@nikolasp98/minion 2026.6.14-dev.20260616061802 → 2026.6.16-dev

package/dist/{gateway-cli-CUrxOlB4.js → gateway-cli-BbuSOWKq.js}

@@ -10,51 +10,51 @@ import { n as getEventStore, r as initEventSystem, t as emitEvent } from "./emit
 import { t as applySqlitePragmas } from "./sqlite-pragmas-C_o_lU6a.js";
 import { t as requireNodeSqlite } from "./sqlite-C3xwcWJn.js";
 import { d as setSentryTag, n as getReliabilityUptimeStartMs, r as initReliability, t as emitReliabilityEvent, u as setSentryContext } from "./reliability-L4etAGQV.js";
-import { n as buildWorkspaceSkillSnapshot, r as loadWorkspaceSkillEntries } from "./workspace-CSBTFAxh.js";
-import "./skills-DMPRReoe.js";
+import { n as buildWorkspaceSkillSnapshot, r as loadWorkspaceSkillEntries } from "./workspace-D5-DoTNR.js";
+import "./skills-DDhWBAii.js";
 import { l as isTestDefaultMemorySlotDisabled, n as loadPluginManifestRegistry } from "./manifest-registry-DCVfom1u.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-DDzkv-Rj.js";
-import { E as parseDurationMs, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, w as sensitive, y as resolveSubagentMaxConcurrent } from "./validation-CG8Ui8_v.js";
-import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-TKYkFbcF.js";
-import { n as migrateLegacyConfig } from "./config-ClkrcdId.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-CBTT87BN.js";
+import { E as parseDurationMs, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, w as sensitive, y as resolveSubagentMaxConcurrent } from "./validation-B-XaORq2.js";
+import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-C_Q6AU5E.js";
+import { n as migrateLegacyConfig } from "./config-DHYot764.js";
 import { $ as validateNodeDescribeParams, A as validateCronRunsParams, At as validateToolsUpdateParams, B as validateExecApprovalRequestParams, Bt as errorShape, C as validateConfigSchemaParams, Ct as validateSkillsStatusParams, D as validateCronListParams, Dt as validateTelegramValidateTokenParams, E as validateCronAddParams, Et as validateTalkModeParams, F as validateDevicePairRejectParams, Ft as validateWizardCancelParams, G as validateExecApprovalsSetParams, Gt as deriveDeviceIdFromPublicKey, H as validateExecApprovalsGetParams, Ht as buildDeviceAuthPayload, I as validateDevicePairRemoveParams, It as validateWizardNextParams, J as validateMeshPlanParams, Jt as verifyDeviceSignature, K as validateLogsTailParams, L as validateDeviceTokenRevokeParams, Lt as validateWizardStartParams, M as validateCronUpdateParams, Mt as validateWakeParams, N as validateDevicePairApproveParams, Nt as validateWebLoginStartParams, O as validateCronRemoveParams, Ot as validateToolsOverridesSetParams, P as validateDevicePairListParams, Pt as validateWebLoginWaitParams, Q as validateModelsListParams, R as validateDeviceTokenRotateParams, Rt as validateWizardStatusParams, S as validateConfigPatchParams, St as validateSkillsInstallParams, T as validateConnectParams, Tt as validateTalkConfigParams, U as validateExecApprovalsNodeGetParams, Ut as normalizeDeviceAuthScopes, V as validateExecApprovalResolveParams, Vt as parseSessionLabel, W as validateExecApprovalsNodeSetParams, X as validateMeshRunParams, Y as validateMeshRetryParams, Z as validateMeshStatusParams, _ as validateChatHistoryParams, _t as validateSessionsPreviewParams, a as validateAgentWaitParams, at as validateNodePairListParams, b as validateConfigApplyParams, bt as validateSessionsUsageParams, c as validateAgentsFilesGetParams, ct as validateNodePairVerifyParams, d as validateAgentsListParams, dt as validateRequestFrame, et as validateNodeEventParams, f as validateAgentsSkillsSetParams, ft as validateSendParams, g as validateChatAbortParams, gt as validateSessionsPatchParams, h as validateChannelsStatusParams, ht as validateSessionsListParams, i as validateAgentParams, it as validateNodePairApproveParams, j as validateCronStatusParams, jt as validateUpdateRunParams, k as validateCronRunParams, kt as validateToolsStatusParams, l as validateAgentsFilesListParams, lt as validateNodeRenameParams, m as validateChannelsLogoutParams, mt as validateSessionsDeleteParams, n as formatValidationErrors, nt as validateNodeInvokeResultParams, o as validateAgentsCreateParams, ot as validateNodePairRejectParams, p as validateAgentsUpdateParams, pt as validateSessionsCompactParams, q as validateMeshPlanAutoParams, qt as normalizeDevicePublicKeyBase64Url, r as validateAgentIdentityParams, rt as validateNodeListParams, s as validateAgentsDeleteParams, st as validateNodePairRequestParams, tt as validateNodeInvokeParams, u as validateAgentsFilesSetParams, ut as validatePollParams, v as validateChatInjectParams, vt as validateSessionsResetParams, w as validateConfigSetParams, wt as validateSkillsUpdateParams, x as validateConfigGetParams, xt as validateSkillsBinsParams, y as validateChatSendParams, yt as validateSessionsResolveParams, z as validateDiscordValidateTokenParams, zt as ErrorCodes } from "./client-DaLwaG9G.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C0DLwT7t.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-DkT-xA-u.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-BrDNyQiZ.js";
 import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-C02KGm4w.js";
 import { c as pickPrimaryLanIPv4, d as resolveGatewayListenHosts, f as resolveHostName, i as isTrustedProxyAddress, l as resolveGatewayBindHost, n as isLoopbackHost, o as normalizeHostHeader, p as rawDataToString, r as isPrivateOrLoopbackAddress, t as isLoopbackAddress, u as resolveGatewayClientIp } from "./net-C0W-QK7p.js";
 import { i as normalizeInputProvenance } from "./input-provenance-ChJN5mZj.js";
-import { $ as isSteppedBuildEnabled, $t as setSkillsRemoteRegistry, A as loadOpenClawPlugins, An as registerUnhandledRejectionHandler, At as buildSectionRenderContext, B as getTotalPendingReplies, Bn as formatZonedTimestamp, C as createOpenClawCodingTools, Cn as applyVerboseOverride, D as getPluginToolMeta, Dt as assembleAgentSystemPromptWithSections, E as buildDefaultToolPolicyPipelineSteps, En as isSystemEventContextChanged, F as openMessageLedger, Fn as extractImageContentFromSource, Ft as buildSystemPromptParams, Gn as stopSubagentsForRequester, Gt as normalizeSendPolicy, Ht as requestHeartbeatNow, I as patchRouting, In as normalizeMimeList, It as buildSystemPromptReport, J as setCliSessionId, Jt as primeRemoteSkillsCache, K as resolveCronStyleNow, Kt as resolveSendPolicy, L as record, Ln as resolveInputFileLimits, M as closeMessageLedger, Mn as DEFAULT_INPUT_IMAGE_MIMES, Mt as PromptSectionRegistry, N as markFailed, Nt as PROSE_GLOBAL_ROOT, Ot as getBuiltinSectionRegistry, P as markSynced, Pn as extractFileContentFromSource, Pt as _clearProseCache, Q as debugStepContinue, Qt as removeRemoteNodeInfo, R as dispatchInboundMessage, S as readConsolidationState, Sn as applyModelOverrideToSessionEntry, St as loadProviderUsageSummary, T