as createConfigIO, s as resolveConfigSnapshotHash, u as OpenClawSchema } from "./config-CKLedg5Y.js";
+import { o as isTestDefaultMemorySlotDisabled } from "./manifest-registry-C69Z-I4v.js";
+import "./server-context-yKyxyxOJ.js";
+import { d as ensurePortAvailable, f as inspectPortUsage, m as formatPortDiagnostics, n as formatErrorMessage } from "./errors-CZ9opC6L.js";
+import { t as rawDataToString } from "./ws-D091yo4M.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-D2E9NKqQ.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-h3xp5PqO.js";
+import { i as enableTailscaleServe, n as disableTailscaleServe, o as getTailnetHostname, r as enableTailscaleFunnel, t as disableTailscaleFunnel } from "./tailscale-9MusRvOi.js";
+import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Byp3obcc.js";
+import { a as resolveGatewayBindHost, n as isLoopbackHost$2, o as resolveGatewayClientIp, r as isTrustedProxyAddress, s as resolveGatewayListenHosts, t as isLoopbackAddress } from "./net-CWMMy37F.js";
+import { i as resolveGatewayAuth, n as authorizeGatewayConnect, r as isLocalDirectRequest, t as assertGatewayAuthConfigured } from "./auth-DksjO6WG.js";
+import { $ as validatePollParams, A as validateDevicePairListParams, At as deriveDeviceIdFromPublicKey, B as validateLogsTailParams, C as validateCronListParams, Ct as PROTOCOL_VERSION, D as validateCronStatusParams, Dt as parseSessionLabel, E as validateCronRunsParams, F as validateExecApprovalResolveParams, G as validateNodeInvokeResultParams, H as validateNodeDescribeParams, I as validateExecApprovalsGetParams, J as validateNodePairListParams, K as validateNodeListParams, L as validateExecApprovalsNodeGetParams, M as validateDeviceTokenRevokeParams, Mt as normalizeDevicePublicKeyBase64Url, N as validateDeviceTokenRotateParams, Nt as verifyDeviceSignature, O as validateCronUpdateParams, Ot as buildDeviceAuthPayload, P as validateExecApprovalRequestParams, Q as validateNodeRenameParams, R as validateExecApprovalsNodeSetParams, S as validateCronAddParams, St as validateWizardStatusParams, T as validateCronRunParams, Tt as errorShape, U as validateNodeEventParams, V as validateModelsListParams, W as validateNodeInvokeParams, X as validateNodePairRequestParams, Y as validateNodePairRejectParams, Z as validateNodePairVerifyParams, _ as validateConfigGetParams, _t as validateWebLoginStartParams, a as validateAgentWaitParams, at as validateSessionsPatchParams, b as validateConfigSetParams, bt as validateWizardNextParams, c as validateAgentsFilesSetParams, ct as validateSessionsResolveParams, d as validateChannelsStatusParams, dt as validateSkillsInstallParams, et as validateRequestFrame, f as validateChatAbortParams, ft as validateSkillsStatusParams, g as validateConfigApplyParams, gt as validateWakeParams, h as validateChatSendParams, ht as validateUpdateRunParams, i as validateAgentParams, it as validateSessionsListParams, j as validateDevicePairRejectParams, k as validateDevicePairApproveParams, l as validateAgentsListParams, lt as validateSessionsUsageParams, m as validateChatInjectParams, mt as validateTalkModeParams, n as formatValidationErrors, nt as validateSessionsCompactParams, o as validateAgentsFilesGetParams, ot as validateSessionsPreviewParams, p as validateChatHistoryParams, pt as validateSkillsUpdateParams, q as validateNodePairApproveParams, r as validateAgentIdentityParams, rt as validateSessionsDeleteParams, s as validateAgentsFilesListParams, st as validateSessionsResetParams, tt as validateSendParams, u as validateChannelsLogoutParams, ut as validateSkillsBinsParams, v as validateConfigPatchParams, vt as validateWebLoginWaitParams, w as validateCronRemoveParams, wt as ErrorCodes, x as validateConnectParams, xt as validateWizardStartParams, y as validateConfigSchemaParams, yt as validateWizardCancelParams, z as validateExecApprovalsSetParams } from "./client-CxbkcEZ7.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-90HgQQ8o.js";
+import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BlgPSDAh.js";
+import { t as formatDocsLink } from "./links-D0uzJbi6.js";
+import { r as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-DyW8lHTT.js";
+import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-BUPpq5aS.js";
+import "./logging-CfEk_PnX.js";
+import "./accounts-Dto4p9zB.js";
+import { $ as approveNodePairing, $n as isTtsEnabled, $t as listSessionsFromStore, A as resolveHeartbeatVisibility, An as scheduleGatewaySigusr1Restart, Ar as clearInternalHooks, B as createReplyDispatcher, Bn as normalizeCronJobPatch, Bt as emitAgentEvent, C as buildControlUiAvatarUrl, Cn as resetDirectoryCache, Cr as resolveUserTimeFormat, Ct as normalizeMimeList, Dn as authorizeGatewaySigusr1Restart, Dt as runEmbeddedPiAgent, Et as stopSubagentsForRequester, Ft as getHookType, G as normalizeSendPolicy, Gn as isSystemEventContextChanged, H as getCliSessionId, Ht as onAgentEvent, In as summarizeRestartSentinel, It as isExternalHookSession, J as primeRemoteSkillsCache, Jt as loadProviderUsageSummary, K as resolveSendPolicy, Kt as loadModelCatalog, L as getChannelActivity, Lt as initSubagentRegistry, M as getLastHeartbeatEvent, Mn as consumeRestartSentinel, Mr as registerInternalHook, Mt as createOpenClawTools, N as onHeartbeatEvent, Nn as formatDoctorNonInteractiveHint, Nr as triggerInternalHook, Nt as buildSafeExternalPrompt, O as createReplyPrefixOptions, On as consumeGatewaySigusr1RestartAuthorization, Or as resolveAgentIdentity, Ot as abortEmbeddedPiRun, Pn as formatRestartSentinelMessage, Pt as detectSuspiciousPatterns, Q as setSkillsRemoteRegistry, Qn as getTtsProvider, Qt as listAgentsForGateway, Rn as writeRestartSentinel, Rt as resolveAgentTimeoutMs, S as CONTROL_UI_AVATAR_PREFIX, Sr as formatUserTime, St as extractImageContentFromSource, T as resolveAssistantAvatarUrl, Tn as runWithModelFallback, Tt as isAbortTrigger, U as setCliSessionId, Ut as registerAgentRunContext, Vn as migrateLegacyCronPayload, Vt as getAgentRunContext, W as runCliAgent, Wn as enqueueSystemEvent, Wt as resolveAnnounceTargetFromKey, X as refreshRemoteBinsForConnectedNodes, Xn as OPENAI_TTS_MODELS, Y as recordRemoteNodeInfo, Yn as getPluginToolMeta, Z as refreshRemoteNodeBins, Zn as OPENAI_TTS_VOICES, _t as DEFAULT_INPUT_PDF_MAX_PAGES, an as capArrayByJsonBytes, ar as resolveTtsProviderOrder, at as verifyNodeToken, bn as resolveOutboundTarget, bt as DEFAULT_INPUT_TIMEOUT_MS, cn as resolveSessionTranscriptCandidates, cr as textToSpeech, d as handleReset, dn as lookupContextTokens, dr as CommandLane, dt as DEFAULT_INPUT_FILE_MAX_BYTES, en as loadCombinedSessionStoreForGateway, er as isTtsProviderConfigured, et as listNodePairing, fn as clearSessionQueues, fr as startDiagnosticHeartbeat, ft as DEFAULT_INPUT_FILE_MAX_CHARS, gn as resolveOutboundSessionRoute, gt as DEFAULT_INPUT_MAX_REDIRECTS, hn as ensureOutboundSessionEntry, hr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, ht as DEFAULT_INPUT_IMAGE_MIMES, in as archiveFileOnDisk, ir as resolveTtsPrefsPath, it as updatePairedNodeMetadata, jn as setGatewaySigusr1RestartPolicy, jr as createInternalHookEvent, jt as registerUnhandledRejectionHandler, k as buildHistoryContextFromEntries, kn as isGatewaySigusr1RestartExternallyAllowed, kt as waitForEmbeddedPiRunEnd, ln as stripEnvelopeFromMessages, lt as applyVerboseOverride, mr as isDiagnosticsEnabled, mt as DEFAULT_INPUT_IMAGE_MAX_BYTES, n as handleSlackHttpRequest, nn as resolveGatewaySessionStoreTarget, nr as resolveTtsAutoMode, nt as renamePairedNode, on as readSessionMessages, or as setTtsEnabled, ot as getSkillsSnapshotVersion, pn as normalizeGroupActivation, pr as stopDiagnosticHeartbeat, pt as DEFAULT_INPUT_FILE_MIMES, q as getRemoteSkillEligibility, qn as requestHeartbeatNow, qt as applyModelOverrideToSessionEntry, rn as resolveSessionModelRef, rr as resolveTtsConfig, rt as requestNodePairing, sn as readSessionPreviewItemsFromTranscript, sr as setTtsProvider, st as registerSkillsChangeListener, t as loadOpenClawPlugins, tn as loadSessionEntry, tr as resolveTtsApiKey, tt as rejectNodePairing, ur as setCommandLaneConcurrency, ut as parseVerboseOverride, vt as DEFAULT_INPUT_PDF_MAX_PIXELS, w as normalizeControlUiBasePath, wr as resolveUserTimezone, wt as formatZonedTimestamp, xn as resolveSessionDeliveryTarget, xr as normalizePollInput, xt as extractFileContentFromSource, yr as stripHeartbeatToken, yt as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, z as dispatchInboundMessage, zn as normalizeCronJobCreate, zt as clearAgentRunContext } from "./loader-_Pj-TZS2.js";
+import { n as withProgress } from "./progress-Da1ehW-x.js";
+import "./prompt-style-Dc0C5HC9.js";
+import "./note-Ci08TSbV.js";
+import { t as WizardCancelledError } from "./prompts-CXLLIBwP.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-D66_XoIz.js";
