@nikolasp98/minion 2026.7.12-dev.20260715050311 → 2026.7.16-dev

package/dist/{gateway-cli-DO7T73U7.js → gateway-cli-n18LFNeU.js}

@@ -1,8 +1,8 @@
 import { C as expandHomePrefix, c as resolveConfigPath, d as resolveGatewayLockDir, f as resolveGatewayPort, n as STATE_DIR, r as isNixMode, t as CONFIG_PATH, v as resolveStateDir } from "./paths-CoM-oAkW.js";
 import { C as shortenHomePath, D as truncateUtf16Safe, L as getChildLogger, P as setVerbose, R as getLogger, _ as resolveConfigDir, b as resolveUserPath, c as ensureDir, d as isPlainObject, r as clamp, t as CONFIG_DIR, w as sleep, z as getResolvedLoggerSettings } from "./utils-FhRSYjMj.js";
 import { n as isRich, r as theme, t as colorize } from "./theme-CDbj88LB.js";
-import { A as resolveBootstrapTotalMaxChars, B as normalizeVerboseLevel, F as listThinkingLevels, H as supportsXHighThinking, I as normalizeElevatedLevel, L as normalizeReasoningLevel, M as formatThinkingLevels, N as formatXHighModelHint, R as normalizeThinkLevel, k as resolveBootstrapMaxChars, z as normalizeUsageDisplay } from "./pi-embedded-helpers-DU-bh5ri.js";
-import { $ as renamePairedNode, Ar as registerUnhandledRejectionHandler, At as abortEmbeddedPiRun, Bt as markRecoveryAttempt, C as initTemplateLoader, Ct as loadCombinedSessionStoreForGateway, Dt as resolveSessionModelRef, Et as resolveGatewaySessionStoreTarget, Fr as extractImageContentFromSource, Ft as closeInFlightTurnsStore, G as recordRemoteNodeInfo, Gt as getBuiltinSectionRegistry, H as resolveSendPolicy, Hn as markSubagentRunTerminated, Hr as resolveAgentTimeoutMs, Ir as normalizeMimeList, It as deleteRow, J as removeRemoteNodeInfo, Jn as getAgentRunContext, Jt as buildToolSummaryMap, K as refreshRemoteBinsForConnectedNodes, Kn as clearAgentRunContext, Ln as countActiveDescendantRuns, Lr as resolveInputFileLimits, Lt as listForCurrentInstance, Mn as stopSubagentsForRequester, Mr as DEFAULT_INPUT_IMAGE_MIMES, Mt as queueEmbeddedPiMessage, Nt as waitForEmbeddedPiRunEnd, On as resolveUserTimezone, Ot as normalizeOrgIds, Pr as extractFileContentFromSource, Pt as registerLifecycleHooks, Q as rejectNodePairing, Qn as resolveAgentIdentity, Qt as createOpenClawCodingTools, Rn as initSubagentRegistry, Rt as listFromOtherInstances, S as getTemplateUsageStats, St as listSessionsFromStore, Tn as formatZonedTimestamp, Tt as pruneLegacyStoreKeys, U as getRemoteSkillEligibility, Ut as readConsolidationState, V as normalizeSendPolicy, Vt as openInFlightTurnsStore, W as primeRemoteSkillsCache, Wn as runSubagentAnnounceFlow, Wt as assembleAgentSystemPromptWithSections, X as approveNodePairing, Xn as registerAgentRunContext, Xt as PROSE_GLOBAL_ROOT, Y as setSkillsRemoteRegistry, Yn as onAgentEvent, Yt as PromptSectionRegistry, Z as listNodePairing, Zt as _clearProseCache, _ as spawnSubagentDirect, _n as getTotalPendingReplies, _r as applyVerboseOverride, _t as buildSystemPromptReport, a as getCliSessionId, an as requestHeartbeatNow, at as verifyPairingToken, b as getTemplateCache, br as isSystemEventContextChanged, c as debugSkipAll, cn as getPluginToolMeta, cr as setCommandLaneConcurrency, ct as readJsonFile, d as setDebugStepBroadcaster, dn as loadOpenClawPlugins, dt as getSkillsSnapshotVersion, en as applyToolPolicyPipeline, et as requestNodePairing, f as setSteppedBuild, ft as registerSkillsChangeListener, gn as createReplyDispatcher, gr as applyModelOverrideToSessionEntry, gt as runEmbeddedPiAgent, hn as dispatchInboundMessage, ht as clearSessionQueues, i as resolveCronStyleNow, in as runToolScript, ir as getActiveTaskCount, it as hashToken$1, j as loadProviderUsageSummary, jn as isAbortTrigger, jt as getActiveEmbeddedRunCount, k as normalizeGroupActivation, kt as orgScopeVisible, l as debugStepContinue, lr as waitForActiveTasks, lt as writeJsonAtomic, mr as buildAuthHealthSummary, n as BARE_SESSION_RESET_PROMPT, nn as createMinionTools, nt as verifyNodeToken, o as setCliSessionId, or as getTotalQueueSize, ot as pruneExpiredPending, q as refreshRemoteNodeBins, qn as emitAgentEvent, qt as buildSectionRenderContext, rn as clearCustomToolsCache, rr as resolveBootstrapContextForRun, rt as generatePairingToken, s as runCliAgent, sr as resetAllLanes, st as resolvePairingPaths, tn as buildDefaultToolPolicyPipelineSteps, tt as updatePairedNodeMetadata, u as isSteppedBuildEnabled, un as loadMinionPlugins, ur as lookupContextTokens, ut as createAsyncLock, v as getLastReloadAt, vr as parseVerboseOverride, vt as buildSystemPromptParams, w as stopTemplateWatcher, wt as loadSessionEntry, x as getTemplateLoadErrors, xt as listAgentsForGateway, y as getTemplate, yr as enqueueSystemEvent, yt as canonicalizeSpawnedByForAgent, zn as listDescendantRunsForRequester, zr as transcribeOpenAiCompatibleAudio, zt as markInterrupted } from "./reply-D1Xsn6eO.js";
+import { A as resolveBootstrapTotalMaxChars, B as normalizeVerboseLevel, F as listThinkingLevels, H as supportsXHighThinking, I as normalizeElevatedLevel, L as normalizeReasoningLevel, M as formatThinkingLevels, N as formatXHighModelHint, R as normalizeThinkLevel, k as resolveBootstrapMaxChars, z as normalizeUsageDisplay } from "./pi-embedded-helpers-Dt84Vt0L.js";
+import { $ as renamePairedNode, Ar as registerUnhandledRejectionHandler, At as abortEmbeddedPiRun, Bt as markRecoveryAttempt, C as initTemplateLoader, Ct as loadCombinedSessionStoreForGateway, Dt as resolveSessionModelRef, Et as resolveGatewaySessionStoreTarget, Fr as extractImageContentFromSource, Ft as closeInFlightTurnsStore, G as recordRemoteNodeInfo, Gt as getBuiltinSectionRegistry, H as resolveSendPolicy, Hn as markSubagentRunTerminated, Hr as resolveAgentTimeoutMs, Ir as normalizeMimeList, It as deleteRow, J as removeRemoteNodeInfo, Jn as getAgentRunContext, Jt as buildToolSummaryMap, K as refreshRemoteBinsForConnectedNodes, Kn as clearAgentRunContext, Ln as countActiveDescendantRuns, Lr as resolveInputFileLimits, Lt as listForCurrentInstance, Mn as stopSubagentsForRequester, Mr as DEFAULT_INPUT_IMAGE_MIMES, Mt as queueEmbeddedPiMessage, Nt as waitForEmbeddedPiRunEnd, On as resolveUserTimezone, Ot as normalizeOrgIds, Pr as extractFileContentFromSource, Pt as registerLifecycleHooks, Q as rejectNodePairing, Qn as resolveAgentIdentity, Qt as createOpenClawCodingTools, Rn as initSubagentRegistry, Rt as listFromOtherInstances, S as getTemplateUsageStats, St as listSessionsFromStore, Tn as formatZonedTimestamp, Tt as pruneLegacyStoreKeys, U as getRemoteSkillEligibility, Ut as readConsolidationState, V as normalizeSendPolicy, Vt as openInFlightTurnsStore, W as primeRemoteSkillsCache, Wn as runSubagentAnnounceFlow, Wt as assembleAgentSystemPromptWithSections, X as approveNodePairing, Xn as registerAgentRunContext, Xt as