@nikolasp98/minion 2026.7.4-dev → 2026.7.4-dev.20260709144240

package/dist/{gateway-cli-DBYifD2O.js → gateway-cli-ChbnKEbL.js}

@@ -1,8 +1,8 @@
 import { C as expandHomePrefix, c as resolveConfigPath, d as resolveGatewayLockDir, f as resolveGatewayPort, n as STATE_DIR, r as isNixMode, t as CONFIG_PATH, v as resolveStateDir } from "./paths-CoM-oAkW.js";
 import { C as shortenHomePath, D as truncateUtf16Safe, L as getChildLogger, P as setVerbose, R as getLogger, _ as resolveConfigDir, b as resolveUserPath, c as ensureDir, d as isPlainObject, r as clamp, t as CONFIG_DIR, z as getResolvedLoggerSettings } from "./utils-FhRSYjMj.js";
 import { n as isRich, r as theme, t as colorize } from "./theme-CDbj88LB.js";
-import { A as resolveBootstrapTotalMaxChars, B as normalizeVerboseLevel, F as listThinkingLevels, H as supportsXHighThinking, I as normalizeElevatedLevel, L as normalizeReasoningLevel, M as formatThinkingLevels, N as formatXHighModelHint, R as normalizeThinkLevel, k as resolveBootstrapMaxChars, z as normalizeUsageDisplay } from "./pi-embedded-helpers-B09QHIJ6.js";
-import { $ as renamePairedNode, An as isAbortTrigger, At as abortEmbeddedPiRun, Bt as markRecoveryAttempt, C as initTemplateLoader, Ct as loadCombinedSessionStoreForGateway, Dn as resolveUserTimezone, Dt as resolveSessionModelRef, Et as resolveGatewaySessionStoreTarget, Fr as normalizeMimeList, Ft as closeInFlightTurnsStore, G as recordRemoteNodeInfo, Gn as clearAgentRunContext, Gt as getBuiltinSectionRegistry, H as resolveSendPolicy, In as countActiveDescendantRuns, Ir as resolveInputFileLimits, It as deleteRow, J as removeRemoteNodeInfo, Jn as onAgentEvent, Jt as buildToolSummaryMap, K as refreshRemoteBinsForConnectedNodes, Kn as emitAgentEvent, Ln as initSubagentRegistry, Lt as listForCurrentInstance, Mt as queueEmbeddedPiMessage, Nr as extractFileContentFromSource, Nt as waitForEmbeddedPiRunEnd, Ot as normalizeOrgIds, Pr as extractImageContentFromSource, Pt as registerLifecycleHooks, Q as rejectNodePairing, Qt as createOpenClawCodingTools, Rn as listDescendantRunsForRequester, Rr as transcribeOpenAiCompatibleAudio, Rt as listFromOtherInstances, S as getTemplateUsageStats, St as listSessionsFromStore, Tt as pruneLegacyStoreKeys, U as getRemoteSkillEligibility, Un as runSubagentAnnounceFlow, Ut as readConsolidationState, V as normalizeSendPolicy, Vn as markSubagentRunTerminated, Vr as resolveAgentTimeoutMs, Vt as openInFlightTurnsStore, W as primeRemoteSkillsCache, Wt as assembleAgentSystemPromptWithSections, X as approveNodePairing, Xt as PROSE_GLOBAL_ROOT, Y as setSkillsRemoteRegistry, Yn as registerAgentRunContext, Yt as PromptSectionRegistry, Z as listNodePairing, Zn as resolveAgentIdentity, Zt as _clearProseCache, _ as spawnSubagentDirect, _r as parseVerboseOverride, _t as buildSystemPromptReport, a as getCliSessionId, ar as getTotalQueueSize, at as verifyPairingToken, b as getTemplateCache, c as debugSkipAll, cr as waitForActiveTasks, ct as readJsonFile, d as setDebugStepBroadcaster, dt as getSkillsSnapshotVersion, en as applyToolPolicyPipeline, et as requestNodePairing, f as setSteppedBuild, ft as registerSkillsChangeListener, gn as getTotalPendingReplies, gr as applyVerboseOverride, gt as runEmbeddedPiAgent, hn as createReplyDispatcher, hr as applyModelOverrideToSessionEntry, ht as clearSessionQueues, i as resolveCronStyleNow, in as requestHeartbeatNow, it as hashToken, j as loadProviderUsageSummary, jn as stopSubagentsForRequester, jr as DEFAULT_INPUT_IMAGE_MIMES, jt as getActiveEmbeddedRunCount, k as normalizeGroupActivation, kr as registerUnhandledRejectionHandler, kt as orgScopeVisible, l as debugStepContinue, ln as loadMinionPlugins, lr as lookupContextTokens, lt as writeJsonAtomic, mn as dispatchInboundMessage, n as BARE_SESSION_RESET_PROMPT, nn as createMinionTools, nr as resolveBootstrapContextForRun, nt as verifyNodeToken, o as setCliSessionId, or as resetAllLanes, ot as pruneExpiredPending, pr as buildAuthHealthSummary, q as refreshRemoteNodeBins, qn as getAgentRunContext, qt as buildSectionRenderContext, rn as TOOL_REGISTRY, rr as getActiveTaskCount, rt as generatePairingToken, s as runCliAgent, sn as getPluginToolMeta, sr as setCommandLaneConcurrency, st as resolvePairingPaths, tn as buildDefaultToolPolicyPipelineSteps, tt as updatePairedNodeMetadata, u as isSteppedBuildEnabled, un as loadOpenClawPlugins, ut as createAsyncLock, v as getLastReloadAt, vr as enqueueSystemEvent, vt as buildSystemPromptParams, w as stopTemplateWatcher, wn as formatZonedTimestamp, wt as loadSessionEntry, x as getTemplateLoadErrors, xt as listAgentsForGateway, y as getTemplate, yr as isSystemEventContextChanged, yt as canonicalizeSpawnedByForAgent, zt as markInterrupted } from "./reply-DjQyZzxK.js";