+import "./onboard-channels-D-ZQTy5V.js";
+import "./archive-D0z3LZDK.js";
+import "./skill-scanner-Bp1D9gra.js";
+import "./installs-DsJkyWfL.js";
+import "./manager-BXiIQku7.js";
+import { n as resolveSessionFilePath, o as resolveStorePath, r as resolveSessionTranscriptPath } from "./paths-CTg8F3AE.js";
+import "./sqlite-DqUEZnjO.js";
+import { m as detectMime, r as saveMediaBuffer } from "./routes-BSfXf8a5.js";
+import { B as normalizeThinkLevel, F as formatXHighModelHint, H as normalizeVerboseLevel, P as formatThinkingLevels, R as normalizeElevatedLevel, V as normalizeUsageDisplay, W as supportsXHighThinking, z as normalizeReasoningLevel } from "./pi-embedded-helpers-DF8SAHU-.js";
+import { o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-Cau4HL7W.js";
+import { $ as stripPluginOnlyAllowlist, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, J as collectExplicitAllowlist, L as resolveMainSessionKeyFromConfig, P as resolveAgentMainSessionKey, Q as resolveToolProfilePolicy, S as mergeDeliveryContext, Y as expandPolicyWithPluginGroups, Z as normalizeToolName, b as deliveryContextFromSession, d as loadSessionStore, g as updateSessionStore, q as buildPluginToolGroups, w as normalizeSessionDeliveryFields, z as snapshotSessionOrigin } from "./sandbox-DuqLKN5J.js";
+import "./channel-summary-D9nzC5WB.js";
+import { i as getMachineDisplayName, r as createBrowserRouteDispatcher } from "./wsl-ATjkMwMA.js";
+import { d as hasBinary, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-CmU0Q92f.js";
+import "./image-nRwqkmtf.js";
+import { c as normalizeExecApprovals, g as saveExecApprovals, l as readExecApprovalsSnapshot, m as resolveExecApprovalsSocketPath, r as ensureExecApprovals } from "./exec-approvals-BCEFzcbC.js";
+import "./redact-B8YiFlwn.js";
+import "./tool-display-DmgKs6-V.js";
+import { t as parseAbsoluteTimeMs } from "./parse-gTOGQPH6.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-PZuuCvrp.js";
+import { i as loadSessionUsageTimeSeries, l as hasNonzeroUsage, n as loadCostUsageSummary, r as loadSessionCostSummary, t as discoverAllSessions } from "./session-cost-usage-BTXosU1k.js";
+import { n as formatTokenCount, r as formatUsd } from "./usage-format-E3bMcUMV.js";
+import { c as resolveSubagentToolPolicy, i as filterToolsByPolicy, o as resolveEffectiveToolPolicy, s as resolveGroupToolPolicy } from "./commands-DAC7XMAT.js";
+import "./pairing-store-DTfv_FGA.js";
+import "./login-qr-Cmsf7BGt.js";
+import { r as runCommandWithRuntime } from "./cli-utils-ByANh4Sp.js";
+import "./pairing-labels-BbydDT7w.js";
+import { t as buildChannelAccountSnapshot } from "./status-CRIEi8Mc.js";
+import "./channels-status-issues-CJ8PJgDc.js";
+import "./register.subclis-BpIR6Iqi.js";
+import "./completion-cli-BbhA_JbG.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-ytXmI88x.js";
+import "./daemon-runtime-BCn_QIHK.js";
+import "./service-_JwSmGSn.js";
+import "./systemd-8sIc6isV.js";
+import "./shared-fnGLWyZ6.js";
+import { a as runDaemonStop, i as runDaemonStart, n as runDaemonStatus, o as runDaemonUninstall, r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-CMKd_D6h.js";
+import "./service-audit-DDX1kO3k.js";
+import "./table-CJSx0YID.js";
+import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-CsSylzXH.js";
+import { a as toOptionString, i as parsePort$1, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-C1XLEyB0.js";
+import { i as probeGateway } from "./audit-BWbjQmyv.js";
+import { g as discoverGatewayBeacons, n as installSkill } from "./onboard-skills-YobctE-R.js";
+import { a as resolveControlUiRootOverrideSync, c as getHealthSnapshot, d as runHeartbeatOnce, f as setHeartbeatsEnabled, n as ensureControlUiAssetsBuilt, o as resolveControlUiRootSync, p as startHeartbeatRunner, s as formatHealthChannelLines } from "./health-format-ND2rUbQO.js";
+import { S as normalizeUpdateChannel, _ as resolveNpmChannelTag, h as compareSemverStrings, m as checkUpdateStatus, t as runGatewayUpdate, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner-2i8_mIG5.js";
+import "./github-copilot-auth-B_lK1g__.js";
+import "./logging-Cc7m6PTv.js";
+import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-CKmUPU-M.js";
+import { f as runOnboardingWizard, n as getStatusSummary, s as loadAgentIdentity, u as loadAgentIdentityFromWorkspace } from "./status-BRXuHUsK.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-DtXrj3fy.js";
+import "./tui-DPorsF4z.js";
+import { i as setGatewayWsLogStyle, n as logWs, r as summarizeAgentEventForWsLog, t as formatForLog } from "./ws-log-DJIXahf0.js";
+import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-Bi6W14MK.js";
+import { a as createOutboundSendDeps$1, i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-DztWhVCH.js";
+import "./node-service-Lc1LlnFH.js";
+import { n as forceFreePortAndWait } from "./ports-0V-Mu4ch.js";
 import { spawn, spawnSync } from "node:child_process";
 import path from "node:path";
 import os from "node:os";
@@ -1962,7 +1967,48 @@ function createChatRunState() {
 		clear
 	};
 }
-function createAgentEventHandler({ broadcast, nodeSendToSession, agentRunSeq, chatRunState, resolveSessionKeyForRun, clearAgentRunContext }) {
+const TOOL_EVENT_RECIPIENT_TTL_MS = 600 * 1e3;
+const TOOL_EVENT_RECIPIENT_FINAL_GRACE_MS = 30 * 1e3;
+function createToolEventRecipientRegistry() {
+	const recipients = /* @__PURE__ */ new Map();
+	const prune = () => {
+		if (recipients.size === 0) return;
+		const now = Date.now();
+		for (const [runId, entry] of recipients) if (now >= (entry.finalizedAt ? entry.finalizedAt + TOOL_EVENT_RECIPIENT_FINAL_GRACE_MS : entry.updatedAt + TOOL_EVENT_RECIPIENT_TTL_MS)) recipients.delete(runId);
+	};
+	const add = (runId, connId) => {
+		if (!runId || !connId) return;
+		const now = Date.now();
+		const existing = recipients.get(runId);
+		if (existing) {
+			existing.connIds.add(connId);
+			existing.updatedAt = now;
+		} else recipients.set(runId, {
+			connIds: new Set([connId]),
+			updatedAt: now
+		});
+		prune();
+	};
+	const get = (runId) => {
+		const entry = recipients.get(runId);
+		if (!entry) return;
+		entry.updatedAt = Date.now();
+		prune();
+		return entry.connIds;
+	};
+	const markFinal = (runId) => {
+		const entry = recipients.get(runId);
+		if (!entry) return;
+		entry.finalizedAt = Date.now();
+		prune();
+	};
+	return {
+		add,
+		get,
+		markFinal
+	};
+}
+function createAgentEventHandler({ broadcast, broadcastToConnIds, nodeSendToSession, agentRunSeq, chatRunState, resolveSessionKeyForRun, clearAgentRunContext, toolEventRecipients }) {
 	const emitChatDelta = (sessionKey, clientRunId, seq, text) => {
 		chatRunState.buffers.set(clientRunId, text);
 		const now = Date.now();
@@ -2018,17 +2064,17 @@ function createAgentEventHandler({ broadcast, nodeSendToSession, agentRunSeq, ch
 		broadcast("chat", payload);
 		nodeSendToSession(sessionKey, "chat", payload);
 	};
-	const shouldEmitToolEvents = (runId, sessionKey) => {
+	const resolveToolVerboseLevel = (runId, sessionKey) => {
 		const runVerbose = normalizeVerboseLevel(getAgentRunContext(runId)?.verboseLevel);
-		if (runVerbose) return runVerbose === "on";
-		if (!sessionKey) return false;
+		if (runVerbose) return runVerbose;
+		if (!sessionKey) return "off";
 		try {
 			const { cfg, entry } = loadSessionEntry(sessionKey);
 			const sessionVerbose = normalizeVerboseLevel(entry?.verboseLevel);
-			if (sessionVerbose) return sessionVerbose === "on";
-			return normalizeVerboseLevel(cfg.agents?.defaults?.verboseDefault) === "on";
+			if (sessionVerbose) return sessionVerbose;
+			return normalizeVerboseLevel(cfg.agents?.defaults?.verboseDefault) ?? "off";
 		} catch {
-			return false;
+			return "off";
 		}
 	};
 	return (evt) => {
@@ -2041,10 +2087,25 @@ function createAgentEventHandler({ broadcast, nodeSendToSession, agentRunSeq, ch
 			sessionKey
 		} : evt;
 		const last = agentRunSeq.get(evt.runId) ?? 0;
-		if (evt.stream === "tool" && !shouldEmitToolEvents(evt.runId, sessionKey)) {
+		const isToolEvent = evt.stream === "tool";
+		const toolVerbose = isToolEvent ? resolveToolVerboseLevel(evt.runId, sessionKey) : "off";
+		if (isToolEvent && toolVerbose === "off") {
 			agentRunSeq.set(evt.runId, evt.seq);
 			return;
 		}
+		const toolPayload = isToolEvent && toolVerbose !== "full" ? (() => {
+			const data = evt.data ? { ...evt.data } : {};
+			delete data.result;
+			delete data.partialResult;
+			return sessionKey ? {
+				...evt,
+				sessionKey,
+				data
+			} : {
+				...evt,
+				data
+			};
+		})() : agentPayload;
 		if (evt.seq !== last + 1) broadcast("agent", {
 			runId: evt.runId,
 			stream: "error",
@@ -2057,10 +2118,13 @@ function createAgentEventHandler({ broadcast, nodeSendToSession, agentRunSeq, ch
 			}
 		});
 		agentRunSeq.set(evt.runId, evt.seq);
-		broadcast("agent", agentPayload);