PROSE_GLOBAL_ROOT, Y as setSkillsRemoteRegistry, Yn as onAgentEvent, Yt as PromptSectionRegistry, Z as listNodePairing, Zt as _clearProseCache, _ as spawnSubagentDirect, _n as getTotalPendingReplies, _r as applyVerboseOverride, _t as buildSystemPromptReport, a as getCliSessionId, an as requestHeartbeatNow, at as verifyPairingToken, b as getTemplateCache, br as isSystemEventContextChanged, c as debugSkipAll, cn as getPluginToolMeta, cr as setCommandLaneConcurrency, ct as readJsonFile, d as setDebugStepBroadcaster, dn as loadOpenClawPlugins, dt as getSkillsSnapshotVersion, en as applyToolPolicyPipeline, et as requestNodePairing, f as setSteppedBuild, ft as registerSkillsChangeListener, gn as createReplyDispatcher, gr as applyModelOverrideToSessionEntry, gt as runEmbeddedPiAgent, hn as dispatchInboundMessage, ht as clearSessionQueues, i as resolveCronStyleNow, in as runToolScript, ir as getActiveTaskCount, it as hashToken$1, j as loadProviderUsageSummary, jn as isAbortTrigger, jt as getActiveEmbeddedRunCount, k as normalizeGroupActivation, kt as orgScopeVisible, l as debugStepContinue, lr as waitForActiveTasks, lt as writeJsonAtomic, mr as buildAuthHealthSummary, n as BARE_SESSION_RESET_PROMPT, nn as createMinionTools, nt as verifyNodeToken, o as setCliSessionId, or as getTotalQueueSize, ot as pruneExpiredPending, q as refreshRemoteNodeBins, qn as emitAgentEvent, qt as buildSectionRenderContext, rn as clearCustomToolsCache, rr as resolveBootstrapContextForRun, rt as generatePairingToken, s as runCliAgent, sr as resetAllLanes, st as resolvePairingPaths, tn as buildDefaultToolPolicyPipelineSteps, tt as updatePairedNodeMetadata, u as isSteppedBuildEnabled, un as loadMinionPlugins, ur as lookupContextTokens, ut as createAsyncLock, v as getLastReloadAt, vr as parseVerboseOverride, vt as buildSystemPromptParams, w as stopTemplateWatcher, wt as loadSessionEntry, x as getTemplateLoadErrors, xt as listAgentsForGateway, y as getTemplate, yr as enqueueSystemEvent, yt as canonicalizeSpawnedByForAgent, zn as listDescendantRunsForRequester, zr as transcribeOpenAiCompatibleAudio, zt as markInterrupted } from "./reply-pajA-Yl6.js";
 import { B as listMcpTools, E as createEmptyPluginRegistry, F as triggerInternalHook, H as registerMcpTool, I as addMcpSseSubscriber, L as getMcpDispatcher, M as clearInternalHooks, N as createInternalHookEvent, P as registerInternalHook, R as getMcpIdentityResolver, U as setMcpDispatcher, V as reconcileMcpPluginTools, W as setMcpIdentityResolver, a as setConsoleSubsystemFilter, d as CHANNEL_IDS, n as runtimeForLogger, o as setConsoleTimestampPrefix, t as createSubsystemLogger, w as setActivePluginRegistryConfig, x as getActivePluginRegistry, z as getMcpToolMethod } from "./subsystem-Dor46CEN.js";
 import { t as defaultRuntime } from "./runtime-Da615Z-K.js";
 import { b as isSubagentSessionKey, d as resolveAgentIdFromSessionKey, h as toAgentStoreSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, m as toAgentRequestSessionKey, n as DEFAULT_AGENT_ID, s as classifySessionKeyShape, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isCronRunSessionKey, x as parseAgentSessionKey } from "./session-key-BcXqsG0l.js";
@@ -16,20 +16,20 @@ import { t as applySqlitePragmas } from "./sqlite-pragmas-C_o_lU6a.js";
 import { t as requireNodeSqlite } from "./sqlite-TEJFfaDd.js";
 import { d as setSentryContext, f as setSentryTag, n as getReliabilityUptimeStartMs, r as initReliability, t as emitReliabilityEvent } from "./reliability-D5odTVhl.js";
 import { n as logAcceptedEnvOption, t as isTruthyEnvValue } from "./env-IZo5oHSI.js";
-import { D as parseDurationMs, T as sensitive, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, y as resolveSubagentMaxConcurrent } from "./validation-Crc6Dwkp.js";
-import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-PqZ9xsqS.js";
+import { D as parseDurationMs, T as sensitive, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, y as resolveSubagentMaxConcurrent } from "./validation-DoqW0cF4.js";
+import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-7MYBxUkU.js";
 import { l as isTestDefaultMemorySlotDisabled, n as loadPluginManifestRegistry } from "./manifest-registry-BhQtdshS.js";
-import { n as migrateLegacyConfig } from "./config-DBs_rRu7.js";
-import { A as getMirrorSnapshot, D as applyChannelRestart, F as setChannelRestartHandler, I as startMirrorRefreshTick, L as resolveHubMetricsConfig, O as channelConfigSource, P as seedMirror, _ as resolveTelegramAccount, c as resolveWhatsAppAccount, j as listMirrorAccountIds, k as getMirrorEntry, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, v as buildChannelAccountBindings, z as setMirrorAccountSource } from "./plugins-B4Zf_SkO.js";
-import { B as resolveExplicitAgentSessionKey, C as readSessionMessages, D as stripEnvelope, E as resolveSessionTranscriptCandidates, H as resolveMainSessionKeyFromConfig, L as resolveFreshSessionTotalTokens, N as resolveSessionResetPolicy, O as stripMessageIdHints, R as canonicalizeMainSessionAlias, S as capArrayByJsonBytes, V as resolveMainSessionKey, W as snapshotSessionOrigin, a as loadSessionStore, b as archiveFileOnDisk, g as mergeDeliveryContext, j as evaluateSessionFreshness, m as deliveryContextFromSession, n as parseSessionThreadInfo, nt as cleanStaleLockFiles, t as extractDeliveryInfo, u as updateSessionStore, v as normalizeSessionDeliveryFields, w as readSessionPreviewItemsFromTranscript, x as archiveSessionTranscripts, z as resolveAgentMainSessionKey } from "./sessions-DaA0crcT.js";
-import { n as runWithModelFallback } from "./model-fallback-FMG5anI7.js";
-import { c as resolveSandboxRuntimeStatus } from "./sandbox-BoqQp8gb.js";
-import { a as collectExplicitAllowlist, c as mergeAlsoAllowPolicy, n as TOOL_GROUPS, s as expandToolGroups, t as GROUP_DESCRIPTIONS, u as resolveToolProfilePolicy } from "./tool-policy-Cn0_ZqFk.js";
+import { n as migrateLegacyConfig } from "./config-BrDW75c2.js";
+import { A as getMirrorSnapshot, D as applyChannelRestart, F as setChannelRestartHandler, I as startMirrorRefreshTick, L as resolveHubMetricsConfig, O as channelConfigSource, P as seedMirror, _ as resolveTelegramAccount, c as resolveWhatsAppAccount, j as listMirrorAccountIds, k as getMirrorEntry, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, v as buildChannelAccountBindings, z as setMirrorAccountSource } from "./plugins-Db3l--Iv.js";