+import { A as resolveBootstrapTotalMaxChars, B as normalizeVerboseLevel, F as listThinkingLevels, H as supportsXHighThinking, I as normalizeElevatedLevel, L as normalizeReasoningLevel, M as formatThinkingLevels, N as formatXHighModelHint, R as normalizeThinkLevel, k as resolveBootstrapMaxChars, z as normalizeUsageDisplay } from "./pi-embedded-helpers-iIC17y0y.js";
+import { $ as renamePairedNode, An as isAbortTrigger, At as abortEmbeddedPiRun, Bt as markRecoveryAttempt, C as initTemplateLoader, Ct as loadCombinedSessionStoreForGateway, Dn as resolveUserTimezone, Dt as resolveSessionModelRef, Et as resolveGatewaySessionStoreTarget, Fr as normalizeMimeList, Ft as closeInFlightTurnsStore, G as recordRemoteNodeInfo, Gn as clearAgentRunContext, Gt as getBuiltinSectionRegistry, H as resolveSendPolicy, In as countActiveDescendantRuns, Ir as resolveInputFileLimits, It as deleteRow, J as removeRemoteNodeInfo, Jn as onAgentEvent, Jt as buildToolSummaryMap, K as refreshRemoteBinsForConnectedNodes, Kn as emitAgentEvent, Ln as initSubagentRegistry, Lt as listForCurrentInstance, Mt as queueEmbeddedPiMessage, Nr as extractFileContentFromSource, Nt as waitForEmbeddedPiRunEnd, Ot as normalizeOrgIds, Pr as extractImageContentFromSource, Pt as registerLifecycleHooks, Q as rejectNodePairing, Qt as createOpenClawCodingTools, Rn as listDescendantRunsForRequester, Rr as transcribeOpenAiCompatibleAudio, Rt as listFromOtherInstances, S as getTemplateUsageStats, St as listSessionsFromStore, Tt as pruneLegacyStoreKeys, U as getRemoteSkillEligibility, Un as runSubagentAnnounceFlow, Ut as readConsolidationState, V as normalizeSendPolicy, Vn as markSubagentRunTerminated, Vr as resolveAgentTimeoutMs, Vt as openInFlightTurnsStore, W as primeRemoteSkillsCache, Wt as assembleAgentSystemPromptWithSections, X as approveNodePairing, Xt as PROSE_GLOBAL_ROOT, Y as setSkillsRemoteRegistry, Yn as registerAgentRunContext, Yt as PromptSectionRegistry, Z as listNodePairing, Zn as resolveAgentIdentity, Zt as _clearProseCache, _ as spawnSubagentDirect, _r as parseVerboseOverride, _t as buildSystemPromptReport, a as getCliSessionId, ar as getTotalQueueSize, at as verifyPairingToken, b as getTemplateCache, c as debugSkipAll, cr as waitForActiveTasks, ct as readJsonFile, d as setDebugStepBroadcaster, dt as getSkillsSnapshotVersion, en as applyToolPolicyPipeline, et as requestNodePairing, f as setSteppedBuild, ft as registerSkillsChangeListener, gn as getTotalPendingReplies, gr as applyVerboseOverride, gt as runEmbeddedPiAgent, hn as createReplyDispatcher, hr as applyModelOverrideToSessionEntry, ht as clearSessionQueues, i as resolveCronStyleNow, in as requestHeartbeatNow, it as hashToken, j as loadProviderUsageSummary, jn as stopSubagentsForRequester, jr as DEFAULT_INPUT_IMAGE_MIMES, jt as getActiveEmbeddedRunCount, k as normalizeGroupActivation, kr as registerUnhandledRejectionHandler, kt as orgScopeVisible, l as debugStepContinue, ln as loadMinionPlugins, lr as lookupContextTokens, lt as writeJsonAtomic, mn as dispatchInboundMessage, n as BARE_SESSION_RESET_PROMPT, nn as createMinionTools, nr as resolveBootstrapContextForRun, nt as verifyNodeToken, o as setCliSessionId, or as resetAllLanes, ot as pruneExpiredPending, pr as buildAuthHealthSummary, q as refreshRemoteNodeBins, qn as getAgentRunContext, qt as buildSectionRenderContext, rn as TOOL_REGISTRY, rr as getActiveTaskCount, rt as generatePairingToken, s as runCliAgent, sn as getPluginToolMeta, sr as setCommandLaneConcurrency, st as resolvePairingPaths, tn as buildDefaultToolPolicyPipelineSteps, tt as updatePairedNodeMetadata, u as isSteppedBuildEnabled, un as loadOpenClawPlugins, ut as createAsyncLock, v as getLastReloadAt, vr as enqueueSystemEvent, vt as buildSystemPromptParams, w as stopTemplateWatcher, wn as formatZonedTimestamp, wt as loadSessionEntry, x as getTemplateLoadErrors, xt as listAgentsForGateway, y as getTemplate, yr as isSystemEventContextChanged, yt as canonicalizeSpawnedByForAgent, zt as markInterrupted } from "./reply-Cztaxyf8.js";