+		if (isToolEvent) {
+			const recipients = toolEventRecipients.get(evt.runId);
+			if (recipients && recipients.size > 0) broadcastToConnIds("agent", toolPayload, recipients);
+		} else broadcast("agent", agentPayload);
 		const lifecyclePhase = evt.stream === "lifecycle" && typeof evt.data?.phase === "string" ? evt.data.phase : null;
 		if (sessionKey) {
-			nodeSendToSession(sessionKey, "agent", agentPayload);
+			nodeSendToSession(sessionKey, "agent", isToolEvent ? toolPayload : agentPayload);
 			if (!isAborted && evt.stream === "assistant" && typeof evt.data?.text === "string") emitChatDelta(sessionKey, clientRunId, evt.seq, evt.data.text);
 			else if (!isAborted && (lifecyclePhase === "end" || lifecyclePhase === "error")) if (chatLink) {
 				const finished = chatRunState.registry.shift(evt.runId);
@@ -2078,7 +2142,10 @@ function createAgentEventHandler({ broadcast, nodeSendToSession, agentRunSeq, ch
 				if (chatLink) chatRunState.registry.remove(evt.runId, clientRunId, sessionKey);
 			}
 		}
-		if (lifecyclePhase === "end" || lifecyclePhase === "error") clearAgentRunContext(evt.runId);
+		if (lifecyclePhase === "end" || lifecyclePhase === "error") {
+			toolEventRecipients.markFinal(evt.runId);
+			clearAgentRunContext(evt.runId);
+		}
 	};
 }
 
@@ -2578,7 +2645,10 @@ async function runCronIsolatedAgentTurn(params) {
 		model,
 		catalog: await loadCatalog()
 	});
-	if (thinkLevel === "xhigh" && !supportsXHighThinking(provider, model)) throw new Error(`Thinking level "xhigh" is only supported for ${formatXHighModelHint()}.`);
+	if (thinkLevel === "xhigh" && !supportsXHighThinking(provider, model)) {
+		logWarn(`[cron:${params.job.id}] Thinking level "xhigh" is not supported for ${provider}/${model}; downgrading to "high".`);
+		thinkLevel = "high";
+	}
 	const timeoutMs = resolveAgentTimeoutMs({
 		cfg: cfgWithAgentDefaults,
 		overrideSeconds: params.job.payload.kind === "agentTurn" ? params.job.payload.timeoutSeconds : void 0
@@ -2855,7 +2925,8 @@ async function readCronRunLogEntries(filePath, opts) {
 //#region src/cron/schedule.ts
 function computeNextRunAtMs(schedule, nowMs) {
 	if (schedule.kind === "at") {
-		const atMs = parseAbsoluteTimeMs(schedule.at);
+		const sched = schedule;
+		const atMs = typeof sched.atMs === "number" && Number.isFinite(sched.atMs) && sched.atMs > 0 ? sched.atMs : typeof sched.atMs === "string" ? parseAbsoluteTimeMs(sched.atMs) : typeof sched.at === "string" ? parseAbsoluteTimeMs(sched.at) : null;
 		if (atMs === null) return;
 		return atMs > nowMs ? atMs : void 0;
 	}
@@ -2931,7 +3002,8 @@ function computeJobNextRunAtMs(job, nowMs) {
 	if (!job.enabled) return;
 	if (job.schedule.kind === "at") {
 		if (job.state.lastStatus === "ok" && job.state.lastRunAtMs) return;
-		const atMs = parseAbsoluteTimeMs(job.schedule.at);
+		const schedule = job.schedule;
+		const atMs = typeof schedule.atMs === "number" && Number.isFinite(schedule.atMs) && schedule.atMs > 0 ? schedule.atMs : typeof schedule.atMs === "string" ? parseAbsoluteTimeMs(schedule.atMs) : typeof schedule.at === "string" ? parseAbsoluteTimeMs(schedule.at) : null;
 		return atMs !== null ? atMs : void 0;
 	}
 	return computeNextRunAtMs(job.schedule, nowMs);
@@ -3251,10 +3323,6 @@ async function getFileMtimeMs(path) {
 }
 async function ensureLoaded(state, opts) {
 	if (state.store && !opts?.forceReload) return;
-	if (opts?.forceReload && state.store) {
-		const mtime = await getFileMtimeMs(state.deps.storePath);
-		if (mtime !== null && state.storeFileMtimeMs !== null && mtime === state.storeFileMtimeMs) return;
-	}
 	const fileMtimeMs = await getFileMtimeMs(state.deps.storePath);
 	const jobs = (await loadCronStore(state.deps.storePath)).jobs ?? [];
 	let mutated = false;
@@ -3341,7 +3409,7 @@ async function ensureLoaded(state, opts) {
 	};
 	state.storeLoadedAtMs = state.deps.nowMs();
 	state.storeFileMtimeMs = fileMtimeMs;
-	recomputeNextRuns(state);
+	if (!opts?.skipRecompute) recomputeNextRuns(state);
 	if (mutated) await persist(state);
 }
 function warnIfDisabled(state, action) {
@@ -3376,20 +3444,23 @@ function armTimer(state) {
 			state.deps.log.error({ err: String(err) }, "cron: timer tick failed");
 		});
 	}, clampedDelay);
-	state.timer.unref?.();
 }
 async function onTimer(state) {
 	if (state.running) return;
 	state.running = true;
 	try {
 		await locked(state, async () => {
-			await ensureLoaded(state, { forceReload: true });
+			await ensureLoaded(state, {
+				forceReload: true,
+				skipRecompute: true
+			});
 			await runDueJobs(state);
+			recomputeNextRuns(state);
 			await persist(state);
-			armTimer(state);
 		});
 	} finally {
 		state.running = false;
+		armTimer(state);
 	}
 }
 async function runDueJobs(state) {
@@ -4932,7 +5003,7 @@ function timestampOptsFromConfig(cfg) {
 //#endregion
 //#region src/gateway/server-methods/agent.ts
 const agentHandlers = {
-	agent: async ({ params, respond, context }) => {
+	agent: async ({ params, respond, context, client }) => {
 		const p = params;
 		if (!validateAgentParams(p)) {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `invalid agent params: ${formatValidationErrors(validateAgentParams.errors)}`));
@@ -5082,6 +5153,9 @@ const agentHandlers = {
 			registerAgentRunContext(idem, { sessionKey: requestedSessionKey });
 		}
 		const runId = idem;
+		const connId = typeof client?.connId === "string" ? client.connId : void 0;
+		const wantsToolEvents = hasGatewayClientCap(client?.connect?.caps, GATEWAY_CLIENT_CAPS.TOOL_EVENTS);
+		if (connId && wantsToolEvents) context.registerToolEventRecipient(runId, connId);
 		const wantsDelivery = request.deliver === true;
 		const explicitTo = typeof request.replyTo === "string" && request.replyTo.trim() ? request.replyTo.trim() : typeof request.to === "string" && request.to.trim() ? request.to.trim() : void 0;
 		const explicitThreadId = typeof request.threadId === "string" && request.threadId.trim() ? request.threadId.trim() : void 0;
@@ -6036,7 +6110,10 @@ const chatHandlers = {
 			const configured = cfg.agents?.defaults?.thinkingDefault;
 			if (configured) thinkingLevel = configured;
 			else {
-				const { provider, model } = resolveSessionModelRef(cfg, entry);
+				const { provider, model } = resolveSessionModelRef(cfg, entry, resolveSessionAgentId({
+					sessionKey,
+					config: cfg
+				}));
 				thinkingLevel = resolveThinkingDefault({
 					cfg,
 					provider,
@@ -6045,11 +6122,13 @@ const chatHandlers = {
 				});
 			}
 		}
+		const verboseLevel = entry?.verboseLevel ?? cfg.agents?.defaults?.verboseDefault;
 		respond(true, {
 			sessionKey,
 			sessionId,
 			messages: capped,
-			thinkingLevel
+			thinkingLevel,
+			verboseLevel
 		});
 	},
 	"chat.abort": ({ params, respond, context }) => {
@@ -6225,15 +6304,17 @@ const chatHandlers = {
 				SenderUsername: clientInfo?.displayName,
 				GatewayClientScopes: client?.connect?.scopes
 			};
-			const agentId = resolveSessionAgentId({
-				sessionKey: p.sessionKey,
-				config: cfg
+			const { onModelSelected, ...prefixOptions } = createReplyPrefixOptions({
+				cfg,
+				agentId: resolveSessionAgentId({
+					sessionKey: p.sessionKey,
+					config: cfg
+				}),
+				channel: INTERNAL_MESSAGE_CHANNEL
 			});
-			let prefixContext = { identityName: resolveIdentityName(cfg, agentId) };
 			const finalReplyParts = [];
 			const dispatcher = createReplyDispatcher({
-				responsePrefix: resolveEffectiveMessagesConfig(cfg, agentId).responsePrefix,
-				responsePrefixContextProvider: () => prefixContext,
+				...prefixOptions,
 				onError: (err) => {
 					context.logGateway.warn(`webchat dispatch failed: ${formatForLog(err)}`);
 				},
@@ -6254,15 +6335,13 @@ const chatHandlers = {
 					abortSignal: abortController.signal,
 					images: parsedImages.length > 0 ? parsedImages : void 0,
 					disableBlockStreaming: true,
-					onAgentRunStart: () => {
+					onAgentRunStart: (runId) => {
 						agentRunStarted = true;
+						const connId = typeof client?.connId === "string" ? client.connId : void 0;
+						const wantsToolEvents = hasGatewayClientCap(client?.connect?.caps, GATEWAY_CLIENT_CAPS.TOOL_EVENTS);
+						if (connId && wantsToolEvents) context.registerToolEventRecipient(runId, connId);
 					},
-					onModelSelected: (ctx) => {
-						prefixContext.provider = ctx.provider;
-						prefixContext.model = extractShortModelName(ctx.model);
-						prefixContext.modelFull = `${ctx.provider}/${ctx.model}`;
-						prefixContext.thinkingLevel = ctx.thinkLevel ?? "off";
-					}
+					onModelSelected
 				}
 			}).then(() => {
 				if (!agentRunStarted) {
@@ -6436,6 +6515,123 @@ function applyMergePatch(base, patch) {
 	return result;
 }
 
+//#endregion
+//#region src/config/redact-snapshot.ts
+/**
+* Sentinel value used to replace sensitive config fields in gateway responses.