+import { B as resolveExplicitAgentSessionKey, C as readSessionMessages, D as stripEnvelope, E as resolveSessionTranscriptCandidates, H as resolveMainSessionKeyFromConfig, L as resolveFreshSessionTotalTokens, N as resolveSessionResetPolicy, O as stripMessageIdHints, R as canonicalizeMainSessionAlias, S as capArrayByJsonBytes, V as resolveMainSessionKey, W as snapshotSessionOrigin, a as loadSessionStore, b as archiveFileOnDisk, g as mergeDeliveryContext, j as evaluateSessionFreshness, m as deliveryContextFromSession, n as parseSessionThreadInfo, nt as cleanStaleLockFiles, t as extractDeliveryInfo, u as updateSessionStore, v as normalizeSessionDeliveryFields, w as readSessionPreviewItemsFromTranscript, x as archiveSessionTranscripts, z as resolveAgentMainSessionKey } from "./sessions-ClJAVE0p.js";
+import { n as runWithModelFallback } from "./model-fallback-Cm3Tv0In.js";
+import { c as resolveSandboxRuntimeStatus } from "./sandbox-DLtSFsnF.js";
+import { a as collectExplicitAllowlist, c as mergeAlsoAllowPolicy, n as TOOL_GROUPS, s as expandToolGroups, t as GROUP_DESCRIPTIONS, u as resolveToolProfilePolicy } from "./tool-policy-CGuZzs9F.js";
 import { a as enableTailscaleServeFunnel, i as enableTailscaleServe, n as disableTailscaleServe, r as enableTailscaleFunnel, s as getTailnetHostname, t as disableTailscaleFunnel } from "./tailscale-ElLAPnGH.js";
 import { a as resolveRequestClientIp, c as createAuthRateLimiter, i as resolveGatewayAuth, l as safeEqualSecret, n as authorizeGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as isLocalDirectRequest, s as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, t as assertGatewayAuthConfigured } from "./auth-OWSujIee.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C0DLwT7t.js";
 import { a as isTrustedProxyAddress, d as resolveGatewayClientIp, f as resolveGatewayListenHosts, i as isPrivateOrLoopbackAddress, l as pickPrimaryLanIPv4, n as isLoopbackAddress, p as resolveHostName, r as isLoopbackHost, s as normalizeHostHeader, t as rawDataToString, u as resolveGatewayBindHost } from "./ws-D1BO6u3O.js";
-import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-DwRkP6wl.js";
+import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-CDmBokpm.js";
 import { n as buildWorkspaceSkillSnapshot, r as loadWorkspaceSkillEntries } from "./workspace-BN1xTeSB.js";
 import "./skills-BDk_UtGi.js";
 import { a as isErrno, n as formatErrorMessage } from "./errors-iV4-NKRR.js";
@@ -41,22 +41,22 @@ import "./logging-_oKeHe0e.js";
 import { r as resolveUserDir } from "./user-directory-D27je39W.js";
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-CIx6mrsE.js";
 import { i as normalizeInputProvenance } from "./input-provenance-ChJN5mZj.js";
-import { D as runGlobalGatewayStopSafely, S as patchRouting, T as getGlobalHookRunner, _ as closeMessageLedger, b as markSynced, g as claimBatch, k as isPluginEnabledForOrg, w as deterministicClientId, x as openMessageLedger, y as markFailed } from "./reply-payloads-CHYk2cao.js";
+import { D as runGlobalGatewayStopSafely, S as patchRouting, T as getGlobalHookRunner, _ as closeMessageLedger, b as markSynced, g as claimBatch, k as isPluginEnabledForOrg, w as deterministicClientId, x as openMessageLedger, y as markFailed } from "./reply-payloads-BlZu5x6x.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-v1JmmyzF.js";
-import { n as loadModelCatalog } from "./model-catalog-DYHf-usN.js";
+import { n as loadModelCatalog } from "./model-catalog-RhTD2XJY.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-DyoUYpcY.js";
 import { a as stripHeartbeatToken } from "./lanes-lpI3esC4.js";
-import { i as resolveSessionDeliveryTarget, r as resolveOutboundTarget } from "./targets-BZDxvcL1.js";
+import { i as resolveSessionDeliveryTarget, r as resolveOutboundTarget } from "./targets-DypSB4K6.js";
 import { n as getMachineDisplayName } from "./with-timeout-B2r_vm3n.js";
 import { n as isDiagnosticsEnabled } from "./diagnostic-events-BIoHynd0.js";
 import { c as startDiagnosticHeartbeat, l as stopDiagnosticHeartbeat } from "./diagnostic-BAEmirZd.js";
-import { C as OPENAI_TTS_MODELS, T as defineDrone, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-CVpT5DDx.js";
-import { i as runDrone, t as createGatewayDroneHost } from "./host-w2pX4Cmj.js";
+import { C as OPENAI_TTS_MODELS, T as defineDrone, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-CdyriGYN.js";
+import { i as runDrone, t as createGatewayDroneHost } from "./host-FOFn61kz.js";
 import { a as traceGatewayEvent, n as pruneOldTraceFiles } from "./chat-trace-DK2HjAH4.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-D2UybctY.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-DWeZSF4O.js";
 import { t as ToolInputError } from "./common-DSuaFkdO.js";
-import { $ as validateMeshRetryParams, $t as normalizeDevicePublicKeyBase64Url, A as validateCronRunsParams, At as validateSkillsUpdateParams, B as validateDronesCancelParams, Bt as validateWakeParams, C as validateConfigSchemaParams, Ct as validateSessionsPreviewParams, D as validateCronListParams, Dt as validateSkillsBinsParams, E as validateCronAddParams, Et as validateSessionsUsageParams, F as validateDevicePairRejectParams, Ft as validateToolsStatusParams, G as validateExecApprovalResolveParams, Gt as validateWizardStartParams, H as validateDronesExecuteParams, Ht as validateWebLoginWaitParams, I as validateDevicePairRemoveParams, It as validateToolsUpdateParams, J as validateExecApprovalsNodeSetParams, Jt as buildDeviceAuthPayload, K as validateExecApprovalsGetParams, Kt as validateWizardStatusParams, L as validateDeviceTokenRevokeParams, Lt as validateUpdateCheckParams, M as validateCronUpdateParams, Mt as validateTalkModeParams, N as validateDevicePairApproveParams, Nt as validateTelegramValidateTokenParams, O as validateCronRemoveParams, Ot as validateSkillsInstallParams, P as validateDevicePairListParams, Pt as validateToolsOverridesSetParams, Q as validateMeshPlanParams, R as validateDeviceTokenRotateParams, Rt as validateUpdateRunParams, S as validateConfigPatchParams, St as validateSessionsPatchParams, T as validateConnectParams, Tt as validateSessionsResolveParams, U as validateDronesProbeParams, Ut as validateWizardCancelParams, V as validateDronesCapabilitiesParams, Vt as validateWebLoginStartParams, W as validateExecApprovalRequestParams, Wt as validateWizardNextParams, X as validateLogsTailParams, Y as validateExecApprovalsSetParams, Yt as normalizeDeviceAuthScopes, Z as validateMeshPlanAutoParams, Zt as deriveDeviceIdFromPublicKey, _ as validateChatHistoryParams, _t as validateRequestFrame, a as validateAgentWaitParams, at as validateNodeEventParams, b as validateConfigApplyParams, bt as validateSessionsDeleteParams, c as validateAgentsFilesGetParams, ct as validateNodeListParams, d as validateAgentsListParams, dt as validateNodePairRejectParams, en as verifyDeviceSignature, et as validateMeshRunParams, f as validateAgentsSkillsSetParams, ft as validateNodePairRequestParams, g as validateChatAbortParams, gt as