@nikolasp98/minion 2026.6.13-dev.20260616002242 → 2026.6.14-dev

package/dist/{exec-approvals-cli-B3afwmyy.js → exec-approvals-cli-DMlA8VUt.js}

@@ -2,10 +2,10 @@ import { St as theme, g as defaultRuntime, xt as isRich } from "./entry.js";
 import { n as formatTimeAgo } from "./format-relative-Bjc3l98W.js";
 import { c as readExecApprovalsSnapshot, p as saveExecApprovals } from "./exec-approvals-9-5NQEhL.js";
 import { t as formatDocsLink } from "./links-B03m-P2Z.js";
-import { n as callGatewayFromCli } from "./gateway-rpc-DISv5FNW.js";
+import { n as callGatewayFromCli } from "./gateway-rpc-DoWGDu53.js";
 import { t as renderTable } from "./table-C83lTYaN.js";
 import { t as describeUnknownError } from "./shared-C-PEQv_O.js";
-import { i as resolveNodeId, r as nodesCallOpts } from "./rpc-0sy58ASH.js";
+import { i as resolveNodeId, r as nodesCallOpts } from "./rpc-BHHw6gvp.js";
 import JSON5 from "json5";
 import fs from "node:fs/promises";
 //#region src/cli/exec-approvals-cli.ts

package/dist/extensionAPI.d.ts

@@ -2308,6 +2308,14 @@ type GatewayConfig = {
   messageLedger?: {
     enabled?: boolean;
     dbPath?: string;
+    /**
+     * Import a channel's existing conversations as ledger rows on (re)connect,
+     * so they can be harvested into CRM contacts even before any new message
+     * arrives. Currently WhatsApp only (Baileys `messaging-history.set`): each
+     * 1:1 chat becomes one idempotent inbound shell row. Enabling this also
+     * requests a full WhatsApp history sync. Off by default. Fork-specific.
+     */
+    importContacts?: boolean;
   };
   /**
    * Memory sync: fire-and-forget shipping of captured agent memories to the hub

package/dist/extensionAPI.js

@@ -1,13 +1,13 @@
-import { f as extractTextFromChatContent, m as __exportAll } from "./pi-embedded-utils-BsHXtv_s.js";
+import { f as extractTextFromChatContent, m as __exportAll } from "./pi-embedded-utils-BEjLqKiL.js";
 import { A as normalizeE164, H as logVerbose, N as resolveUserPath, k as isRecord, n as defaultRuntime, t as createSubsystemLogger, u as normalizeChannelId, ut as resolveStateDir, z as truncateUtf16Safe } from "./subsystem-Bz8lTz2g.js";
 import { A as DEFAULT_AGENT_ID, B as sanitizeAgentId, C as ensureAgentWorkspace, F as normalizeAccountId, G as parseAgentSessionKey, I as normalizeAgentId, M as buildAgentMainSessionKey, R as resolveAgentIdFromSessionKey, W as isSubagentSessionKey, c as resolveAgentWorkspaceDir, n as resolveAgentConfig, r as resolveAgentDir, u as resolveSessionAgentId, z as resolveThreadSessionKeys } from "./agent-scope-G3FqXqqy.js";
 import { i as logDebug, s as logWarn } from "./exec-DWwKe_AW.js";
 import { E as resolveEnvApiKey, S as getApiKeyForModel, Y as ensureAuthProfileStore, d as resolveDefaultModelForAgent, dt as DEFAULT_MODEL, f as resolveModelRefFromString, ft as DEFAULT_PROVIDER, it as resolveCliName, m as resolveThinkingDefault, o as modelKey, q as listProfilesForProvider, r as buildModelAliasIndex, rt as formatCliCommand, t as buildAllowedModelSet, u as resolveConfiguredModelRef, w as requireApiKey } from "./model-selection-CpCBvCTw.js";
-import { A as abortEmbeddedPiRun, C as replaceSubagentRunAfterSteer, D as resolveAgentTimeoutMs, E as clearSessionQueues, F as resolveAgentIdentity, M as resolveUserTimeFormat, N as resolveUserTimezone, O as runEmbeddedPiAgent, P as getSubagentDepthFromSessionStore, S as markSubagentRunTerminated, T as getFollowupQueueDepth, _ as applyModelOverrideToSessionEntry, a as truncateLine, b as listSubagentRunsForRequester, c as resolveSubagentLabel, d as normalizeGroupActivation, f as loadProviderUsageSummary, g as buildStatusMessage, h as resolveModelAuthLabel, i as resolveTotalTokens, j as formatUserTime, k as loadCombinedSessionStoreForGateway, l as resolveSubagentTargetFromRuns, m as resolveUsageProviderId, n as formatDurationCompact, o as spawnSubagentDirect, p as formatUsageWindowSummary, r as formatTokenUsageDisplay, s as getTemplate, t as resolvePluginTools, u as sortSubagentRuns, v as loadModelCatalog, w as resolveQueueSettings, x as markSubagentRunForSteerRestart, y as clearSubagentRunSteerRestart } from "./tools-BOIsoaYH.js";
+import { A as abortEmbeddedPiRun, C as replaceSubagentRunAfterSteer, D as resolveAgentTimeoutMs, E as clearSessionQueues, F as resolveAgentIdentity, M as resolveUserTimeFormat, N as resolveUserTimezone, O as runEmbeddedPiAgent, P as getSubagentDepthFromSessionStore, S as markSubagentRunTerminated, T as getFollowupQueueDepth, _ as applyModelOverrideToSessionEntry, a as truncateLine, b as listSubagentRunsForRequester, c as resolveSubagentLabel, d as normalizeGroupActivation, f as loadProviderUsageSummary, g as buildStatusMessage, h as resolveModelAuthLabel, i as resolveTotalTokens, j as formatUserTime, k as loadCombinedSessionStoreForGateway, l as resolveSubagentTargetFromRuns, m as resolveUsageProviderId, n as formatDurationCompact, o as spawnSubagentDirect, p as formatUsageWindowSummary, r as formatTokenUsageDisplay, s as getTemplate, t as resolvePluginTools, u as sortSubagentRuns, v as loadModelCatalog, w as resolveQueueSettings, x as markSubagentRunForSteerRestart, y as clearSubagentRunSteerRestart } from "./tools-DHQl5ndU.js";
 import { n as recallMemories } from "./memory-sink-Cai9LXP2.js";
-import { n as createKnowledgeGraphTools, t as KnowledgeGraphSession } from "./knowledge-graph-BGqH6iEp.js";
-import { _ as parseDurationMs, i as resolveConfigSnapshotHash, n as loadConfig } from "./config-IIUu4YLi.js";
-import { _ as parseReplyDirectives, g as normalizeTargetForProvider, h as normalizeChannelTargetInput, m as buildTargetResolverSignature } from "./ir-xoKEMB_a.js";
+import { n as createKnowledgeGraphTools, t as KnowledgeGraphSession } from "./knowledge-graph-BKiuRnet.js";
+import { _ as parseDurationMs, i as resolveConfigSnapshotHash, n as loadConfig } from "./config-Bad23vig.js";
+import { _ as parseReplyDirectives, g as normalizeTargetForProvider, h as normalizeChannelTargetInput, m as buildTargetResolverSignature } from "./ir-_p6R0VXT.js";
 import { t as wrapToolWithTracking } from "./tool-tracking-BfpUmfBM.js";
 import { n as formatErrorMessage } from "./errors-DInjg6Ku.js";
 import { n as normalizeSecretInput } from "./normalize-secret-input-Ct6H42vX.js";
@@ -16,30 +16,30 @@ import { h as imageMimeFromFormat, i as resolveImageSanitizationLimits, p as ext
