@hanzo/bot 2026.3.7 → 2026.3.9

package/dist/restart-D97MOP8K.js

@@ -0,0 +1,782 @@
+import { u as resolveGatewayPort } from "./paths-BMo6kTge.js";
+import { t as createSubsystemLogger } from "./subsystem-C6poMade.js";
+import { n as logLaneDequeue, r as logLaneEnqueue, t as diag } from "./diagnostic-CXxZq_XY.js";
+import { n as resolveLsofCommandSync } from "./ports-lsof-C-KFQ3hh.js";
+import { f as resolveGatewaySystemdServiceName, l as resolveGatewayLaunchAgentLabel } from "./constants-CkIxhEvX.js";
+import { spawnSync } from "node:child_process";
+import os from "node:os";
+import path from "node:path";
+
+//#region src/process/lanes.ts
+let CommandLane = /* @__PURE__ */ function(CommandLane) {
+	CommandLane["Main"] = "main";
+	CommandLane["Cron"] = "cron";
+	CommandLane["Subagent"] = "subagent";
+	CommandLane["Nested"] = "nested";
+	return CommandLane;
+}({});
+
+//#endregion
+//#region src/process/command-queue.ts
+/**
+* Dedicated error type thrown when a queued command is rejected because
+* its lane was cleared.  Callers that fire-and-forget enqueued tasks can
+* catch (or ignore) this specific type to avoid unhandled-rejection noise.
+*/
+var CommandLaneClearedError = class extends Error {
+	constructor(lane) {
+		super(lane ? `Command lane "${lane}" cleared` : "Command lane cleared");
+		this.name = "CommandLaneClearedError";
+	}
+};
+/**
+* Dedicated error type thrown when a new command is rejected because the
+* gateway is currently draining for restart.
+*/
+var GatewayDrainingError = class extends Error {
+	constructor() {
+		super("Gateway is draining for restart; new tasks are not accepted");
+		this.name = "GatewayDrainingError";
+	}
+};
+let gatewayDraining = false;
+const lanes = /* @__PURE__ */ new Map();
+let nextTaskId = 1;
+function getLaneState(lane) {
+	const existing = lanes.get(lane);
+	if (existing) return existing;
+	const created = {
+		lane,
+		queue: [],
+		activeTaskIds: /* @__PURE__ */ new Set(),
+		maxConcurrent: 1,
+		draining: false,
+		generation: 0
+	};
+	lanes.set(lane, created);
+	return created;
+}
+function completeTask(state, taskId, taskGeneration) {
+	if (taskGeneration !== state.generation) return false;
+	state.activeTaskIds.delete(taskId);
+	return true;
+}
+function drainLane(lane) {
+	const state = getLaneState(lane);
+	if (state.draining) {
+		if (state.activeTaskIds.size === 0 && state.queue.length > 0) diag.warn(`drainLane blocked: lane=${lane} draining=true active=0 queue=${state.queue.length}`);
+		return;
+	}
+	state.draining = true;
+	const pump = () => {
+		try {
+			while (state.activeTaskIds.size < state.maxConcurrent && state.queue.length > 0) {
+				const entry = state.queue.shift();
+				const waitedMs = Date.now() - entry.enqueuedAt;
+				if (waitedMs >= entry.warnAfterMs) {
+					try {
+						entry.onWait?.(waitedMs, state.queue.length);
+					} catch (err) {
+						diag.error(`lane onWait callback failed: lane=${lane} error="${String(err)}"`);
+					}
+					diag.warn(`lane wait exceeded: lane=${lane} waitedMs=${waitedMs} queueAhead=${state.queue.length}`);
+				}
+				logLaneDequeue(lane, waitedMs, state.queue.length);
+				const taskId = nextTaskId++;
+				const taskGeneration = state.generation;
+				state.activeTaskIds.add(taskId);
+				(async () => {
+					const startTime = Date.now();
+					try {
+						const result = await entry.task();
+						if (completeTask(state, taskId, taskGeneration)) {
+							diag.debug(`lane task done: lane=${lane} durationMs=${Date.now() - startTime} active=${state.activeTaskIds.size} queued=${state.queue.length}`);
+							pump();
+						}
+						entry.resolve(result);
+					} catch (err) {
+						const completedCurrentGeneration = completeTask(state, taskId, taskGeneration);
+						if (!(lane.startsWith("auth-probe:") || lane.startsWith("session:probe-"))) diag.error(`lane task error: lane=${lane} durationMs=${Date.now() - startTime} error="${String(err)}"`);
+						if (completedCurrentGeneration) pump();
+						entry.reject(err);
+					}
+				})();
+			}
+		} finally {
+			state.draining = false;
+		}
+	};
+	pump();
+}
+/**
+* Mark gateway as draining for restart so new enqueues fail fast with
+* `GatewayDrainingError` instead of being silently killed on shutdown.