+* Write-side handlers (config.set, config.apply, config.patch) detect this
+* sentinel and restore the original value from the on-disk config, so a
+* round-trip through the Web UI does not corrupt credentials.
+*/
+const REDACTED_SENTINEL = "__OPENCLAW_REDACTED__";
+/**
+* Patterns that identify sensitive config field names.
+* Aligned with the UI-hint logic in schema.ts.
+*/
+const SENSITIVE_KEY_PATTERNS = [
+	/token/i,
+	/password/i,
+	/secret/i,
+	/api.?key/i
+];
+function isSensitiveKey(key) {
+	return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+/**
+* Deep-walk an object and replace values whose key matches a sensitive pattern
+* with the redaction sentinel.
+*/
+function redactObject(obj) {
+	if (obj === null || obj === void 0) return obj;
+	if (typeof obj !== "object") return obj;
+	if (Array.isArray(obj)) return obj.map(redactObject);
+	const result = {};
+	for (const [key, value] of Object.entries(obj)) if (isSensitiveKey(key) && value !== null && value !== void 0) result[key] = REDACTED_SENTINEL;
+	else if (typeof value === "object" && value !== null) result[key] = redactObject(value);
+	else result[key] = value;
+	return result;
+}
+function redactConfigObject(value) {
+	return redactObject(value);
+}
+/**
+* Collect all sensitive string values from a config object.
+* Used for text-based redaction of the raw JSON5 source.
+*/
+function collectSensitiveValues(obj) {
+	const values = [];
+	if (obj === null || obj === void 0 || typeof obj !== "object") return values;
+	if (Array.isArray(obj)) {
+		for (const item of obj) values.push(...collectSensitiveValues(item));
+		return values;
+	}
+	for (const [key, value] of Object.entries(obj)) if (isSensitiveKey(key) && typeof value === "string" && value.length > 0) values.push(value);
+	else if (typeof value === "object" && value !== null) values.push(...collectSensitiveValues(value));
+	return values;
+}
+/**
+* Replace known sensitive values in a raw JSON5 string with the sentinel.
+* Values are replaced longest-first to avoid partial matches.
+*/
+function redactRawText(raw, config) {
+	const sensitiveValues = collectSensitiveValues(config);
+	sensitiveValues.sort((a, b) => b.length - a.length);
+	let result = raw;
+	for (const value of sensitiveValues) {
+		const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		result = result.replace(new RegExp(escaped, "g"), REDACTED_SENTINEL);
+	}
+	result = result.replace(/(^|[{\s,])((["'])([^"']+)\3|([A-Za-z0-9_$.-]+))(\s*:\s*)(["'])([^"']*)\7/g, (match, prefix, keyExpr, _keyQuote, keyQuoted, keyBare, sep, valQuote, val) => {
+		const key = keyQuoted ?? keyBare;
+		if (!key || !isSensitiveKey(key)) return match;
+		if (val === REDACTED_SENTINEL) return match;
+		return `${prefix}${keyExpr}${sep}${valQuote}${REDACTED_SENTINEL}${valQuote}`;
+	});
+	return result;
+}
+/**
+* Returns a copy of the config snapshot with all sensitive fields
+* replaced by {@link REDACTED_SENTINEL}. The `hash` is preserved
+* (it tracks config identity, not content).
+*
+* Both `config` (the parsed object) and `raw` (the JSON5 source) are scrubbed
+* so no credential can leak through either path.
+*/
+function redactConfigSnapshot(snapshot) {
+	const redactedConfig = redactConfigObject(snapshot.config);
+	const redactedRaw = snapshot.raw ? redactRawText(snapshot.raw, snapshot.config) : null;
+	const redactedParsed = snapshot.parsed ? redactConfigObject(snapshot.parsed) : snapshot.parsed;
+	return {
+		...snapshot,
+		config: redactedConfig,
+		raw: redactedRaw,
+		parsed: redactedParsed
+	};
+}
+/**
+* Deep-walk `incoming` and replace any {@link REDACTED_SENTINEL} values
+* (on sensitive keys) with the corresponding value from `original`.
+*
+* This is called by config.set / config.apply / config.patch before writing,
+* so that credentials survive a Web UI round-trip unmodified.
+*/
+function restoreRedactedValues(incoming, original) {
+	if (incoming === null || incoming === void 0) return incoming;
+	if (typeof incoming !== "object") return incoming;
+	if (Array.isArray(incoming)) {
+		const origArr = Array.isArray(original) ? original : [];
+		return incoming.map((item, i) => restoreRedactedValues(item, origArr[i]));
+	}
+	const orig = original && typeof original === "object" && !Array.isArray(original) ? original : {};
+	const result = {};
+	for (const [key, value] of Object.entries(incoming)) if (isSensitiveKey(key) && value === REDACTED_SENTINEL) {
+		if (!(key in orig)) throw new Error(`config write rejected: "${key}" is redacted; set an explicit value instead of ${REDACTED_SENTINEL}`);
+		result[key] = orig[key];
+	} else if (typeof value === "object" && value !== null) result[key] = restoreRedactedValues(value, orig[key]);
+	else result[key] = value;
+	return result;
+}
+
 //#endregion
 //#region src/config/schema.ts
 const GROUP_LABELS = {
@@ -6690,6 +6886,7 @@ const FIELD_LABELS = {
 	"commands.debug": "Allow /debug",
 	"commands.restart": "Allow Restart",
 	"commands.useAccessGroups": "Use Access Groups",
+	"commands.ownerAllowFrom": "Command Owners",
 	"ui.seamColor": "Accent Color",
 	"ui.assistant.name": "Assistant Name",
 	"ui.assistant.avatar": "Assistant Avatar",
@@ -6952,6 +7149,7 @@ const FIELD_HELP = {
 	"commands.debug": "Allow /debug chat command for runtime-only overrides (default: false).",
 	"commands.restart": "Allow /restart and gateway restart tool actions (default: false).",
 	"commands.useAccessGroups": "Enforce access-group allowlists/policies for commands.",
+	"commands.ownerAllowFrom": "Explicit owner allowlist for owner-only tools/commands. Use channel-native IDs (optionally prefixed like \"whatsapp:+15551234567\"). '*' is ignored.",
 	"session.dmScope": "DM session scoping: \"main\" keeps continuity; \"per-peer\", \"per-channel-peer\", or \"per-account-channel-peer\" isolates DM history (recommended for shared inboxes/multi-account).",
 	"session.identityLinks": "Map canonical identities to provider-prefixed peer IDs for DM session linking (example: telegram:123456).",
 	"channels.telegram.configWrites": "Allow Telegram to write config in response to channel events/commands (default: true).",
@@ -7292,7 +7490,7 @@ const configHandlers = {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `invalid config.get params: ${formatValidationErrors(validateConfigGetParams.errors)}`));
 			return;
 		}
-		respond(true, await readConfigFileSnapshot(), void 0);
+		respond(true, redactConfigSnapshot(await readConfigFileSnapshot()), void 0);
 	},
 	"config.schema": ({ params, respond }) => {
 		if (!validateConfigSchemaParams(params)) {
@@ -7331,7 +7529,8 @@ const configHandlers = {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `invalid config.set params: ${formatValidationErrors(validateConfigSetParams.errors)}`));
 			return;
 		}
-		if (!requireConfigBaseHash(params, await readConfigFileSnapshot(), respond)) return;
+		const snapshot = await readConfigFileSnapshot();
+		if (!requireConfigBaseHash(params, snapshot, respond)) return;
 		const rawValue = params.raw;
 		if (typeof rawValue !== "string") {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid config.set params: raw (string) required"));
@@ -7347,11 +7546,18 @@ const configHandlers = {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid config", { details: { issues: validated.issues } }));
 			return;
 		}
-		await writeConfigFile(validated.config);
+		let restored;
+		try {
+			restored = restoreRedactedValues(validated.config, snapshot.config);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, String(err instanceof Error ? err.message : err)));
+			return;
+		}
+		await writeConfigFile(restored);
 		respond(true, {
 			ok: true,
 			path: CONFIG_PATH,
-			config: validated.config
+			config: redactConfigObject(restored)
 		}, void 0);
 	},
 	"config.patch": async ({ params, respond }) => {
@@ -7380,7 +7586,14 @@ const configHandlers = {
 			return;
 		}
 		const merged = applyMergePatch(snapshot.config, parsedRes.parsed);
-		const validated = validateConfigObjectWithPlugins(applyLegacyMigrations(merged).next ?? merged);
+		let restoredMerge;
+		try {
+			restoredMerge = restoreRedactedValues(merged, snapshot.config);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, String(err instanceof Error ? err.message : err)));
+			return;
+		}
+		const validated = validateConfigObjectWithPlugins(applyLegacyMigrations(restoredMerge).next ?? restoredMerge);
 		if (!validated.ok) {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid config", { details: { issues: validated.issues } }));
 			return;
@@ -7415,7 +7628,7 @@ const configHandlers = {
 		respond(true, {
 			ok: true,
 			path: CONFIG_PATH,
-			config: validated.config,
+			config: redactConfigObject(validated.config),
 			restart,
 			sentinel: {
 				path: sentinelPath,
