@nikolasp98/minion 2026.7.12-dev.20260717012629 → 2026.7.16-dev

package/dist/{gateway-cli-CLUd67zt.js → gateway-cli-1dY-uNhm.js}

@@ -14,54 +14,54 @@ import { n as getEventStore, r as initEventSystem, t as emitEvent } from "./emit
 import { t as applySqlitePragmas } from "./sqlite-pragmas-C_o_lU6a.js";
 import { t as requireNodeSqlite } from "./sqlite-C3xwcWJn.js";
 import { d as setSentryContext, f as setSentryTag, n as getReliabilityUptimeStartMs, r as initReliability, t as emitReliabilityEvent } from "./reliability-B8aPy4cP.js";
-import { $n as resetAllLanes, $t as requestNodePairing, A as loadMinionPlugins, An as extractImageContentFromSource, At as buildSystemPromptParams, B as resolveCronStyleNow, Bn as stopSubagentsForRequester, Bt as normalizeSendPolicy, C as readConsolidationState, Ct as getBuiltinSectionRegistry, D as buildDefaultToolPolicyPipelineSteps, Dn as DEFAULT_INPUT_IMAGE_MIMES, Dt as PromptSectionRegistry, E as applyToolPolicyPipeline, Et as buildToolSummaryMap, Fn as formatZonedTimestamp, G as debugSkipAll, Gt as refreshRemoteBinsForConnectedNodes, H as setCliSessionId, Ht as getRemoteSkillEligibility, J as setDebugStepBroadcaster, Jt as setSkillsRemoteRegistry, K as debugStepContinue, Kn as resolveAgentIdentity, Kt as refreshRemoteNodeBins, Lt as requestHeartbeatNow, M as dispatchInboundMessage, Mn as resolveInputFileLimits, N as createReplyDispatcher, O as getPluginToolMeta, Ot as PROSE_GLOBAL_ROOT, P as getTotalPendingReplies, Pn as transcribeOpenAiCompatibleAudio, Q as runToolScript, Qn as getTotalQueueSize, Qt as renamePairedNode, R as BARE_SESSION_RESET_PROMPT, Rn as resolveUserTimezone, S as openInFlightTurnsStore, St as assembleAgentSystemPromptWithSections, Tn as registerUnhandledRejectionHandler, Tt as buildSectionRenderContext, U as runCliAgent, Ut as primeRemoteSkillsCache, V as getCliSessionId, Vt as resolveSendPolicy, Wn as clearSessionQueues, Wt as recordRemoteNodeInfo, X as createMinionTools, Xn as getActiveTaskCount, Xt as listNodePairing, Y as setSteppedBuild, Yn as resolveBootstrapContextForRun, Yt as approveNodePairing, Z as clearCustomToolsCache, Zt as rejectNodePairing, _ as deleteRow, _n as applyModelOverrideToSessionEntry, _t as loadProviderUsageSummary, an as pruneExpiredPending, ar as getAgentRunContext, at as getTemplate, b as markInterrupted, bn as enqueueSystemEvent, cn as writeJsonAtomic, ct as getTemplateUsageStats, d as abortEmbeddedPiRun, dn as registerSkillsChangeListener, en as updatePairedNodeMetadata, er as setCommandLaneConcurrency, f as getActiveEmbeddedRunCount, g as closeInFlightTurnsStore, gt as normalizeGroupActivation, h as registerLifecycleHooks, hn as buildAuthHealthSummary, i as listDescendantRunsForRequester, in as verifyPairingToken, ir as emitAgentEvent, it as getLastReloadAt, j as loadOpenClawPlugins, jn as normalizeMimeList, jt as buildSystemPromptReport, kn as extractFileContentFromSource, kt as _clearProseCache, l as runSubagentAnnounceFlow, ln as createAsyncLock, lt as initTemplateLoader, m as waitForEmbeddedPiRunEnd, n as countActiveDescendantRuns, nn as generatePairingToken, nr as resolveAgentTimeoutMs, on as resolvePairingPaths, or as onAgentEvent, ot as getTemplateCache, p as queueEmbeddedPiMessage, q as isSteppedBuildEnabled, qt as removeRemoteNodeInfo, r as initSubagentRegistry, rn as hashToken$1, rr as clearAgentRunContext, rt as spawnSubagentDirect, s as markSubagentRunTerminated, sn as readJsonFile, sr as registerAgentRunContext, st as getTemplateLoadErrors, tn as verifyNodeToken, tr as waitForActiveTasks, u as runEmbeddedPiAgent, un as getSkillsSnapshotVersion, ut as stopTemplateWatcher, v as listForCurrentInstance, vn as applyVerboseOverride, w as createOpenClawCodingTools, x as markRecoveryAttempt, xn as isSystemEventContextChanged, y as listFromOtherInstances, yn as parseVerboseOverride, zn as isAbortTrigger } from "./subagent-registry-ByD-v8W6.js";
+import { $n as resetAllLanes, $t as requestNodePairing, A as loadMinionPlugins, An as extractImageContentFromSource, At as buildSystemPromptParams, B as resolveCronStyleNow, Bn as stopSubagentsForRequester, Bt as normalizeSendPolicy, C as readConsolidationState, Ct as getBuiltinSectionRegistry, D as buildDefaultToolPolicyPipelineSteps, Dn as DEFAULT_INPUT_IMAGE_MIMES, Dt as PromptSectionRegistry, E as applyToolPolicyPipeline, Et as buildToolSummaryMap, Fn as formatZonedTimestamp, G as debugSkipAll, Gt as refreshRemoteBinsForConnectedNodes, H as setCliSessionId, Ht as getRemoteSkillEligibility, J as setDebugStepBroadcaster, Jt as setSkillsRemoteRegistry, K as debugStepContinue, Kn as resolveAgentIdentity, Kt as refreshRemoteNodeBins, Lt as requestHeartbeatNow, M as dispatchInboundMessage, Mn as resolveInputFileLimits, N as createReplyDispatcher, O as getPluginToolMeta, Ot as PROSE_GLOBAL_ROOT, P as getTotalPendingReplies, Pn as transcribeOpenAiCompatibleAudio, Q as runToolScript, Qn as getTotalQueueSize, Qt as renamePairedNode, R as BARE_SESSION_RESET_PROMPT, Rn as resolveUserTimezone, S as openInFlightTurnsStore, St as assembleAgentSystemPromptWithSections, Tn as registerUnhandledRejectionHandler, Tt as buildSectionRenderContext, U as runCliAgent, Ut as primeRemoteSkillsCache, V as getCliSessionId, Vt as resolveSendPolicy, Wn as clearSessionQueues, Wt as recordRemoteNodeInfo, X as createMinionTools, Xn as getActiveTaskCount, Xt as listNodePairing, Y as setSteppedBuild, Yn as resolveBootstrapContextForRun, Yt as approveNodePairing, Z as clearCustomToolsCache, Zt as rejectNodePairing, _ as