+*/
+function markGatewayDraining() {
+	gatewayDraining = true;
+}
+function setCommandLaneConcurrency(lane, maxConcurrent) {
+	const cleaned = lane.trim() || CommandLane.Main;
+	const state = getLaneState(cleaned);
+	state.maxConcurrent = Math.max(1, Math.floor(maxConcurrent));
+	drainLane(cleaned);
+}
+function enqueueCommandInLane(lane, task, opts) {
+	if (gatewayDraining) return Promise.reject(new GatewayDrainingError());
+	const cleaned = lane.trim() || CommandLane.Main;
+	const warnAfterMs = opts?.warnAfterMs ?? 2e3;
+	const state = getLaneState(cleaned);
+	return new Promise((resolve, reject) => {
+		state.queue.push({
+			task: () => task(),
+			resolve: (value) => resolve(value),
+			reject,
+			enqueuedAt: Date.now(),
+			warnAfterMs,
+			onWait: opts?.onWait
+		});
+		logLaneEnqueue(cleaned, state.queue.length + state.activeTaskIds.size);
+		drainLane(cleaned);
+	});
+}
+function getQueueSize(lane = CommandLane.Main) {
+	const resolved = lane.trim() || CommandLane.Main;
+	const state = lanes.get(resolved);
+	if (!state) return 0;
+	return state.queue.length + state.activeTaskIds.size;
+}
+function getTotalQueueSize() {
+	let total = 0;
+	for (const s of lanes.values()) total += s.queue.length + s.activeTaskIds.size;
+	return total;
+}
+function clearCommandLane(lane = CommandLane.Main) {
+	const cleaned = lane.trim() || CommandLane.Main;
+	const state = lanes.get(cleaned);
+	if (!state) return 0;
+	const removed = state.queue.length;
+	const pending = state.queue.splice(0);
+	for (const entry of pending) entry.reject(new CommandLaneClearedError(cleaned));
+	return removed;
+}
+/**
+* Reset all lane runtime state to idle. Used after SIGUSR1 in-process
+* restarts where interrupted tasks' finally blocks may not run, leaving
+* stale active task IDs that permanently block new work from draining.
+*
+* Bumps lane generation and clears execution counters so stale completions
+* from old in-flight tasks are ignored. Queued entries are intentionally
+* preserved — they represent pending user work that should still execute
+* after restart.
+*
+* After resetting, drains any lanes that still have queued entries so
+* preserved work is pumped immediately rather than waiting for a future
+* `enqueueCommandInLane()` call (which may never come).
+*/
+function resetAllLanes() {
+	gatewayDraining = false;
+	const lanesToDrain = [];
+	for (const state of lanes.values()) {
+		state.generation += 1;
+		state.activeTaskIds.clear();
+		state.draining = false;
+		if (state.queue.length > 0) lanesToDrain.push(state.lane);
+	}
+	for (const lane of lanesToDrain) drainLane(lane);
+}
+/**
+* Returns the total number of actively executing tasks across all lanes
+* (excludes queued-but-not-started entries).
+*/
+function getActiveTaskCount() {
+	let total = 0;
+	for (const s of lanes.values()) total += s.activeTaskIds.size;
+	return total;
+}
+/**
+* Wait for all currently active tasks across all lanes to finish.
+* Polls at a short interval; resolves when no tasks are active or
+* when `timeoutMs` elapses (whichever comes first).
+*
+* New tasks enqueued after this call are ignored — only tasks that are
+* already executing are waited on.