 import { B as listMcpTools, E as createEmptyPluginRegistry, F as triggerInternalHook, H as registerMcpTool, I as addMcpSseSubscriber, L as getMcpDispatcher, M as clearInternalHooks, N as createInternalHookEvent, P as registerInternalHook, R as getMcpIdentityResolver, U as setMcpDispatcher, V as reconcileMcpPluginTools, W as setMcpIdentityResolver, a as setConsoleSubsystemFilter, d as CHANNEL_IDS, n as runtimeForLogger, o as setConsoleTimestampPrefix, t as createSubsystemLogger, w as setActivePluginRegistryConfig, x as getActivePluginRegistry, z as getMcpToolMethod } from "./subsystem-Dor46CEN.js";
 import { t as defaultRuntime } from "./runtime-Da615Z-K.js";
 import { b as isSubagentSessionKey, d as resolveAgentIdFromSessionKey, h as toAgentStoreSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, m as toAgentRequestSessionKey, n as DEFAULT_AGENT_ID, s as classifySessionKeyShape, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isCronRunSessionKey, x as parseAgentSessionKey } from "./session-key-BcXqsG0l.js";
@@ -16,19 +16,19 @@ import { t as applySqlitePragmas } from "./sqlite-pragmas-C_o_lU6a.js";
 import { t as requireNodeSqlite } from "./sqlite-TEJFfaDd.js";
 import { d as setSentryContext, f as setSentryTag, n as getReliabilityUptimeStartMs, r as initReliability, t as emitReliabilityEvent } from "./reliability-D5odTVhl.js";
 import { n as logAcceptedEnvOption, t as isTruthyEnvValue } from "./env-IZo5oHSI.js";
-import { E as parseDurationMs, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, w as sensitive, y as resolveSubagentMaxConcurrent } from "./validation-C3bcbV84.js";
-import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-m4wc1BAH.js";
+import { E as parseDurationMs, c as applyLegacyMigrations, i as MinionSchema, n as validateConfigObjectWithPlugins, v as resolveAgentMaxConcurrent, w as sensitive, y as resolveSubagentMaxConcurrent } from "./validation-BerZ8GL9.js";
+import { C as resolveRuntimeServiceVersion, S as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, i as loadConfig, l as writeConfigFile, n as clearConfigCache, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, t as applySnapshotDefaults, y as applyMergePatch } from "./io-CdQCAaa6.js";
 import { l as isTestDefaultMemorySlotDisabled, n as loadPluginManifestRegistry } from "./manifest-registry-BhQtdshS.js";
-import { n as migrateLegacyConfig } from "./config-C7v6yY2J.js";
-import { A as getMirrorSnapshot, D as applyChannelRestart, F as setChannelRestartHandler, I as startMirrorRefreshTick, L as resolveHubMetricsConfig, O as channelConfigSource, P as seedMirror, _ as resolveTelegramAccount, c as resolveWhatsAppAccount, j as listMirrorAccountIds, k as getMirrorEntry, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, v as buildChannelAccountBindings, z as setMirrorAccountSource } from "./plugins-C3Yr0vjv.js";
-import { B as resolveExplicitAgentSessionKey, C as readSessionMessages, D as stripEnvelope, E as resolveSessionTranscriptCandidates, H as resolveMainSessionKeyFromConfig, L as resolveFreshSessionTotalTokens, N as resolveSessionResetPolicy, O as stripMessageIdHints, R as canonicalizeMainSessionAlias, S as capArrayByJsonBytes, V as resolveMainSessionKey, W as snapshotSessionOrigin, a as loadSessionStore, b as archiveFileOnDisk, g as mergeDeliveryContext, j as evaluateSessionFreshness, m as deliveryContextFromSession, n as parseSessionThreadInfo, nt as cleanStaleLockFiles, t as extractDeliveryInfo, u as updateSessionStore, v as normalizeSessionDeliveryFields, w as readSessionPreviewItemsFromTranscript, x as archiveSessionTranscripts, z as resolveAgentMainSessionKey } from "./sessions-CLk9f3VS.js";
-import { n as runWithModelFallback } from "./model-fallback-ClZN3VTY.js";
-import { c as resolveSandboxRuntimeStatus, g as collectExplicitAllowlist, p as TOOL_GROUPS, v as expandToolGroups, x as resolveToolProfilePolicy, y as mergeAlsoAllowPolicy } from "./sandbox-DuNLTHpm.js";
+import { n as migrateLegacyConfig } from "./config-DehMVNfT.js";
+import { A as getMirrorSnapshot, D as applyChannelRestart, F as setChannelRestartHandler, I as startMirrorRefreshTick, L as resolveHubMetricsConfig, O as channelConfigSource, P as seedMirror, _ as resolveTelegramAccount, c as resolveWhatsAppAccount, j as listMirrorAccountIds, k as getMirrorEntry, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin, v as buildChannelAccountBindings, z as setMirrorAccountSource } from "./plugins-DoD5loqV.js";