as applyToolPolicyPipeline, Tn as enqueueSystemEvent, Un as resolveUserTimezone, W as BARE_SESSION_RESET_PROMPT, Wn as isAbortTrigger, Xt as refreshRemoteBinsForConnectedNodes, Y as runCliAgent, Yn as clearSessionQueues, Yt as recordRemoteNodeInfo, Z as debugSkipAll, Zn as resolveAgentIdentity, Zt as refreshRemoteNodeBins, _ as listForCurrentInstance, an as updatePairedNodeMetadata, ar as setCommandLaneConcurrency, b as markRecoveryAttempt, bn as buildAuthHealthSummary, cn as hashToken, cr as clearAgentRunContext, ct as spawnSubagentDirect, d as abortEmbeddedPiRun, dn as resolvePairingPaths, dr as onAgentEvent, dt as getTemplateCache, en as approveNodePairing, er as resolveBootstrapContextForRun, et as setDebugStepBroadcaster, f as getActiveEmbeddedRunCount, fn as readJsonFile, fr as registerAgentRunContext, ft as getTemplateLoadErrors, g as deleteRow, gn as registerSkillsChangeListener, h as closeInFlightTurnsStore, hn as getSkillsSnapshotVersion, ht as stopTemplateWatcher, i as listDescendantRunsForRequester, in as requestNodePairing, ir as resetAllLanes, j as claimBatch, jt as buildToolSummaryMap, k as loadMinionPlugins, l as runSubagentAnnounceFlow, ln as verifyPairingToken, lr as emitAgentEvent, lt as getLastReloadAt, m as waitForEmbeddedPiRunEnd, mn as createAsyncLock, mt as initTemplateLoader, n as countActiveDescendantRuns, nn as rejectNodePairing, nt as createOpenClawTools, on as verifyNodeToken, or as waitForActiveTasks, p as queueEmbeddedPiMessage, pn as writeJsonAtomic, pt as getTemplateUsageStats, q as getCliSessionId, qt as getRemoteSkillEligibility, r as initSubagentRegistry, rn as renamePairedNode, rr as getTotalQueueSize, rt as TOOL_REGISTRY, s as markSubagentRunTerminated, sn as generatePairingToken, sr as resolveAgentTimeoutMs, tn as listNodePairing, tr as getActiveTaskCount, tt as setSteppedBuild, u as runEmbeddedPiAgent, un as pruneExpiredPending, ur as getAgentRunContext, ut as getTemplate, v as listFromOtherInstances, wn as parseVerboseOverride, x as openInFlightTurnsStore, xt as normalizeGroupActivation, y as markInterrupted, z as createReplyDispatcher, zn as transcribeOpenAiCompatibleAudio } from "./subagent-registry-0zv9UyYz.js";
-import { $ as mergeDeliveryContext, C as cleanStaleLockFiles, E as evaluateSessionFreshness, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, L as resolveMainSessionKeyFromConfig, M as resolveFreshSessionTotalTokens, N as canonicalizeMainSessionAlias, O as resolveSessionResetPolicy, P as resolveAgentMainSessionKey, Z as deliveryContextFromSession, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, g as capArrayByJsonBytes, h as archiveSessionTranscripts, m as archiveFileOnDisk, n as parseSessionThreadInfo, t as extractDeliveryInfo, tt as normalizeSessionDeliveryFields, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, x as stripEnvelopeFromMessages, z as snapshotSessionOrigin } from "./sessions-D_b2UXud.js";
+import { $ as debugStepContinue, $t as removeRemoteNodeInfo, A as loadMinionPlugins, B as createReplyDispatcher, Bn as transcribeOpenAiCompatibleAudio, C as readConsolidationState, Cn as applyModelOverrideToSessionEntry, Ct as loadProviderUsageSummary, D as buildDefaultToolPolicyPipelineSteps, Dn as isSystemEventContextChanged, E as applyToolPolicyPipeline, En as enqueueSystemEvent, F as markSynced, Fn as extractFileContentFromSource, Ft as _clearProseCache, G as BARE_SESSION_RESET_PROMPT, Gn as isAbortTrigger, I as openMessageLedger, In as extractImageContentFromSource, It as buildSystemPromptParams, J as getCliSessionId, Jt as getRemoteSkillEligibility, Kn as stopSubagentsForRequester, Kt as normalizeSendPolicy, L as patchRouting, Ln as normalizeMimeList, Lt as buildSystemPromptReport, M as claimBatch, Mt as buildToolSummaryMap, N as closeMessageLedger, Nn as DEFAULT_INPUT_IMAGE_MIMES, Nt as PromptSectionRegistry, O as getPluginToolMeta, Ot as assembleAgentSystemPromptWithSections, P as markFailed, Pt as PROSE_GLOBAL_ROOT, Q as debugSkipAll, Qn as resolveAgentIdentity, Qt as refreshRemoteNodeBins, R as record, Rn as resolveInputFileLimits, S as openInFlightTurnsStore, St as normalizeGroupActivation, Tn as parseVerboseOverride, Ut as requestHeartbeatNow, V as getTotalPendingReplies, Vn as formatZonedTimestamp, Wn as resolveUserTimezone, X as runCliAgent, Xn as clearSessionQueues, Xt as recordRemoteNodeInfo, Y as setCliSessionId, Yt as primeRemoteSkillsCache, Zt as refreshRemoteBinsForConnectedNodes, _ as deleteRow, _n as registerSkillsChangeListener, an as requestNodePairing, ar as resetAllLanes, b as markInterrupted, cn as generatePairingToken, cr as resolveAgentTimeoutMs, d as abortEmbeddedPiRun, dn as pruneExpiredPending, dr as getAgentRunContext, dt as getTemplate, en as setSkillsRemoteRegistry, et as isSteppedBuildEnabled, f as getActiveEmbeddedRunCount, fn as resolvePairingPaths, fr as onAgentEvent, ft as getTemplateCache, g as closeInFlightTurnsStore, gn as getSkillsSnapshotVersion, gt as stopTemplateWatcher, h as registerLifecycleHooks, hn as createAsyncLock, ht as initTemplateLoader, i as listDescendantRunsForRequester, in as renamePairedNode, ir as getTotalQueueSize, it as TOOL_REGISTRY, j as loadOpenClawPlugins, jn as registerUnhandledRejectionHandler, jt as buildSectionRenderContext, kt as getBuiltinSectionRegistry, l as runSubagentAnnounceFlow, ln as hashToken, lr as clearAgentRunContext, lt as spawnSubagentDirect, m as waitForEmbeddedPiRunEnd, mn as writeJsonAtomic, mt as getTemplateUsageStats, n as countActiveDescendantRuns, nn as listNodePairing, nr as getActiveTaskCount, nt as setSteppedBuild, on as updatePairedNodeMetadata, or as setCommandLaneConcurrency, p as queueEmbeddedPiMessage, pn as readJsonFile, pr as registerAgentRunContext, pt as getTemplateLoadErrors, q as resolveCronStyleNow, qt as resolveSendPolicy, r as initSubagentRegistry, rn as rejectNodePairing, rt as createOpenClawTools, s as markSubagentRunTerminated, sn as verifyNodeToken, sr as waitForActiveTasks, tn as approveNodePairing, tr as resolveBootstrapContextForRun, tt as setDebugStepBroadcaster, u as runEmbeddedPiAgent, un as verifyPairingToken, ur as emitAgentEvent, ut as getLastReloadAt, v as listForCurrentInstance, w as createOpenClawCodingTools, wn as applyVerboseOverride, x as markRecoveryAttempt, xn as buildAuthHealthSummary, y as listFromOtherInstances, z as dispatchInboundMessage } from "./subagent-registry-C_UHFYRY.js";
+import { $ as mergeDeliveryContext, C as cleanStaleLockFiles, E as evaluateSessionFreshness, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, L as resolveMainSessionKeyFromConfig, M as resolveFreshSessionTotalTokens, N as canonicalizeMainSessionAlias, O as resolveSessionResetPolicy, P as resolveAgentMainSessionKey, Z as deliveryContextFromSession, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, g as capArrayByJsonBytes, h as archiveSessionTranscripts, m as archiveFileOnDisk, n as parseSessionThreadInfo, t as extractDeliveryInfo, tt as normalizeSessionDeliveryFields, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, x as stripEnvelopeFromMessages, z as snapshotSessionOrigin } from "./sessions-C0Qs0Flz.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-BkvS7DSy.js";