+*/
+function waitForActiveTasks(timeoutMs) {
+	const POLL_INTERVAL_MS = 50;
+	const deadline = Date.now() + timeoutMs;
+	const activeAtStart = /* @__PURE__ */ new Set();
+	for (const state of lanes.values()) for (const taskId of state.activeTaskIds) activeAtStart.add(taskId);
+	return new Promise((resolve) => {
+		const check = () => {
+			if (activeAtStart.size === 0) {
+				resolve({ drained: true });
+				return;
+			}
+			let hasPending = false;
+			for (const state of lanes.values()) {
+				for (const taskId of state.activeTaskIds) if (activeAtStart.has(taskId)) {
+					hasPending = true;
+					break;
+				}
+				if (hasPending) break;
+			}
+			if (!hasPending) {
+				resolve({ drained: true });
+				return;
+			}
+			if (Date.now() >= deadline) {
+				resolve({ drained: false });
+				return;
+			}
+			setTimeout(check, POLL_INTERVAL_MS);
+		};
+		check();
+	});
+}
+
+//#endregion
+//#region src/infra/restart-stale-pids.ts
+const SPAWN_TIMEOUT_MS$1 = 2e3;
+const STALE_SIGTERM_WAIT_MS = 600;
+const STALE_SIGKILL_WAIT_MS = 400;
+/**
+* After SIGKILL, the kernel may not release the TCP port immediately.
+* Poll until the port is confirmed free (or until the budget expires) before
+* returning control to the caller (typically `triggerOpenClawRestart` →
+* `systemctl restart`). Without this wait the new process races the dying
+* process for the port and systemd enters an EADDRINUSE restart loop.
+*
+* POLL_SPAWN_TIMEOUT_MS is intentionally much shorter than SPAWN_TIMEOUT_MS
+* so that a single slow or hung lsof invocation does not consume the entire
+* polling budget. At 400 ms per call, up to five independent lsof attempts
+* fit within PORT_FREE_TIMEOUT_MS = 2000 ms, each with a definitive outcome.
+*/
+const PORT_FREE_POLL_INTERVAL_MS = 50;
+const PORT_FREE_TIMEOUT_MS = 2e3;
+const POLL_SPAWN_TIMEOUT_MS = 400;
+const restartLog$1 = createSubsystemLogger("restart");
+let sleepSyncOverride = null;
+let dateNowOverride = null;
+function getTimeMs() {
+	return dateNowOverride ? dateNowOverride() : Date.now();
+}
+function sleepSync(ms) {
+	const timeoutMs = Math.max(0, Math.floor(ms));
+	if (timeoutMs <= 0) return;
+	if (sleepSyncOverride) {
+		sleepSyncOverride(timeoutMs);
+		return;
+	}
+	try {
+		const lock = new Int32Array(new SharedArrayBuffer(4));
+		Atomics.wait(lock, 0, 0, timeoutMs);
+	} catch {
+		const start = Date.now();
+		while (Date.now() - start < timeoutMs);
+	}
+}
+/**
+* Parse openclaw gateway PIDs from lsof -Fpc stdout.
+* Pure function — no I/O. Excludes the current process.
+*/
+function parsePidsFromLsofOutput(stdout) {
+	const pids = [];
+	let currentPid;
+	let currentCmd;
+	for (const line of stdout.split(/\r?\n/).filter(Boolean)) if (line.startsWith("p")) {
+		if (currentPid != null && currentCmd && currentCmd.toLowerCase().includes("openclaw")) pids.push(currentPid);
+		const parsed = Number.parseInt(line.slice(1), 10);
+		currentPid = Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+		currentCmd = void 0;
+	} else if (line.startsWith("c")) currentCmd = line.slice(1);
+	if (currentPid != null && currentCmd && currentCmd.toLowerCase().includes("openclaw")) pids.push(currentPid);
+	return [...new Set(pids)].filter((pid) => pid !== process.pid);
+}
+/**
+* Find PIDs of gateway processes listening on the given port using synchronous lsof.
+* Returns only PIDs that belong to openclaw gateway processes (not the current process).