+import { B as resolveExplicitAgentSessionKey, C as readSessionMessages, D as stripEnvelope, E as resolveSessionTranscriptCandidates, H as resolveMainSessionKeyFromConfig, L as resolveFreshSessionTotalTokens, N as resolveSessionResetPolicy, O as stripMessageIdHints, R as canonicalizeMainSessionAlias, S as capArrayByJsonBytes, V as resolveMainSessionKey, W as snapshotSessionOrigin, a as loadSessionStore, b as archiveFileOnDisk, g as mergeDeliveryContext, j as evaluateSessionFreshness, m as deliveryContextFromSession, n as parseSessionThreadInfo, nt as cleanStaleLockFiles, t as extractDeliveryInfo, u as updateSessionStore, v as normalizeSessionDeliveryFields, w as readSessionPreviewItemsFromTranscript, x as archiveSessionTranscripts, z as resolveAgentMainSessionKey } from "./sessions-BwRNCPkA.js";
+import { n as runWithModelFallback } from "./model-fallback-CbUPBvLD.js";
+import { c as resolveSandboxRuntimeStatus, g as collectExplicitAllowlist, p as TOOL_GROUPS, v as expandToolGroups, x as resolveToolProfilePolicy, y as mergeAlsoAllowPolicy } from "./sandbox-DbBsfhrg.js";
 import { a as enableTailscaleServeFunnel, i as enableTailscaleServe, n as disableTailscaleServe, r as enableTailscaleFunnel, s as getTailnetHostname, t as disableTailscaleFunnel } from "./tailscale-ElLAPnGH.js";
 import { a as resolveRequestClientIp, c as createAuthRateLimiter, i as resolveGatewayAuth, l as safeEqualSecret, n as authorizeGatewayConnect, o as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, r as isLocalDirectRequest, s as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, t as assertGatewayAuthConfigured } from "./auth-OWSujIee.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-C0DLwT7t.js";
 import { a as isTrustedProxyAddress, d as resolveGatewayClientIp, f as resolveGatewayListenHosts, i as isPrivateOrLoopbackAddress, l as pickPrimaryLanIPv4, n as isLoopbackAddress, p as resolveHostName, r as isLoopbackHost, s as normalizeHostHeader, t as rawDataToString, u as resolveGatewayBindHost } from "./ws-D1BO6u3O.js";
-import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-DmXqKFna.js";
+import { h as mergeGatewayTailscaleConfig, m as ensureGatewayStartupAuth } from "./server-context-D-6GdMor.js";
 import { n as buildWorkspaceSkillSnapshot, r as loadWorkspaceSkillEntries } from "./workspace-CsM-Cs49.js";
 import "./skills-CiPqFRzf.js";
 import { a as isErrno, n as formatErrorMessage } from "./errors-iV4-NKRR.js";
@@ -40,22 +40,22 @@ import "./logging-_oKeHe0e.js";
 import { r as resolveUserDir } from "./user-directory-D27je39W.js";
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-CIx6mrsE.js";
 import { i as normalizeInputProvenance } from "./input-provenance-ChJN5mZj.js";
-import { D as runGlobalGatewayStopSafely, S as patchRouting, T as getGlobalHookRunner, _ as closeMessageLedger, b as markSynced, g as claimBatch, k as isPluginEnabledForOrg, w as deterministicClientId, x as openMessageLedger, y as markFailed } from "./reply-payloads-DRKznvAh.js";
+import { D as runGlobalGatewayStopSafely, S as patchRouting, T as getGlobalHookRunner, _ as closeMessageLedger, b as markSynced, g as claimBatch, k as isPluginEnabledForOrg, w as deterministicClientId, x as openMessageLedger, y as markFailed } from "./reply-payloads-SesmOYS1.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-v1JmmyzF.js";
-import { n as loadModelCatalog } from "./model-catalog-D2mf6NCd.js";
+import { n as loadModelCatalog } from "./model-catalog-BT-GB5Sg.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-DyoUYpcY.js";
 import { a as stripHeartbeatToken } from "./lanes-lpI3esC4.js";
-import { i as resolveSessionDeliveryTarget, r as resolveOutboundTarget } from "./targets-COAISf4b.js";
+import { i as resolveSessionDeliveryTarget, r as resolveOutboundTarget } from "./targets-0zwF_rcw.js";
 import { n as getMachineDisplayName } from "./with-timeout-B2r_vm3n.js";
 import { n as isDiagnosticsEnabled } from "./diagnostic-events-BIoHynd0.js";
 import { c as startDiagnosticHeartbeat, l as stopDiagnosticHeartbeat } from "./diagnostic-BAEmirZd.js";
-import { C as OPENAI_TTS_MODELS, T as defineDrone, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-B96k_Lwf.js";