validatePollParams, h as validateChannelsStatusParams, ht as validatePlaygroundCompleteParams, i as validateAgentParams, it as validateNodeDescribeParams, j as validateCronStatusParams, jt as validateTalkConfigParams, k as validateCronRunParams, kt as validateSkillsStatusParams, l as validateAgentsFilesListParams, lt as validateNodePairApproveParams, m as validateChannelsLogoutParams, mt as validateNodeRenameParams, n as formatValidationErrors, nt as validateModelsListParams, o as validateAgentsCreateParams, ot as validateNodeInvokeParams, p as validateAgentsUpdateParams, pt as validateNodePairVerifyParams, q as validateExecApprovalsNodeGetParams, qt as parseSessionLabel, r as validateAgentIdentityParams, rt as validateModelsSetEnabledParams, s as validateAgentsDeleteParams, st as validateNodeInvokeResultParams, tt as validateMeshStatusParams, u as validateAgentsFilesSetParams, ut as validateNodePairListParams, v as validateChatInjectParams, vt as validateSendParams, w as validateConfigSetParams, wt as validateSessionsResetParams, x as validateConfigGetParams, xt as validateSessionsListParams, y as validateChatSendParams, yt as validateSessionsCompactParams, z as validateDiscordValidateTokenParams, zt as validateUpdateStatusParams } from "./client-UbK7ubLT.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-2tXHVKWh.js";
+import { $ as validateMeshRetryParams, $t as normalizeDevicePublicKeyBase64Url, A as validateCronRunsParams, At as validateSkillsUpdateParams, B as validateDronesCancelParams, Bt as validateWakeParams, C as validateConfigSchemaParams, Ct as validateSessionsPreviewParams, D as validateCronListParams, Dt as validateSkillsBinsParams, E as validateCronAddParams, Et as validateSessionsUsageParams, F as validateDevicePairRejectParams, Ft as validateToolsStatusParams, G as validateExecApprovalResolveParams, Gt as validateWizardStartParams, H as validateDronesExecuteParams, Ht as validateWebLoginWaitParams, I as validateDevicePairRemoveParams, It as validateToolsUpdateParams, J as validateExecApprovalsNodeSetParams, Jt as buildDeviceAuthPayload, K as validateExecApprovalsGetParams, Kt as validateWizardStatusParams, L as validateDeviceTokenRevokeParams, Lt as validateUpdateCheckParams, M as validateCronUpdateParams, Mt as validateTalkModeParams, N as validateDevicePairApproveParams, Nt as validateTelegramValidateTokenParams, O as validateCronRemoveParams, Ot as validateSkillsInstallParams, P as validateDevicePairListParams, Pt as validateToolsOverridesSetParams, Q as validateMeshPlanParams, R as validateDeviceTokenRotateParams, Rt as validateUpdateRunParams, S as validateConfigPatchParams, St as validateSessionsPatchParams, T as validateConnectParams, Tt as validateSessionsResolveParams, U as validateDronesProbeParams, Ut as validateWizardCancelParams, V as validateDronesCapabilitiesParams, Vt as validateWebLoginStartParams, W as validateExecApprovalRequestParams, Wt as validateWizardNextParams, X as validateLogsTailParams, Y as validateExecApprovalsSetParams, Yt as normalizeDeviceAuthScopes, Z as validateMeshPlanAutoParams, Zt as deriveDeviceIdFromPublicKey, _ as validateChatHistoryParams, _t as validateRequestFrame, a as validateAgentWaitParams, at as validateNodeEventParams, b as validateConfigApplyParams, bt as validateSessionsDeleteParams, c as validateAgentsFilesGetParams, ct as validateNodeListParams, d as validateAgentsListParams, dt as validateNodePairRejectParams, en as verifyDeviceSignature, et as validateMeshRunParams, f as validateAgentsSkillsSetParams, ft as validateNodePairRequestParams, g as validateChatAbortParams, gt as validatePollParams, h as validateChannelsStatusParams, ht as validatePlaygroundCompleteParams, i as validateAgentParams, it as validateNodeDescribeParams, j as validateCronStatusParams, jt as validateTalkConfigParams, k as validateCronRunParams, kt as validateSkillsStatusParams, l as validateAgentsFilesListParams, lt as validateNodePairApproveParams, m as validateChannelsLogoutParams, mt as validateNodeRenameParams, n as formatValidationErrors, nt as validateModelsListParams, o as validateAgentsCreateParams, ot as validateNodeInvokeParams, p as validateAgentsUpdateParams, pt as validateNodePairVerifyParams, q as validateExecApprovalsNodeGetParams, qt as parseSessionLabel, r as validateAgentIdentityParams, rt as validateModelsSetEnabledParams, s as validateAgentsDeleteParams, st as validateNodeInvokeResultParams, tt as validateMeshStatusParams, u as validateAgentsFilesSetParams, ut as validateNodePairListParams, v as validateChatInjectParams, vt as validateSendParams, w as validateConfigSetParams, wt as validateSessionsResetParams, x as validateConfigGetParams, xt as validateSessionsListParams, y as validateChatSendParams, yt as validateSessionsCompactParams, z as validateDiscordValidateTokenParams, zt as validateUpdateStatusParams } from "./client-4u1JH1Zk.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-DQ1ciEPz.js";
 import { i as isExternalHookSession, n as detectSuspiciousPatterns, r as getHookType, t as buildSafeExternalPrompt } from "./external-content-Css-cJoz.js";
 import { t as formatDocsLink } from "./links-XaZTa0pi.js";
 import { n as runCommandWithRuntime } from "./cli-utils-Cg2c3XDf.js";
@@ -64,23 +64,23 @@ import { t as formatHelpExamples } from "./help-format-D20I7z1G.js";
 import { n as withProgress } from "./progress-Dai1njDG.js";
 import { t as getChannelActivity } from "./channel-activity-mLVM0GeJ.js";
 import { a as mergeExecApprovalsSocketDefaults, c as readExecApprovalsSnapshot, p as saveExecApprovals, r as ensureExecApprovals, s as normalizeExecApprovals, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-DkFd6DjM.js";
-import { t as TOOL_REGISTRY } from "./_registry.generated-CVwb-DEK.js";
-import { a as resolveGroupToolPolicy, i as resolveEffectiveToolPolicy, o as resolveSubagentToolPolicy, t as listAgentWorkspaceDirs } from "./workspace-dirs-Bxd48BAf.js";
+import { t as TOOL_REGISTRY } from "./_registry.generated-DKC2RDUo.js";
+import { a as resolveGroupToolPolicy, i as resolveEffectiveToolPolicy, o as resolveSubagentToolPolicy, t as listAgentWorkspaceDirs } from "./workspace-dirs-Duw92DA5.js";
 import { r as recallMemories, t as configureMemorySink } from "./memory-sink-D19pkCCX.js";
 import { t as KnowledgeGraphSession } from "./knowledge-graph-pXjPijn6.js";
 import { n as setHubRest, t as getHubRest } from "./hub-rest-registry-DQyDHHy2.js";
 import { n as resolveModel } from "./model-CS8MRSpT.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-D-vzOkTS.js";
-import { r as invalidateToolIndex } from "./tool-index-DT6m2Vqq.js";
+import { r as invalidateToolIndex } from "./tool-index-CEYMGFrO.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format--dK3YoXf.js";