+*/
+function findGatewayPidsOnPortSync(port, spawnTimeoutMs = SPAWN_TIMEOUT_MS$1) {
+	if (process.platform === "win32") return [];
+	const res = spawnSync(resolveLsofCommandSync(), [
+		"-nP",
+		`-iTCP:${port}`,
+		"-sTCP:LISTEN",
+		"-Fpc"
+	], {
+		encoding: "utf8",
+		timeout: spawnTimeoutMs
+	});
+	if (res.error) {
+		const code = res.error.code;
+		const detail = code && code.trim().length > 0 ? code : res.error instanceof Error ? res.error.message : "unknown error";
+		restartLog$1.warn(`lsof failed during initial stale-pid scan for port ${port}: ${detail}`);
+		return [];
+	}
+	if (res.status === 1) return [];
+	if (res.status !== 0) {
+		restartLog$1.warn(`lsof exited with status ${res.status} during initial stale-pid scan for port ${port}; skipping stale pid check`);
+		return [];
+	}
+	return parsePidsFromLsofOutput(res.stdout);
+}
+function pollPortOnce(port) {
+	try {
+		const res = spawnSync(resolveLsofCommandSync(), [
+			"-nP",
+			`-iTCP:${port}`,
+			"-sTCP:LISTEN",
+			"-Fpc"
+		], {
+			encoding: "utf8",
+			timeout: POLL_SPAWN_TIMEOUT_MS
+		});
+		if (res.error) {
+			const code = res.error.code;
+			return {
+				free: null,
+				permanent: code === "ENOENT" || code === "EACCES" || code === "EPERM"
+			};
+		}
+		if (res.status === 1) {
+			if (res.stdout) return parsePidsFromLsofOutput(res.stdout).length === 0 ? { free: true } : { free: false };
+			return { free: true };
+		}
+		if (res.status !== 0) return {
+			free: null,
+			permanent: false
+		};
+		return parsePidsFromLsofOutput(res.stdout).length === 0 ? { free: true } : { free: false };
+	} catch {
+		return {
+			free: null,
+			permanent: false
+		};
+	}
+}
+/**
+* Synchronously terminate stale gateway processes.
+* Callers must pass a non-empty pids array.
+* Sends SIGTERM, waits briefly, then SIGKILL for survivors.
+*/
+function terminateStaleProcessesSync(pids) {
+	const killed = [];
+	for (const pid of pids) try {
+		process.kill(pid, "SIGTERM");
+		killed.push(pid);
+	} catch {}
+	if (killed.length === 0) return killed;
+	sleepSync(STALE_SIGTERM_WAIT_MS);
+	for (const pid of killed) try {
+		process.kill(pid, 0);
+		process.kill(pid, "SIGKILL");
+	} catch {}
+	sleepSync(STALE_SIGKILL_WAIT_MS);
+	return killed;
+}
+/**
+* Poll the given port until it is confirmed free, lsof is confirmed unavailable,
+* or the wall-clock budget expires.
+*
+* Each poll invocation uses POLL_SPAWN_TIMEOUT_MS (400 ms), which is
+* significantly shorter than PORT_FREE_TIMEOUT_MS (2000 ms). This ensures
+* that a single slow or hung lsof call cannot consume the entire polling
+* budget and cause the function to exit prematurely with an inconclusive
+* result. Up to five independent lsof attempts fit within the budget.
+*
+* Exit conditions:
+*   - `pollPortOnce` returns `{ free: true }`                    → port confirmed free
+*   - `pollPortOnce` returns `{ free: null, permanent: true }`   → lsof unavailable, bail
+*   - `pollPortOnce` returns `{ free: false }`                   → port busy, sleep + retry
+*   - `pollPortOnce` returns `{ free: null, permanent: false }`  → transient error, sleep + retry
+*   - Wall-clock deadline exceeded                               → log warning, proceed anyway
+*/
+function waitForPortFreeSync(port) {
+	const deadline = getTimeMs() + PORT_FREE_TIMEOUT_MS;
+	while (getTimeMs() < deadline) {
+		const result = pollPortOnce(port);
+		if (result.free === true) return;
+		if (result.free === null && result.permanent) return;
+		sleepSync(PORT_FREE_POLL_INTERVAL_MS);
+	}
+	restartLog$1.warn(`port ${port} still in use after ${PORT_FREE_TIMEOUT_MS}ms; proceeding anyway`);
+}
+/**
+* Inspect the gateway port and kill any stale gateway processes holding it.