+import { C as OPENAI_TTS_MODELS, T as defineDrone, _ as setTtsEnabled, d as resolveTtsAutoMode, f as resolveTtsConfig, i as getTtsProvider, m as resolveTtsProviderOrder, o as isTtsEnabled, p as resolveTtsPrefsPath, s as isTtsProviderConfigured, t as buildTtsSystemPromptHint, u as resolveTtsApiKey, w as OPENAI_TTS_VOICES, x as textToSpeech, y as setTtsProvider } from "./tts-pal-CEGo.js";
 import { i as runDrone, t as createGatewayDroneHost } from "./host-DjZfjj2q.js";
 import { a as traceGatewayEvent, n as pruneOldTraceFiles } from "./chat-trace-DK2HjAH4.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-DSkmVEn2.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-Cjc2QC34.js";
 import { t as ToolInputError } from "./common-DSuaFkdO.js";
 import { $ as validateModelsSetEnabledParams, A as validateCronRunsParams, At as validateToolsOverridesSetParams, B as validateExecApprovalRequestParams, Bt as validateWizardStatusParams, C as validateConfigSchemaParams, Ct as validateSkillsBinsParams, D as validateCronListParams, Dt as validateTalkConfigParams, E as validateCronAddParams, Et as validateSkillsUpdateParams, F as validateDevicePairRejectParams, Ft as validateWebLoginStartParams, G as validateExecApprovalsSetParams, Gt as deriveDeviceIdFromPublicKey, H as validateExecApprovalsGetParams, Ht as buildDeviceAuthPayload, I as validateDevicePairRemoveParams, It as validateWebLoginWaitParams, J as validateMeshPlanParams, Jt as verifyDeviceSignature, K as validateLogsTailParams, L as validateDeviceTokenRevokeParams, Lt as validateWizardCancelParams, M as validateCronUpdateParams, Mt as validateToolsUpdateParams, N as validateDevicePairApproveParams, Nt as validateUpdateRunParams, O as validateCronRemoveParams, Ot as validateTalkModeParams, P as validateDevicePairListParams, Pt as validateWakeParams, Q as validateModelsListParams, R as validateDeviceTokenRotateParams, Rt as validateWizardNextParams, S as validateConfigPatchParams, St as validateSessionsUsageParams, T as validateConnectParams, Tt as validateSkillsStatusParams, U as validateExecApprovalsNodeGetParams, Ut as normalizeDeviceAuthScopes, V as validateExecApprovalResolveParams, Vt as parseSessionLabel, W as validateExecApprovalsNodeSetParams, X as validateMeshRunParams, Y as validateMeshRetryParams, Z as validateMeshStatusParams, _ as validateChatHistoryParams, _t as validateSessionsListParams, a as validateAgentWaitParams, at as validateNodePairApproveParams, b as validateConfigApplyParams, bt as validateSessionsResetParams, c as validateAgentsFilesGetParams, ct as validateNodePairRequestParams, d as validateAgentsListParams, dt as validatePlaygroundCompleteParams, et as validateNodeDescribeParams, f as validateAgentsSkillsSetParams, ft as validatePollParams, g as validateChatAbortParams, gt as validateSessionsDeleteParams, h as validateChannelsStatusParams, ht as validateSessionsCompactParams, i as validateAgentParams, it as validateNodeListParams, j as validateCronStatusParams, jt as validateToolsStatusParams, k as validateCronRunParams, kt as validateTelegramValidateTokenParams, l as validateAgentsFilesListParams, lt as validateNodePairVerifyParams, m as validateChannelsLogoutParams, mt as validateSendParams, n as formatValidationErrors, nt as validateNodeInvokeParams, o as validateAgentsCreateParams, ot as validateNodePairListParams, p as validateAgentsUpdateParams, pt as validateRequestFrame, q as validateMeshPlanAutoParams, qt as normalizeDevicePublicKeyBase64Url, r as validateAgentIdentityParams, rt as validateNodeInvokeResultParams, s as validateAgentsDeleteParams, st as validateNodePairRejectParams, tt as validateNodeEventParams, u as validateAgentsFilesSetParams, ut as validateNodeRenameParams, v as validateChatInjectParams, vt as validateSessionsPatchParams, w as validateConfigSetParams, wt as validateSkillsInstallParams, x as validateConfigGetParams, xt as validateSessionsResolveParams, y as validateChatSendParams, yt as validateSessionsPreviewParams, z as validateDiscordValidateTokenParams, zt as validateWizardStartParams } from "./client-D2G3F-qm.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-CKivy66e.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-Cv9JOMB9.js";
 import { i as isExternalHookSession, n as detectSuspiciousPatterns, r as getHookType, t as buildSafeExternalPrompt } from "./external-content-Css-cJoz.js";