 import { a as markGatewaySigusr1RestartHandled, c as setPreRestartDeferralCheck, i as isGatewaySigusr1RestartExternallyAllowed, n as deferGatewayRestartUntilIdle, o as scheduleGatewaySigusr1Restart, r as emitGatewayRestart, s as setGatewaySigusr1RestartPolicy, t as consumeGatewaySigusr1RestartAuthorization } from "./restart-CrIJvqAZ.js";
-import { a as areHeartbeatsEnabled, c as setHeartbeatsEnabled, i as styleHealthChannelLine, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as resolveHeartbeatVisibility } from "./health-CJLBn09L.js";
-import { n as getLastHeartbeatEvent, r as onHeartbeatEvent } from "./heartbeat-events-CNb7CXLY.js";
-import { f as normalizePollInput, i as ensureOutboundSessionEntry, n as runMessageAction, o as resetDirectoryCache, r as resolveOutboundSessionRoute } from "./message-action-runner-BC0NPAEt.js";
-import { a as computeBackoff, n as resolveChannelSenderIdentity, o as sleepWithAbort, r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-CxJuc0hI.js";
+import { a as areHeartbeatsEnabled, c as setHeartbeatsEnabled, i as styleHealthChannelLine, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as resolveHeartbeatVisibility } from "./health-8oE9qNSE.js";
+import { n as getLastHeartbeatEvent, r as onHeartbeatEvent } from "./heartbeat-events-D-wmX2Vg.js";
+import { f as normalizePollInput, i as ensureOutboundSessionEntry, n as runMessageAction, o as resetDirectoryCache, r as resolveOutboundSessionRoute } from "./message-action-runner-BJzBMfAN.js";
+import { a as computeBackoff, n as resolveChannelSenderIdentity, o as sleepWithAbort, r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-g25aWRqJ.js";
 import { n as handleHubAssignmentChanged, r as initUserSubsystem, t as getActiveUserSubsystem } from "./server-startup-users-BPNhajYB.js";
 import { t as mapRoleToScopes } from "./types-Utz3c3Qq.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-dO6xHyfp.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-i_B9izvk.js";
 import { t as ensureMinionCliOnPath } from "./path-env-q2qzs5In.js";
 import { t as forceFreePortAndWait } from "./ports-CRi_UQIX.js";
 import { t as buildChannelUiCatalog } from "./catalog-Pmvum_mS.js";
@@ -90,42 +90,42 @@ import { n as setGoogleAdcClient, t as getGoogleAdcClient } from "./hub-credenti
 import { a as normalizeOptionalAgentId, c as normalizePayloadToSystemText, d as buildDeliveryFromLegacyPayload, f as hasLegacyDeliveryHints, i as inferLegacyName, l as normalizeRequiredName, n as normalizeCronJobCreate, o as normalizeOptionalSessionKey, p as stripLegacyDeliveryFields, r as normalizeCronJobPatch, s as normalizeOptionalText, t as normalizeHttpWebhookUrl, u as migrateLegacyCronPayload } from "./webhook-url-ZyRlcF75.js";
 import { i as parseAbsoluteTimeMs, n as resolveCronStaggerMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-BlvVswOf.js";
 import { a as summarizeRestartSentinel, n as formatDoctorNonInteractiveHint, r as formatRestartSentinelMessage, s as writeRestartSentinel, t as consumeRestartSentinel } from "./restart-sentinel-fbAWH01I.js";
-import { n as listGatewayMethods, t as GATEWAY_EVENTS } from "./server-methods-list-BkeL_f1I.js";
-import { o as normalizeReplyPayloadsForDelivery, s as loadChannelOutboundAdapter, t as deliverOutboundPayloads } from "./deliver-BBHWk2Fl.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-D-JiWYSP.js";
-import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-D1lEb2ij.js";
+import { n as listGatewayMethods, t as GATEWAY_EVENTS } from "./server-methods-list-ZEquDpTD.js";
+import { o as normalizeReplyPayloadsForDelivery, s as loadChannelOutboundAdapter, t as deliverOutboundPayloads } from "./deliver-BUifEj0F.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-wHLAe5Et.js";
+import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-BCSCZOB-.js";
 import { a as runAggregation, n as executeOrchestration, r as readStatusJson, t as executePipeline } from "./orchestration-pipeline-BBscBgru.js";
 import { r as readManifest, t as completeManifest } from "./orchestration-manifest-ByxGsjSI.js";
-import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-DF4h-8kw.js";
-import { t as createBrowserRouteDispatcher } from "./dispatcher-Cce5sJHy.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-C369Rxs0.js";
+import { t as createBrowserRouteDispatcher } from "./dispatcher-CvddQmnF.js";
 import { n as persistBrowserProxyFiles, t as applyBrowserProxyPaths } from "./proxy-files-CGzbQD6b.js";
 import { r as cachedJson } from "./ttl-cache-C8H9R9LT.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-C1Fg_5xy.js";
 import { n as inheritOptionFromParent } from "./command-options-Dhjl7AMa.js";
 import { t as WizardCancelledError } from "./prompts-E0FayNjJ.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BcEbnHmz.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-CoUmbc3E.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-BFqsBeiO.js";
 import { t as buildChannelAccountSnapshot } from "./status-Dg720jp3.js";
-import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-COFCTrXY.js";
-import "./onboard-helpers-CshtI1Zv.js";
+import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-gS7HQOeH.js";
+import "./onboard-helpers-DfEvL7Eo.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-XKS1L_j5.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-BwC8GE-s.js";
 import { t as discoverGatewayBeacons } from "./bonjour-discovery-NB0c0sCF.js";
 import { t as installSkill } from "./skills-install-C3il4PTO.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-C2cJYDtd.js";
-import { m as parsePort$1 } from "./lifecycle-core-Cefw3jp5.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-B8kOSqee.js";
+import { m as parsePort$1 } from "./lifecycle-core-Dmy-67JO.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-CAgHOWp8.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CwLlNhTt.js";
-import { a as resolveNodeCommandAllowlist, i as isNodeCommandAllowed, o as probeGateway } from "./audit-BZt5UM89.js";
-import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-DJ3pP2oq.js";
+import { a as resolveNodeCommandAllowlist, i as isNodeCommandAllowed, o as probeGateway } from "./audit-CftXdiYP.js";
+import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-BeasmhMH.js";
 import { a as isNewerVersionString, l as channelToNpmTag, o as resolveNpmChannelTag, p as normalizeUpdateChannel, r as fetchNpmTagVersion, t as checkUpdateStatus } from "./update-check-DyLwYZgC.js";
 import { i as initCrypto, n as ProbeRegistry, r as SecretsManager, t as SecretStore } from "./store-J0lVAVgk.js";
-import { t as runOnboardingWizard } from "./onboarding-DEi30r7I.js";