deleteRow, _n as applyModelOverrideToSessionEntry, _t as loadProviderUsageSummary, an as pruneExpiredPending, ar as getAgentRunContext, at as getTemplate, b as markInterrupted, bn as enqueueSystemEvent, cn as writeJsonAtomic, ct as getTemplateUsageStats, d as abortEmbeddedPiRun, dn as registerSkillsChangeListener, en as updatePairedNodeMetadata, er as setCommandLaneConcurrency, f as getActiveEmbeddedRunCount, g as closeInFlightTurnsStore, gt as normalizeGroupActivation, h as registerLifecycleHooks, hn as buildAuthHealthSummary, i as listDescendantRunsForRequester, in as verifyPairingToken, ir as emitAgentEvent, it as getLastReloadAt, j as loadOpenClawPlugins, jn as normalizeMimeList, jt as buildSystemPromptReport, kn as extractFileContentFromSource, kt as _clearProseCache, l as runSubagentAnnounceFlow, ln as createAsyncLock, lt as initTemplateLoader, m as waitForEmbeddedPiRunEnd, n as countActiveDescendantRuns, nn as generatePairingToken, nr as resolveAgentTimeoutMs, on as resolvePairingPaths, or as onAgentEvent, ot as getTemplateCache, p as queueEmbeddedPiMessage, q as isSteppedBuildEnabled, qt as removeRemoteNodeInfo, r as initSubagentRegistry, rn as hashToken$1, rr as clearAgentRunContext, rt as spawnSubagentDirect, s as markSubagentRunTerminated, sn as readJsonFile, sr as registerAgentRunContext, st as getTemplateLoadErrors, tn as verifyNodeToken, tr as waitForActiveTasks, u as runEmbeddedPiAgent, un as getSkillsSnapshotVersion, ut as stopTemplateWatcher, v as listForCurrentInstance, vn as applyVerboseOverride, w as createOpenClawCodingTools, x as markRecoveryAttempt, xn as isSystemEventContextChanged, y as listFromOtherInstances, yn as parseVerboseOverride, zn as isAbortTrigger } from "./subagent-registry-BHdRG10Z.js";
 import { n as resolveModel } from "./model-D1Av16ad.js";
 import { n as buildWorkspaceSkillSnapshot, r as loadWorkspaceSkillEntries } from "./workspace-mV3QF7Vc.js";
 import "./skills-DT6jTHB3.js";
 import { l as isTestDefaultMemorySlotDisabled, n as loadPluginManifestRegistry } from "./manifest-registry-ByjgBm6U.js";
 import { t as buildWorkspaceSkillStatus } from "./skills-status-Dmu5cEr7.js";
-import { D as parseDurationMs, T as sensitive, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, y as resolveSubagentMaxConcurrent } from "./validation-Tg8YP6Zn.js";
-import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-_W2ysx6z.js";
-import { n as migrateLegacyConfig } from "./config-Cv9wgnm3.js";
-import { $ as validateMeshRetryParams, $t as normalizeDevicePublicKeyBase64Url, A as validateCronRunsParams, At as validateSkillsUpdateParams, B as validateDronesCancelParams, Bt as validateWakeParams, C as validateConfigSchemaParams, Ct as validateSessionsPreviewParams, D as validateCronListParams, Dt as validateSkillsBinsParams, E as validateCronAddParams, Et as validateSessionsUsageParams, F as validateDevicePairRejectParams, Ft as validateToolsStatusParams, G as validateExecApprovalResolveParams, Gt as validateWizardStartParams, H as validateDronesExecuteParams, Ht as validateWebLoginWaitParams, I as validateDevicePairRemoveParams, It as validateToolsUpdateParams, J as validateExecApprovalsNodeSetParams, Jt as buildDeviceAuthPayload, K as validateExecApprovalsGetParams, Kt as validateWizardStatusParams, L as validateDeviceTokenRevokeParams, Lt as validateUpdateCheckParams, M as validateCronUpdateParams, Mt as validateTalkModeParams, N as validateDevicePairApproveParams, Nt as validateTelegramValidateTokenParams, O as validateCronRemoveParams, Ot as validateSkillsInstallParams, P as validateDevicePairListParams, Pt as validateToolsOverridesSetParams, Q as validateMeshPlanParams, R as validateDeviceTokenRotateParams, Rt as validateUpdateRunParams, S as validateConfigPatchParams, St as validateSessionsPatchParams, T as validateConnectParams, Tt as validateSessionsResolveParams, U as validateDronesProbeParams, Ut as validateWizardCancelParams, V as validateDronesCapabilitiesParams, Vt as validateWebLoginStartParams, W as validateExecApprovalRequestParams, Wt as validateWizardNextParams, X as validateLogsTailParams, Y as validateExecApprovalsSetParams, Yt as normalizeDeviceAuthScopes, Z as validateMeshPlanAutoParams, Zt as deriveDeviceIdFromPublicKey, _ as validateChatHistoryParams, _t as validateRequestFrame, a as validateAgentWaitParams, at as validateNodeEventParams, b as validateConfigApplyParams, bt as validateSessionsDeleteParams, c as validateAgentsFilesGetParams, ct as validateNodeListParams, d as validateAgentsListParams, dt as validateNodePairRejectParams, en as verifyDeviceSignature, et as validateMeshRunParams, f as validateAgentsSkillsSetParams, ft as validateNodePairRequestParams, g as validateChatAbortParams, gt as validatePollParams, h as validateChannelsStatusParams, ht as validatePlaygroundCompleteParams, i as validateAgentParams, it as validateNodeDescribeParams, j as validateCronStatusParams, jt as validateTalkConfigParams, k as validateCronRunParams, kt as validateSkillsStatusParams, l as validateAgentsFilesListParams, lt as validateNodePairApproveParams, m as validateChannelsLogoutParams, mt as validateNodeRenameParams, n as formatValidationErrors, nt as validateModelsListParams, o as validateAgentsCreateParams, ot as validateNodeInvokeParams, p as validateAgentsUpdateParams, pt as validateNodePairVerifyParams, q as validateExecApprovalsNodeGetParams, qt as parseSessionLabel, r as validateAgentIdentityParams, rt as validateModelsSetEnabledParams, s as validateAgentsDeleteParams, st as validateNodeInvokeResultParams, tt as validateMeshStatusParams, u as validateAgentsFilesSetParams, ut as validateNodePairListParams, v as validateChatInjectParams, vt as validateSendParams, w as validateConfigSetParams, wt as validateSessionsResetParams, x as validateConfigGetParams, xt as validateSessionsListParams, y as validateChatSendParams, yt as validateSessionsCompactParams, z as validateDiscordValidateTokenParams, zt as validateUpdateStatusParams } from "./client-BYzTMaoO.js";