 import { t as formatDocsLink } from "./links-XaZTa0pi.js";
 import { n as runCommandWithRuntime } from "./cli-utils-Cg2c3XDf.js";
@@ -63,20 +63,20 @@ import { t as formatHelpExamples } from "./help-format-D20I7z1G.js";
 import { n as withProgress } from "./progress-Dai1njDG.js";
 import { t as getChannelActivity } from "./channel-activity-mLVM0GeJ.js";
 import { a as mergeExecApprovalsSocketDefaults, c as readExecApprovalsSnapshot, p as saveExecApprovals, r as ensureExecApprovals, s as normalizeExecApprovals, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-DkFd6DjM.js";
-import { a as resolveGroupToolPolicy, i as resolveEffectiveToolPolicy, o as resolveSubagentToolPolicy, t as listAgentWorkspaceDirs } from "./workspace-dirs-CBjbBiRa.js";
+import { a as resolveGroupToolPolicy, i as resolveEffectiveToolPolicy, o as resolveSubagentToolPolicy, t as listAgentWorkspaceDirs } from "./workspace-dirs-7j25QnoW.js";
 import { r as recallMemories, t as configureMemorySink } from "./memory-sink-D19pkCCX.js";
 import { t as KnowledgeGraphSession } from "./knowledge-graph-pXjPijn6.js";
 import { n as resolveModel } from "./model-BXSqE87X.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-D-vzOkTS.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format--dK3YoXf.js";
 import { a as markGatewaySigusr1RestartHandled, c as setPreRestartDeferralCheck, i as isGatewaySigusr1RestartExternallyAllowed, n as deferGatewayRestartUntilIdle, o as scheduleGatewaySigusr1Restart, r as emitGatewayRestart, s as setGatewaySigusr1RestartPolicy, t as consumeGatewaySigusr1RestartAuthorization } from "./restart-CrIJvqAZ.js";
-import { a as areHeartbeatsEnabled, c as setHeartbeatsEnabled, i as styleHealthChannelLine, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as resolveHeartbeatVisibility } from "./health-B8RawP7b.js";
+import { a as areHeartbeatsEnabled, c as setHeartbeatsEnabled, i as styleHealthChannelLine, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as resolveHeartbeatVisibility } from "./health-CMSekzYP.js";
 import { n as getLastHeartbeatEvent, r as onHeartbeatEvent } from "./heartbeat-events-CNb7CXLY.js";
-import { a as resetDirectoryCache, n as ensureOutboundSessionEntry, s as normalizePollInput, t as resolveOutboundSessionRoute } from "./outbound-session-CDWwaggL.js";
-import { a as computeBackoff, n as resolveChannelSenderIdentity, o as sleepWithAbort, r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-DMYpa9nO.js";
+import { a as resetDirectoryCache, n as ensureOutboundSessionEntry, s as normalizePollInput, t as resolveOutboundSessionRoute } from "./outbound-session-DAvju8aE.js";
+import { a as computeBackoff, n as resolveChannelSenderIdentity, o as sleepWithAbort, r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-DaqS3OL8.js";
 import { n as handleHubAssignmentChanged, r as initUserSubsystem, t as getActiveUserSubsystem } from "./server-startup-users-BPNhajYB.js";
 import { t as mapRoleToScopes } from "./types-Utz3c3Qq.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-OtLVxtqA.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-dnIzvRTI.js";
 import { t as ensureMinionCliOnPath } from "./path-env-q2qzs5In.js";
 import { t as forceFreePortAndWait } from "./ports-CRi_UQIX.js";
 import { t as buildChannelUiCatalog } from "./catalog-Pmvum_mS.js";
@@ -87,41 +87,41 @@ import { a as normalizeOptionalAgentId, c as normalizePayloadToSystemText, d as
 import { i as parseAbsoluteTimeMs, n as resolveCronStaggerMs, r as resolveDefaultCronStaggerMs, t as normalizeCronStaggerMs } from "./stagger-BlvVswOf.js";
 import { a as summarizeRestartSentinel, n as formatDoctorNonInteractiveHint, r as formatRestartSentinelMessage, s as writeRestartSentinel, t as consumeRestartSentinel } from "./restart-sentinel-fbAWH01I.js";
 import { n as setHubRest } from "./hub-rest-registry-DQyDHHy2.js";
-import { o as normalizeReplyPayloadsForDelivery, s as loadChannelOutboundAdapter, t as deliverOutboundPayloads } from "./deliver-Ckze82mh.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-DlUXGnzg.js";
-import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-CUJ4eMri.js";
+import { o as normalizeReplyPayloadsForDelivery, s as loadChannelOutboundAdapter, t as deliverOutboundPayloads } from "./deliver-C97xbDFj.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-BTmIs82T.js";