 import { a as readNumberParam, i as jsonResult, n as imageResult, o as readStringArrayParam, r as imageResultFromFile, s as readStringParam } from "./common-mPQVYX41.js";
 import { a as INTERNAL_MESSAGE_CHANNEL, h as GATEWAY_CLIENT_NAMES, l as listDeliverableMessageChannels, m as GATEWAY_CLIENT_MODES, o as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, u as normalizeMessageChannel } from "./input-provenance-BUf7opno.js";
 import { a as normalizeWhatsAppTarget, f as resolveDiscordAccount, i as isWhatsAppGroupJid, l as resolveSlackAccount, n as listChannelPlugins, r as normalizeChannelId$1, t as getChannelPlugin } from "./plugins-7HkLtO7B.js";
-import { V as normalizeStringEntriesLower, i as loadSessionStore, l as updateSessionStore, n as appendAssistantMessageToSessionTranscript, o as recordSessionMetaFromInbound, s as saveSessionStore, t as extractDeliveryInfo, y as capArrayByJsonBytes } from "./sessions-C8o68kYY.js";
+import { V as normalizeStringEntriesLower, i as loadSessionStore, l as updateSessionStore, n as appendAssistantMessageToSessionTranscript, o as recordSessionMetaFromInbound, s as saveSessionStore, t as extractDeliveryInfo, y as capArrayByJsonBytes } from "./sessions-CeClbleZ.js";
 import { n as SILENT_REPLY_TOKEN } from "./tokens-Dxroopzl.js";
 import { i as stripHeartbeatToken, n as AGENT_LANE_SUBAGENT, t as AGENT_LANE_NESTED } from "./lanes-BR5o5mOf.js";
-import { _ as listChannelSupportedActions, a as ambiguousTargetError, b as parseTelegramTarget, f as createSlackWebClient, o as unknownTargetError, r as resolveOutboundTarget, t as buildAgentSessionKey, x as resolveTelegramTargetChatType } from "./resolve-route-BuDsUAp2.js";
-import { b as textToSpeech } from "./tts-5tm68-op.js";
-import { l as assertMediaNotDataUrl, p as resolveSandboxedMediaSource } from "./workspace-CcTveER4.js";
-import { x as DEFAULT_AI_SNAPSHOT_MAX_CHARS } from "./chrome-iX7jX5OS.js";
-import { c as DEFAULT_UPLOAD_DIR, l as resolvePathsWithinRoot, o as saveMediaBuffer, r as resolveBrowserConfig, s as DEFAULT_DOWNLOAD_DIR } from "./server-context-BmpZ_o4F.js";
+import { _ as listChannelSupportedActions, a as ambiguousTargetError, b as parseTelegramTarget, f as createSlackWebClient, o as unknownTargetError, r as resolveOutboundTarget, t as buildAgentSessionKey, x as resolveTelegramTargetChatType } from "./resolve-route-x8nX2Bvi.js";
+import { b as textToSpeech } from "./tts-BIIXe002.js";
+import { l as assertMediaNotDataUrl, p as resolveSandboxedMediaSource } from "./workspace-5GvwPOFe.js";
+import { x as DEFAULT_AI_SNAPSHOT_MAX_CHARS } from "./chrome-CZH2epNE.js";
+import { c as DEFAULT_UPLOAD_DIR, l as resolvePathsWithinRoot, o as saveMediaBuffer, r as resolveBrowserConfig, s as DEFAULT_DOWNLOAD_DIR } from "./server-context-DKIIU2b6.js";
 import { t as SsrFBlockedError } from "./ssrf-DWqM0QRy.js";
-import { a as decodeDataUrl, f as normalizeWorkspaceDir, h as ensureOpenClawModelsJson, i as coerceImageModelConfig, o as resolveProviderVisionModelFromConfig, p as resolveWorkspaceRoot, r as coerceImageAssistantText, s as minimaxUnderstandImage, t as runWithImageModelFallback } from "./model-fallback-Cui8eNG0.js";
-import { n as randomIdempotencyKey, t as callGateway } from "./call-B6tcVJsz.js";
-import { n as readGatewayCallOptions, r as resolveGatewayOptions$1, t as callGatewayTool } from "./gateway-BTIu_WkF.js";
-import { n as resolveNodeId, r as resolveNodeIdFromList, t as listNodes } from "./nodes-utils-sk7SkOXJ.js";
+import { a as decodeDataUrl, f as normalizeWorkspaceDir, h as ensureOpenClawModelsJson, i as coerceImageModelConfig, o as resolveProviderVisionModelFromConfig, p as resolveWorkspaceRoot, r as coerceImageAssistantText, s as minimaxUnderstandImage, t as runWithImageModelFallback } from "./model-fallback-DLcFpp9D.js";
+import { n as randomIdempotencyKey, t as callGateway } from "./call-lVSGXvNm.js";
+import { n as readGatewayCallOptions, r as resolveGatewayOptions$1, t as callGatewayTool } from "./gateway-C2etf3RM.js";
+import { n as resolveNodeId, r as resolveNodeIdFromList, t as listNodes } from "./nodes-utils-BQ7_niGR.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-6r0F3dD_.js";
-import { n as discoverModels, t as discoverAuthStorage } from "./pi-model-discovery-C9mzQkkq.js";
+import { n as discoverModels, t as discoverAuthStorage } from "./pi-model-discovery-CQ80N8DY.js";
 import { t as stripReasoningTagsFromText } from "./reasoning-tags-DYznQbdm.js";
 import { n as loadWebMedia, t as getDefaultLocalRoots } from "./load-DKwJGFTz.js";
-import { a as stripToolMessages, c as resolveEffectiveSessionToolsVisibility, d as resolveDisplaySessionKey, f as resolveInternalSessionKey, h as shouldResolveSessionIdInput, l as resolveSandboxedSessionToolContext, m as resolveSessionReference, n as deriveChannel, o as createAgentToAgentPolicy, p as resolveMainSessionAlias, r as extractAssistantText, s as createSessionVisibilityGuard, t as classifySessionKind, u as isRequesterSpawnedSessionVisible } from "./sessions-helpers-D9_LcHW9.js";
+import { a as stripToolMessages, c as resolveEffectiveSessionToolsVisibility, d as resolveDisplaySessionKey, f as resolveInternalSessionKey, h as shouldResolveSessionIdInput, l as resolveSandboxedSessionToolContext, m as resolveSessionReference, n as deriveChannel, o as createAgentToAgentPolicy, p as resolveMainSessionAlias, r as extractAssistantText, s as createSessionVisibilityGuard, t as classifySessionKind, u as isRequesterSpawnedSessionVisible } from "./sessions-helpers-B4-7MIpM.js";
 import { n as wrapExternalContent, r as wrapWebContent } from "./external-content-BeJGOgQK.js";
 import { t as scheduleGatewaySigusr1Restart } from "./restart-DTw1wkyF.js";
 import { a as applyTargetToParams, i as stringEnum, n as channelTargetsSchema, o as actionHasTarget, r as optionalStringEnum, s as actionRequiresTarget, t as channelTargetSchema } from "./typebox-AaaT2Z0h.js";
-import { i as throwIfAborted, r as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-arEeQQHJ.js";
+import { i as throwIfAborted, r as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-BY_ZOJRJ.js";
 import { a as writeCameraClipPayloadToFile, c as asString, i as writeBase64ToFile, l as resolveTempPathParts, n as parseCameraClipPayload, o as writeUrlToFile, r as parseCameraSnapPayload, s as asRecord, t as cameraTempPath } from "./nodes-camera-C2Ht8dH1.js";