-import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-C7QqFlQ5.js";
-import { h as resolveGmailPullRuntimeConfigs } from "./gmail-De7lwq9k.js";
+import { t as runOnboardingWizard } from "./onboarding-BNfuRC7v.js";
+import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-Bxplfna8.js";
+import { h as resolveGmailPullRuntimeConfigs } from "./gmail-tGz-kYHa.js";
 import { t as createOutboundSendDeps$1 } from "./outbound-send-deps-BF7Fp5DR.js";
 import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-CpPHpV3L.js";
-import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-C63gAsUc.js";
+import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-DaBGbCfi.js";
 import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-BRxsVIll.js";
 import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-BJTc667L.js";
 import { i as shellEscape, n as resolveSystemdUnit, r as runRestartScript } from "./restart-helper-BCZgXDv5.js";
@@ -1938,7 +1938,7 @@ async function recordAvailableUpdate(input, cfg) {
 		notified: false,
 		reason: "not-newer"
 	};
-	if (!isNewerVersionString("2026.7.12-dev.20260715050311", input.version)) return {
+	if (!isNewerVersionString("2026.7.16-dev", input.version)) return {
 		notified: false,
 		reason: "not-newer"
 	};
@@ -1976,7 +1976,7 @@ async function getUpdateStatus() {
 async function clearPendingIfCurrent() {
 	const pending = await readJson(pendingPath());
 	if (!pending) return;
-	if (!isNewerVersionString("2026.7.12-dev.20260715050311", pending.version)) await fs$1.rm(pendingPath(), { force: true });
+	if (!isNewerVersionString("2026.7.16-dev", pending.version)) await fs$1.rm(pendingPath(), { force: true });
 }
 /** Consume update-result.json if present. Returns false when no file existed. */
 async function processUpdateResult(cfg) {
@@ -2067,7 +2067,7 @@ async function runGatewayUpdateCheck(params) {
 		await writeState(statePath, nextState);
 		return;
 	}
-	if (isNewerVersionString("2026.7.12-dev.20260715050311", resolved.version)) {
+	if (isNewerVersionString("2026.7.16-dev", resolved.version)) {
 		if (state.lastNotifiedVersion !== resolved.version || state.lastNotifiedTag !== tag) {
 			params.log.info(`update available (${tag}): v${resolved.version} (current v${VERSION}). Run: ${formatCliCommand("minion update")}`);
 			nextState.lastNotifiedVersion = resolved.version;
@@ -2093,17 +2093,19 @@ function createGoogleAdcClient(opts) {
 	const base = opts.hubUrl.replace(/\/$/, "");
 	const cache = /* @__PURE__ */ new Map();
 	const feedCache = /* @__PURE__ */ new Map();
-	async function fetchFeedForUser(userId) {
-		const cached = feedCache.get(userId);
+	async function fetchFeedForUser(userId, orgId) {
+		const cacheKey = `${userId}::${orgId ?? ""}`;
+		const cached = feedCache.get(cacheKey);
 		if (cached && cached.expiresAt > now()) return cached.value;
-		const url = `${base}/api/gateway/google-identities?userId=${encodeURIComponent(userId)}`;
+		let url = `${base}/api/gateway/google-identities?userId=${encodeURIComponent(userId)}`;
+		if (orgId) url += `&orgId=${encodeURIComponent(orgId)}`;
 		const res = await doFetch(url, {
 			method: "GET",
 			headers: { Authorization: `Bearer ${opts.serverToken}` }
 		});
 		if (!res.ok) throw new Error(`hub google-identities fetch failed: ${res.status}`);
 		const value = (await res.json()).identities ?? [];
-		feedCache.set(userId, {
+		feedCache.set(cacheKey, {
 			value,
 			expiresAt: now() + ttlMs
 		});
@@ -2129,7 +2131,8 @@ function createGoogleAdcClient(opts) {
 	}
 	function invalidate(userId) {
 		cache.delete(userId);
-		feedCache.delete(userId);
+		const prefix = `${userId}::`;
+		for (const key of feedCache.keys()) if (key.startsWith(prefix)) feedCache.delete(key);
 	}
 	return {
 		fetchForUser,
@@ -5654,7 +5657,7 @@ function createFreeTierApiHandler(db) {
 *
 * Records per-method handler latency at the request dispatch chokepoint and
 * samples Node's event-loop delay, then emits a single aggregated
-* `gateway.perf_snapshot` event per window (default 60s) into the unified
+* `gateway.perf_snapshot` event per window (default 5min) into the unified
 * event store — the same surface the hub reliability dashboard reads.
 *
 * Why this exists: the legacy `gateway.ws_slow_response` event fired per-call
@@ -5677,8 +5680,12 @@ function createFreeTierApiHandler(db) {
 const log$24 = createSubsystemLogger("gateway/metrics");
 /** Cap on retained latency samples per method (reservoir) to bound memory. */
 const MAX_SAMPLES_PER_METHOD = 512;
-/** Default snapshot window. Matches the reliability rate-limiter granularity. */
-const DEFAULT_INTERVAL_MS = 6e4;
+/**
+* Default snapshot window. 5min (was 60s) — the payload is a percentile/throughput
+* aggregate carrying its own `windowMs`, so a wider window keeps stats valid while
+* cutting emitted rows 5×. Consumers must read `windowMs`, never assume 60s.
+*/
+const DEFAULT_INTERVAL_MS = 3e5;
 const methodStats = /* @__PURE__ */ new Map();
 let reporterTimer = null;
 let eventLoopHist = null;
@@ -21037,7 +21044,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-BpU_jSoz.js");
+			const { handleNodeEvent } = await import("./server-node-events-DpkjSBLL.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			const nodeConnId = client?.connId;
 			await handleNodeEvent({
@@ -23680,6 +23687,10 @@ const MODEL_PRICING = {
 		inputPerMillion: 15,
 		outputPerMillion: 75
 	},
+	"claude-haiku-4": {
+		inputPerMillion: 1,
+		outputPerMillion: 5
+	},
 	"claude-haiku-3.5": {
 		inputPerMillion: .8,
 		outputPerMillion: 4
@@ -23784,6 +23795,10 @@ const MODEL_PRICING = {
 		inputPerMillion: .14,
 		outputPerMillion: .28
 	},
+	"deepseek-v3": {
+		inputPerMillion: .14,
+		outputPerMillion: .28
+	},
 	"deepseek-coder": {
 		inputPerMillion: .14,
 		outputPerMillion: .28
@@ -23802,14 +23817,32 @@ const MODEL_PRICING = {
 	}
 };
 /**
-* Look up pricing for a model. Tries exact match, then prefix match.
-* Returns undefined for unknown or local models (cost = 0).
+* Look up pricing for a model id. Strips any `provider/` prefix (OpenRouter et al.
+* namespace models as `deepseek/deepseek-chat-v3-0324`), then tries an exact match
+* followed by a LONGEST-prefix match (so `claude-opus-4-8` → `claude-opus-4`, and
+* the most specific key wins over a shorter one). Returns undefined for unknown or
+* local models (cost = 0).
+*
+* NOTE: this mirrors `minion_hub/src/lib/utils/model-pricing.ts:getModelPricing`.
+* The two copies must stay in sync — the hub falls back to its copy when the
+* gateway usage aggregate is unavailable. The previous server version did neither
+* the prefix-strip nor longest-match, so every OpenRouter-namespaced id (which is