@@ -7428,7 +7641,8 @@ const configHandlers = {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `invalid config.apply params: ${formatValidationErrors(validateConfigApplyParams.errors)}`));
 			return;
 		}
-		if (!requireConfigBaseHash(params, await readConfigFileSnapshot(), respond)) return;
+		const snapshot = await readConfigFileSnapshot();
+		if (!requireConfigBaseHash(params, snapshot, respond)) return;
 		const rawValue = params.raw;
 		if (typeof rawValue !== "string") {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid config.apply params: raw (string) required"));
@@ -7444,7 +7658,14 @@ const configHandlers = {
 			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid config", { details: { issues: validated.issues } }));
 			return;
 		}
-		await writeConfigFile(validated.config);
+		let restoredApply;
+		try {
+			restoredApply = restoreRedactedValues(validated.config, snapshot.config);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, String(err instanceof Error ? err.message : err)));
+			return;
+		}
+		await writeConfigFile(restoredApply);
 		const sessionKey = typeof params.sessionKey === "string" ? params.sessionKey?.trim() || void 0 : void 0;
 		const note = typeof params.note === "string" ? params.note?.trim() || void 0 : void 0;
 		const restartDelayMsRaw = params.restartDelayMs;
@@ -7474,7 +7695,7 @@ const configHandlers = {
 		respond(true, {
 			ok: true,
 			path: CONFIG_PATH,
-			config: validated.config,
+			config: redactConfigObject(restoredApply),
 			restart,
 			sentinel: {
 				path: sentinelPath,
@@ -8774,7 +8995,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-IMwI538C.js");
+			const { handleNodeEvent } = await import("./server-node-events-BR2vHqf6.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -9074,6 +9295,10 @@ function normalizeExecAsk(raw) {
 async function applySessionsPatchToStore(params) {
 	const { cfg, store, storeKey, patch } = params;
 	const now = Date.now();
+	const resolvedDefault = resolveDefaultModelForAgent({
+		cfg,
+		agentId: normalizeAgentId(parseAgentSessionKey(storeKey)?.agentId ?? resolveDefaultAgentId(cfg))
+	});
 	const existing = store[storeKey];
 	const next = existing ? {
 		...existing,
@@ -9112,14 +9337,7 @@ async function applySessionsPatchToStore(params) {
 		if (raw === null) delete next.thinkingLevel;
 		else if (raw !== void 0) {
 			const normalized = normalizeThinkLevel(String(raw));
-			if (!normalized) {
-				const resolvedDefault = resolveConfiguredModelRef({
-					cfg,
-					defaultProvider: DEFAULT_PROVIDER,
-					defaultModel: DEFAULT_MODEL
-				});
-				return invalid(`invalid thinkingLevel (use ${formatThinkingLevels(existing?.providerOverride?.trim() || resolvedDefault.provider, existing?.modelOverride?.trim() || resolvedDefault.model, "|")})`);
-			}
+			if (!normalized) return invalid(`invalid thinkingLevel (use ${formatThinkingLevels(existing?.providerOverride?.trim() || resolvedDefault.provider, existing?.modelOverride?.trim() || resolvedDefault.model, "|")})`);
 			if (normalized === "off") delete next.thinkingLevel;
 			else next.thinkingLevel = normalized;
 		}
@@ -9197,11 +9415,6 @@ async function applySessionsPatchToStore(params) {
 	}
 	if ("model" in patch) {
 		const raw = patch.model;
-		const resolvedDefault = resolveConfiguredModelRef({
-			cfg,
-			defaultProvider: DEFAULT_PROVIDER,
-			defaultModel: DEFAULT_MODEL
-		});
 		if (raw === null) applyModelOverrideToSessionEntry({
 			entry: next,
 			selection: {
@@ -9237,11 +9450,6 @@ async function applySessionsPatchToStore(params) {
 		}
 	}
 	if (next.thinkingLevel === "xhigh") {
-		const resolvedDefault = resolveConfiguredModelRef({
-			cfg,
-			defaultProvider: DEFAULT_PROVIDER,
-			defaultModel: DEFAULT_MODEL
-		});
 		if (!supportsXHighThinking(next.providerOverride ?? resolvedDefault.provider, next.modelOverride ?? resolvedDefault.model)) {
 			if ("thinkingLevel" in patch) return invalid(`thinkingLevel "xhigh" is only supported for ${formatXHighModelHint()}`);
 			next.thinkingLevel = "high";
@@ -9501,11 +9709,17 @@ const sessionsHandlers = {
 			respond(false, void 0, applied.error);
 			return;
 		}
+		const agentId = normalizeAgentId(parseAgentSessionKey(target.canonicalKey ?? key)?.agentId ?? resolveDefaultAgentId(cfg));
+		const resolved = resolveSessionModelRef(cfg, applied.entry, agentId);
 		respond(true, {
 			ok: true,
 			path: storePath,
 			key: target.canonicalKey,
-			entry: applied.entry
+			entry: applied.entry,
+			resolved: {
+				modelProvider: resolved.provider,
+				model: resolved.model
+			}
 		}, void 0);
 	},
 	"sessions.reset": async ({ params, respond }) => {
@@ -10159,18 +10373,54 @@ const updateHandlers = { "update.run": async ({ params, respond }) => {
 //#region src/gateway/server-methods/usage.ts
 const COST_USAGE_CACHE_TTL_MS = 3e4;
 const costUsageCache = /* @__PURE__ */ new Map();
+/**
+* Parse a date string (YYYY-MM-DD) to start of day timestamp in UTC.
+* Returns undefined if invalid.
+*/
+const parseDateToMs = (raw) => {
+	if (typeof raw !== "string" || !raw.trim()) return;
+	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(raw.trim());
+	if (!match) return;
+	const [, year, month, day] = match;
+	const ms = Date.UTC(parseInt(year), parseInt(month) - 1, parseInt(day));
+	if (Number.isNaN(ms)) return;
+	return ms;
+};
 const parseDays = (raw) => {
 	if (typeof raw === "number" && Number.isFinite(raw)) return Math.floor(raw);
 	if (typeof raw === "string" && raw.trim() !== "") {
 		const parsed = Number(raw);
 		if (Number.isFinite(parsed)) return Math.floor(parsed);
 	}
-	return 30;
+};
+/**
+* Get date range from params (startDate/endDate or days).
+* Falls back to last 30 days if not provided.
+*/
+const parseDateRange = (params) => {
+	const now = /* @__PURE__ */ new Date();
+	const todayStartMs = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+	const todayEndMs = todayStartMs + 1440 * 60 * 1e3 - 1;
+	const startMs = parseDateToMs(params.startDate);
+	const endMs = parseDateToMs(params.endDate);
+	if (startMs !== void 0 && endMs !== void 0) return {
+		startMs,
+		endMs: endMs + 1440 * 60 * 1e3 - 1
+	};
+	const days = parseDays(params.days);
+	if (days !== void 0) return {
+		startMs: todayStartMs - (Math.max(1, days) - 1) * 24 * 60 * 60 * 1e3,
+		endMs: todayEndMs
+	};
+	return {
+		startMs: todayStartMs - 696 * 60 * 60 * 1e3,
+		endMs: todayEndMs
+	};
 };
 async function loadCostUsageSummaryCached(params) {
-	const days = Math.max(1, params.days);
+	const cacheKey = `${params.startMs}-${params.endMs}`;
 	const now = Date.now();
-	const cached = costUsageCache.get(days);
+	const cached = costUsageCache.get(cacheKey);
 	if (cached?.summary && cached.updatedAt && now - cached.updatedAt < COST_USAGE_CACHE_TTL_MS) return cached.summary;
 	if (cached?.inFlight) {
 		if (cached.summary) return cached.summary;
@@ -10178,10 +10428,11 @@ async function loadCostUsageSummaryCached(params) {
 	}
 	const entry = cached ?? {};
 	const inFlight = loadCostUsageSummary({
-		days,
+		startMs: params.startMs,
+		endMs: params.endMs,
 		config: params.config
 	}).then((summary) => {
-		costUsageCache.set(days, {
+		costUsageCache.set(cacheKey, {
 			summary,
 			updatedAt: Date.now()
 		});
@@ -10190,14 +10441,14 @@ async function loadCostUsageSummaryCached(params) {
 		if (entry.summary) return entry.summary;
 		throw err;
 	}).finally(() => {
-		const current = costUsageCache.get(days);
+		const current = costUsageCache.get(cacheKey);
 		if (current?.inFlight === inFlight) {
 			current.inFlight = void 0;
-			costUsageCache.set(days, current);
+			costUsageCache.set(cacheKey, current);
 		}
 	});
 	entry.inFlight = inFlight;
-	costUsageCache.set(days, entry);
+	costUsageCache.set(cacheKey, entry);
 	if (entry.summary) return entry.summary;
 	return await inFlight;
 }
@@ -10207,10 +10458,395 @@ const usageHandlers = {
 	},
 	"usage.cost": async ({ respond, params }) => {
 		const config = loadConfig();
+		const { startMs, endMs } = parseDateRange({
+			startDate: params?.startDate,
+			endDate: params?.endDate,
+			days: params?.days
+		});
 		respond(true, await loadCostUsageSummaryCached({
-			days: parseDays(params?.days),
+			startMs,
+			endMs,
 			config
 		}), void 0);
+	},
+	"sessions.usage": async ({ respond, params }) => {
+		if (!validateSessionsUsageParams(params)) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `invalid sessions.usage params: ${formatValidationErrors(validateSessionsUsageParams.errors)}`));
+			return;
+		}
+		const p = params;
+		const config = loadConfig();
+		const { startMs, endMs } = parseDateRange({
+			startDate: p.startDate,
+			endDate: p.endDate
+		});
+		const limit = typeof p.limit === "number" && Number.isFinite(p.limit) ? p.limit : 50;
+		const includeContextWeight = p.includeContextWeight ?? false;