-import { _ as fetchBrowserJson, a as browserSnapshot, c as browserStop, d as browserArmDialog, f as browserArmFileChooser, g as browserWaitForDownload, h as browserScreenshotAction, i as browserProfiles, l as browserTabs, m as browserNavigate, n as browserFocusTab, o as browserStart, p as browserDownload, r as browserOpenTab, s as browserStatus, t as browserCloseTab, u as browserAct, v as buildProfileQuery, y as withBaseUrl } from "./client-0Q0z75AO.js";
+import { _ as fetchBrowserJson, a as browserSnapshot, c as browserStop, d as browserArmDialog, f as browserArmFileChooser, g as browserWaitForDownload, h as browserScreenshotAction, i as browserProfiles, l as browserTabs, m as browserNavigate, n as browserFocusTab, o as browserStart, p as browserDownload, r as browserOpenTab, s as browserStatus, t as browserCloseTab, u as browserAct, v as buildProfileQuery, y as withBaseUrl } from "./client-4GINRkn3.js";
 import { a as resolveTimeoutSeconds, i as resolveCacheTtlMs, n as readCacheShared, o as withTimeout, r as readResponseText, s as writeCacheShared, t as normalizeCacheKey } from "./web-shared-wFHHPl7K.js";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{gateway-BTIu_WkF.js → gateway-C2etf3RM.js}

@@ -1,8 +1,8 @@
 import { st as resolveGatewayPort } from "./subsystem-Bz8lTz2g.js";
-import { n as loadConfig } from "./config-IIUu4YLi.js";
+import { n as loadConfig } from "./config-Bad23vig.js";
 import { s as readStringParam } from "./common-mPQVYX41.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./input-provenance-BUf7opno.js";
-import { t as callGateway } from "./call-B6tcVJsz.js";
+import { t as callGateway } from "./call-lVSGXvNm.js";
 //#region src/agents/tools/automation/gateway.ts
 function readGatewayCallOptions(params) {
 	return {

package/dist/{gateway-DWsA8AiN.js → gateway-CHsNxUxJ.js}

@@ -1,9 +1,9 @@
 import { f as resolveGatewayPort } from "./paths-Ce170Tex.js";
-import { i as loadConfig } from "./io-dX6aN0-I.js";
-import "./config-CwI9qbLc.js";
+import { i as loadConfig } from "./io-DWhsHb_h.js";
+import "./config-CJnHZ6tT.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-_gH8UHtd.js";
 import { s as readStringParam } from "./common-CRD8HhuP.js";
-import { n as callGateway } from "./call-BWHz092V.js";
+import { n as callGateway } from "./call-BH1OgnGt.js";
 //#region src/agents/tools/automation/gateway.ts
 function readGatewayCallOptions(params) {
 	return {

package/dist/{gateway-BWFLBWYE.js → gateway-CzCJQJHj.js}

@@ -1,7 +1,7 @@
 import { f as resolveGatewayPort } from "./paths-aEg9UgoF.js";
-import { i as loadConfig } from "./io-87ZCDtw1.js";
-import "./config-CA9SbGZY.js";
-import { n as callGateway } from "./call-CNVcH2oR.js";
+import { i as loadConfig } from "./io-D2T0KwYe.js";
+import "./config-ULIrsUrF.js";
+import { n as callGateway } from "./call-DaiN21tT.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-C02KGm4w.js";
 import { s as readStringParam } from "./common-BHzo6lXS.js";
 //#region src/agents/tools/automation/gateway.ts

package/dist/{gateway-cli-dYwREBbX.js → gateway-cli-B1dfOPMr.js}

@@ -14,47 +14,47 @@ import { n as buildWorkspaceSkillSnapshot, r as loadWorkspaceSkillEntries } from
 import "./skills-DMPRReoe.js";
 import { l as isTestDefaultMemorySlotDisabled, n as loadPluginManifestRegistry } from "./manifest-registry-DCVfom1u.js";
 import { t as buildWorkspaceSkillStatus } from "./skills-status-DDzkv-Rj.js";
-import { E as parseDurationMs, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, w as sensitive, y as resolveSubagentMaxConcurrent } from "./validation-BNYj_b3N.js";
-import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-87ZCDtw1.js";
-import { n as migrateLegacyConfig } from "./config-CA9SbGZY.js";
+import { E as parseDurationMs, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, w as sensitive, y as resolveSubagentMaxConcurrent } from "./validation-CG8Ui8_v.js";
+import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-D2T0KwYe.js";
+import { n as migrateLegacyConfig } from "./config-ULIrsUrF.js";
 import { $ as validateNodeDescribeParams, A as validateCronRunsParams, At as validateToolsUpdateParams, B as validateExecApprovalRequestParams, Bt as errorShape, C as validateConfigSchemaParams, Ct as validateSkillsStatusParams, D as validateCronListParams, Dt as validateTelegramValidateTokenParams, E as validateCronAddParams, Et as validateTalkModeParams, F as validateDevicePairRejectParams, Ft as validateWizardCancelParams, G as validateExecApprovalsSetParams, Gt as deriveDeviceIdFromPublicKey, H as validateExecApprovalsGetParams, Ht as buildDeviceAuthPayload, I as validateDevicePairRemoveParams, It as validateWizardNextParams, J as validateMeshPlanParams, Jt as verifyDeviceSignature, K as validateLogsTailParams, L as validateDeviceTokenRevokeParams, Lt as validateWizardStartParams, M as validateCronUpdateParams, Mt as validateWakeParams, N as validateDevicePairApproveParams, Nt as validateWebLoginStartParams, O as validateCronRemoveParams, Ot as validateToolsOverridesSetParams, P as validateDevicePairListParams, Pt as validateWebLoginWaitParams, Q as validateModelsListParams, R as validateDeviceTokenRotateParams, Rt as validateWizardStatusParams, S as validateConfigPatchParams, St as validateSkillsInstallParams, T as validateConnectParams, Tt as validateTalkConfigParams, U as validateExecApprovalsNodeGetParams, Ut as normalizeDeviceAuthScopes, V as validateExecApprovalResolveParams, Vt as parseSessionLabel, W as validateExecApprovalsNodeSetParams, X as validateMeshRunParams, Y as validateMeshRetryParams, Z as validateMeshStatusParams, _ as validateChatHistoryParams, _t as validateSessionsPreviewParams, a as validateAgentWaitParams, at as validateNodePairListParams, b as validateConfigApplyParams, bt as validateSessionsUsageParams, c as validateAgentsFilesGetParams, ct as validateNodePairVerifyParams, d as validateAgentsListParams, dt as validateRequestFrame, et as validateNodeEventParams, f as validateAgentsSkillsSetParams, ft as validateSendParams, g as validateChatAbortParams, gt as validateSessionsPatchParams, h as validateChannelsStatusParams, ht as validateSessionsListParams, i as validateAgentParams, it as validateNodePairApproveParams, j as validateCronStatusParams, jt as validateUpdateRunParams, k as validateCronRunParams, kt as validateToolsStatusParams, l as validateAgentsFilesListParams, lt as validateNodeRenameParams, m as validateChannelsLogoutParams, mt as validateSessionsDeleteParams, n as formatValidationErrors, nt as validateNodeInvokeResultParams, o as validateAgentsCreateParams, ot as validateNodePairRejectParams, p as validateAgentsUpdateParams, pt as validateSessionsCompactParams, q as validateMeshPlanAutoParams, qt as normalizeDevicePublicKeyBase64Url, r as validateAgentIdentityParams, rt as validateNodeListParams, s as validateAgentsDeleteParams, st as validateNodePairRequestParams, tt as validateNodeInvokeParams, u as validateAgentsFilesSetParams, ut as validatePollParams, v as validateChatInjectParams, vt as validateSessionsResetParams, w as validateConfigSetParams, wt as validateSkillsUpdateParams, x as validateConfigGetParams, xt as validateSkillsBinsParams, y as validateChatSendParams, yt as validateSessionsResolveParams, z as validateDiscordValidateTokenParams, zt as ErrorCodes } from "./client-DaLwaG9G.