 import { d as buildChannelAccountBindings, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-irMKpl65.js";
 import "./logging-D43UWj1X.js";
 import { r as resolveUserDir } from "./user-directory-D27je39W.js";
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-D59m1grH.js";
 import { a as stripHeartbeatToken } from "./lanes-L5j3C7cx.js";
-import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget } from "./resolve-route-FLi7kFo1.js";
+import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget } from "./resolve-route-0arQsERr.js";
 import { n as getMachineDisplayName } from "./with-timeout-BVhDEOTB.js";
 import { c as startDiagnosticHeartbeat, d as isDiagnosticsEnabled, l as stopDiagnosticHeartbeat } from "./diagnostic-BEEvI8Zw.js";
-import { g as getGlobalHookRunner, v as runGlobalGatewayStopSafely } from "./reply-payloads-CikGrhVL.js";
-import { C as OPENAI_TTS_MODELS, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-CRpGlsYO.js";
+import { g as getGlobalHookRunner, v as runGlobalGatewayStopSafely } from "./reply-payloads-Dk-zLmJC.js";
+import { C as OPENAI_TTS_MODELS, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-DrFhyLnB.js";
 import { c as detectMime } from "./image-ops-QvmG4zb9.js";
-import { a as defineDrone, i as runDrone, t as createGatewayDroneHost } from "./host-CafVbu36.js";
-import { K as resolveBootstrapMaxChars, a as formatXHighModelHint, c as normalizeElevatedLevel, d as normalizeUsageDisplay, f as normalizeVerboseLevel, i as formatThinkingLevels, l as normalizeReasoningLevel, m as supportsXHighThinking, q as resolveBootstrapTotalMaxChars, s as listThinkingLevels, u as normalizeThinkLevel } from "./pi-embedded-helpers-D-m7pmXE.js";
-import { c as resolveSandboxRuntimeStatus, g as collectExplicitAllowlist, p as TOOL_GROUPS, v as expandToolGroups, x as resolveToolProfilePolicy, y as mergeAlsoAllowPolicy } from "./sandbox-pZvVQZ-a.js";
+import { a as defineDrone, i as runDrone, t as createGatewayDroneHost } from "./host-DCfZcVR_.js";
+import { K as resolveBootstrapMaxChars, a as formatXHighModelHint, c as normalizeElevatedLevel, d as normalizeUsageDisplay, f as normalizeVerboseLevel, i as formatThinkingLevels, l as normalizeReasoningLevel, m as supportsXHighThinking, q as resolveBootstrapTotalMaxChars, s as listThinkingLevels, u as normalizeThinkLevel } from "./pi-embedded-helpers-BsRnajNh.js";
+import { c as resolveSandboxRuntimeStatus, g as collectExplicitAllowlist, p as TOOL_GROUPS, v as expandToolGroups, x as resolveToolProfilePolicy, y as mergeAlsoAllowPolicy } from "./sandbox-CDGF9AVA.js";
 import { a as enableTailscaleServeFunnel, i as enableTailscaleServe, n as disableTailscaleServe, r as enableTailscaleFunnel, s as getTailnetHostname, t as disableTailscaleFunnel } from "./tailscale-DztQ748s.js";
 import { a as resolveRequestClientIp, c as createAuthRateLimiter, i as resolveGatewayAuth, l as safeEqualSecret, n as authorizeGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as isLocalDirectRequest, s as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, t as assertGatewayAuthConfigured } from "./auth-CFiHbm6v.js";
-import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-D-VUH9Bz.js";
+import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-BRKaxwJB.js";
 import { a as isErrno, n as formatErrorMessage } from "./errors-iV4-NKRR.js";
 import { i as formatPortDiagnostics, n as inspectPortUsage, t as ensurePortAvailable } from "./ports-CWP9QmS6.js";
 import { t as movePathToTrash } from "./trash-DPd6fFGH.js";
 import { a as traceGatewayEvent, n as pruneOldTraceFiles } from "./chat-trace-BMcJ2gl7.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-Y_w-AsVt.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-ilkHc_D4.js";
 import { t as ToolInputError } from "./common-BHzo6lXS.js";
 import { i as isExternalHookSession, n as detectSuspiciousPatterns, r as getHookType, t as buildSafeExternalPrompt } from "./external-content-Css-cJoz.js";
-import { n as runWithModelFallback } from "./model-fallback-C92G-WUW.js";
+import { n as runWithModelFallback } from "./model-fallback-DXR7ZbvM.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-2x6L37KS.js";
-import { n as loadModelCatalog } from "./model-catalog-AiXYmm_2.js";
-import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, d as orgScopeVisible, f as lookupContextTokens, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as normalizeOrgIds } from "./session-utils-0BYkk3f_.js";
-import { a as resolveSubagentToolPolicy, d as listAgentWorkspaceDirs, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-Dt2kTSid.js";
+import { n as loadModelCatalog } from "./model-catalog-7Ew4iFgU.js";
+import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, d as orgScopeVisible, f as lookupContextTokens, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as normalizeOrgIds } from "./session-utils-DDCd8HC9.js";
+import { a as resolveSubagentToolPolicy, d as listAgentWorkspaceDirs, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-DDJ31-0E.js";
 import { a as mergeExecApprovalsSocketDefaults, c as readExecApprovalsSnapshot, p as saveExecApprovals, r as ensureExecApprovals, s as normalizeExecApprovals, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-9-5NQEhL.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-b8aNuBYW.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format--dK3YoXf.js";
@@ -70,18 +70,18 @@ import { n as setGoogleAdcClient, t as getGoogleAdcClient } from "./hub-credenti
 import { a as normalizeOptionalAgentId, c as normalizePayloadToSystemText, d as buildDeliveryFromLegacyPayload, f as hasLegacyDeliveryHints, i as inferLegacyName, l as normalizeRequiredName, n as normalizeCronJobCreate, o as normalizeOptionalSessionKey, p as stripLegacyDeliveryFields, r as normalizeCronJobPatch, s as normalizeOptionalText, t as normalizeHttpWebhookUrl, u as migrateLegacyCronPayload } from "./webhook-url-DQ4SDf3R.js";
 import { i as parseAbsoluteTimeMs, n as resolveCronStaggerMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-BlvVswOf.js";
 import { a as summarizeRestartSentinel, n as formatDoctorNonInteractiveHint, r as formatRestartSentinelMessage, s as writeRestartSentinel, t as consumeRestartSentinel } from "./restart-sentinel-CFtgrOm4.js";
-import { c as loadChannelOutboundAdapter, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-C40KRMzm.js";
+import { c as loadChannelOutboundAdapter, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-BCijF1xe.js";
 import { n as resolveMessageChannelSelection } from "./channel-selection-Bzg2Xpo4.js";