+import { D as parseDurationMs, T as sensitive, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, y as resolveSubagentMaxConcurrent } from "./validation-DAS7vvMM.js";
+import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-6cqme3no.js";
+import { n as migrateLegacyConfig } from "./config-BerwgOPM.js";
+import { $ as validateMeshRetryParams, $t as normalizeDevicePublicKeyBase64Url, A as validateCronRunsParams, At as validateSkillsUpdateParams, B as validateDronesCancelParams, Bt as validateWakeParams, C as validateConfigSchemaParams, Ct as validateSessionsPreviewParams, D as validateCronListParams, Dt as validateSkillsBinsParams, E as validateCronAddParams, Et as validateSessionsUsageParams, F as validateDevicePairRejectParams, Ft as validateToolsStatusParams, G as validateExecApprovalResolveParams, Gt as validateWizardStartParams, H as validateDronesExecuteParams, Ht as validateWebLoginWaitParams, I as validateDevicePairRemoveParams, It as validateToolsUpdateParams, J as validateExecApprovalsNodeSetParams, Jt as buildDeviceAuthPayload, K as validateExecApprovalsGetParams, Kt as validateWizardStatusParams, L as validateDeviceTokenRevokeParams, Lt as validateUpdateCheckParams, M as validateCronUpdateParams, Mt as validateTalkModeParams, N as validateDevicePairApproveParams, Nt as validateTelegramValidateTokenParams, O as validateCronRemoveParams, Ot as validateSkillsInstallParams, P as validateDevicePairListParams, Pt as validateToolsOverridesSetParams, Q as validateMeshPlanParams, R as validateDeviceTokenRotateParams, Rt as validateUpdateRunParams, S as validateConfigPatchParams, St as validateSessionsPatchParams, T as validateConnectParams, Tt as validateSessionsResolveParams, U as validateDronesProbeParams, Ut as validateWizardCancelParams, V as validateDronesCapabilitiesParams, Vt as validateWebLoginStartParams, W as validateExecApprovalRequestParams, Wt as validateWizardNextParams, X as validateLogsTailParams, Y as validateExecApprovalsSetParams, Yt as normalizeDeviceAuthScopes, Z as validateMeshPlanAutoParams, Zt as deriveDeviceIdFromPublicKey, _ as validateChatHistoryParams, _t as validateRequestFrame, a as validateAgentWaitParams, at as validateNodeEventParams, b as validateConfigApplyParams, bt as validateSessionsDeleteParams, c as validateAgentsFilesGetParams, ct as validateNodeListParams, d as validateAgentsListParams, dt as validateNodePairRejectParams, en as verifyDeviceSignature, et as validateMeshRunParams, f as validateAgentsSkillsSetParams, ft as validateNodePairRequestParams, g as validateChatAbortParams, gt as validatePollParams, h as validateChannelsStatusParams, ht as validatePlaygroundCompleteParams, i as validateAgentParams, it as validateNodeDescribeParams, j as validateCronStatusParams, jt as validateTalkConfigParams, k as validateCronRunParams, kt as validateSkillsStatusParams, l as validateAgentsFilesListParams, lt as validateNodePairApproveParams, m as validateChannelsLogoutParams, mt as validateNodeRenameParams, n as formatValidationErrors, nt as validateModelsListParams, o as validateAgentsCreateParams, ot as validateNodeInvokeParams, p as validateAgentsUpdateParams, pt as validateNodePairVerifyParams, q as validateExecApprovalsNodeGetParams, qt as parseSessionLabel, r as validateAgentIdentityParams, rt as validateModelsSetEnabledParams, s as validateAgentsDeleteParams, st as validateNodeInvokeResultParams, tt as validateMeshStatusParams, u as validateAgentsFilesSetParams, ut as validateNodePairListParams, v as validateChatInjectParams, vt as validateSendParams, w as validateConfigSetParams, wt as validateSessionsResetParams, x as validateConfigGetParams, xt as validateSessionsListParams, y as validateChatSendParams, yt as validateSessionsCompactParams, z as validateDiscordValidateTokenParams, zt as validateUpdateStatusParams } from "./client-W3BYtITQ.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C0DLwT7t.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-ZqMa-gJE.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-BWSchIcf.js";
 import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BKpbLfdK.js";
 import { c as pickPrimaryLanIPv4, d as resolveGatewayListenHosts, f as resolveHostName, i as isTrustedProxyAddress, l as resolveGatewayBindHost, n as isLoopbackHost, o as normalizeHostHeader, p as rawDataToString, r as isPrivateOrLoopbackAddress, t as isLoopbackAddress, u as resolveGatewayClientIp } from "./net-C0W-QK7p.js";
 import { i as normalizeInputProvenance } from "./input-provenance-ChJN5mZj.js";
-import { B as snapshotSessionOrigin, D as evaluateSessionFreshness, F as resolveAgentMainSessionKey, I as resolveExplicitAgentSessionKey, L as resolveMainSessionKey, N as resolveFreshSessionTotalTokens, P as canonicalizeMainSessionAlias, Q as deliveryContextFromSession, R as resolveMainSessionKeyFromConfig, S as stripMessageIdHints, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, et as mergeDeliveryContext, g as capArrayByJsonBytes, h as archiveSessionTranscripts, k as resolveSessionResetPolicy, m as archiveFileOnDisk, n as parseSessionThreadInfo, nt as normalizeSessionDeliveryFields, t as extractDeliveryInfo, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, w as cleanStaleLockFiles, x as stripEnvelope } from "./sessions-CNmLoXhd.js";