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C0DLwT7t.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-CNVcH2oR.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-DaiN21tT.js";
 import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-C02KGm4w.js";
 import { c as pickPrimaryLanIPv4, d as resolveGatewayListenHosts, f as resolveHostName, i as isTrustedProxyAddress, l as resolveGatewayBindHost, n as isLoopbackHost, o as normalizeHostHeader, p as rawDataToString, r as isPrivateOrLoopbackAddress, t as isLoopbackAddress, u as resolveGatewayClientIp } from "./net-C0W-QK7p.js";
 import { i as normalizeInputProvenance } from "./input-provenance-ChJN5mZj.js";
-import { $ as isSteppedBuildEnabled, $t as setSkillsRemoteRegistry, A as loadOpenClawPlugins, An as registerUnhandledRejectionHandler, At as buildSectionRenderContext, B as getTotalPendingReplies, Bn as formatZonedTimestamp, C as createOpenClawCodingTools, Cn as applyVerboseOverride, D as getPluginToolMeta, Dt as assembleAgentSystemPromptWithSections, E as buildDefaultToolPolicyPipelineSteps, En as isSystemEventContextChanged, F as openMessageLedger, Fn as extractImageContentFromSource, Ft as buildSystemPromptParams, Gn as stopSubagentsForRequester, Gt as normalizeSendPolicy, Ht as requestHeartbeatNow, I as patchRouting, In as normalizeMimeList, It as buildSystemPromptReport, J as setCliSessionId, Jt as primeRemoteSkillsCache, K as resolveCronStyleNow, Kt as resolveSendPolicy, L as record, Ln as resolveInputFileLimits, M as closeMessageLedger, Mn as DEFAULT_INPUT_IMAGE_MIMES, Mt as PromptSectionRegistry, N as markFailed, Nt as PROSE_GLOBAL_ROOT, Ot as getBuiltinSectionRegistry, P as markSynced, Pn as extractFileContentFromSource, Pt as _clearProseCache, Q as debugStepContinue, Qt as removeRemoteNodeInfo, R as dispatchInboundMessage, S as readConsolidationState, Sn as applyModelOverrideToSessionEntry, St as loadProviderUsageSummary, T as applyToolPolicyPipeline, Tn as enqueueSystemEvent, Un as resolveUserTimezone, W as BARE_SESSION_RESET_PROMPT, Wn as isAbortTrigger, Xt as refreshRemoteBinsForConnectedNodes, Y as runCliAgent, Yn as clearSessionQueues, Yt as recordRemoteNodeInfo, Z as debugSkipAll, Zn as resolveAgentIdentity, Zt as refreshRemoteNodeBins, _ as listForCurrentInstance, an as updatePairedNodeMetadata, ar as setCommandLaneConcurrency, b as markRecoveryAttempt, bn as buildAuthHealthSummary, cn as hashToken, cr as clearAgentRunContext, ct as spawnSubagentDirect, d as abortEmbeddedPiRun, dn as resolvePairingPaths, dr as onAgentEvent, dt as getTemplateCache, en as approveNodePairing, er as resolveBootstrapContextForRun, et as setDebugStepBroadcaster, f as getActiveEmbeddedRunCount, fn as readJsonFile, fr as registerAgentRunContext, ft as getTemplateLoadErrors, g as deleteRow, gn as registerSkillsChangeListener, h as closeInFlightTurnsStore, hn as getSkillsSnapshotVersion, ht as stopTemplateWatcher, i as listDescendantRunsForRequester, in as requestNodePairing, ir as resetAllLanes, j as claimBatch, jt as buildToolSummaryMap, k as loadMinionPlugins, l as runSubagentAnnounceFlow, ln as verifyPairingToken, lr as emitAgentEvent, lt as getLastReloadAt, m as waitForEmbeddedPiRunEnd, mn as createAsyncLock, mt as initTemplateLoader, n as countActiveDescendantRuns, nn as rejectNodePairing, nt as createOpenClawTools, on as verifyNodeToken, or as waitForActiveTasks, p as queueEmbeddedPiMessage, pn as writeJsonAtomic, pt as getTemplateUsageStats, q as getCliSessionId, qt as getRemoteSkillEligibility, r as initSubagentRegistry, rn as renamePairedNode, rr as getTotalQueueSize, rt as TOOL_REGISTRY, s as markSubagentRunTerminated, sn as generatePairingToken, sr as resolveAgentTimeoutMs, tn as listNodePairing, tr as getActiveTaskCount, tt as setSteppedBuild, u as runEmbeddedPiAgent, un as pruneExpiredPending, ur as getAgentRunContext, ut as getTemplate, v as listFromOtherInstances, wn as parseVerboseOverride, x as openInFlightTurnsStore, xt as normalizeGroupActivation, y as markInterrupted, z as createReplyDispatcher, zn as transcribeOpenAiCompatibleAudio } from "./subagent-registry-Dr8IyuUy.js";
-import { $ as mergeDeliveryContext, C as cleanStaleLockFiles, E as evaluateSessionFreshness, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, L as resolveMainSessionKeyFromConfig, M as resolveFreshSessionTotalTokens, N as canonicalizeMainSessionAlias, O as resolveSessionResetPolicy, P as resolveAgentMainSessionKey, Z as deliveryContextFromSession, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, g as capArrayByJsonBytes, h as archiveSessionTranscripts, m as archiveFileOnDisk, n as parseSessionThreadInfo, t as extractDeliveryInfo, tt as normalizeSessionDeliveryFields, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, x as stripEnvelopeFromMessages, z as snapshotSessionOrigin } from "./sessions-BUJYqVut.js";