+* Blocks until the port is confirmed free (or the poll budget expires) so
+* the supervisor (systemd / launchctl) does not race a zombie process for
+* the port and enter an EADDRINUSE restart loop.
+*
+* Called before service restart commands to prevent port conflicts.
+*/
+function cleanStaleGatewayProcessesSync() {
+	try {
+		const port = resolveGatewayPort(void 0, process.env);
+		const stalePids = findGatewayPidsOnPortSync(port);
+		if (stalePids.length === 0) return [];
+		restartLog$1.warn(`killing ${stalePids.length} stale gateway process(es) before restart: ${stalePids.join(", ")}`);
+		const killed = terminateStaleProcessesSync(stalePids);
+		waitForPortFreeSync(port);
+		return killed;
+	} catch {
+		return [];
+	}
+}
+
+//#endregion
+//#region src/infra/restart.ts
+const SPAWN_TIMEOUT_MS = 2e3;
+const SIGUSR1_AUTH_GRACE_MS = 5e3;
+const DEFAULT_DEFERRAL_POLL_MS = 500;
+const DEFAULT_DEFERRAL_MAX_WAIT_MS = 3e4;
+const RESTART_COOLDOWN_MS = 3e4;
+const restartLog = createSubsystemLogger("restart");
+let sigusr1AuthorizedCount = 0;
+let sigusr1AuthorizedUntil = 0;
+let sigusr1ExternalAllowed = false;
+let preRestartCheck = null;
+let restartCycleToken = 0;
+let emittedRestartToken = 0;
+let consumedRestartToken = 0;
+let lastRestartEmittedAt = 0;
+let pendingRestartTimer = null;
+let pendingRestartDueAt = 0;
+let pendingRestartReason;
+function hasUnconsumedRestartSignal() {
+	return emittedRestartToken > consumedRestartToken;
+}
+function clearPendingScheduledRestart() {
+	if (pendingRestartTimer) clearTimeout(pendingRestartTimer);
+	pendingRestartTimer = null;
+	pendingRestartDueAt = 0;
+	pendingRestartReason = void 0;
+}
+function summarizeChangedPaths(paths, maxPaths = 6) {
+	if (!Array.isArray(paths) || paths.length === 0) return null;
+	if (paths.length <= maxPaths) return paths.join(",");
+	return `${paths.slice(0, maxPaths).join(",")},+${paths.length - maxPaths} more`;
+}
+function formatRestartAudit(audit) {
+	const actor = typeof audit?.actor === "string" && audit.actor.trim() ? audit.actor.trim() : null;
+	const deviceId = typeof audit?.deviceId === "string" && audit.deviceId.trim() ? audit.deviceId.trim() : null;
+	const clientIp = typeof audit?.clientIp === "string" && audit.clientIp.trim() ? audit.clientIp.trim() : null;
+	const changed = summarizeChangedPaths(audit?.changedPaths);
+	const fields = [];
+	if (actor) fields.push(`actor=${actor}`);
+	if (deviceId) fields.push(`device=${deviceId}`);
+	if (clientIp) fields.push(`ip=${clientIp}`);
+	if (changed) fields.push(`changedPaths=${changed}`);
+	return fields.length > 0 ? fields.join(" ") : "actor=<unknown>";
+}
+/**
+* Register a callback that scheduleGatewaySigusr1Restart checks before emitting SIGUSR1.
+* The callback should return the number of pending items (0 = safe to restart).
+*/
+function setPreRestartDeferralCheck(fn) {
+	preRestartCheck = fn;
+}
+/**
+* Emit an authorized SIGUSR1 gateway restart, guarded against duplicate emissions.
+* Returns true if SIGUSR1 was emitted, false if a restart was already emitted.
+* Both scheduleGatewaySigusr1Restart and the config watcher should use this
+* to ensure only one restart fires.