-import { a as resetDirectoryCache, n as ensureOutboundSessionEntry, t as resolveOutboundSessionRoute } from "./outbound-session-B9B7Vsxm.js";
+import { a as resetDirectoryCache, n as ensureOutboundSessionEntry, t as resolveOutboundSessionRoute } from "./outbound-session-BCNTkSVV.js";
 import { t as normalizePollInput } from "./polls-8i6CJXI7.js";
-import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-Bf1GImWB.js";
+import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-DnVo1ws9.js";
 import { a as runAggregation, n as executeOrchestration, r as readStatusJson, t as executePipeline } from "./orchestration-pipeline-Bi3YT3Jf.js";
 import { r as readManifest, t as completeManifest } from "./orchestration-manifest-DXWf2_x7.js";
-import { i as startBrowserControlServiceFromConfig, r as createBrowserControlContext, t as createBrowserRouteDispatcher } from "./dispatcher-BWcYLowQ.js";
+import { i as startBrowserControlServiceFromConfig, r as createBrowserControlContext, t as createBrowserRouteDispatcher } from "./dispatcher-D46WCdTe.js";
 import { n as persistBrowserProxyFiles, t as applyBrowserProxyPaths } from "./proxy-files-DtQxHMjp.js";
 import { r as cachedJson } from "./ttl-cache-CEaNnSl4.js";
 import { i as onHeartbeatEvent, r as getLastHeartbeatEvent, t as resolveHeartbeatVisibility } from "./heartbeat-visibility-BqNH_1lC.js";
-import { a as initUserSubsystem, d as sleepWithAbort, i as handleHubAssignmentChanged, l as buildHistoryContextFromEntries, n as resolveChannelSenderIdentity, r as getActiveUserSubsystem, s as mapRoleToScopes, t as createReplyPrefixOptions, u as computeBackoff } from "./reply-prefix-CYbvVBOV.js";
+import { a as initUserSubsystem, d as sleepWithAbort, i as handleHubAssignmentChanged, l as buildHistoryContextFromEntries, n as resolveChannelSenderIdentity, r as getActiveUserSubsystem, s as mapRoleToScopes, t as createReplyPrefixOptions, u as computeBackoff } from "./reply-prefix-D9MQ_veY.js";
 import { t as ensureMinionCliOnPath } from "./path-env-DpsCNe2h.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-_OH_n-zu.js";
 import { n as inheritOptionFromParent } from "./command-options-Dhjl7AMa.js";
@@ -90,27 +90,27 @@ import { t as WizardCancelledError } from "./prompts-E0FayNjJ.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-HNAIOJ_3.js";
 import { t as applyPluginAutoEnable } from "./plugin-auto-enable-CEWEwQIw.js";
 import { t as buildChannelAccountSnapshot } from "./status-Dg720jp3.js";
-import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-DCve32jF.js";
-import "./onboard-helpers-7fbTU2tq.js";
+import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-DP2LE5Oh.js";
+import "./onboard-helpers-BKca3qU4.js";
 import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-DMloABxR.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-Cx6dCwYR.js";
-import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as formatHealthChannelLines, r as getHealthSnapshot, s as runHeartbeatOnce } from "./health-BlZEOPXK.js";
+import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as formatHealthChannelLines, r as getHealthSnapshot, s as runHeartbeatOnce } from "./health-6TTjEZoo.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-76BDB4BP.js";
 import { t as discoverGatewayBeacons } from "./bonjour-discovery-COG6-6UR.js";
-import { t as installSkill } from "./skills-install-DAphGXoj.js";
+import { t as installSkill } from "./skills-install-Bo9PwVmT.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-B2N-dnoC.js";
 import { a as resolveNpmChannelTag, n as compareSemverStrings, p as normalizeUpdateChannel, t as checkUpdateStatus } from "./update-check-DUIvch0v.js";
-import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-gWt5DmvD.js";
-import { a as probeGateway, i as resolveNodeCommandAllowlist, r as isNodeCommandAllowed } from "./audit-DmJGMt0j.js";
+import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-Dz_-4ATW.js";
+import { a as probeGateway, i as resolveNodeCommandAllowlist, r as isNodeCommandAllowed } from "./audit-Ck6MCUxx.js";
 import { t as parsePort$1 } from "./parse-port-DA32M3gA.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-dauqwBcE.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-D7K6zRR6.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-C-PEQv_O.js";
-import { n as createDefaultDeps, r as createOutboundSendDeps$1, t as createOutboundSendDeps } from "./outbound-send-deps-BmDpImVK.js";
+import { n as createDefaultDeps, r as createOutboundSendDeps$1, t as createOutboundSendDeps } from "./outbound-send-deps-Dg8cSoFv.js";
 import { i as initCrypto, n as ProbeRegistry, r as SecretsManager, t as SecretStore } from "./store-CCYsWl7_.js";
-import { t as runOnboardingWizard } from "./onboarding-C--TfoeE.js";
-import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-D4wjtIOe.js";
-import { h as resolveGmailPullRuntimeConfig } from "./gmail-DpPYd91j.js";
-import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-6dzad4Vk.js";
+import { t as runOnboardingWizard } from "./onboarding-nPyIyp8f.js";
+import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-D69Af97u.js";
+import { h as resolveGmailPullRuntimeConfig } from "./gmail-C1O6grHu.js";
+import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-CZq9c4BW.js";
 import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-BRxsVIll.js";
 import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-B0q97NF_.js";
 import { n as setEmbedConcurrency } from "./qmd-embed-semaphore-CLBO94qU.js";
@@ -120,7 +120,7 @@ import os, { homedir } from "node:os";
 import * as path$1 from "node:path";
 import path, { dirname, join } from "node:path";
 import * as fs$3 from "node:fs";
-import fs, { constants, promises, readFileSync } from "node:fs";
+import fs, { appendFileSync, constants, existsSync, mkdirSync, promises, readFileSync, statSync } from "node:fs";
 import { promisify } from "node:util";
 import chalk from "chalk";
 import JSON5 from "json5";
@@ -142,8 +142,8 @@ import { lookup } from "node:dns/promises";
 import chokidar from "chokidar";
 import { EventEmitter } from "node:events";
 import Database from "better-sqlite3";
-import { monitorEventLoopDelay } from "node:perf_hooks";
 import { SignJWT, createRemoteJWKSet, jwtVerify } from "jose";
+import { monitorEventLoopDelay } from "node:perf_hooks";
 import { Cron } from "croner";
 import { DatabaseSync } from "node:sqlite";
 import { encode } from "gpt-tokenizer";
@@ -1393,177 +1393,8 @@ function scanForInterruptedOrchestrations(agentWorkspaces) {
 	return interrupted;
 }
 //#endregion
-//#region src/gateway/gateway-request-metrics.ts
-/**
-* Gateway request performance metrics.
-*
-* Records per-method handler latency at the request dispatch chokepoint and
-* samples Node's event-loop delay, then emits a single aggregated
-* `gateway.perf_snapshot` event per window (default 60s) into the unified
-* event store — the same surface the hub reliability dashboard reads.