+import { $ as isSteppedBuildEnabled, $t as setSkillsRemoteRegistry, A as loadOpenClawPlugins, An as registerUnhandledRejectionHandler, At as buildSectionRenderContext, B as getTotalPendingReplies, Bn as formatZonedTimestamp, C as createOpenClawCodingTools, Cn as applyVerboseOverride, D as getPluginToolMeta, Dt as assembleAgentSystemPromptWithSections, E as buildDefaultToolPolicyPipelineSteps, En as isSystemEventContextChanged, F as openMessageLedger, Fn as extractImageContentFromSource, Ft as buildSystemPromptParams, Gn as stopSubagentsForRequester, Gt as normalizeSendPolicy, Ht as requestHeartbeatNow, I as patchRouting, In as normalizeMimeList, It as buildSystemPromptReport, J as setCliSessionId, Jt as primeRemoteSkillsCache, K as resolveCronStyleNow, Kt as resolveSendPolicy, L as record, Ln as resolveInputFileLimits, M as closeMessageLedger, Mn as DEFAULT_INPUT_IMAGE_MIMES, Mt as PromptSectionRegistry, N as markFailed, Nt as PROSE_GLOBAL_ROOT, Ot as getBuiltinSectionRegistry, P as markSynced, Pn as extractFileContentFromSource, Pt as _clearProseCache, Q as debugStepContinue, Qt as removeRemoteNodeInfo, R as dispatchInboundMessage, S as readConsolidationState, Sn as applyModelOverrideToSessionEntry, St as loadProviderUsageSummary, T as applyToolPolicyPipeline, Tn as enqueueSystemEvent, Un as resolveUserTimezone, W as BARE_SESSION_RESET_PROMPT, Wn as isAbortTrigger, Xt as refreshRemoteBinsForConnectedNodes, Y as runCliAgent, Yn as clearSessionQueues, Yt as recordRemoteNodeInfo, Z as debugSkipAll, Zn as resolveAgentIdentity, Zt as refreshRemoteNodeBins, _ as listForCurrentInstance, an as updatePairedNodeMetadata, ar as setCommandLaneConcurrency, b as markRecoveryAttempt, bn as buildAuthHealthSummary, cn as hashToken, cr as clearAgentRunContext, ct as spawnSubagentDirect, d as abortEmbeddedPiRun, dn as resolvePairingPaths, dr as onAgentEvent, dt as getTemplateCache, en as approveNodePairing, er as resolveBootstrapContextForRun, et as setDebugStepBroadcaster, f as getActiveEmbeddedRunCount, fn as readJsonFile, fr as registerAgentRunContext, ft as getTemplateLoadErrors, g as deleteRow, gn as registerSkillsChangeListener, h as closeInFlightTurnsStore, hn as getSkillsSnapshotVersion, ht as stopTemplateWatcher, i as listDescendantRunsForRequester, in as requestNodePairing, ir as resetAllLanes, j as claimBatch, jt as buildToolSummaryMap, k as loadMinionPlugins, l as runSubagentAnnounceFlow, ln as verifyPairingToken, lr as emitAgentEvent, lt as getLastReloadAt, m as waitForEmbeddedPiRunEnd, mn as createAsyncLock, mt as initTemplateLoader, n as countActiveDescendantRuns, nn as rejectNodePairing, nt as createOpenClawTools, on as verifyNodeToken, or as waitForActiveTasks, p as queueEmbeddedPiMessage, pn as writeJsonAtomic, pt as getTemplateUsageStats, q as getCliSessionId, qt as getRemoteSkillEligibility, r as initSubagentRegistry, rn as renamePairedNode, rr as getTotalQueueSize, rt as TOOL_REGISTRY, s as markSubagentRunTerminated, sn as generatePairingToken, sr as resolveAgentTimeoutMs, tn as listNodePairing, tr as getActiveTaskCount, tt as setSteppedBuild, u as runEmbeddedPiAgent, un as pruneExpiredPending, ur as getAgentRunContext, ut as getTemplate, v as listFromOtherInstances, wn as parseVerboseOverride, x as openInFlightTurnsStore, xt as normalizeGroupActivation, y as markInterrupted, z as createReplyDispatcher, zn as transcribeOpenAiCompatibleAudio } from "./subagent-registry-C4Xeveht.js";
+import { $ as mergeDeliveryContext, C as cleanStaleLockFiles, E as evaluateSessionFreshness, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, L as resolveMainSessionKeyFromConfig, M as resolveFreshSessionTotalTokens, N as canonicalizeMainSessionAlias, O as resolveSessionResetPolicy, P as resolveAgentMainSessionKey, Z as deliveryContextFromSession, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, g as capArrayByJsonBytes, h as archiveSessionTranscripts, m as archiveFileOnDisk, n as parseSessionThreadInfo, t as extractDeliveryInfo, tt as normalizeSessionDeliveryFields, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, x as stripEnvelopeFromMessages, z as snapshotSessionOrigin } from "./sessions-DlMPB0jU.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-BkvS7DSy.js";
 import { d as buildChannelAccountBindings, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-irMKpl65.js";
 import "./logging-D43UWj1X.js";
 import { r as resolveUserDir } from "./user-directory-D27je39W.js";
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-D59m1grH.js";
 import { a as stripHeartbeatToken } from "./lanes-L5j3C7cx.js";
-import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget } from "./resolve-route-3TryCcGm.js";
+import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget } from "./resolve-route-Bxvuje16.js";
 import { n as getMachineDisplayName } from "./with-timeout-BVhDEOTB.js";
 import { c as startDiagnosticHeartbeat, d as isDiagnosticsEnabled, l as stopDiagnosticHeartbeat } from "./diagnostic-BEEvI8Zw.js";
-import { g as getGlobalHookRunner, v as runGlobalGatewayStopSafely } from "./reply-payloads-D_-_qjhk.js";
+import { g as getGlobalHookRunner, v as runGlobalGatewayStopSafely } from "./reply-payloads-Doc7XJEA.js";
 import { C as OPENAI_TTS_MODELS, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-CRpGlsYO.js";
 import { c as detectMime } from "./image-ops-QvmG4zb9.js";
 import { a as defineDrone, i as runDrone, t as createGatewayDroneHost } from "./host-CafVbu36.js";
-import { K as resolveBootstrapMaxChars, a as formatXHighModelHint, c as normalizeElevatedLevel, d as normalizeUsageDisplay, f as normalizeVerboseLevel, i as formatThinkingLevels, l as normalizeReasoningLevel, m as supportsXHighThinking, q as resolveBootstrapTotalMaxChars, s as listThinkingLevels, u as normalizeThinkLevel } from "./pi-embedded-helpers-D9fHlhyc.js";
-import { c as resolveSandboxRuntimeStatus, g as collectExplicitAllowlist, p as TOOL_GROUPS, v as expandToolGroups, x as resolveToolProfilePolicy, y as mergeAlsoAllowPolicy } from "./sandbox-BGpWI5iG.js";
-import { a as enableTailscaleServeFunnel, i as enableTailscaleServe, n as disableTailscaleServe, r as enableTailscaleFunnel, s as getTailnetHostname, t as disableTailscaleFunnel } from "./tailscale-EgZafNge.js";
-import { a as resolveRequestClientIp, c as createAuthRateLimiter, i as resolveGatewayAuth, l as safeEqualSecret, n as authorizeGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as isLocalDirectRequest, s as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, t as assertGatewayAuthConfigured } from "./auth-B37vkorh.js";
-import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-CpEmSoJu.js";
+import { K as resolveBootstrapMaxChars, a as formatXHighModelHint, c as normalizeElevatedLevel, d as normalizeUsageDisplay, f as normalizeVerboseLevel, i as formatThinkingLevels, l as normalizeReasoningLevel, m as supportsXHighThinking, q as resolveBootstrapTotalMaxChars, s as listThinkingLevels, u as normalizeThinkLevel } from "./pi-embedded-helpers-BFVQgHYJ.js";
+import { c as resolveSandboxRuntimeStatus, g as collectExplicitAllowlist, p as TOOL_GROUPS, v as expandToolGroups, x as resolveToolProfilePolicy, y as mergeAlsoAllowPolicy } from "./sandbox-CGRbJpDU.js";