+import { B as snapshotSessionOrigin, D as evaluateSessionFreshness, F as resolveAgentMainSessionKey, I as resolveExplicitAgentSessionKey, L as resolveMainSessionKey, N as resolveFreshSessionTotalTokens, P as canonicalizeMainSessionAlias, Q as deliveryContextFromSession, R as resolveMainSessionKeyFromConfig, S as stripMessageIdHints, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, et as mergeDeliveryContext, g as capArrayByJsonBytes, h as archiveSessionTranscripts, k as resolveSessionResetPolicy, m as archiveFileOnDisk, n as parseSessionThreadInfo, nt as normalizeSessionDeliveryFields, t as extractDeliveryInfo, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, w as cleanStaleLockFiles, x as stripEnvelope } from "./sessions-bztP6lN1.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-CCCwddgc.js";
-import { A as resolveHubMetricsConfig, C as getMirrorSnapshot, D as seedMirror, M as setMirrorAccountSource, O as setChannelRestartHandler, S as getMirrorEntry, b as applyChannelRestart, c as resolveWhatsAppAccount, d as buildChannelAccountBindings, k as startMirrorRefreshTick, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, u as resolveTelegramAccount, w as listMirrorAccountIds, x as channelConfigSource } from "./plugins-aBgm3_eG.js";
+import { A as resolveHubMetricsConfig, C as getMirrorSnapshot, D as seedMirror, M as setMirrorAccountSource, O as setChannelRestartHandler, S as getMirrorEntry, b as applyChannelRestart, c as resolveWhatsAppAccount, d as buildChannelAccountBindings, k as startMirrorRefreshTick, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, u as resolveTelegramAccount, w as listMirrorAccountIds, x as channelConfigSource } from "./plugins-BSX3IzSW.js";
 import "./logging-CyBpyZLp.js";
 import { r as resolveUserDir } from "./user-directory-D27je39W.js";
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-Dm5-em7b.js";
 import { a as stripHeartbeatToken } from "./lanes-BEZu7L5R.js";
-import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget } from "./resolve-route-B8qAtRTs.js";
+import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget } from "./resolve-route-DQ7BIAU_.js";
 import { n as getMachineDisplayName } from "./with-timeout-BVhDEOTB.js";
 import { n as isDiagnosticsEnabled } from "./diagnostic-events-BIoHynd0.js";
 import { c as startDiagnosticHeartbeat, l as stopDiagnosticHeartbeat } from "./diagnostic-DYs0_0mX.js";
-import { D as getGlobalHookRunner, a as markSynced, i as markFailed, j as isPluginEnabledForOrg, k as runGlobalGatewayStopSafely, l as deterministicClientId, n as closeMessageLedger, o as openMessageLedger, s as patchRouting, t as claimBatch } from "./message-ledger-DGMqKFzT.js";
-import { C as OPENAI_TTS_MODELS, T as defineDrone, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-BKfdvnUw.js";
+import { D as getGlobalHookRunner, a as markSynced, i as markFailed, j as isPluginEnabledForOrg, k as runGlobalGatewayStopSafely, l as deterministicClientId, n as closeMessageLedger, o as openMessageLedger, s as patchRouting, t as claimBatch } from "./message-ledger-DmX8k7Eb.js";
+import { C as OPENAI_TTS_MODELS, T as defineDrone, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-EAcO1Hwe.js";
 import { c as detectMime } from "./image-ops-C3SpAWwm.js";
-import { i as runDrone, t as createGatewayDroneHost } from "./host-D_jlsIB_.js";
-import { B as resolveBootstrapMaxChars, V as resolveBootstrapTotalMaxChars, a as listThinkingLevels, c as normalizeThinkLevel, f as supportsXHighThinking, l as normalizeUsageDisplay, n as formatThinkingLevels, o as normalizeElevatedLevel, r as formatXHighModelHint, s as normalizeReasoningLevel, u as normalizeVerboseLevel } from "./pi-embedded-helpers-Crzl9Ptt.js";
-import { c as resolveSandboxRuntimeStatus } from "./sandbox-CITm9v8F.js";
-import { a as collectExplicitAllowlist, c as mergeAlsoAllowPolicy, n as TOOL_GROUPS, s as expandToolGroups, t as GROUP_DESCRIPTIONS, u as resolveToolProfilePolicy } from "./tool-policy-Cn0_ZqFk.js";
+import { i as runDrone, t as createGatewayDroneHost } from "./host-Ck1Iu5db.js";
+import { B as resolveBootstrapMaxChars, V as resolveBootstrapTotalMaxChars, a as listThinkingLevels, c as normalizeThinkLevel, f as supportsXHighThinking, l as normalizeUsageDisplay, n as formatThinkingLevels, o as normalizeElevatedLevel, r as formatXHighModelHint, s as normalizeReasoningLevel, u as normalizeVerboseLevel } from "./pi-embedded-helpers-CJQRe8VG.js";
+import { c as resolveSandboxRuntimeStatus } from "./sandbox-DQ8PqB1U.js";
+import { a as collectExplicitAllowlist, c as mergeAlsoAllowPolicy, n as TOOL_GROUPS, s as expandToolGroups, t as GROUP_DESCRIPTIONS, u as resolveToolProfilePolicy } from "./tool-policy-CGuZzs9F.js";
 import { a as enableTailscaleServeFunnel, i as enableTailscaleServe, n as disableTailscaleServe, r as enableTailscaleFunnel, s as getTailnetHostname, t as disableTailscaleFunnel } from "./tailscale-DdVOGsI9.js";
 import { a as resolveRequestClientIp, c as createAuthRateLimiter, i as resolveGatewayAuth, l as safeEqualSecret, n as authorizeGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as isLocalDirectRequest, s as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, t as assertGatewayAuthConfigured } from "./auth-DPXV6BW7.js";