+		const specificKey = typeof p.key === "string" ? p.key.trim() : null;
+		const { store } = loadCombinedSessionStoreForGateway(config);
+		const now = Date.now();
+		const mergedEntries = [];
+		if (specificKey) {
+			const storeEntry = store[specificKey];
+			let sessionId = storeEntry?.sessionId ?? specificKey;
+			const sessionFile = resolveSessionFilePath(sessionId, storeEntry);
+			try {
+				const stats = fs.statSync(sessionFile);
+				if (stats.isFile()) mergedEntries.push({
+					key: specificKey,
+					sessionId,
+					sessionFile,
+					label: storeEntry?.label,
+					updatedAt: storeEntry?.updatedAt ?? stats.mtimeMs,
+					storeEntry
+				});
+			} catch {}
+		} else {
+			const discoveredSessions = await discoverAllSessions({
+				startMs,
+				endMs
+			});
+			const storeBySessionId = /* @__PURE__ */ new Map();
+			for (const [key, entry] of Object.entries(store)) if (entry?.sessionId) storeBySessionId.set(entry.sessionId, {
+				key,
+				entry
+			});
+			for (const discovered of discoveredSessions) {
+				const storeMatch = storeBySessionId.get(discovered.sessionId);
+				if (storeMatch) mergedEntries.push({
+					key: storeMatch.key,
+					sessionId: discovered.sessionId,
+					sessionFile: discovered.sessionFile,
+					label: storeMatch.entry.label,
+					updatedAt: storeMatch.entry.updatedAt ?? discovered.mtime,
+					storeEntry: storeMatch.entry
+				});
+				else mergedEntries.push({
+					key: discovered.sessionId,
+					sessionId: discovered.sessionId,
+					sessionFile: discovered.sessionFile,
+					label: void 0,
+					updatedAt: discovered.mtime
+				});
+			}
+		}
+		mergedEntries.sort((a, b) => b.updatedAt - a.updatedAt);
+		const limitedEntries = mergedEntries.slice(0, limit);
+		const sessions = [];
+		const aggregateTotals = {
+			input: 0,
+			output: 0,
+			cacheRead: 0,
+			cacheWrite: 0,
+			totalTokens: 0,
+			totalCost: 0,
+			inputCost: 0,
+			outputCost: 0,
+			cacheReadCost: 0,
+			cacheWriteCost: 0,
+			missingCostEntries: 0
+		};
+		const aggregateMessages = {
+			total: 0,
+			user: 0,
+			assistant: 0,
+			toolCalls: 0,
+			toolResults: 0,
+			errors: 0
+		};
+		const toolAggregateMap = /* @__PURE__ */ new Map();
+		const byModelMap = /* @__PURE__ */ new Map();
+		const byProviderMap = /* @__PURE__ */ new Map();
+		const byAgentMap = /* @__PURE__ */ new Map();
+		const byChannelMap = /* @__PURE__ */ new Map();
+		const dailyAggregateMap = /* @__PURE__ */ new Map();
+		const latencyTotals = {
+			count: 0,
+			sum: 0,
+			min: Number.POSITIVE_INFINITY,
+			max: 0,
+			p95Max: 0
+		};
+		const dailyLatencyMap = /* @__PURE__ */ new Map();
+		const modelDailyMap = /* @__PURE__ */ new Map();
+		const emptyTotals = () => ({
+			input: 0,
+			output: 0,
+			cacheRead: 0,
+			cacheWrite: 0,
+			totalTokens: 0,
+			totalCost: 0,
+			inputCost: 0,
+			outputCost: 0,
+			cacheReadCost: 0,
+			cacheWriteCost: 0,
+			missingCostEntries: 0
+		});
+		const mergeTotals = (target, source) => {
+			target.input += source.input;
+			target.output += source.output;
+			target.cacheRead += source.cacheRead;
+			target.cacheWrite += source.cacheWrite;
+			target.totalTokens += source.totalTokens;
+			target.totalCost += source.totalCost;
+			target.inputCost += source.inputCost;
+			target.outputCost += source.outputCost;
+			target.cacheReadCost += source.cacheReadCost;
+			target.cacheWriteCost += source.cacheWriteCost;
+			target.missingCostEntries += source.missingCostEntries;
+		};
+		for (const merged of limitedEntries) {
+			const usage = await loadSessionCostSummary({
+				sessionId: merged.sessionId,
+				sessionEntry: merged.storeEntry,
+				sessionFile: merged.sessionFile,
+				config,
+				startMs,
+				endMs
+			});
+			if (usage) {
+				aggregateTotals.input += usage.input;
+				aggregateTotals.output += usage.output;
+				aggregateTotals.cacheRead += usage.cacheRead;
+				aggregateTotals.cacheWrite += usage.cacheWrite;
+				aggregateTotals.totalTokens += usage.totalTokens;
+				aggregateTotals.totalCost += usage.totalCost;
+				aggregateTotals.inputCost += usage.inputCost;
+				aggregateTotals.outputCost += usage.outputCost;
+				aggregateTotals.cacheReadCost += usage.cacheReadCost;
+				aggregateTotals.cacheWriteCost += usage.cacheWriteCost;
+				aggregateTotals.missingCostEntries += usage.missingCostEntries;
+			}
+			const agentId = parseAgentSessionKey(merged.key)?.agentId;
+			const channel = merged.storeEntry?.channel ?? merged.storeEntry?.origin?.provider;
+			const chatType = merged.storeEntry?.chatType ?? merged.storeEntry?.origin?.chatType;
+			if (usage) {
+				if (usage.messageCounts) {
+					aggregateMessages.total += usage.messageCounts.total;
+					aggregateMessages.user += usage.messageCounts.user;
+					aggregateMessages.assistant += usage.messageCounts.assistant;
+					aggregateMessages.toolCalls += usage.messageCounts.toolCalls;
+					aggregateMessages.toolResults += usage.messageCounts.toolResults;
+					aggregateMessages.errors += usage.messageCounts.errors;
+				}
+				if (usage.toolUsage) for (const tool of usage.toolUsage.tools) toolAggregateMap.set(tool.name, (toolAggregateMap.get(tool.name) ?? 0) + tool.count);
+				if (usage.modelUsage) for (const entry of usage.modelUsage) {
+					const modelKey = `${entry.provider ?? "unknown"}::${entry.model ?? "unknown"}`;
+					const modelExisting = byModelMap.get(modelKey) ?? {
+						provider: entry.provider,
+						model: entry.model,
+						count: 0,
+						totals: emptyTotals()
+					};
+					modelExisting.count += entry.count;
+					mergeTotals(modelExisting.totals, entry.totals);
+					byModelMap.set(modelKey, modelExisting);
+					const providerKey = entry.provider ?? "unknown";
+					const providerExisting = byProviderMap.get(providerKey) ?? {
+						provider: entry.provider,
+						model: void 0,
+						count: 0,
+						totals: emptyTotals()
+					};
+					providerExisting.count += entry.count;
+					mergeTotals(providerExisting.totals, entry.totals);
+					byProviderMap.set(providerKey, providerExisting);
+				}
+				if (usage.latency) {
+					const { count, avgMs, minMs, maxMs, p95Ms } = usage.latency;
+					if (count > 0) {
+						latencyTotals.count += count;
+						latencyTotals.sum += avgMs * count;
+						latencyTotals.min = Math.min(latencyTotals.min, minMs);
+						latencyTotals.max = Math.max(latencyTotals.max, maxMs);
+						latencyTotals.p95Max = Math.max(latencyTotals.p95Max, p95Ms);
+					}
+				}
+				if (usage.dailyLatency) for (const day of usage.dailyLatency) {
+					const existing = dailyLatencyMap.get(day.date) ?? {
+						date: day.date,
+						count: 0,
+						sum: 0,
+						min: Number.POSITIVE_INFINITY,
+						max: 0,
+						p95Max: 0
+					};
+					existing.count += day.count;
+					existing.sum += day.avgMs * day.count;
+					existing.min = Math.min(existing.min, day.minMs);
+					existing.max = Math.max(existing.max, day.maxMs);
+					existing.p95Max = Math.max(existing.p95Max, day.p95Ms);
+					dailyLatencyMap.set(day.date, existing);
+				}
+				if (usage.dailyModelUsage) for (const entry of usage.dailyModelUsage) {
+					const key = `${entry.date}::${entry.provider ?? "unknown"}::${entry.model ?? "unknown"}`;
+					const existing = modelDailyMap.get(key) ?? {
+						date: entry.date,
+						provider: entry.provider,
+						model: entry.model,
+						tokens: 0,
+						cost: 0,
+						count: 0
+					};
+					existing.tokens += entry.tokens;
+					existing.cost += entry.cost;
+					existing.count += entry.count;
+					modelDailyMap.set(key, existing);
+				}
+				if (agentId) {
+					const agentTotals = byAgentMap.get(agentId) ?? emptyTotals();
+					mergeTotals(agentTotals, usage);
+					byAgentMap.set(agentId, agentTotals);
+				}
+				if (channel) {
+					const channelTotals = byChannelMap.get(channel) ?? emptyTotals();
+					mergeTotals(channelTotals, usage);
+					byChannelMap.set(channel, channelTotals);
+				}
+				if (usage.dailyBreakdown) for (const day of usage.dailyBreakdown) {
+					const daily = dailyAggregateMap.get(day.date) ?? {
+						date: day.date,
+						tokens: 0,
+						cost: 0,
+						messages: 0,
+						toolCalls: 0,
+						errors: 0
+					};
+					daily.tokens += day.tokens;
+					daily.cost += day.cost;
+					dailyAggregateMap.set(day.date, daily);
+				}
+				if (usage.dailyMessageCounts) for (const day of usage.dailyMessageCounts) {
+					const daily = dailyAggregateMap.get(day.date) ?? {
+						date: day.date,
+						tokens: 0,
+						cost: 0,
+						messages: 0,
+						toolCalls: 0,
+						errors: 0
+					};
+					daily.messages += day.total;
+					daily.toolCalls += day.toolCalls;
+					daily.errors += day.errors;
+					dailyAggregateMap.set(day.date, daily);
+				}
+			}
+			sessions.push({
+				key: merged.key,
+				label: merged.label,