+* what agents actually use) resolved to undefined → cost $0 despite real tokens.
 */
 function getModelPricing(modelId) {
-	const lower = modelId.toLowerCase();
+	if (!modelId) return;
+	let lower = modelId.toLowerCase();
+	const slash = lower.lastIndexOf("/");
+	if (slash >= 0) lower = lower.slice(slash + 1);
 	const exact = MODEL_PRICING[lower];
 	if (exact) return exact;
-	for (const [key, value] of Object.entries(MODEL_PRICING)) if (lower.startsWith(key)) return value;
+	let best;
+	let bestLen = 0;
+	for (const [key, value] of Object.entries(MODEL_PRICING)) if (lower.startsWith(key) && key.length > bestLen) {
+		best = value;
+		bestLen = key.length;
+	}
+	return best;
 }
 //#endregion
 //#region src/events/usage-aggregate.ts
@@ -25967,7 +26000,7 @@ const updateHandlers = {
 				const stagedPrev = result.mode === "staged" ? result.previousTarget : null;
 				const stagedLink = process.env.MINION_CURRENT_LINK?.trim();
 				const wd = await prepareUpdateWatchdogScript({
-					fromVersion: result.before?.version ?? "2026.7.12-dev.20260715050311",
+					fromVersion: result.before?.version ?? "2026.7.16-dev",
 					toVersion: result.after?.version ?? "",
 					stateDir: resolveStateDir(),
 					restartDelayMs,
@@ -29184,7 +29217,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.MINION_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.MINION_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./control-service-DF4h-8kw.js").then((n) => n.t);
+	const mod = override ? await import(override) : await import("./control-service-C369Rxs0.js").then((n) => n.t);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -33989,6 +34022,13 @@ function createGatewayHttpServer(opts) {
 			const configSnapshot = loadConfig();
 			const trustedProxies = configSnapshot.gateway?.trustedProxies ?? [];
 			const requestPath = new URL(req.url ?? "/", "http://localhost").pathname;
+			if (requestPath === "/health" && (req.method === "GET" || req.method === "HEAD")) {
+				res.statusCode = 200;
+				res.setHeader("Content-Type", "application/json; charset=utf-8");
+				res.setHeader("Cache-Control", "no-cache");
+				res.end(req.method === "HEAD" ? void 0 : JSON.stringify({ ok: true }));
+				return;
+			}
 			if (requestPath.startsWith("/shell-access/") && handleShellAccessRequest) {
 				if (await handleShellAccessRequest(req, res)) return;
 			}
@@ -35226,7 +35266,7 @@ async function deliverFlowReply(sessionKey, reply) {
 	}
 	try {
 		const cfg = loadConfig();
-		const { deliverOutboundPayloads } = await import("./deliver-BBHWk2Fl.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-BUifEj0F.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg,
 			channel: target.channel,
@@ -38867,11 +38907,21 @@ function requireOperator(client, respond) {
 	}
 	return true;
 }
-/** Return the caller's organization, or `undefined` for a platform admin.
-* Ordinary operator sessions must never fall back to an unscoped lookup. */
+/**
+* Return the caller's organization, derived ONLY from `client.orgId` —
+* the value the gateway itself established at connect time from a validated
+* JWT or service-account claim (see ws-jwt-auth.ts / message-handler.ts).
+*
+* Every hub dashboard session (browser and hub-server alike) presents the
+* same shared operator token and carries `operator.admin` scope, so
+* `operator.admin` is NOT a trust signal for org membership — treating it
+* as one previously let ANY hub session read/mutate every org's shells
+* (params.orgId / an "unscoped admin" fallback both trusted the caller's
+* own say-so). `params.orgId` must never be consulted here: a caller that
+* wants org scoping must actually hold connect-time identity for that org.
+*/
 function requireOrgScope(client, respond) {
 	if (client?.orgId) return client.orgId;
-	if (hasScope(client, ADMIN_SCOPE)) return;
 	respond(false, void 0, errorShape(ErrorCodes.FORBIDDEN, "organization context required"));
 	return null;
 }
@@ -38938,11 +38988,12 @@ function createShellsHandlers({ shells }) {
 		},
 		[METHOD.provision]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const displayName = asString(params?.displayName);
 			const harness = asString(params?.harness);
-			const orgId = client?.orgId ?? asString(params?.orgId);
 			if (!displayName) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing 'displayName'");
 				return;
@@ -38951,10 +39002,6 @@ function createShellsHandlers({ shells }) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing 'harness'");
 				return;
 			}
-			if (!orgId) {
-				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing organization context");
-				return;
-			}
 			const runtimes = asStringArray(params?.runtimes);
 			if (params?.runtimes !== void 0 && !runtimes) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "'runtimes' must be a string array");
@@ -39033,6 +39080,8 @@ function createShellsHandlers({ shells }) {
 		},
 		[METHOD.archive]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39043,7 +39092,7 @@ function createShellsHandlers({ shells }) {
 			tryRespond(respond, () => m.archive({
 				shellId,
 				skipBackup: Boolean(params?.skipBackup),
-				orgId: client?.orgId
+				orgId
 			}));
 		},
 		[METHOD.wake]: ({ params, client, respond }) => {
@@ -39057,6 +39106,8 @@ function createShellsHandlers({ shells }) {
 		},
 		[METHOD.restart]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39064,10 +39115,12 @@ function createShellsHandlers({ shells }) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing 'shellId'");
 				return;
 			}
-			tryRespond(respond, () => m.restart(shellId, client?.orgId));
+			tryRespond(respond, () => m.restart(shellId, orgId));
 		},
 		[METHOD.destroy]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39078,11 +39131,13 @@ function createShellsHandlers({ shells }) {
 			tryRespond(respond, () => m.destroy({
 				shellId,
 				keepBackups: Boolean(params?.keepBackups),
-				orgId: client?.orgId
+				orgId
 			}));
 		},
 		[METHOD.backupNow]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39092,7 +39147,7 @@ function createShellsHandlers({ shells }) {
 			}
 			tryRespond(respond, () => m.backupNow({
 				shellId,
-				orgId: client?.orgId
+				orgId
 			}));
 		},
 		[METHOD.listBackups]: ({ params, client, respond }) => {
@@ -39635,7 +39690,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	}
 	if (!minimalTestGateway) (async () => {
 		const { recoverPendingDeliveries } = await import("./delivery-queue-BTPlqn4c.js").then((n) => n.n);
-		const { deliverOutboundPayloads } = await import("./deliver-BBHWk2Fl.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-BUifEj0F.js").then((n) => n.n);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),