+import { c as resolveAnnounceTargetFromKey, t as readLatestAssistantReply } from "./agent-step-BlC5YTeo.js";
 import { a as runAggregation, n as executeOrchestration, r as readStatusJson, t as executePipeline } from "./orchestration-pipeline-BBscBgru.js";
 import { r as readManifest, t as completeManifest } from "./orchestration-manifest-ByxGsjSI.js";
-import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-BomzHVkf.js";
-import { t as createBrowserRouteDispatcher } from "./dispatcher-CmOeTrK_.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-B4NmPTp4.js";
+import { t as createBrowserRouteDispatcher } from "./dispatcher-Dpk5Q-if.js";
 import { n as persistBrowserProxyFiles, t as applyBrowserProxyPaths } from "./proxy-files-CGzbQD6b.js";
 import { r as cachedJson } from "./ttl-cache-C8H9R9LT.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-C1Fg_5xy.js";
 import { n as inheritOptionFromParent } from "./command-options-Dhjl7AMa.js";
 import { t as WizardCancelledError } from "./prompts-E0FayNjJ.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-BcEbnHmz.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-BhGucCgt.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-C1841BQR.js";
 import { t as buildChannelAccountSnapshot } from "./status-Dg720jp3.js";
-import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-BeTBv9NV.js";
-import "./onboard-helpers-CmQBiGjp.js";
+import { C as resolveAssistantAvatarUrl, S as normalizeControlUiBasePath, b as CONTROL_UI_AVATAR_PREFIX, c as handleReset, x as buildControlUiAvatarUrl } from "./onboard-helpers-CLTVAIAP.js";
+import "./onboard-helpers-DobA9gFL.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-Qux811Cp.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-BwC8GE-s.js";
 import { t as discoverGatewayBeacons } from "./bonjour-discovery-NB0c0sCF.js";
 import { t as installSkill } from "./skills-install-FagnOGmD.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-C2cJYDtd.js";
-import { m as parsePort$1 } from "./lifecycle-core-DfqLUBMA.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-am9lVfde.js";
+import { m as parsePort$1 } from "./lifecycle-core-D1qgiAnW.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-BIyeWSo9.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CwLlNhTt.js";
-import { a as resolveNodeCommandAllowlist, i as isNodeCommandAllowed, o as probeGateway } from "./audit-BJ-z-LVb.js";
-import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-DLQ6qhVR.js";
+import { a as resolveNodeCommandAllowlist, i as isNodeCommandAllowed, o as probeGateway } from "./audit-bz0y9XAh.js";
+import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-V-A_EQLj.js";
 import { a as resolveNpmChannelTag, n as compareSemverStrings, p as normalizeUpdateChannel, t as checkUpdateStatus } from "./update-check-Bx-oG--O.js";
 import { i as initCrypto, n as ProbeRegistry, r as SecretsManager, t as SecretStore } from "./store-J0lVAVgk.js";
-import { t as runOnboardingWizard } from "./onboarding-CquDb4Ko.js";
-import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-D08TcbbK.js";
-import { h as resolveGmailPullRuntimeConfig } from "./gmail-DgNp3YYe.js";
+import { t as runOnboardingWizard } from "./onboarding-BOHF-KyS.js";
+import { a as normalizeRpcAttachmentsToChatAttachments, c as logWs, d as setGatewayWsLogStyle, i as sendApnsBackgroundWake, l as shouldLogWs, o as parseMessageWithAttachments, r as resolveApnsAuthConfigFromEnv, s as formatForLog, t as loadApnsRegistration, u as summarizeAgentEventForWsLog } from "./push-apns-DnLzbtEB.js";
+import { h as resolveGmailPullRuntimeConfig } from "./gmail-DyzUUJJc.js";
 import { t as createOutboundSendDeps$1 } from "./outbound-send-deps-BF7Fp5DR.js";
 import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-Bkv5OgWh.js";
-import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-PiFxVqHJ.js";
+import { i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-r19IQe9R.js";
 import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-BRxsVIll.js";
 import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-fhvkz2W3.js";
 import { n as setEmbedConcurrency } from "./qmd-embed-semaphore-BI3_fJ4u.js";
@@ -1379,7 +1379,7 @@ async function stripLegacyConfigOverrides(cfg, stateDir, log) {
 * Orchestration event bus — typed EventEmitter for orchestration progress
 * with auto-cleanup on completion and optional gateway bridge.