+				sessionId: merged.sessionId,
+				updatedAt: merged.updatedAt,
+				agentId,
+				channel,
+				chatType,
+				origin: merged.storeEntry?.origin,
+				modelOverride: merged.storeEntry?.modelOverride,
+				providerOverride: merged.storeEntry?.providerOverride,
+				modelProvider: merged.storeEntry?.modelProvider,
+				model: merged.storeEntry?.model,
+				usage,
+				contextWeight: includeContextWeight ? merged.storeEntry?.systemPromptReport ?? null : void 0
+			});
+		}
+		const formatDateStr = (ms) => {
+			const d = new Date(ms);
+			return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}-${String(d.getUTCDate()).padStart(2, "0")}`;
+		};
+		const aggregates = {
+			messages: aggregateMessages,
+			tools: {
+				totalCalls: Array.from(toolAggregateMap.values()).reduce((sum, count) => sum + count, 0),
+				uniqueTools: toolAggregateMap.size,
+				tools: Array.from(toolAggregateMap.entries()).map(([name, count]) => ({
+					name,
+					count
+				})).toSorted((a, b) => b.count - a.count)
+			},
+			byModel: Array.from(byModelMap.values()).toSorted((a, b) => {
+				const costDiff = b.totals.totalCost - a.totals.totalCost;
+				if (costDiff !== 0) return costDiff;
+				return b.totals.totalTokens - a.totals.totalTokens;
+			}),
+			byProvider: Array.from(byProviderMap.values()).toSorted((a, b) => {
+				const costDiff = b.totals.totalCost - a.totals.totalCost;
+				if (costDiff !== 0) return costDiff;
+				return b.totals.totalTokens - a.totals.totalTokens;
+			}),
+			byAgent: Array.from(byAgentMap.entries()).map(([id, totals]) => ({
+				agentId: id,
+				totals
+			})).toSorted((a, b) => b.totals.totalCost - a.totals.totalCost),
+			byChannel: Array.from(byChannelMap.entries()).map(([name, totals]) => ({
+				channel: name,
+				totals
+			})).toSorted((a, b) => b.totals.totalCost - a.totals.totalCost),
+			latency: latencyTotals.count > 0 ? {
+				count: latencyTotals.count,
+				avgMs: latencyTotals.sum / latencyTotals.count,
+				minMs: latencyTotals.min === Number.POSITIVE_INFINITY ? 0 : latencyTotals.min,
+				maxMs: latencyTotals.max,
+				p95Ms: latencyTotals.p95Max
+			} : void 0,
+			dailyLatency: Array.from(dailyLatencyMap.values()).map((entry) => ({
+				date: entry.date,
+				count: entry.count,
+				avgMs: entry.count ? entry.sum / entry.count : 0,
+				minMs: entry.min === Number.POSITIVE_INFINITY ? 0 : entry.min,
+				maxMs: entry.max,
+				p95Ms: entry.p95Max
+			})).toSorted((a, b) => a.date.localeCompare(b.date)),
+			modelDaily: Array.from(modelDailyMap.values()).toSorted((a, b) => a.date.localeCompare(b.date) || b.cost - a.cost),
+			daily: Array.from(dailyAggregateMap.values()).toSorted((a, b) => a.date.localeCompare(b.date))
+		};
+		respond(true, {
+			updatedAt: now,
+			startDate: formatDateStr(startMs),
+			endDate: formatDateStr(endMs),
+			sessions,
+			totals: aggregateTotals,
+			aggregates
+		}, void 0);
+	},
+	"sessions.usage.timeseries": async ({ respond, params }) => {
+		const key = typeof params?.key === "string" ? params.key.trim() : null;
+		if (!key) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "key is required for timeseries"));
+			return;
+		}
+		const config = loadConfig();
+		const { entry } = loadSessionEntry(key);
+		const timeseries = await loadSessionUsageTimeSeries({
+			sessionId: entry?.sessionId ?? key,
+			sessionEntry: entry,
+			sessionFile: entry?.sessionFile ?? resolveSessionFilePath(key),
+			config,
+			maxPoints: 200
+		});
+		if (!timeseries) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `No transcript found for session: ${key}`));
+			return;
+		}
+		respond(true, timeseries, void 0);
+	},
+	"sessions.usage.logs": async ({ respond, params }) => {
+		const key = typeof params?.key === "string" ? params.key.trim() : null;
+		if (!key) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "key is required for logs"));
+			return;
+		}
+		const limit = typeof params?.limit === "number" && Number.isFinite(params.limit) ? Math.min(params.limit, 1e3) : 200;
+		const config = loadConfig();
+		const { entry } = loadSessionEntry(key);
+		const sessionId = entry?.sessionId ?? key;
+		const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(key);
+		const { loadSessionLogs } = await import("./session-cost-usage-BTXosU1k.js").then((n) => n.a);
+		respond(true, { logs: await loadSessionLogs({
+			sessionId,
+			sessionEntry: entry,
+			sessionFile,
+			config,
+			limit
+		}) ?? [] }, void 0);
 	}
 };
 
@@ -11210,29 +11846,14 @@ function resolveHooksConfig(cfg) {
 		mappings: resolveHookMappings(cfg.hooks)
 	};
 }
-function extractHookToken(req, url) {
+function extractHookToken(req) {
 	const auth = typeof req.headers.authorization === "string" ? req.headers.authorization.trim() : "";
 	if (auth.toLowerCase().startsWith("bearer ")) {
 		const token = auth.slice(7).trim();
-		if (token) return {
-			token,
-			fromQuery: false
-		};
+		if (token) return token;
 	}
 	const headerToken = typeof req.headers["x-openclaw-token"] === "string" ? req.headers["x-openclaw-token"].trim() : "";
-	if (headerToken) return {
-		token: headerToken,
-		fromQuery: false
-	};
-	const queryToken = url.searchParams.get("token");
-	if (queryToken) return {
-		token: queryToken.trim(),
-		fromQuery: true
-	};
-	return {
-		token: void 0,
-		fromQuery: false
-	};
+	if (headerToken) return headerToken;
 }
 async function readJsonBody(req, maxBytes) {
 	return await new Promise((resolve) => {
@@ -11370,7 +11991,7 @@ function normalizeAgentPayload(payload, opts) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.OPENCLAW_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.OPENCLAW_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./control-service-DsUyuevF.js");
+	const mod = override ? await import(override) : await import("./control-service-D2E9NKqQ.js").then((n) => n.t);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -12038,8 +12659,8 @@ function hasEventScope(client, event) {
 }
 function createGatewayBroadcaster(params) {
 	let seq = 0;
-	const broadcast = (event, payload, opts) => {
-		const eventSeq = ++seq;
+	const broadcastInternal = (event, payload, opts, targetConnIds) => {
+		const eventSeq = Boolean(targetConnIds) ? void 0 : ++seq;
 		const frame = JSON.stringify({
 			type: "event",
 			event,
@@ -12049,8 +12670,9 @@ function createGatewayBroadcaster(params) {
 		});
 		const logMeta = {
 			event,
-			seq: eventSeq,
+			seq: eventSeq ?? "targeted",
 			clients: params.clients.size,
+			targets: targetConnIds ? targetConnIds.size : void 0,
 			dropIfSlow: opts?.dropIfSlow,
 			presenceVersion: opts?.stateVersion?.presence,
 			healthVersion: opts?.stateVersion?.health
@@ -12058,6 +12680,7 @@ function createGatewayBroadcaster(params) {
 		if (event === "agent") Object.assign(logMeta, summarizeAgentEventForWsLog(payload));
 		logWs("out", "event", logMeta);
 		for (const c of params.clients) {
+			if (targetConnIds && !targetConnIds.has(c.connId)) continue;
 			if (!hasEventScope(c, event)) continue;
 			const slow = c.socket.bufferedAmount > MAX_BUFFERED_BYTES;
 			if (slow && opts?.dropIfSlow) continue;
@@ -12072,7 +12695,15 @@ function createGatewayBroadcaster(params) {
 			} catch {}
 		}
 	};
-	return { broadcast };
+	const broadcast = (event, payload, opts) => broadcastInternal(event, payload, opts);
+	const broadcastToConnIds = (event, payload, connIds, opts) => {
+		if (connIds.size === 0) return;
+		broadcastInternal(event, payload, opts, connIds);
+	};
+	return {
+		broadcast,
+		broadcastToConnIds
+	};
 }
 
 //#endregion
@@ -13812,6 +14443,40 @@ function sendJson(res, status, body) {
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
 	res.end(JSON.stringify(body));
 }
+function isCanvasPath(pathname) {
+	return pathname === A2UI_PATH || pathname.startsWith(`${A2UI_PATH}/`) || pathname === CANVAS_HOST_PATH || pathname.startsWith(`${CANVAS_HOST_PATH}/`) || pathname === CANVAS_WS_PATH;
+}
+function hasAuthorizedWsClientForIp(clients, clientIp) {
+	for (const client of clients) if (client.clientIp && client.clientIp === clientIp) return true;
+	return false;
+}
+async function authorizeCanvasRequest(params) {
+	const { req, auth, trustedProxies, clients } = params;
+	if (isLocalDirectRequest(req, trustedProxies)) return true;
+	const token = getBearerToken(req);
+	if (token) {
+		if ((await authorizeGatewayConnect({
+			auth: {
+				...auth,
+				allowTailscale: false
+			},
+			connectAuth: {
+				token,
+				password: token
+			},
+			req,
+			trustedProxies
+		})).ok) return true;
+	}
+	const clientIp = resolveGatewayClientIp({
+		remoteAddr: req.socket?.remoteAddress ?? "",
+		forwardedFor: getHeader(req, "x-forwarded-for"),
+		realIp: getHeader(req, "x-real-ip"),
+		trustedProxies
+	});
+	if (!clientIp) return false;
+	return hasAuthorizedWsClientForIp(clients, clientIp);