+import { a as enableTailscaleServeFunnel, i as enableTailscaleServe, n as disableTailscaleServe, r as enableTailscaleFunnel, s as getTailnetHostname, t as disableTailscaleFunnel } from "./tailscale-DztQ748s.js";
+import { a as resolveRequestClientIp, c as createAuthRateLimiter, i as resolveGatewayAuth, l as safeEqualSecret, n as authorizeGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as isLocalDirectRequest, s as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, t as assertGatewayAuthConfigured } from "./auth-CFiHbm6v.js";
+import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-CyRjTQlV.js";
 import { a as isErrno, n as formatErrorMessage } from "./errors-iV4-NKRR.js";
 import { i as formatPortDiagnostics, n as inspectPortUsage, t as ensurePortAvailable } from "./ports-CWP9QmS6.js";
 import { t as movePathToTrash } from "./trash-DPd6fFGH.js";
 import { a as traceGatewayEvent, n as pruneOldTraceFiles } from "./chat-trace-BMcJ2gl7.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-fZmRRpWO.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-BYpHkFGw.js";
 import { t as ToolInputError } from "./common-BHzo6lXS.js";
 import { i as isExternalHookSession, n as detectSuspiciousPatterns, r as getHookType, t as buildSafeExternalPrompt } from "./external-content-Css-cJoz.js";
-import { n as runWithModelFallback } from "./model-fallback-B_IR4wM4.js";
+import { n as runWithModelFallback } from "./model-fallback-DGrCGjis.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-2x6L37KS.js";
-import { n as loadModelCatalog } from "./model-catalog-BJJu7Y-K.js";
-import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, d as orgScopeVisible, f as lookupContextTokens, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as normalizeOrgIds } from "./session-utils-C6V1m0Vd.js";
-import { a as resolveSubagentToolPolicy, d as listAgentWorkspaceDirs, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-CyixHAJx.js";
+import { n as loadModelCatalog } from "./model-catalog-DXonO3lD.js";
+import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, d as orgScopeVisible, f as lookupContextTokens, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as normalizeOrgIds } from "./session-utils-JpLf3m4T.js";
+import { a as resolveSubagentToolPolicy, d as listAgentWorkspaceDirs, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-CixzOy4m.js";
 import { a as mergeExecApprovalsSocketDefaults, c as readExecApprovalsSnapshot, p as saveExecApprovals, r as ensureExecApprovals, s as normalizeExecApprovals, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-9-5NQEhL.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-b8aNuBYW.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format--dK3YoXf.js";
@@ -70,18 +70,18 @@ import { n as setGoogleAdcClient, t as getGoogleAdcClient } from "./hub-credenti
 import { a as normalizeOptionalAgentId, c as normalizePayloadToSystemText, d as buildDeliveryFromLegacyPayload, f as hasLegacyDeliveryHints, i as inferLegacyName, l as normalizeRequiredName, n as normalizeCronJobCreate, o as normalizeOptionalSessionKey, p as stripLegacyDeliveryFields, r as normalizeCronJobPatch, s as normalizeOptionalText, t as normalizeHttpWebhookUrl, u as migrateLegacyCronPayload } from "./webhook-url-DQ4SDf3R.js";
 import { i as parseAbsoluteTimeMs, n as resolveCronStaggerMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-BlvVswOf.js";
 import { a as summarizeRestartSentinel, n as formatDoctorNonInteractiveHint, r as formatRestartSentinelMessage, s as writeRestartSentinel, t as consumeRestartSentinel } from "./restart-sentinel-CFtgrOm4.js";
-import { c as loadChannelOutboundAdapter, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-CiN28QCt.js";
+import { c as loadChannelOutboundAdapter, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-DWPdKF44.js";
 import { n as resolveMessageChannelSelection } from "./channel-selection-Bzg2Xpo4.js";
-import { a as resetDirectoryCache, n as ensureOutboundSessionEntry, t as resolveOutboundSessionRoute } from "./outbound-session-BjJ_Kc2p.js";
+import { a as resetDirectoryCache, n as ensureOutboundSessionEntry, t as resolveOutboundSessionRoute } from "./outbound-session-bdqdT6c0.js";
 import { t as normalizePollInput } from "./polls-8i6CJXI7.js";
-import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-trCkc6Rj.js";
+import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-WEpy2gjj.js";
 import { a as runAggregation, n as executeOrchestration, r as readStatusJson, t as executePipeline } from "./orchestration-pipeline-Bi3YT3Jf.js";
 import { r as readManifest, t as completeManifest } from "./orchestration-manifest-DXWf2_x7.js";
-import { i as startBrowserControlServiceFromConfig, r as createBrowserControlContext, t as createBrowserRouteDispatcher } from "./dispatcher-BquAzCBK.js";
+import { i as startBrowserControlServiceFromConfig, r as createBrowserControlContext, t as createBrowserRouteDispatcher } from "./dispatcher-MqSl1Kll.js";
 import { n as persistBrowserProxyFiles, t as applyBrowserProxyPaths } from "./proxy-files-DtQxHMjp.js";
 import { r as cachedJson } from "./ttl-cache-CEaNnSl4.js";
 import { i as onHeartbeatEvent, r as getLastHeartbeatEvent, t as resolveHeartbeatVisibility } from "./heartbeat-visibility-BqNH_1lC.js";
-import { a as initUserSubsystem, d as sleepWithAbort, i as handleHubAssignmentChanged, l as buildHistoryContextFromEntries, n as resolveChannelSenderIdentity, r as getActiveUserSubsystem, s as mapRoleToScopes, t as createReplyPrefixOptions, u as computeBackoff } from "./reply-prefix-DiUpMQsM.js";
+import { a as initUserSubsystem, d as sleepWithAbort, i as handleHubAssignmentChanged, l as buildHistoryContextFromEntries, n as resolveChannelSenderIdentity, r as getActiveUserSubsystem, s as mapRoleToScopes, t as createReplyPrefixOptions, u as computeBackoff } from "./reply-prefix-Bf6xFewe.js";
 import { t as ensureMinionCliOnPath } from "./path-env-DpsCNe2h.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-_OH_n-zu.js";
 import { n as inheritOptionFromParent } from "./command-options-Dhjl7AMa.js";
@@ -90,27 +90,27 @@ import { t as WizardCancelledError } from "./prompts-E0FayNjJ.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-HNAIOJ_3.js";
 import { t as applyPluginAutoEnable } from "./plugin-auto-enable-CEWEwQIw.js";
 import { t as buildChannelAccountSnapshot } from "./status-Dg720jp3.js";