package/dist/{gateway-rpc-Dor0Ne5G.js → gateway-rpc-BaD9gDWy.js}

@@ -1,4 +1,4 @@
-import { n as callGateway } from "./call-DrV6uU2c.js";
+import { n as callGateway } from "./call-BWSchIcf.js";
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-BKpbLfdK.js";
 import { n as withProgress } from "./progress-Dai1njDG.js";
 //#region src/cli/gateway-rpc.ts

package/dist/{gateway-rpc-bFDfI0jC.js → gateway-rpc-C3LLjyGe.js}

@@ -1,5 +1,5 @@
 import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-xBRW9igp.js";
-import { n as callGateway } from "./call-2tXHVKWh.js";
+import { n as callGateway } from "./call-DQ1ciEPz.js";
 import { n as withProgress } from "./progress-Dai1njDG.js";
 //#region src/cli/gateway-rpc.ts
 function addGatewayClientOptions(cmd) {

package/dist/{gateway-tool-CYNiLl9-.js → gateway-tool-BAdp6SH1.js}

@@ -1,8 +1,8 @@
 import { t as createSubsystemLogger } from "./subsystem-Dor46CEN.js";
-import { c as resolveConfigSnapshotHash } from "./io-PqZ9xsqS.js";
-import { t as extractDeliveryInfo } from "./sessions-DaA0crcT.js";
+import { c as resolveConfigSnapshotHash } from "./io-7MYBxUkU.js";
+import { t as extractDeliveryInfo } from "./sessions-ClJAVE0p.js";
 import { i as jsonResult, s as readStringParam } from "./common-DSuaFkdO.js";
-import { t as callGatewayTool } from "./gateway-DuPlq3Lo.js";
+import { t as callGatewayTool } from "./gateway-DyaIYiPf.js";
 import { o as scheduleGatewaySigusr1Restart } from "./restart-CrIJvqAZ.js";
 import { i as stringEnum } from "./typebox-BbVstVJp.js";
 import { n as formatDoctorNonInteractiveHint, s as writeRestartSentinel } from "./restart-sentinel-fbAWH01I.js";

package/dist/{gateway-tool-FiBzkiaT.js → gateway-tool-kRxmsmMz.js}

@@ -1,8 +1,8 @@
 import { t as createSubsystemLogger } from "./subsystem-dDe36eMH.js";
-import { c as resolveConfigSnapshotHash } from "./io-BJQ6wGt0.js";
-import { t as extractDeliveryInfo } from "./sessions-Bmu1qNSi.js";
+import { c as resolveConfigSnapshotHash } from "./io-6cqme3no.js";
+import { t as extractDeliveryInfo } from "./sessions-bztP6lN1.js";
 import { i as jsonResult, s as readStringParam } from "./common-DaYU0QCr.js";
-import { t as callGatewayTool } from "./gateway-CKw1B3G3.js";
+import { t as callGatewayTool } from "./gateway-RMd15lxN.js";
 import { o as scheduleGatewaySigusr1Restart } from "./restart-CrIJvqAZ.js";
 import { i as stringEnum } from "./typebox-BbVstVJp.js";
 import { n as formatDoctorNonInteractiveHint, s as writeRestartSentinel } from "./restart-sentinel-f8KHn8x4.js";

package/dist/{gateway-tool-DimDGfH7.js → gateway-tool-sHQ43WtK.js}

@@ -1,9 +1,9 @@
 import { dt as resolveStateDir, t as createSubsystemLogger } from "./subsystem-DRI1a_Xn.js";
 import { G as formatCliCommand } from "./model-selection-DwJwoDl4.js";
-import { i as resolveConfigSnapshotHash } from "./io-36IWgxWF.js";
+import { i as resolveConfigSnapshotHash } from "./io-D8w0m4e7.js";
 import { i as jsonResult, s as readStringParam } from "./common-DcXFOnHs.js";
-import { t as extractDeliveryInfo } from "./sessions-Dv0AsGXk.js";
-import { t as callGatewayTool } from "./gateway-DkZbWoSP.js";
+import { t as extractDeliveryInfo } from "./sessions-DcOCMszs.js";
+import { t as callGatewayTool } from "./gateway-DpUea-L8.js";
 import { t as scheduleGatewaySigusr1Restart } from "./restart-DTw1wkyF.js";
 import { i as stringEnum } from "./typebox-AaaT2Z0h.js";
 import path from "node:path";

package/dist/{github-copilot-auth-bj7yKXqQ.js → github-copilot-auth-C6LhCOk3.js}

@@ -1,10 +1,10 @@
-import { dn as loadOpenClawPlugins, ln as createPluginLoaderLogger } from "./reply-D1Xsn6eO.js";
+import { dn as loadOpenClawPlugins, ln as createPluginLoaderLogger } from "./reply-pajA-Yl6.js";
 import { t as createSubsystemLogger } from "./subsystem-Dor46CEN.js";
 import { jt as ensureAuthProfileStore, kt as upsertAuthProfile, l as normalizeProviderId } from "./model-selection-D61Vkp-Q.js";
 import { r as stylePromptTitle } from "./prompt-style-DRUklDCU.js";
 import { l as applyAuthProfileConfig } from "./onboard-auth-GZ_rm5pe.js";
 import { n as isWSLEnv } from "./wsl-ClveESZ1.js";
-import { f as updateConfig } from "./shared-7xAh_DUw.js";
+import { f as updateConfig } from "./shared-CCaYvPXV.js";
 import { n as logConfigUpdated } from "./logging-D7Qj9noS.js";
 import { intro, note, outro, spinner } from "@clack/prompts";
 //#region src/plugins/providers.ts

package/dist/{github-copilot-auth--CKRNoaw.js → github-copilot-auth-VK12SD5f.js}

@@ -1,11 +1,11 @@
 import { t as createSubsystemLogger } from "./subsystem-dDe36eMH.js";
 import { J as normalizeProviderId, S as ensureAuthProfileStore, b as upsertAuthProfile } from "./auth-profiles-D0AOw2T4.js";
-import { j as loadOpenClawPlugins, k as createPluginLoaderLogger } from "./subagent-registry-DPNFbdCM.js";
+import { j as loadOpenClawPlugins, k as createPluginLoaderLogger } from "./subagent-registry-BHdRG10Z.js";
 import { r as stylePromptTitle } from "./prompt-style-DRUklDCU.js";
 import { n as logConfigUpdated } from "./logging-Bfx6vaGc.js";
 import { l as applyAuthProfileConfig } from "./onboard-auth-D6zepJ3I.js";
 import { n as isWSLEnv } from "./wsl-ClveESZ1.js";
-import { f as updateConfig } from "./shared-DDwwQhyO.js";
+import { f as updateConfig } from "./shared-3xuhqrQ5.js";
 import { intro, note, outro, spinner } from "@clack/prompts";
 //#region src/plugins/providers.ts
 const log = createSubsystemLogger("plugins");

package/dist/{gmail-OOodZN5v.js → gmail-89acEtXH.js}

@@ -1,5 +1,5 @@
 import { b as DEFAULT_GATEWAY_PORT, f as resolveGatewayPort } from "./paths-OcEPpXQE.js";
-import "./config-Bdlgx0wn.js";
+import "./config-BerwgOPM.js";
 import { randomBytes } from "node:crypto";
 //#region src/hooks/gmail.ts
 const DEFAULT_GMAIL_LABEL = "INBOX";