-*
-* Why this exists: the legacy `gateway.ws_slow_response` event fired per-call
-* at a 50ms bar, flooding the dashboard with non-actionable noise while
-* measuring *total* WS round-trip time (which is dominated by event-loop
-* scheduling, not handler work). This module instead measures handler CPU
-* time per method AND event-loop delay separately, so slow responses can be
-* correctly attributed (heavy handler vs. a congested event loop) from
-* percentile aggregates rather than guesswork.
-*
-* Metric points emitted (in `gateway.perf_snapshot` metadata):
-* - requests          — count + throughput (req/s) over the window
-* - errorRate         — fraction of requests that responded `ok: false`
-* - latencyMs         — p50 / p95 / p99 / max handler latency across all methods
-* - slowestMethods    — top methods by p95 latency (count, p50, p95, max, errors)
-* - eventLoopDelayMs  — mean / p50 / p99 / max event-loop lag over the window
-*
-* @module
-*/
-const log$26 = createSubsystemLogger("gateway/metrics");
-/** Cap on retained latency samples per method (reservoir) to bound memory. */
-const MAX_SAMPLES_PER_METHOD = 512;
-/** Default snapshot window. Matches the reliability rate-limiter granularity. */
-const DEFAULT_INTERVAL_MS = 6e4;
-const methodStats = /* @__PURE__ */ new Map();
-let reporterTimer = null;
-let eventLoopHist = null;
-let windowStartMs = 0;
-/**
-* Record one dispatched request's handler latency and outcome.
-* Called at the dispatch chokepoint. Best-effort — never throws.
-*/
-function recordMethodLatency(method, durationMs, ok) {
-	if (!Number.isFinite(durationMs) || durationMs < 0) return;
-	let stat = methodStats.get(method);
-	if (!stat) {
-		stat = {
-			count: 0,
-			errors: 0,
-			samples: []
-		};
-		methodStats.set(method, stat);
-	}
-	stat.count += 1;
-	if (!ok) stat.errors += 1;
-	if (stat.samples.length < MAX_SAMPLES_PER_METHOD) stat.samples.push(durationMs);
-	else stat.samples[Math.floor(Math.random() * MAX_SAMPLES_PER_METHOD)] = durationMs;
-}
-function percentiles(samples) {
-	if (samples.length === 0) return {
-		p50: 0,
-		p95: 0,
-		p99: 0,
-		max: 0
-	};
-	const sorted = [...samples].sort((a, b) => a - b);
-	const at = (q) => sorted[Math.min(Math.floor(sorted.length * q), sorted.length - 1)];
-	return {
-		p50: Math.round(at(.5)),
-		p95: Math.round(at(.95)),
-		p99: Math.round(at(.99)),
-		max: Math.round(sorted[sorted.length - 1])
-	};
-}
-/** Build a snapshot from the current window without resetting state. */
-function buildGatewayPerfSnapshot(windowMs, topN = 5) {
-	const allSamples = [];
-	let requests = 0;
-	let errors = 0;
-	const perMethod = [];
-	for (const [method, stat] of methodStats) {
-		requests += stat.count;
-		errors += stat.errors;
-		for (const s of stat.samples) allSamples.push(s);
-		const p = percentiles(stat.samples);
-		perMethod.push({
-			method,
-			count: stat.count,
-			errors: stat.errors,
-			p50: p.p50,
-			p95: p.p95,
-			max: p.max
-		});
-	}
-	perMethod.sort((a, b) => b.p95 - a.p95 || b.max - a.max);
-	const windowSec = windowMs > 0 ? windowMs / 1e3 : 1;
-	const el = eventLoopHist;
-	const elMs = (ns) => Math.round(ns / 1e6 * 100) / 100;
-	return {
-		windowMs,
-		requests,
-		throughputPerSec: Math.round(requests / windowSec * 100) / 100,
-		errorRate: requests > 0 ? Math.round(errors / requests * 1e3) / 1e3 : 0,
-		latencyMs: percentiles(allSamples),
-		slowestMethods: perMethod.slice(0, topN),
-		eventLoopDelayMs: el ? {
-			mean: elMs(el.mean),
-			p50: elMs(el.percentile(50)),
-			p99: elMs(el.percentile(99)),
-			max: elMs(el.max)
-		} : {
-			mean: 0,
-			p50: 0,
-			p99: 0,
-			max: 0
-		}
-	};
-}
-function emitSnapshot(windowMs) {
-	const snap = buildGatewayPerfSnapshot(windowMs);
-	if (snap.requests === 0 && snap.eventLoopDelayMs.max < 100) return;
-	const { latencyMs: lat, eventLoopDelayMs: el } = snap;
-	emitEvent({
-		category: "gateway",
-		severity: "info",
-		event: "gateway.perf_snapshot",
-		message: `Gateway perf: ${snap.requests} req (${snap.throughputPerSec}/s), p95 ${lat.p95}ms / max ${lat.max}ms, evloop p99 ${el.p99}ms / max ${el.max}ms`,
-		metadata: { ...snap },
-		timestamp: Date.now()
-	});
-}
-/**
-* Start the periodic metrics reporter and event-loop delay monitor.
-* Idempotent — a second call is a no-op until {@link stopGatewayRequestMetrics}.
-* Returns a stop function.