-import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-BxF3w4R5.js";
-import "./onboard-helpers-BzUHCvbd.js";
+import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-CdkG3FJh.js";
+import "./onboard-helpers-DvYmk4Z3.js";
 import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-DMloABxR.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-Cx6dCwYR.js";
-import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as formatHealthChannelLines, r as getHealthSnapshot, s as runHeartbeatOnce } from "./health-dMwMuCHD.js";
+import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as formatHealthChannelLines, r as getHealthSnapshot, s as runHeartbeatOnce } from "./health-D6n9mIOb.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-76BDB4BP.js";
 import { t as discoverGatewayBeacons } from "./bonjour-discovery-COG6-6UR.js";
 import { t as installSkill } from "./skills-install-DAphGXoj.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-B2N-dnoC.js";
 import { a as resolveNpmChannelTag, n as compareSemverStrings, p as normalizeUpdateChannel, t as checkUpdateStatus } from "./update-check-DUIvch0v.js";
-import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-DvuC2ZVh.js";
-import { a as probeGateway, i as resolveNodeCommandAllowlist, r as isNodeCommandAllowed } from "./audit-CSNd-phC.js";
+import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-CtTyPHvB.js";
+import { a as probeGateway, i as resolveNodeCommandAllowlist, r as isNodeCommandAllowed } from "./audit-bAFC5ey-.js";
 import { t as parsePort$1 } from "./parse-port-DA32M3gA.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-CPtjgknw.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-Ca2eoh9D.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-C-PEQv_O.js";
-import { n as createDefaultDeps, r as createOutboundSendDeps$1, t as createOutboundSendDeps } from "./outbound-send-deps-BECNMA9x.js";
+import { n as createDefaultDeps, r as createOutboundSendDeps$1, t as createOutboundSendDeps } from "./outbound-send-deps-BiCPa0bu.js";
 import { i as initCrypto, n as ProbeRegistry, r as SecretsManager, t as SecretStore } from "./store-CCYsWl7_.js";
-import { t as runOnboardingWizard } from "./onboarding-BJJPdTA6.js";
-import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-BvtEOSzu.js";
-import { h as resolveGmailPullRuntimeConfig } from "./gmail-BGbBY8iR.js";
-import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-NvyKtiKZ.js";
+import { t as runOnboardingWizard } from "./onboarding-CBci11Hg.js";
+import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-Ce38yX-Q.js";
+import { h as resolveGmailPullRuntimeConfig } from "./gmail-DQ48jQY-.js";
+import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-J4Hr7pxJ.js";
 import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-BRxsVIll.js";
 import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-B0q97NF_.js";
 import { n as setEmbedConcurrency } from "./qmd-embed-semaphore-CLBO94qU.js";
@@ -136,8 +136,8 @@ import { WebSocketServer } from "ws";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { Type } from "@sinclair/typebox";
 import net from "node:net";
-import { createServer } from "node:http";
-import { createServer as createServer$1 } from "node:https";
+import http, { createServer } from "node:http";
+import https, { createServer as createServer$1 } from "node:https";
 import { lookup } from "node:dns/promises";
 import chokidar from "chokidar";
 import { EventEmitter } from "node:events";
@@ -3975,7 +3975,7 @@ var UserRepository = class {
 const log$22 = createSubsystemLogger("free-tier/email");
 const RESEND_API = "https://api.resend.com/emails";
 const FROM = "OpenClaw <noreply@minion.ai>";
-async function send(to, subject, html) {
+async function send$1(to, subject, html) {
 	const apiKey = process.env["RESEND_API_KEY"];
 	if (!apiKey) {
 		log$22.warn("RESEND_API_KEY not set — email not sent", {
@@ -4007,7 +4007,7 @@ async function send(to, subject, html) {
 }
 async function sendVerificationEmail(email, token, baseUrl) {
 	const link = `${baseUrl}/auth/verify-email?token=${encodeURIComponent(token)}`;
-	await send(email, "Verify your OpenClaw email", `<p>Click the link below to verify your email address. It expires in 24 hours.</p>
+	await send$1(email, "Verify your OpenClaw email", `<p>Click the link below to verify your email address. It expires in 24 hours.</p>
 <p><a href="${link}">${link}</a></p>`);
 }
 //#endregion
@@ -18899,7 +18899,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-CXzX6Y8i.js");
+			const { handleNodeEvent } = await import("./server-node-events-DRsJK9ry.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			const nodeConnId = client?.connId;
 			await handleNodeEvent({
@@ -26406,7 +26406,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.MINION_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.MINION_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./dispatcher-BquAzCBK.js").then((n) => n.n);
+	const mod = override ? await import(override) : await import("./dispatcher-MqSl1Kll.js").then((n) => n.n);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -30481,6 +30481,118 @@ async function handleToolsInvokeHttpRequest(req, res, opts) {
 	return true;
 }
 //#endregion
+//#region src/gateway/workforce-proxy.ts
+/**
+* Workforce backend reverse-proxy (Minion Workforce, formerly Paperclip).
+*
+* The Workforce backend runs co-located with the gateway (localhost on the same
+* box) and is NOT publicly reachable. The hub (on Vercel) cannot reach it
+* directly over the private network, so it dials the gateway's public hostname
+* instead and the gateway forwards over loopback:
+*
+*   hub → https://<gw-public>/api/workforce-backend/api/companies/...   (TLS)
+*       → gateway strips /api/workforce-backend
+*       → http://127.0.0.1:3200/api/companies/...                        (loopback)
+*
+* This keeps the Workforce backend private (only the gateway is exposed, which
+* is already fronted by Cloudflare WAF) and turns the cross-machine hop into a
+* loopback hop. The backend self-authenticates on the forwarded board key /
+* x-hub-identity header, so this proxy is a thin forwarder.
+*
+* Opt-in: enabled only when MINION_WORKFORCE_UPSTREAM_URL is set (operators set
+* it on the box that runs the Workforce backend). On every other gateway the
+* handler is inert and the path 404s like any other unknown route.