+}
 function createHooksRequestHandler(opts) {
 	const { getHooksConfig, bindHost, port, logHooks, dispatchAgentHook, dispatchWakeHook } = opts;
 	return async (req, res) => {
@@ -13820,14 +14485,19 @@ function createHooksRequestHandler(opts) {
 		const url = new URL(req.url ?? "/", `http://${bindHost}:${port}`);
 		const basePath = hooksConfig.basePath;
 		if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return false;
-		const { token, fromQuery } = extractHookToken(req, url);
+		if (url.searchParams.has("token")) {
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "text/plain; charset=utf-8");
+			res.end("Hook token must be provided via Authorization: Bearer <token> or X-OpenClaw-Token header (query parameters are not allowed).");
+			return true;
+		}
+		const token = extractHookToken(req);
 		if (!token || token !== hooksConfig.token) {
 			res.statusCode = 401;
 			res.setHeader("Content-Type", "text/plain; charset=utf-8");
 			res.end("Unauthorized");
 			return true;
 		}
-		if (fromQuery) logHooks.warn("Hook token provided via query parameter is deprecated for security reasons. Tokens in URLs appear in logs, browser history, and referrer headers. Use Authorization: Bearer <token> or X-OpenClaw-Token header instead.");
 		if (req.method !== "POST") {
 			res.statusCode = 405;
 			res.setHeader("Allow", "POST");
@@ -13955,7 +14625,7 @@ function createHooksRequestHandler(opts) {
 	};
 }
 function createGatewayHttpServer(opts) {
-	const { canvasHost, controlUiEnabled, controlUiBasePath, controlUiRoot, openAiChatCompletionsEnabled, openResponsesEnabled, openResponsesConfig, handleHooksRequest, handlePluginRequest, resolvedAuth } = opts;
+	const { canvasHost, clients, controlUiEnabled, controlUiBasePath, controlUiRoot, openAiChatCompletionsEnabled, openResponsesEnabled, openResponsesConfig, handleHooksRequest, handlePluginRequest, resolvedAuth } = opts;
 	const httpServer = opts.tlsOptions ? createServer$1(opts.tlsOptions, (req, res) => {
 		handleRequest(req, res);
 	}) : createServer((req, res) => {
@@ -13987,6 +14657,17 @@ function createGatewayHttpServer(opts) {
 				})) return;
 			}
 			if (canvasHost) {
+				if (isCanvasPath(new URL(req.url ?? "/", "http://localhost").pathname)) {
+					if (!await authorizeCanvasRequest({
+						req,
+						auth: resolvedAuth,
+						trustedProxies,
+						clients
+					})) {
+						sendUnauthorized(res);
+						return;
+					}
+				}
 				if (await handleA2uiHttpRequest(req, res)) return;
 				if (await canvasHost.handleHttpRequest(req, res)) return;
 			}
@@ -14013,11 +14694,29 @@ function createGatewayHttpServer(opts) {
 	return httpServer;
 }
 function attachGatewayUpgradeHandler(opts) {
-	const { httpServer, wss, canvasHost } = opts;
+	const { httpServer, wss, canvasHost, clients, resolvedAuth } = opts;
 	httpServer.on("upgrade", (req, socket, head) => {
-		if (canvasHost?.handleUpgrade(req, socket, head)) return;
-		wss.handleUpgrade(req, socket, head, (ws) => {
-			wss.emit("connection", ws, req);
+		(async () => {
+			if (canvasHost) {
+				if (new URL(req.url ?? "/", "http://localhost").pathname === CANVAS_WS_PATH) {
+					if (!await authorizeCanvasRequest({
+						req,
+						auth: resolvedAuth,
+						trustedProxies: loadConfig().gateway?.trustedProxies ?? [],
+						clients
+					})) {
+						socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+						socket.destroy();
+						return;
+					}
+				}
+				if (canvasHost.handleUpgrade(req, socket, head)) return;
+			}
+			wss.handleUpgrade(req, socket, head, (ws) => {
+				wss.emit("connection", ws, req);
+			});
+		})().catch(() => {
+			socket.destroy();
 		});
 	});
 }
@@ -14336,6 +15035,8 @@ async function createGatewayRuntimeState(params) {
 	} catch (err) {
 		params.logCanvas.warn(`canvas host failed to start: ${String(err)}`);
 	}
+	const clients = /* @__PURE__ */ new Set();
+	const { broadcast, broadcastToConnIds } = createGatewayBroadcaster({ clients });
 	const handleHooksRequest = createGatewayHooksRequestHandler({
 		deps: params.deps,
 		getHooksConfig: params.hooksConfig,
@@ -14353,6 +15054,7 @@ async function createGatewayRuntimeState(params) {
 	for (const host of bindHosts) {
 		const httpServer = createGatewayHttpServer({
 			canvasHost,
+			clients,
 			controlUiEnabled: params.controlUiEnabled,
 			controlUiBasePath: params.controlUiBasePath,
 			controlUiRoot: params.controlUiRoot,
@@ -14386,10 +15088,10 @@ async function createGatewayRuntimeState(params) {
 	for (const server of httpServers) attachGatewayUpgradeHandler({
 		httpServer: server,
 		wss,
-		canvasHost
+		canvasHost,
+		clients,
+		resolvedAuth: params.resolvedAuth
 	});
-	const clients = /* @__PURE__ */ new Set();
-	const { broadcast } = createGatewayBroadcaster({ clients });
 	const agentRunSeq = /* @__PURE__ */ new Map();
 	const dedupe = /* @__PURE__ */ new Map();
 	const chatRunState = createChatRunState();
@@ -14398,6 +15100,8 @@ async function createGatewayRuntimeState(params) {
 	const chatDeltaSentAt = chatRunState.deltaSentAt;
 	const addChatRun = chatRunRegistry.add;
 	const removeChatRun = chatRunRegistry.remove;
+	const chatAbortControllers = /* @__PURE__ */ new Map();
+	const toolEventRecipients = createToolEventRecipientRegistry();
 	return {
 		canvasHost,
 		httpServer,
@@ -14406,6 +15110,7 @@ async function createGatewayRuntimeState(params) {
 		wss,
 		clients,
 		broadcast,
+		broadcastToConnIds,
 		agentRunSeq,
 		dedupe,
 		chatRunState,
@@ -14413,7 +15118,8 @@ async function createGatewayRuntimeState(params) {
 		chatDeltaSentAt,
 		addChatRun,
 		removeChatRun,
-		chatAbortControllers: /* @__PURE__ */ new Map()
+		chatAbortControllers,
+		toolEventRecipients
 	};
 }
 
@@ -14882,7 +15588,7 @@ function formatGatewayAuthFailureMessage(params) {
 	const isCli = isGatewayCliClient(client);
 	const isControlUi = client?.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
 	const isWebchat = isWebchatClient(client);
-	const tokenHint = isCli ? "set gateway.remote.token to match gateway.auth.token" : isControlUi || isWebchat ? "open a tokenized dashboard URL or paste token in Control UI settings" : "provide gateway auth token";
+	const tokenHint = isCli ? "set gateway.remote.token to match gateway.auth.token" : isControlUi || isWebchat ? "open the dashboard URL and paste the token in Control UI settings" : "provide gateway auth token";
 	const passwordHint = isCli ? "set gateway.remote.password to match gateway.auth.password" : isControlUi || isWebchat ? "enter the password in Control UI settings" : "provide gateway auth password";
 	switch (reason) {
 		case "token_missing": return `unauthorized: gateway token missing (${tokenHint})`;
@@ -15450,7 +16156,8 @@ function attachGatewayWsMessageHandler(params) {
 					socket,
 					connect: connectParams,
 					connId,
-					presenceKey
+					presenceKey,
+					clientIp: reportedClientIp
 				};
 				setClient(nextClient);
 				setHandshakeState("connected");
@@ -15870,7 +16577,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	let canvasHostServer = null;
 	const gatewayTls = await loadGatewayTlsRuntime(cfgAtStart.gateway?.tls, log.child("tls"));
 	if (cfgAtStart.gateway?.tls?.enabled && !gatewayTls.enabled) throw new Error(gatewayTls.error ?? "gateway tls: failed to enable");
-	const { canvasHost, httpServer, httpServers, httpBindHosts, wss, clients, broadcast, agentRunSeq, dedupe, chatRunState, chatRunBuffers, chatDeltaSentAt, addChatRun, removeChatRun, chatAbortControllers } = await createGatewayRuntimeState({
+	const { canvasHost, httpServer, httpServers, httpBindHosts, wss, clients, broadcast, broadcastToConnIds, agentRunSeq, dedupe, chatRunState, chatRunBuffers, chatDeltaSentAt, addChatRun, removeChatRun, chatAbortControllers, toolEventRecipients } = await createGatewayRuntimeState({
 		cfg: cfgAtStart,
 		bindHost,
 		port,
@@ -15965,11 +16672,13 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	});
 	const agentUnsub = onAgentEvent(createAgentEventHandler({
 		broadcast,
+		broadcastToConnIds,
 		nodeSendToSession,
 		agentRunSeq,
 		chatRunState,
 		resolveSessionKeyForRun,
-		clearAgentRunContext
+		clearAgentRunContext,
+		toolEventRecipients
 	}));
 	const heartbeatUnsub = onHeartbeatEvent((evt) => {
 		broadcast("heartbeat", evt, { dropIfSlow: true });
@@ -16008,6 +16717,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			incrementPresenceVersion,
 			getHealthVersion,
 			broadcast,
+			broadcastToConnIds,
 			nodeSendToSession,
 			nodeSendToAllSubscribed,
 			nodeSubscribe,
@@ -16022,6 +16732,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			chatDeltaSentAt: chatRunState.deltaSentAt,
 			addChatRun,
 			removeChatRun,
+			registerToolEventRecipient: toolEventRecipients.add,
 			dedupe,
 			wizardSessions,
 			findRunningWizard,