-*/
-function startGatewayRequestMetrics(opts) {
-	if (reporterTimer) return stopGatewayRequestMetrics;
-	const intervalMs = opts?.intervalMs ?? DEFAULT_INTERVAL_MS;
-	try {
-		eventLoopHist = monitorEventLoopDelay({ resolution: 20 });
-		eventLoopHist.enable();
-	} catch (err) {
-		log$26.debug(`event-loop delay monitor unavailable: ${err instanceof Error ? err.message : String(err)}`);
-		eventLoopHist = null;
-	}
-	windowStartMs = Date.now();
-	reporterTimer = setInterval(() => {
-		const now = Date.now();
-		try {
-			emitSnapshot(now - windowStartMs);
-		} catch (err) {
-			log$26.debug(`perf snapshot emit failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		methodStats.clear();
-		eventLoopHist?.reset();
-		windowStartMs = now;
-	}, intervalMs);
-	reporterTimer.unref?.();
-	return stopGatewayRequestMetrics;
-}
-/** Stop the reporter and clear accumulated state. */
-function stopGatewayRequestMetrics() {
-	if (reporterTimer) {
-		clearInterval(reporterTimer);
-		reporterTimer = null;
-	}
-	eventLoopHist?.disable();
-	eventLoopHist = null;
-	methodStats.clear();
-}
-//#endregion
 //#region src/infra/exec-approval-forwarder.ts
-const log$25 = createSubsystemLogger("gateway/exec-approvals");
+const log$26 = createSubsystemLogger("gateway/exec-approvals");
 const DEFAULT_MODE = "session";
 function normalizeMode(mode) {
 	return mode ?? DEFAULT_MODE;
@@ -1681,7 +1512,7 @@ async function deliverToTargets(params) {
 				payloads: [{ text: params.text }]
 			});
 		} catch (err) {
-			log$25.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
+			log$26.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
 		}
 	});
 	await Promise.allSettled(deliveries);
@@ -1842,12 +1673,12 @@ function stopLedgerFlusher() {
 }
 //#endregion
 //#region src/infra/message-ledger-hooks.ts
-const PLUGIN_ID$2 = "minion:message-ledger";
+const PLUGIN_ID$3 = "minion:message-ledger";
 const recentInbound = /* @__PURE__ */ new Map();
 const keyFor = (channel, accountId, chatId) => `${channel}|${accountId ?? ""}|${chatId ?? ""}`;
 function registerMessageLedgerHooks(registry, dbPath, flusher) {
 	registry.typedHooks.push({
-		pluginId: PLUGIN_ID$2,
+		pluginId: PLUGIN_ID$3,
 		hookName: "gateway_start",
 		handler: () => {
 			openMessageLedger(dbPath);
@@ -1855,7 +1686,7 @@ function registerMessageLedgerHooks(registry, dbPath, flusher) {
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$2,
+		pluginId: PLUGIN_ID$3,
 		hookName: "gateway_stop",
 		handler: () => {
 			stopLedgerFlusher();
@@ -1863,7 +1694,7 @@ function registerMessageLedgerHooks(registry, dbPath, flusher) {
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$2,
+		pluginId: PLUGIN_ID$3,
 		hookName: "message_inbound",
 		handler: (event) => {
 			const row = record({
@@ -1888,7 +1719,7 @@ function registerMessageLedgerHooks(registry, dbPath, flusher) {
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$2,
+		pluginId: PLUGIN_ID$3,
 		hookName: "message_received",
 		handler: (_event, ctx) => {
 			if (!ctx.sessionKey) return;
@@ -1904,7 +1735,7 @@ function registerMessageLedgerHooks(registry, dbPath, flusher) {
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$2,
+		pluginId: PLUGIN_ID$3,
 		hookName: "message_sent",
 		handler: (event, ctx) => {
 			record({
@@ -2342,24 +2173,24 @@ function ensureWorkspaceSafely(userId) {
 		ensurePersonalAgentWorkspace(userId);
 	} catch {}
 }
-const PLUGIN_ID$1 = "minion:personal-agent-observations";
+const PLUGIN_ID$2 = "minion:personal-agent-observations";
 function registerPersonalAgentObservationHooks(registry, dbPath) {
 	registry.typedHooks.push({
-		pluginId: PLUGIN_ID$1,
+		pluginId: PLUGIN_ID$2,
 		hookName: "gateway_start",
 		handler: () => {
 			openObservationStore(dbPath);
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$1,
+		pluginId: PLUGIN_ID$2,
 		hookName: "gateway_stop",
 		handler: () => {
 			closeObservationStore();
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$1,
+		pluginId: PLUGIN_ID$2,
 		hookName: "message_inbound",
 		handler: (event) => {
 			if (event.isGroup) return;
@@ -2382,7 +2213,7 @@ function registerPersonalAgentObservationHooks(registry, dbPath) {
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$1,
+		pluginId: PLUGIN_ID$2,
 		hookName: "message_received",
 		handler: (event, ctx) => {
 			const channel = ctx.channelId;
@@ -2399,7 +2230,7 @@ function registerPersonalAgentObservationHooks(registry, dbPath) {
 		},
 		source: "internal"
 	}, {
-		pluginId: PLUGIN_ID$1,
+		pluginId: PLUGIN_ID$2,
 		hookName: "message_sent",
 		handler: (event, ctx) => {
 			const channel = ctx.channelId;
@@ -3141,6 +2972,86 @@ function asStringArray(v) {
 	return v.filter((x) => typeof x === "string");
 }
 //#endregion
+//#region src/trajectory/writer.ts
+const DEFAULT_MAX_BYTES$2 = 5 * 1024 * 1024;
+var TrajectoryWriter = class {
+	constructor(file, opts) {
+		this.file = file;
+		this.bytes = 0;
+		this.dropped = 0;
+		this.maxBytes = opts?.maxBytes ?? DEFAULT_MAX_BYTES$2;
+		mkdirSync(dirname(file), { recursive: true });
+		if (existsSync(file)) this.bytes = statSync(file).size;
+	}
+	append(event) {
+		if (this.bytes >= this.maxBytes) {
+			this.dropped += 1;
+			return;
+		}
+		const line = `${JSON.stringify(event)}\n`;
+		try {
+			appendFileSync(this.file, line);
+			this.bytes += Buffer.byteLength(line);
+		} catch {
+			this.dropped += 1;
+		}
+	}
+};
+//#endregion
+//#region src/trajectory/recorder.ts
+const PLUGIN_ID$1 = "trajectory-recorder";
+const writers = /* @__PURE__ */ new Map();
+const MAX_LIVE_SESSIONS = 500;
+function writerFor(sessionId, agentId) {
+	let w = writers.get(sessionId);
+	if (!w) {
+		if (writers.size >= MAX_LIVE_SESSIONS) {
+			const oldest = writers.keys().next().value;
+			if (oldest !== void 0) writers.delete(oldest);
+		}
+		w = new TrajectoryWriter(join(resolveSessionTranscriptsDirForAgent(agentId), `trajectory-${sessionId}.jsonl`));
+		writers.set(sessionId, w);
+	}
+	return w;
+}
+/** Idempotent: enable per-session JSONL trajectory recording via lifecycle hooks. */
+function enableTrajectoryRecording() {
+	registerLifecycleHooks(PLUGIN_ID$1, {
+		onSessionStart: async (s) => {
+			writerFor(s.sessionId, s.agentId).append({
+				kind: "session_start",
+				sessionId: s.sessionId,
+				agentId: s.agentId,
+				channelType: s.channelType,
+				timestamp: s.startedAt
+			});
+		},
+		postLlmCall: async (ctx, result) => {
+			writerFor(ctx.sessionId, ctx.agentId).append({
+				kind: "llm_call",
+				turn: ctx.turn,
+				model: result.model,
+				inputTokens: result.inputTokens,
+				outputTokens: result.outputTokens,
+				durationMs: result.durationMs,
+				hasToolCalls: result.hasToolCalls,
+				error: result.error,
+				timestamp: ctx.timestamp
+			});
+		},
+		onSessionEnd: async (s, summary) => {
+			writerFor(s.sessionId, s.agentId).append({
+				kind: "session_end",
+				turns: summary.turns,
+				durationMs: summary.durationMs,
+				endReason: summary.endReason,
+				timestamp: Date.now()
+			});
+			writers.delete(s.sessionId);
+		}
+	});
+}
+//#endregion
 //#region src/gateway/auth/auth-jwt.ts
 /**
 * JWT validation module for the multi-tenant gateway.