+*/
+function emitGatewayRestart() {
+	if (hasUnconsumedRestartSignal()) {
+		clearPendingScheduledRestart();
+		return false;
+	}
+	clearPendingScheduledRestart();
+	emittedRestartToken = ++restartCycleToken;
+	authorizeGatewaySigusr1Restart();
+	try {
+		if (process.listenerCount("SIGUSR1") > 0) process.emit("SIGUSR1");
+		else process.kill(process.pid, "SIGUSR1");
+	} catch {
+		emittedRestartToken = consumedRestartToken;
+		return false;
+	}
+	lastRestartEmittedAt = Date.now();
+	return true;
+}
+function resetSigusr1AuthorizationIfExpired(now = Date.now()) {
+	if (sigusr1AuthorizedCount <= 0) return;
+	if (now <= sigusr1AuthorizedUntil) return;
+	sigusr1AuthorizedCount = 0;
+	sigusr1AuthorizedUntil = 0;
+}
+function setGatewaySigusr1RestartPolicy(opts) {
+	sigusr1ExternalAllowed = opts?.allowExternal === true;
+}
+function isGatewaySigusr1RestartExternallyAllowed() {
+	return sigusr1ExternalAllowed;
+}
+function authorizeGatewaySigusr1Restart(delayMs = 0) {
+	const delay = Math.max(0, Math.floor(delayMs));
+	const expiresAt = Date.now() + delay + SIGUSR1_AUTH_GRACE_MS;
+	sigusr1AuthorizedCount += 1;
+	if (expiresAt > sigusr1AuthorizedUntil) sigusr1AuthorizedUntil = expiresAt;
+}
+function consumeGatewaySigusr1RestartAuthorization() {
+	resetSigusr1AuthorizationIfExpired();
+	if (sigusr1AuthorizedCount <= 0) return false;
+	sigusr1AuthorizedCount -= 1;
+	if (sigusr1AuthorizedCount <= 0) sigusr1AuthorizedUntil = 0;
+	return true;
+}
+/**
+* Mark the currently emitted SIGUSR1 restart cycle as consumed by the run loop.
+* This explicitly advances the cycle state instead of resetting emit guards inside
+* consumeGatewaySigusr1RestartAuthorization().
+*/
+function markGatewaySigusr1RestartHandled() {
+	if (hasUnconsumedRestartSignal()) consumedRestartToken = emittedRestartToken;
+}
+/**
+* Poll pending work until it drains (or times out), then emit one restart signal.
+* Shared by both the direct RPC restart path and the config watcher path.
+*/
+function deferGatewayRestartUntilIdle(opts) {
+	const pollMsRaw = opts.pollMs ?? DEFAULT_DEFERRAL_POLL_MS;
+	const pollMs = Math.max(10, Math.floor(pollMsRaw));
+	const maxWaitMsRaw = opts.maxWaitMs ?? DEFAULT_DEFERRAL_MAX_WAIT_MS;
+	const maxWaitMs = Math.max(pollMs, Math.floor(maxWaitMsRaw));
+	let pending;
+	try {
+		pending = opts.getPendingCount();
+	} catch (err) {
+		opts.hooks?.onCheckError?.(err);
+		emitGatewayRestart();
+		return;
+	}
+	if (pending <= 0) {
+		opts.hooks?.onReady?.();
+		emitGatewayRestart();
+		return;
+	}
+	opts.hooks?.onDeferring?.(pending);
+	const startedAt = Date.now();
+	const poll = setInterval(() => {
+		let current;
+		try {
+			current = opts.getPendingCount();
+		} catch (err) {
+			clearInterval(poll);
+			opts.hooks?.onCheckError?.(err);
+			emitGatewayRestart();
+			return;
+		}
+		if (current <= 0) {
+			clearInterval(poll);
+			opts.hooks?.onReady?.();
+			emitGatewayRestart();
+			return;
+		}
+		const elapsedMs = Date.now() - startedAt;
+		if (elapsedMs >= maxWaitMs) {
+			clearInterval(poll);
+			opts.hooks?.onTimeout?.(current, elapsedMs);
+			emitGatewayRestart();
+		}
+	}, pollMs);
+}
+function formatSpawnDetail(result) {
+	const clean = (value) => {
+		return (typeof value === "string" ? value : value ? value.toString() : "").replace(/\s+/g, " ").trim();