-import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-DjgDk76D.js";
+import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-DFdTmsBq.js";
 import { a as isErrno, n as formatErrorMessage } from "./errors-iV4-NKRR.js";
 import { i as formatPortDiagnostics, n as inspectPortUsage, t as ensurePortAvailable } from "./ports-DHJ3IPPA.js";
 import { t as movePathToTrash } from "./trash--L0YM4v3.js";
-import { n as runWithModelFallback } from "./model-fallback-DjjhedHX.js";
+import { n as runWithModelFallback } from "./model-fallback-CrSemKRh.js";
 import { a as traceGatewayEvent, n as pruneOldTraceFiles } from "./chat-trace-DMQCLCi7.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-DJz45LiT.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-CchSD5_M.js";
 import { t as ToolInputError } from "./common-DaYU0QCr.js";
 import { i as isExternalHookSession, n as detectSuspiciousPatterns, r as getHookType, t as buildSafeExternalPrompt } from "./external-content-Css-cJoz.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-Cz8ylHLg.js";
-import { n as loadModelCatalog } from "./model-catalog-DU-4NufX.js";
-import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, d as orgScopeVisible, f as lookupContextTokens, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as normalizeOrgIds } from "./session-utils-DJlQmR6P.js";
-import { a as resolveSubagentToolPolicy, d as listAgentWorkspaceDirs, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-ZOYo3MOw.js";
+import { n as loadModelCatalog } from "./model-catalog-Dun9rUwm.js";
+import { a as loadCombinedSessionStoreForGateway, c as resolveGatewaySessionStoreTarget, d as orgScopeVisible, f as lookupContextTokens, i as listSessionsFromStore, l as resolveSessionModelRef, o as loadSessionEntry, r as listAgentsForGateway, s as pruneLegacyStoreKeys, t as canonicalizeSpawnedByForAgent, u as normalizeOrgIds } from "./session-utils-Ffl6ASbR.js";
+import { a as resolveSubagentToolPolicy, d as listAgentWorkspaceDirs, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy } from "./pi-tools.policy-DClWWLv0.js";
 import { a as mergeExecApprovalsSocketDefaults, c as readExecApprovalsSnapshot, p as saveExecApprovals, r as ensureExecApprovals, s as normalizeExecApprovals, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-BeHGjZzx.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-yBL75k4k.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format--dK3YoXf.js";
@@ -69,32 +69,32 @@ import { a as markGatewaySigusr1RestartHandled, c as setPreRestartDeferralCheck,
 import { r as recallMemories, t as configureMemorySink } from "./memory-sink-D19pkCCX.js";
 import { t as KnowledgeGraphSession } from "./knowledge-graph-MDjNQD5L.js";
 import { n as setHubRest, t as getHubRest } from "./hub-rest-registry-DQyDHHy2.js";
-import { t as TOOL_REGISTRY } from "./_registry.generated-CsDwKqbj.js";
+import { t as TOOL_REGISTRY } from "./_registry.generated-B5zHyziR.js";
 import { t as formatDocsLink } from "./links-snWstk4Z.js";
 import { n as runCommandWithRuntime } from "./cli-utils-Cg2c3XDf.js";
 import { t as formatHelpExamples } from "./help-format-D20I7z1G.js";
 import { n as withProgress } from "./progress-Dai1njDG.js";
 import { t as getChannelActivity } from "./channel-activity-mLVM0GeJ.js";
-import { r as invalidateToolIndex } from "./tool-index-CSvXEUhV.js";
+import { r as invalidateToolIndex } from "./tool-index-BwKMLu1r.js";
 import { i as gwsIsolatedEnv, r as gwsCredEnv } from "./gws-credentials-B0R6fpjJ.js";
 import { n as setGoogleAdcClient, t as getGoogleAdcClient } from "./hub-credential-client-registry-Do4Y6KWZ.js";
 import { a as normalizeOptionalAgentId, c as normalizePayloadToSystemText, d as buildDeliveryFromLegacyPayload, f as hasLegacyDeliveryHints, i as inferLegacyName, l as normalizeRequiredName, n as normalizeCronJobCreate, o as normalizeOptionalSessionKey, p as stripLegacyDeliveryFields, r as normalizeCronJobPatch, s as normalizeOptionalText, t as normalizeHttpWebhookUrl, u as migrateLegacyCronPayload } from "./webhook-url-DKnEHZR9.js";
 import { i as parseAbsoluteTimeMs, n as resolveCronStaggerMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-BlvVswOf.js";
 import { a as summarizeRestartSentinel, n as formatDoctorNonInteractiveHint, r as formatRestartSentinelMessage, s as writeRestartSentinel, t as consumeRestartSentinel } from "./restart-sentinel-f8KHn8x4.js";
-import { n as listGatewayMethods, t as GATEWAY_EVENTS } from "./server-methods-list-DCASvqMj.js";
-import { a as normalizePollInput, i as ensureOutboundSessionEntry, n as runMessageAction, r as resolveOutboundSessionRoute, s as resetDirectoryCache } from "./message-action-runner-CrnI7zJF.js";
-import { o as normalizeReplyPayloadsForDelivery, s as loadChannelOutboundAdapter, t as deliverOutboundPayloads } from "./deliver-CUJiWM35.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-rfZAntR5.js";
-import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-DAXo3AND.js";
+import { n as listGatewayMethods, t as GATEWAY_EVENTS } from "./server-methods-list-CUUd_Znm.js";
+import { a as normalizePollInput, i as ensureOutboundSessionEntry, n as runMessageAction, r as resolveOutboundSessionRoute, s as resetDirectoryCache } from "./message-action-runner-aRJaOp3h.js";
+import { o as normalizeReplyPayloadsForDelivery, s as loadChannelOutboundAdapter, t as deliverOutboundPayloads } from "./deliver-O2dLDnLg.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-1nQ35zxv.js";
+import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-CgJNQPZ8.js";