@@ -3246,7 +3157,7 @@ async function validateGatewayJwt(token, config) {
 }
 //#endregion
 //#region src/gateway/channel-health-monitor.ts
-const log$24 = createSubsystemLogger("gateway/health-monitor");
+const log$25 = createSubsystemLogger("gateway/health-monitor");
 const DEFAULT_CHECK_INTERVAL_MS$1 = 5 * 6e4;
 const DEFAULT_STARTUP_GRACE_MS = 6e4;
 const DEFAULT_COOLDOWN_CYCLES = 2;
@@ -3295,11 +3206,11 @@ function startChannelHealthMonitor(deps) {
 					if (now - record.lastRestartAt <= cooldownMs) continue;
 					pruneOldRestarts(record, now);
 					if (record.restartsThisHour.length >= maxRestartsPerHour) {
-						log$24.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
+						log$25.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
 						continue;
 					}
 					const reason = !status.running ? status.reconnectAttempts && status.reconnectAttempts >= 10 ? "gave-up" : "stopped" : "stuck";
-					log$24.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
+					log$25.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
 					try {
 						if (status.running) await channelManager.stopChannel(channelId, accountId);
 						channelManager.resetRestartAttempts(channelId, accountId);
@@ -3308,7 +3219,7 @@ function startChannelHealthMonitor(deps) {
 						record.restartsThisHour.push({ at: now });
 						restartRecords.set(key, record);
 					} catch (err) {
-						log$24.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
+						log$25.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
 					}
 				}
 			}
@@ -3328,7 +3239,7 @@ function startChannelHealthMonitor(deps) {
 		abortSignal?.addEventListener("abort", stop, { once: true });
 		timer = setInterval(() => void runCheck(), checkIntervalMs);
 		if (typeof timer === "object" && "unref" in timer) timer.unref();
-		log$24.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
+		log$25.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
 	}
 	return { stop };
 }
@@ -3822,7 +3733,7 @@ var ExecApprovalManager = class {
 * Opens the SQLite database, applies WAL pragmas, and runs the
 * 004_free_tier_users migration. Returns the DatabaseSync instance.
 */
-const log$23 = createSubsystemLogger("free-tier/db");
+const log$24 = createSubsystemLogger("free-tier/db");
 const MIGRATION_SQL_PATH = join(dirname(fileURLToPath(import.meta.url)), "../../db/migrations/004_free_tier_users.sql");
 function openFreeTierDb(dbPath) {
 	const { DatabaseSync } = requireNodeSqlite();
@@ -3831,9 +3742,9 @@ function openFreeTierDb(dbPath) {
 	try {
 		const sql = readFileSync(MIGRATION_SQL_PATH, "utf8");
 		db.exec(sql);
-		log$23.info("free-tier DB migration applied", { dbPath });
+		log$24.info("free-tier DB migration applied", { dbPath });
 	} catch (err) {
-		log$23.error("free-tier DB migration failed", {
+		log$24.error("free-tier DB migration failed", {
 			dbPath,
 			error: String(err)
 		});
@@ -3972,13 +3883,13 @@ var UserRepository = class {
 };
 //#endregion
 //#region src/gateway/free-tier/email.ts
-const log$22 = createSubsystemLogger("free-tier/email");
+const log$23 = createSubsystemLogger("free-tier/email");
 const RESEND_API = "https://api.resend.com/emails";
 const FROM = "OpenClaw <noreply@minion.ai>";
 async function send$1(to, subject, html) {
 	const apiKey = process.env["RESEND_API_KEY"];
 	if (!apiKey) {
-		log$22.warn("RESEND_API_KEY not set — email not sent", {
+		log$23.warn("RESEND_API_KEY not set — email not sent", {
 			to,
 			subject
 		});
@@ -3999,7 +3910,7 @@ async function send$1(to, subject, html) {
 	});
 	if (!res.ok) {
 		const text = await res.text().catch(() => "");
-		log$22.error("Resend API error", {
+		log$23.error("Resend API error", {
 			status: res.status,
 			body: text
 		});
@@ -4012,7 +3923,7 @@ async function sendVerificationEmail(email, token, baseUrl) {
 }
 //#endregion
 //#region src/gateway/free-tier/auth-http.ts
-const log$21 = createSubsystemLogger("free-tier/auth");
+const log$22 = createSubsystemLogger("free-tier/auth");
 function json$1(res, status, body) {
 	res.statusCode = status;
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -4074,7 +3985,7 @@ async function handleSignup(req, res, users) {
 		passwordHash
 	});
 	await sendVerificationEmail(email, verifyToken, process.env["HUB_BASE_URL"] ?? "https://hub.minion.ai").catch((e) => {
-		log$21.error("failed to send verification email", {
+		log$22.error("failed to send verification email", {
 			userId: user.id,
 			error: String(e)
 		});
@@ -4381,6 +4292,175 @@ function createFreeTierApiHandler(db) {
 	};
 }
 //#endregion
+//#region src/gateway/gateway-request-metrics.ts
+/**
+* Gateway request performance metrics.
+*
+* Records per-method handler latency at the request dispatch chokepoint and
+* samples Node's event-loop delay, then emits a single aggregated
+* `gateway.perf_snapshot` event per window (default 60s) into the unified
+* event store — the same surface the hub reliability dashboard reads.
+*
+* Why this exists: the legacy `gateway.ws_slow_response` event fired per-call
+* at a 50ms bar, flooding the dashboard with non-actionable noise while
+* measuring *total* WS round-trip time (which is dominated by event-loop
+* scheduling, not handler work). This module instead measures handler CPU
+* time per method AND event-loop delay separately, so slow responses can be
+* correctly attributed (heavy handler vs. a congested event loop) from
+* percentile aggregates rather than guesswork.
+*
+* Metric points emitted (in `gateway.perf_snapshot` metadata):
+* - requests          — count + throughput (req/s) over the window
+* - errorRate         — fraction of requests that responded `ok: false`
+* - latencyMs         — p50 / p95 / p99 / max handler latency across all methods
+* - slowestMethods    — top methods by p95 latency (count, p50, p95, max, errors)
+* - eventLoopDelayMs  — mean / p50 / p99 / max event-loop lag over the window
+*
+* @module
+*/
+const log$21 = createSubsystemLogger("gateway/metrics");
+/** Cap on retained latency samples per method (reservoir) to bound memory. */
+const MAX_SAMPLES_PER_METHOD = 512;
+/** Default snapshot window. Matches the reliability rate-limiter granularity. */
+const DEFAULT_INTERVAL_MS = 6e4;
+const methodStats = /* @__PURE__ */ new Map();
+let reporterTimer = null;
+let eventLoopHist = null;
+let windowStartMs = 0;
+/**
+* Record one dispatched request's handler latency and outcome.
+* Called at the dispatch chokepoint. Best-effort — never throws.