+	};
+	if (result.error) {
+		if (result.error instanceof Error) return result.error.message;
+		if (typeof result.error === "string") return result.error;
+		try {
+			return JSON.stringify(result.error);
+		} catch {
+			return "unknown error";
+		}
+	}
+	const stderr = clean(result.stderr);
+	if (stderr) return stderr;
+	const stdout = clean(result.stdout);
+	if (stdout) return stdout;
+	if (typeof result.status === "number") return `exit ${result.status}`;
+	return "unknown error";
+}
+function normalizeSystemdUnit(raw, profile) {
+	const unit = raw?.trim();
+	if (!unit) return `${resolveGatewaySystemdServiceName(profile)}.service`;
+	return unit.endsWith(".service") ? unit : `${unit}.service`;
+}
+function triggerOpenClawRestart() {
+	if (process.env.VITEST || false) return {
+		ok: true,
+		method: "supervisor",
+		detail: "test mode"
+	};
+	cleanStaleGatewayProcessesSync();
+	const tried = [];
+	if (process.platform !== "darwin") {
+		if (process.platform === "linux") {
+			const unit = normalizeSystemdUnit(process.env.OPENCLAW_SYSTEMD_UNIT, process.env.OPENCLAW_PROFILE);
+			const userArgs = [
+				"--user",
+				"restart",
+				unit
+			];
+			tried.push(`systemctl ${userArgs.join(" ")}`);
+			const userRestart = spawnSync("systemctl", userArgs, {
+				encoding: "utf8",
+				timeout: SPAWN_TIMEOUT_MS
+			});
+			if (!userRestart.error && userRestart.status === 0) return {
+				ok: true,
+				method: "systemd",
+				tried
+			};
+			const systemArgs = ["restart", unit];
+			tried.push(`systemctl ${systemArgs.join(" ")}`);
+			const systemRestart = spawnSync("systemctl", systemArgs, {
+				encoding: "utf8",
+				timeout: SPAWN_TIMEOUT_MS
+			});
+			if (!systemRestart.error && systemRestart.status === 0) return {
+				ok: true,
+				method: "systemd",
+				tried
+			};
+			return {
+				ok: false,
+				method: "systemd",
+				detail: [`user: ${formatSpawnDetail(userRestart)}`, `system: ${formatSpawnDetail(systemRestart)}`].join("; "),
+				tried
+			};
+		}
+		return {
+			ok: false,
+			method: "supervisor",
+			detail: "unsupported platform restart"
+		};
+	}
+	const label = process.env.OPENCLAW_LAUNCHD_LABEL || resolveGatewayLaunchAgentLabel(process.env.OPENCLAW_PROFILE);
+	const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+	const domain = uid !== void 0 ? `gui/${uid}` : "gui/501";
+	const target = `${domain}/${label}`;
+	const args = [
+		"kickstart",
+		"-k",
+		target
+	];
+	tried.push(`launchctl ${args.join(" ")}`);
+	const res = spawnSync("launchctl", args, {
+		encoding: "utf8",
+		timeout: SPAWN_TIMEOUT_MS
+	});
+	if (!res.error && res.status === 0) return {
+		ok: true,
+		method: "launchctl",
+		tried
+	};
+	const home = process.env.HOME?.trim() || os.homedir();
+	const bootstrapArgs = [
+		"bootstrap",
+		domain,
+		path.join(home, "Library", "LaunchAgents", `${label}.plist`)
+	];
+	tried.push(`launchctl ${bootstrapArgs.join(" ")}`);
+	const boot = spawnSync("launchctl", bootstrapArgs, {
+		encoding: "utf8",
+		timeout: SPAWN_TIMEOUT_MS
+	});
+	if (boot.error || boot.status !== 0 && boot.status !== null) return {
+		ok: false,
+		method: "launchctl",
+		detail: formatSpawnDetail(boot),
+		tried
+	};
+	const retryArgs = [
+		"kickstart",
+		"-k",
+		target
+	];
+	tried.push(`launchctl ${retryArgs.join(" ")}`);