 import { a as runAggregation, n as executeOrchestration, r as readStatusJson, t as executePipeline } from "./orchestration-pipeline-Bi3YT3Jf.js";
 import { r as readManifest, t as completeManifest } from "./orchestration-manifest-DXWf2_x7.js";
-import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-C7eTLrXZ.js";
-import { t as createBrowserRouteDispatcher } from "./dispatcher-988hS7Ae.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-DIbEfWbr.js";
+import { t as createBrowserRouteDispatcher } from "./dispatcher-Dt_9aSBz.js";
 import { n as persistBrowserProxyFiles, t as applyBrowserProxyPaths } from "./proxy-files-CndZU0gq.js";
 import { r as cachedJson } from "./ttl-cache-UdlZ-zJd.js";
-import { a as styleHealthChannelLine, c as runHeartbeatOnce, d as resolveHeartbeatVisibility, l as setHeartbeatsEnabled, n as formatHealthChannelLines, o as areHeartbeatsEnabled, r as getHealthSnapshot, u as startHeartbeatRunner } from "./health-n09fR4uF.js";
-import { n as getLastHeartbeatEvent, r as onHeartbeatEvent } from "./heartbeat-events-DLgkBgdw.js";
-import { n as resolveChannelSenderIdentity, r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-BqPoLwgX.js";
+import { a as styleHealthChannelLine, c as runHeartbeatOnce, d as resolveHeartbeatVisibility, l as setHeartbeatsEnabled, n as formatHealthChannelLines, o as areHeartbeatsEnabled, r as getHealthSnapshot, u as startHeartbeatRunner } from "./health-CYE5q8Un.js";
+import { n as getLastHeartbeatEvent, r as onHeartbeatEvent } from "./heartbeat-events-C2_9-jxQ.js";
+import { n as resolveChannelSenderIdentity, r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-C2RVZSgb.js";
 import { n as handleHubAssignmentChanged, r as initUserSubsystem, t as getActiveUserSubsystem } from "./server-startup-users-B1IlQBSa.js";
 import { t as mapRoleToScopes } from "./types-Utz3c3Qq.js";
 import { t as ensureMinionCliOnPath } from "./path-env-DpsCNe2h.js";
@@ -103,10 +103,10 @@ import { n as inheritOptionFromParent } from "./command-options-Dhjl7AMa.js";
 import { t as buildChannelUiCatalog } from "./catalog-DOKauHFd.js";
 import { t as WizardCancelledError } from "./prompts-E0FayNjJ.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-HNAIOJ_3.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-DJVuPnPD.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-2zVKrpSR.js";
 import { t as buildChannelAccountSnapshot } from "./status-Dg720jp3.js";
-import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-Ckl5HK9L.js";
-import "./onboard-helpers-Dx0nCBj-.js";
+import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-CekhN2Dt.js";
+import "./onboard-helpers-BE_18443.js";
 import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-CtaYBeW0.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-gq3z8oCQ.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-DJ67yyP8.js";
@@ -114,17 +114,17 @@ import { t as discoverGatewayBeacons } from "./bonjour-discovery-DzKslgdA.js";
 import { t as installSkill } from "./skills-install-C0wxLKNQ.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-DKaLYbe_.js";
 import { a as isNewerVersionString, m as normalizeUpdateChannel, o as resolveNpmChannelTag, r as fetchNpmTagVersion, t as checkUpdateStatus, u as channelToNpmTag } from "./update-check-BsgxNmzL.js";
-import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-DAWcKhN8.js";
-import { a as probeGateway, i as resolveNodeCommandAllowlist, r as isNodeCommandAllowed } from "./audit-DAd-GODJ.js";
-import { m as parsePort$1 } from "./lifecycle-core-Dv7iETEh.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-RcyTg_dK.js";
+import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-DbOwDhDe.js";
+import { a as probeGateway, i as resolveNodeCommandAllowlist, r as isNodeCommandAllowed } from "./audit-D9GAKieT.js";
+import { m as parsePort$1 } from "./lifecycle-core-DwiJf6GO.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-yrlA9L0h.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-BjuB2JdU.js";
-import { n as createDefaultDeps, r as createOutboundSendDeps$1, t as createOutboundSendDeps } from "./outbound-send-deps-DrcbV6tD.js";
+import { n as createDefaultDeps, r as createOutboundSendDeps$1, t as createOutboundSendDeps } from "./outbound-send-deps-_gwXpS3X.js";
 import { i as initCrypto, n as ProbeRegistry, r as SecretsManager, t as SecretStore } from "./store-DR4Ip_0q.js";
-import { t as runOnboardingWizard } from "./onboarding-D8RZyRch.js";
-import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-D-ADx4p9.js";
-import { h as resolveGmailPullRuntimeConfigs } from "./gmail-C0H3lnho.js";
-import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-BzAtsKoj.js";
+import { t as runOnboardingWizard } from "./onboarding-IiILUaqA.js";
+import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-a42ldGL8.js";
+import { h as resolveGmailPullRuntimeConfigs } from "./gmail-89acEtXH.js";
+import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-BvFdXWhL.js";
 import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-BRxsVIll.js";
 import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-B4Jwvszu.js";
 import { i as shellEscape, n as resolveSystemdUnit, r as runRestartScript } from "./restart-helper-BgOyezP2.js";
@@ -1955,7 +1955,7 @@ async function recordAvailableUpdate(input, cfg) {
 		notified: false,
 		reason: "not-newer"
 	};
-	if (!isNewerVersionString("2026.7.12-dev.20260717012629", input.version)) return {
+	if (!isNewerVersionString("2026.7.16-dev", input.version)) return {
 		notified: false,