+*
+* Optional hardening: set MINION_WORKFORCE_PROXY_SECRET to require a matching
+* x-workforce-proxy-secret header (the hub must then send it). When unset, the
+* proxy still requires a backend auth header to be present so it never behaves
+* as an open loopback proxy — the backend does the real validation.
+*/
+const PROXY_PREFIX = "/api/workforce-backend";
+const HOP_BY_HOP = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"host",
+	"x-workforce-proxy-secret"
+]);
+function send(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "application/json; charset=utf-8");
+	res.end(JSON.stringify({ error: body }));
+}
+/** True if the request looks like a legitimate hub→backend call. */
+function hasBackendAuth(req) {
+	const auth = req.headers["authorization"];
+	const hubId = req.headers["x-hub-identity"];
+	return typeof auth === "string" && auth.startsWith("Bearer ") || typeof hubId === "string" && hubId.length > 0;
+}
+/**
+* Forward a matched request to the Workforce backend. Returns true if the
+* request was handled (matched the proxy prefix), false to let the gateway's
+* remaining handlers try it.
+*/
+async function handleWorkforceProxyRequest(req, res) {
+	const upstreamBase = process.env.MINION_WORKFORCE_UPSTREAM_URL;
+	if (!upstreamBase) return false;
+	const url = new URL(req.url ?? "/", "http://localhost");
+	if (url.pathname !== PROXY_PREFIX && !url.pathname.startsWith(`${PROXY_PREFIX}/`)) return false;
+	const requiredSecret = process.env.MINION_WORKFORCE_PROXY_SECRET;
+	if (requiredSecret) {
+		const provided = req.headers["x-workforce-proxy-secret"];
+		if (!safeEqualSecret(Array.isArray(provided) ? provided[0] ?? "" : provided ?? "", requiredSecret)) {
+			send(res, 401, "workforce proxy: unauthorized");
+			return true;
+		}
+	} else if (!hasBackendAuth(req)) {
+		send(res, 401, "workforce proxy: missing backend auth header");
+		return true;
+	}
+	const rest = url.pathname.slice(22);
+	const base = upstreamBase.replace(/\/+$/, "");
+	const target = new URL(`${base}${rest || "/"}${url.search}`);
+	const headers = {};
+	for (const [k, v] of Object.entries(req.headers)) {
+		if (HOP_BY_HOP.has(k.toLowerCase())) continue;
+		if (v !== void 0) headers[k] = v;
+	}
+	headers["host"] = target.host;
+	const transport = target.protocol === "https:" ? https : http;
+	const options = {
+		protocol: target.protocol,
+		hostname: target.hostname,
+		port: target.port || (target.protocol === "https:" ? 443 : 80),
+		path: `${target.pathname}${target.search}`,
+		method: req.method,
+		headers
+	};
+	await new Promise((resolve) => {
+		const upstream = transport.request(options, (upstreamRes) => {
+			const responseHeaders = {};
+			for (const [k, v] of Object.entries(upstreamRes.headers)) {
+				if (HOP_BY_HOP.has(k.toLowerCase())) continue;
+				if (v !== void 0) responseHeaders[k] = v;
+			}
+			res.writeHead(upstreamRes.statusCode ?? 502, responseHeaders);
+			upstreamRes.pipe(res);
+			upstreamRes.on("end", () => resolve());
+			upstreamRes.on("error", () => resolve());
+		});
+		upstream.on("error", () => {
+			if (!res.headersSent) send(res, 502, "workforce proxy: upstream unreachable");
+			else res.end();
+			resolve();
+		});
+		req.pipe(upstream);
+	});
+	return true;
+}
+//#endregion
 //#region src/gateway/server-core/server-http.ts
 const HOOK_AUTH_FAILURE_LIMIT = 20;
 const HOOK_AUTH_FAILURE_WINDOW_MS = 6e4;
@@ -30888,6 +31000,7 @@ function createGatewayHttpServer(opts) {
 			const trustedProxies = configSnapshot.gateway?.trustedProxies ?? [];
 			const requestPath = new URL(req.url ?? "/", "http://localhost").pathname;
 			if (await handleHooksRequest(req, res)) return;
+			if (await handleWorkforceProxyRequest(req, res)) return;
 			if (await handleToolsInvokeHttpRequest(req, res, {
 				auth: resolvedAuth,
 				trustedProxies,
@@ -32152,7 +32265,7 @@ async function deliverFlowReply(sessionKey, reply) {
 	}
 	try {
 		const cfg = loadConfig();
-		const { deliverOutboundPayloads } = await import("./deliver-CiN28QCt.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-DWPdKF44.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg,
 			channel: target.channel,
@@ -33835,7 +33948,7 @@ function attachGatewayWsMessageHandler(params) {
 					mtUserRole = matchedSvc.role;
 					mtOrgId = "service";
 					mtAssignedAgentIds = matchedSvc.agentIds;
-					const { mapRoleToScopes: mapRole } = await import("./reply-prefix-DiUpMQsM.js").then((n) => n.c);
+					const { mapRoleToScopes: mapRole } = await import("./reply-prefix-Bf6xFewe.js").then((n) => n.c);
 					scopes = mapRole(matchedSvc.role);
 					connectParams.scopes = scopes;
 					authOk = true;
@@ -33876,7 +33989,7 @@ function attachGatewayWsMessageHandler(params) {
 					scopes = jwtResult.scopes;
 					connectParams.scopes = scopes;
 					if (jwtResult.jti) {
-						const { getActiveUserSubsystem } = await import("./reply-prefix-DiUpMQsM.js").then((n) => n.o);
+						const { getActiveUserSubsystem } = await import("./reply-prefix-Bf6xFewe.js").then((n) => n.o);
 						if (getActiveUserSubsystem()?.tokenRevocationStore.isRevoked(jwtResult.jti)) {
 							markHandshakeFailure("token-revoked", {
 								userId: mtUserId,
@@ -33924,7 +34037,7 @@ function attachGatewayWsMessageHandler(params) {
 						return;
 					}
 					if (mtUserId) {
-						const { provisionOnConnect } = await import("./reply-prefix-DiUpMQsM.js").then((n) => n.o);
+						const { provisionOnConnect } = await import("./reply-prefix-Bf6xFewe.js").then((n) => n.o);
 						const { resolveStateDir } = await import("./paths-aEg9UgoF.js").then((n) => n.i);
 						provisionOnConnect({
 							stateDir: resolveStateDir(process.env),
@@ -35818,8 +35931,8 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	});
 	if (!minimalTestGateway) cron.start().catch((err) => logCron.error(`failed to start: ${String(err)}`));
 	if (!minimalTestGateway) (async () => {
-		const { recoverPendingDeliveries } = await import("./deliver-CiN28QCt.js").then((n) => n.s);
-		const { deliverOutboundPayloads } = await import("./deliver-CiN28QCt.js").then((n) => n.n);
+		const { recoverPendingDeliveries } = await import("./deliver-DWPdKF44.js").then((n) => n.s);
+		const { deliverOutboundPayloads } = await import("./deliver-DWPdKF44.js").then((n) => n.n);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),