+	const retry = spawnSync("launchctl", retryArgs, {
+		encoding: "utf8",
+		timeout: SPAWN_TIMEOUT_MS
+	});
+	if (!retry.error && retry.status === 0) return {
+		ok: true,
+		method: "launchctl",
+		tried
+	};
+	return {
+		ok: false,
+		method: "launchctl",
+		detail: formatSpawnDetail(retry),
+		tried
+	};
+}
+function scheduleGatewaySigusr1Restart(opts) {
+	const delayMsRaw = typeof opts?.delayMs === "number" && Number.isFinite(opts.delayMs) ? Math.floor(opts.delayMs) : 2e3;
+	const delayMs = Math.min(Math.max(delayMsRaw, 0), 6e4);
+	const reason = typeof opts?.reason === "string" && opts.reason.trim() ? opts.reason.trim().slice(0, 200) : void 0;
+	const mode = process.listenerCount("SIGUSR1") > 0 ? "emit" : "signal";
+	const nowMs = Date.now();
+	const cooldownMsApplied = Math.max(0, lastRestartEmittedAt + RESTART_COOLDOWN_MS - nowMs);
+	const requestedDueAt = nowMs + delayMs + cooldownMsApplied;
+	if (hasUnconsumedRestartSignal()) {
+		restartLog.warn(`restart request coalesced (already in-flight) reason=${reason ?? "unspecified"} ${formatRestartAudit(opts?.audit)}`);
+		return {
+			ok: true,
+			pid: process.pid,
+			signal: "SIGUSR1",
+			delayMs: 0,
+			reason,
+			mode,
+			coalesced: true,
+			cooldownMsApplied
+		};
+	}
+	if (pendingRestartTimer) {
+		const remainingMs = Math.max(0, pendingRestartDueAt - nowMs);
+		if (requestedDueAt < pendingRestartDueAt) {
+			restartLog.warn(`restart request rescheduled earlier reason=${reason ?? "unspecified"} pendingReason=${pendingRestartReason ?? "unspecified"} oldDelayMs=${remainingMs} newDelayMs=${Math.max(0, requestedDueAt - nowMs)} ${formatRestartAudit(opts?.audit)}`);
+			clearPendingScheduledRestart();
+		} else {
+			restartLog.warn(`restart request coalesced (already scheduled) reason=${reason ?? "unspecified"} pendingReason=${pendingRestartReason ?? "unspecified"} delayMs=${remainingMs} ${formatRestartAudit(opts?.audit)}`);
+			return {
+				ok: true,
+				pid: process.pid,
+				signal: "SIGUSR1",
+				delayMs: remainingMs,
+				reason,
+				mode,
+				coalesced: true,
+				cooldownMsApplied
+			};
+		}
+	}
+	pendingRestartDueAt = requestedDueAt;
+	pendingRestartReason = reason;
+	pendingRestartTimer = setTimeout(() => {
+		pendingRestartTimer = null;
+		pendingRestartDueAt = 0;
+		pendingRestartReason = void 0;
+		const pendingCheck = preRestartCheck;
+		if (!pendingCheck) {
+			emitGatewayRestart();
+			return;
+		}
+		deferGatewayRestartUntilIdle({ getPendingCount: pendingCheck });
+	}, Math.max(0, requestedDueAt - nowMs));
+	return {
+		ok: true,
+		pid: process.pid,
+		signal: "SIGUSR1",
+		delayMs: Math.max(0, requestedDueAt - nowMs),
+		reason,
+		mode,
+		coalesced: false,
+		cooldownMsApplied
+	};
+}
+
+//#endregion
+export { setCommandLaneConcurrency as _, markGatewaySigusr1RestartHandled as a, setPreRestartDeferralCheck as c, enqueueCommandInLane as d, getActiveTaskCount as f, resetAllLanes as g, markGatewayDraining as h, isGatewaySigusr1RestartExternallyAllowed as i, triggerOpenClawRestart as l, getTotalQueueSize as m, deferGatewayRestartUntilIdle as n, scheduleGatewaySigusr1Restart as o, getQueueSize as p, emitGatewayRestart as r, setGatewaySigusr1RestartPolicy as s, consumeGatewaySigusr1RestartAuthorization as t, clearCommandLane as u, waitForActiveTasks as v, CommandLane as y };