 		reason: "not-newer"
 	};
@@ -1993,7 +1993,7 @@ async function getUpdateStatus() {
 async function clearPendingIfCurrent() {
 	const pending = await readJson(pendingPath());
 	if (!pending) return;
-	if (!isNewerVersionString("2026.7.12-dev.20260717012629", pending.version)) await fs$1.rm(pendingPath(), { force: true });
+	if (!isNewerVersionString("2026.7.16-dev", pending.version)) await fs$1.rm(pendingPath(), { force: true });
 }
 /** Consume update-result.json if present. Returns false when no file existed. */
 async function processUpdateResult(cfg) {
@@ -2084,7 +2084,7 @@ async function runGatewayUpdateCheck(params) {
 		await writeState(statePath, nextState);
 		return;
 	}
-	if (isNewerVersionString("2026.7.12-dev.20260717012629", resolved.version)) {
+	if (isNewerVersionString("2026.7.16-dev", resolved.version)) {
 		if (state.lastNotifiedVersion !== resolved.version || state.lastNotifiedTag !== tag) {
 			params.log.info(`update available (${tag}): v${resolved.version} (current v${VERSION}). Run: ${formatCliCommand("minion update")}`);
 			nextState.lastNotifiedVersion = resolved.version;
@@ -2110,17 +2110,19 @@ function createGoogleAdcClient(opts) {
 	const base = opts.hubUrl.replace(/\/$/, "");
 	const cache = /* @__PURE__ */ new Map();
 	const feedCache = /* @__PURE__ */ new Map();
-	async function fetchFeedForUser(userId) {
-		const cached = feedCache.get(userId);
+	async function fetchFeedForUser(userId, orgId) {
+		const cacheKey = `${userId}::${orgId ?? ""}`;
+		const cached = feedCache.get(cacheKey);
 		if (cached && cached.expiresAt > now()) return cached.value;
-		const url = `${base}/api/gateway/google-identities?userId=${encodeURIComponent(userId)}`;
+		let url = `${base}/api/gateway/google-identities?userId=${encodeURIComponent(userId)}`;
+		if (orgId) url += `&orgId=${encodeURIComponent(orgId)}`;
 		const res = await doFetch(url, {
 			method: "GET",
 			headers: { Authorization: `Bearer ${opts.serverToken}` }
 		});
 		if (!res.ok) throw new Error(`hub google-identities fetch failed: ${res.status}`);
 		const value = (await res.json()).identities ?? [];
-		feedCache.set(userId, {
+		feedCache.set(cacheKey, {
 			value,
 			expiresAt: now() + ttlMs
 		});
@@ -2146,7 +2148,8 @@ function createGoogleAdcClient(opts) {
 	}
 	function invalidate(userId) {
 		cache.delete(userId);
-		feedCache.delete(userId);
+		const prefix = `${userId}::`;
+		for (const key of feedCache.keys()) if (key.startsWith(prefix)) feedCache.delete(key);
 	}
 	return {
 		fetchForUser,
@@ -5671,7 +5674,7 @@ function createFreeTierApiHandler(db) {
 *
 * Records per-method handler latency at the request dispatch chokepoint and
 * samples Node's event-loop delay, then emits a single aggregated
-* `gateway.perf_snapshot` event per window (default 60s) into the unified
+* `gateway.perf_snapshot` event per window (default 5min) into the unified
 * event store — the same surface the hub reliability dashboard reads.
 *
 * Why this exists: the legacy `gateway.ws_slow_response` event fired per-call
@@ -5694,8 +5697,12 @@ function createFreeTierApiHandler(db) {
 const log$24 = createSubsystemLogger("gateway/metrics");
 /** Cap on retained latency samples per method (reservoir) to bound memory. */
 const MAX_SAMPLES_PER_METHOD = 512;
-/** Default snapshot window. Matches the reliability rate-limiter granularity. */
-const DEFAULT_INTERVAL_MS = 6e4;
+/**
+* Default snapshot window. 5min (was 60s) — the payload is a percentile/throughput
+* aggregate carrying its own `windowMs`, so a wider window keeps stats valid while
+* cutting emitted rows 5×. Consumers must read `windowMs`, never assume 60s.
+*/
+const DEFAULT_INTERVAL_MS = 3e5;
 const methodStats = /* @__PURE__ */ new Map();
 let reporterTimer = null;
 let eventLoopHist = null;
@@ -21054,7 +21061,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-FM-1CCYG.js");
+			const { handleNodeEvent } = await import("./server-node-events-Dml6MIAW.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			const nodeConnId = client?.connId;
 			await handleNodeEvent({
@@ -23697,6 +23704,10 @@ const MODEL_PRICING = {
 		inputPerMillion: 15,
 		outputPerMillion: 75
 	},
+	"claude-haiku-4": {
+		inputPerMillion: 1,
+		outputPerMillion: 5
+	},
 	"claude-haiku-3.5": {
 		inputPerMillion: .8,
 		outputPerMillion: 4
@@ -23801,6 +23812,10 @@ const MODEL_PRICING = {
 		inputPerMillion: .14,
 		outputPerMillion: .28
 	},
+	"deepseek-v3": {
+		inputPerMillion: .14,
+		outputPerMillion: .28
+	},
 	"deepseek-coder": {
 		inputPerMillion: .14,
 		outputPerMillion: .28
@@ -23819,14 +23834,32 @@ const MODEL_PRICING = {
 	}
 };
 /**
-* Look up pricing for a model. Tries exact match, then prefix match.
-* Returns undefined for unknown or local models (cost = 0).
+* Look up pricing for a model id. Strips any `provider/` prefix (OpenRouter et al.
+* namespace models as `deepseek/deepseek-chat-v3-0324`), then tries an exact match
+* followed by a LONGEST-prefix match (so `claude-opus-4-8` → `claude-opus-4`, and
+* the most specific key wins over a shorter one). Returns undefined for unknown or
+* local models (cost = 0).
+*
+* NOTE: this mirrors `minion_hub/src/lib/utils/model-pricing.ts:getModelPricing`.
+* The two copies must stay in sync — the hub falls back to its copy when the
+* gateway usage aggregate is unavailable. The previous server version did neither
+* the prefix-strip nor longest-match, so every OpenRouter-namespaced id (which is
+* what agents actually use) resolved to undefined → cost $0 despite real tokens.