+*/
+function recordMethodLatency(method, durationMs, ok) {
+	if (!Number.isFinite(durationMs) || durationMs < 0) return;
+	let stat = methodStats.get(method);
+	if (!stat) {
+		stat = {
+			count: 0,
+			errors: 0,
+			samples: []
+		};
+		methodStats.set(method, stat);
+	}
+	stat.count += 1;
+	if (!ok) stat.errors += 1;
+	if (stat.samples.length < MAX_SAMPLES_PER_METHOD) stat.samples.push(durationMs);
+	else stat.samples[Math.floor(Math.random() * MAX_SAMPLES_PER_METHOD)] = durationMs;
+}
+function percentiles(samples) {
+	if (samples.length === 0) return {
+		p50: 0,
+		p95: 0,
+		p99: 0,
+		max: 0
+	};
+	const sorted = [...samples].sort((a, b) => a - b);
+	const at = (q) => sorted[Math.min(Math.floor(sorted.length * q), sorted.length - 1)];
+	return {
+		p50: Math.round(at(.5)),
+		p95: Math.round(at(.95)),
+		p99: Math.round(at(.99)),
+		max: Math.round(sorted[sorted.length - 1])
+	};
+}
+/** Build a snapshot from the current window without resetting state. */
+function buildGatewayPerfSnapshot(windowMs, topN = 5) {
+	const allSamples = [];
+	let requests = 0;
+	let errors = 0;
+	const perMethod = [];
+	for (const [method, stat] of methodStats) {
+		requests += stat.count;
+		errors += stat.errors;
+		for (const s of stat.samples) allSamples.push(s);
+		const p = percentiles(stat.samples);
+		perMethod.push({
+			method,
+			count: stat.count,
+			errors: stat.errors,
+			p50: p.p50,
+			p95: p.p95,
+			max: p.max
+		});
+	}
+	perMethod.sort((a, b) => b.p95 - a.p95 || b.max - a.max);
+	const windowSec = windowMs > 0 ? windowMs / 1e3 : 1;
+	const el = eventLoopHist;
+	const elMs = (ns) => Math.round(ns / 1e6 * 100) / 100;
+	return {
+		windowMs,
+		requests,
+		throughputPerSec: Math.round(requests / windowSec * 100) / 100,
+		errorRate: requests > 0 ? Math.round(errors / requests * 1e3) / 1e3 : 0,
+		latencyMs: percentiles(allSamples),
+		slowestMethods: perMethod.slice(0, topN),
+		eventLoopDelayMs: el ? {
+			mean: elMs(el.mean),
+			p50: elMs(el.percentile(50)),
+			p99: elMs(el.percentile(99)),
+			max: elMs(el.max)
+		} : {
+			mean: 0,
+			p50: 0,
+			p99: 0,
+			max: 0
+		}
+	};
+}
+function emitSnapshot(windowMs) {
+	const snap = buildGatewayPerfSnapshot(windowMs);
+	if (snap.requests === 0 && snap.eventLoopDelayMs.max < 100) return;
+	const { latencyMs: lat, eventLoopDelayMs: el } = snap;
+	emitEvent({
+		category: "gateway",
+		severity: "info",
+		event: "gateway.perf_snapshot",
+		message: `Gateway perf: ${snap.requests} req (${snap.throughputPerSec}/s), p95 ${lat.p95}ms / max ${lat.max}ms, evloop p99 ${el.p99}ms / max ${el.max}ms`,
+		metadata: { ...snap },
+		timestamp: Date.now()
+	});
+}
+/**
+* Start the periodic metrics reporter and event-loop delay monitor.
+* Idempotent — a second call is a no-op until {@link stopGatewayRequestMetrics}.
+* Returns a stop function.
+*/
+function startGatewayRequestMetrics(opts) {
+	if (reporterTimer) return stopGatewayRequestMetrics;
+	const intervalMs = opts?.intervalMs ?? DEFAULT_INTERVAL_MS;
+	try {
+		eventLoopHist = monitorEventLoopDelay({ resolution: 20 });
+		eventLoopHist.enable();
+	} catch (err) {
+		log$21.debug(`event-loop delay monitor unavailable: ${err instanceof Error ? err.message : String(err)}`);
+		eventLoopHist = null;
+	}
+	windowStartMs = Date.now();
+	reporterTimer = setInterval(() => {
+		const now = Date.now();
+		try {
+			emitSnapshot(now - windowStartMs);
+		} catch (err) {
+			log$21.debug(`perf snapshot emit failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		methodStats.clear();
+		eventLoopHist?.reset();
+		windowStartMs = now;
+	}, intervalMs);
+	reporterTimer.unref?.();
+	return stopGatewayRequestMetrics;
+}
+/** Stop the reporter and clear accumulated state. */
+function stopGatewayRequestMetrics() {
+	if (reporterTimer) {
+		clearInterval(reporterTimer);
+		reporterTimer = null;
+	}
+	eventLoopHist?.disable();
+	eventLoopHist = null;
+	methodStats.clear();
+}
+//#endregion
 //#region src/gateway/http-utils.ts
 function getHeader(req, name) {
 	const raw = req.headers[name.toLowerCase()];
@@ -18899,7 +18979,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-BqG45BMs.js");
+			const { handleNodeEvent } = await import("./server-node-events-D90DAPI1.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			const nodeConnId = client?.connId;
 			await handleNodeEvent({
@@ -26406,7 +26486,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.MINION_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.MINION_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./dispatcher-BWcYLowQ.js").then((n) => n.n);
+	const mod = override ? await import(override) : await import("./dispatcher-D46WCdTe.js").then((n) => n.n);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -32265,7 +32345,7 @@ async function deliverFlowReply(sessionKey, reply) {
 	}
 	try {
 		const cfg = loadConfig();
-		const { deliverOutboundPayloads } = await import("./deliver-C40KRMzm.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-BCijF1xe.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg,
 			channel: target.channel,
@@ -33948,7 +34028,7 @@ function attachGatewayWsMessageHandler(params) {
 					mtUserRole = matchedSvc.role;
 					mtOrgId = "service";
 					mtAssignedAgentIds = matchedSvc.agentIds;
-					const { mapRoleToScopes: mapRole } = await import("./reply-prefix-CYbvVBOV.js").then((n) => n.c);
+					const { mapRoleToScopes: mapRole } = await import("./reply-prefix-D9MQ_veY.js").then((n) => n.c);
 					scopes = mapRole(matchedSvc.role);
 					connectParams.scopes = scopes;
 					authOk = true;
@@ -33989,7 +34069,7 @@ function attachGatewayWsMessageHandler(params) {
 					scopes = jwtResult.scopes;
 					connectParams.scopes = scopes;
 					if (jwtResult.jti) {
-						const { getActiveUserSubsystem } = await import("./reply-prefix-CYbvVBOV.js").then((n) => n.o);
+						const { getActiveUserSubsystem } = await import("./reply-prefix-D9MQ_veY.js").then((n) => n.o);
 						if (getActiveUserSubsystem()?.tokenRevocationStore.isRevoked(jwtResult.jti)) {
 							markHandshakeFailure("token-revoked", {
 								userId: mtUserId,
@@ -34037,7 +34117,7 @@ function attachGatewayWsMessageHandler(params) {
 						return;
 					}
 					if (mtUserId) {
-						const { provisionOnConnect } = await import("./reply-prefix-CYbvVBOV.js").then((n) => n.o);
+						const { provisionOnConnect } = await import("./reply-prefix-D9MQ_veY.js").then((n) => n.o);
 						const { resolveStateDir } = await import("./paths-aEg9UgoF.js").then((n) => n.i);
 						provisionOnConnect({
 							stateDir: resolveStateDir(process.env),
@@ -35633,6 +35713,10 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			key: "MINION_PERSONAL_AGENT_OBSERVATIONS_PATH",
 			description: "personal-agent observations database path override"
 		});
+		if (cfgAtStart.gateway?.trajectory?.enabled === true) {
+			enableTrajectoryRecording();
+			log.info("trajectory recording enabled");
+		}
 	}
 	const channelLogs = Object.fromEntries(listChannelPlugins().map((plugin) => [plugin.id, logChannels.child(plugin.id)]));
 	const channelRuntimeEnvs = Object.fromEntries(Object.entries(channelLogs).map(([id, logger]) => [id, runtimeForLogger(logger)]));
@@ -35931,8 +36015,8 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	});
 	if (!minimalTestGateway) cron.start().catch((err) => logCron.error(`failed to start: ${String(err)}`));
 	if (!minimalTestGateway) (async () => {
-		const { recoverPendingDeliveries } = await import("./deliver-C40KRMzm.js").then((n) => n.s);
-		const { deliverOutboundPayloads } = await import("./deliver-C40KRMzm.js").then((n) => n.n);
+		const { recoverPendingDeliveries } = await import("./deliver-BCijF1xe.js").then((n) => n.s);
+		const { deliverOutboundPayloads } = await import("./deliver-BCijF1xe.js").then((n) => n.n);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),