 */
 function getModelPricing(modelId) {
-	const lower = modelId.toLowerCase();
+	if (!modelId) return;
+	let lower = modelId.toLowerCase();
+	const slash = lower.lastIndexOf("/");
+	if (slash >= 0) lower = lower.slice(slash + 1);
 	const exact = MODEL_PRICING[lower];
 	if (exact) return exact;
-	for (const [key, value] of Object.entries(MODEL_PRICING)) if (lower.startsWith(key)) return value;
+	let best;
+	let bestLen = 0;
+	for (const [key, value] of Object.entries(MODEL_PRICING)) if (lower.startsWith(key) && key.length > bestLen) {
+		best = value;
+		bestLen = key.length;
+	}
+	return best;
 }
 //#endregion
 //#region src/events/usage-aggregate.ts
@@ -25984,7 +26017,7 @@ const updateHandlers = {
 				const stagedPrev = result.mode === "staged" ? result.previousTarget : null;
 				const stagedLink = process.env.MINION_CURRENT_LINK?.trim();
 				const wd = await prepareUpdateWatchdogScript({
-					fromVersion: result.before?.version ?? "2026.7.12-dev.20260717012629",
+					fromVersion: result.before?.version ?? "2026.7.16-dev",
 					toVersion: result.after?.version ?? "",
 					stateDir: resolveStateDir(),
 					restartDelayMs,
@@ -29201,7 +29234,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.MINION_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.MINION_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./control-service-C7eTLrXZ.js").then((n) => n.t);
+	const mod = override ? await import(override) : await import("./control-service-DIbEfWbr.js").then((n) => n.t);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -35250,7 +35283,7 @@ async function deliverFlowReply(sessionKey, reply) {
 	}
 	try {
 		const cfg = loadConfig();
-		const { deliverOutboundPayloads } = await import("./deliver-CUJiWM35.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-O2dLDnLg.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg,
 			channel: target.channel,
@@ -38891,11 +38924,21 @@ function requireOperator(client, respond) {
 	}
 	return true;
 }
-/** Return the caller's organization, or `undefined` for a platform admin.
-* Ordinary operator sessions must never fall back to an unscoped lookup. */
+/**
+* Return the caller's organization, derived ONLY from `client.orgId` —
+* the value the gateway itself established at connect time from a validated
+* JWT or service-account claim (see ws-jwt-auth.ts / message-handler.ts).
+*
+* Every hub dashboard session (browser and hub-server alike) presents the
+* same shared operator token and carries `operator.admin` scope, so
+* `operator.admin` is NOT a trust signal for org membership — treating it
+* as one previously let ANY hub session read/mutate every org's shells
+* (params.orgId / an "unscoped admin" fallback both trusted the caller's
+* own say-so). `params.orgId` must never be consulted here: a caller that
+* wants org scoping must actually hold connect-time identity for that org.
+*/
 function requireOrgScope(client, respond) {
 	if (client?.orgId) return client.orgId;
-	if (hasScope(client, ADMIN_SCOPE)) return;
 	respond(false, void 0, errorShape(ErrorCodes.FORBIDDEN, "organization context required"));
 	return null;
 }
@@ -38962,11 +39005,12 @@ function createShellsHandlers({ shells }) {
 		},
 		[METHOD.provision]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const displayName = asString(params?.displayName);
 			const harness = asString(params?.harness);
-			const orgId = client?.orgId ?? asString(params?.orgId);
 			if (!displayName) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing 'displayName'");
 				return;
@@ -38975,10 +39019,6 @@ function createShellsHandlers({ shells }) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing 'harness'");
 				return;
 			}
-			if (!orgId) {
-				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing organization context");
-				return;
-			}
 			const runtimes = asStringArray(params?.runtimes);
 			if (params?.runtimes !== void 0 && !runtimes) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "'runtimes' must be a string array");
@@ -39057,6 +39097,8 @@ function createShellsHandlers({ shells }) {
 		},
 		[METHOD.archive]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39067,7 +39109,7 @@ function createShellsHandlers({ shells }) {
 			tryRespond(respond, () => m.archive({
 				shellId,
 				skipBackup: Boolean(params?.skipBackup),
-				orgId: client?.orgId
+				orgId
 			}));
 		},
 		[METHOD.wake]: ({ params, client, respond }) => {
@@ -39081,6 +39123,8 @@ function createShellsHandlers({ shells }) {
 		},
 		[METHOD.restart]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39088,10 +39132,12 @@ function createShellsHandlers({ shells }) {
 				respondError(respond, ErrorCodes.INVALID_REQUEST, "missing 'shellId'");
 				return;
 			}
-			tryRespond(respond, () => m.restart(shellId, client?.orgId));
+			tryRespond(respond, () => m.restart(shellId, orgId));
 		},
 		[METHOD.destroy]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39102,11 +39148,13 @@ function createShellsHandlers({ shells }) {
 			tryRespond(respond, () => m.destroy({
 				shellId,
 				keepBackups: Boolean(params?.keepBackups),
-				orgId: client?.orgId
+				orgId
 			}));
 		},
 		[METHOD.backupNow]: ({ params, client, respond }) => {
 			if (!requireAdmin(client, respond)) return;
+			const orgId = requireOrgScope(client, respond);
+			if (orgId === null) return;
 			const m = ensureMgr(respond);
 			if (!m) return;
 			const shellId = asString(params?.shellId);
@@ -39116,7 +39164,7 @@ function createShellsHandlers({ shells }) {
 			}
 			tryRespond(respond, () => m.backupNow({
 				shellId,
-				orgId: client?.orgId
+				orgId
 			}));
 		},
 		[METHOD.listBackups]: ({ params, client, respond }) => {
@@ -39659,7 +39707,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	}
 	if (!minimalTestGateway) (async () => {
 		const { recoverPendingDeliveries } = await import("./delivery-queue-4i2kXntr.js").then((n) => n.n);
-		const { deliverOutboundPayloads } = await import("./deliver-CUJiWM35.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-O2dLDnLg.js").then((n) => n.n);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),