 */
-const log$29 = createSubsystemLogger("orchestration-events");
+const log$30 = createSubsystemLogger("orchestration-events");
 var OrchestrationEventBus = class {
 	constructor() {
 		this.listeners = /* @__PURE__ */ new Map();
@@ -1477,7 +1477,7 @@ function scanForInterruptedOrchestrations(agentWorkspaces) {
 			if (manifest.status === "running") {
 				completeManifest(orchestrationDir, "interrupted");
 				interrupted.push(manifest.orchestrationId);
-				log$29.info(`crash recovery: marked orchestration ${manifest.orchestrationId} as interrupted`);
+				log$30.info(`crash recovery: marked orchestration ${manifest.orchestrationId} as interrupted`);
 			}
 		}
 	}
@@ -1485,7 +1485,7 @@ function scanForInterruptedOrchestrations(agentWorkspaces) {
 }
 //#endregion
 //#region src/infra/exec-approval-forwarder.ts
-const log$28 = createSubsystemLogger("gateway/exec-approvals");
+const log$29 = createSubsystemLogger("gateway/exec-approvals");
 const DEFAULT_MODE = "session";
 function normalizeMode(mode) {
 	return mode ?? DEFAULT_MODE;
@@ -1603,7 +1603,7 @@ async function deliverToTargets(params) {
 				payloads: [{ text: params.text }]
 			});
 		} catch (err) {
-			log$28.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
+			log$29.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
 		}
 	});
 	await Promise.allSettled(deliveries);
@@ -3216,7 +3216,7 @@ async function validateGatewayJwt(token, config) {
 }
 //#endregion
 //#region src/gateway/channel-health-monitor.ts
-const log$27 = createSubsystemLogger("gateway/health-monitor");
+const log$28 = createSubsystemLogger("gateway/health-monitor");
 const DEFAULT_CHECK_INTERVAL_MS$1 = 5 * 6e4;
 const DEFAULT_STARTUP_GRACE_MS = 6e4;
 const DEFAULT_COOLDOWN_CYCLES = 2;
@@ -3266,11 +3266,11 @@ function startChannelHealthMonitor(deps) {
 					if (now - record.lastRestartAt <= cooldownMs) continue;
 					pruneOldRestarts(record, now);
 					if (record.restartsThisHour.length >= maxRestartsPerHour) {
-						log$27.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
+						log$28.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
 						continue;
 					}
 					const reason = !status.running ? status.reconnectAttempts && status.reconnectAttempts >= 10 ? "gave-up" : "stopped" : "stuck";
-					log$27.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
+					log$28.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
 					try {
 						if (status.running) await channelManager.stopChannel(channelId, accountId);
 						channelManager.resetRestartAttempts(channelId, accountId);
@@ -3279,7 +3279,7 @@ function startChannelHealthMonitor(deps) {
 						record.restartsThisHour.push({ at: now });
 						restartRecords.set(key, record);
 					} catch (err) {
-						log$27.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
+						log$28.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
 					}
 				}
 			}
@@ -3299,7 +3299,7 @@ function startChannelHealthMonitor(deps) {
 		abortSignal?.addEventListener("abort", stop, { once: true });
 		timer = setInterval(() => void runCheck(), checkIntervalMs);
 		if (typeof timer === "object" && "unref" in timer) timer.unref();
-		log$27.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
+		log$28.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
 	}
 	return { stop };
 }
@@ -3319,7 +3319,7 @@ function startChannelHealthMonitor(deps) {
 * compare) before any phase flips dispatch to the mirror. whatsapp + telegram compare
 * fully; discord is compare-deferred. See specs/2026-06-26-gateway-config-db-migration-plan.md.
 */
-const log$26 = createSubsystemLogger("channel-mirror");
+const log$27 = createSubsystemLogger("channel-mirror");
 /** The gateway's live (gateway.json-resolved) comparable projection for an account.
 *  Type-aware: whatsapp + telegram resolve cleanly; discord's per-guild/channel model
 *  has no flat account projection → returns null (compare deferred, logged honestly). */
@@ -3378,7 +3378,7 @@ async function channelMirrorCompareFromTags(tags) {
 	try {
 		await seedMirror();
 	} catch (err) {
-		log$26.warn(`mirror refresh on signal failed: ${String(err)}`);
+		log$27.warn(`mirror refresh on signal failed: ${String(err)}`);
 	}
 	const affectedTypes = /* @__PURE__ */ new Set();
 	for (const tag of channelTags) {
@@ -3390,7 +3390,7 @@ async function channelMirrorCompareFromTags(tags) {
 		try {
 			compareOne(type, accountId);
 		} catch (err) {
-			log$26.warn(`compare failed for ${tag}: ${String(err)}`);
+			log$27.warn(`compare failed for ${tag}: ${String(err)}`);
 		}
 	}
 	for (const type of affectedTypes) await applyChannelRestart(type);
@@ -3399,18 +3399,18 @@ async function channelMirrorCompareFromTags(tags) {
 function compareOne(type, accountId) {
 	const entry = getMirrorEntry(type, accountId);
 	if (!entry) {
-		log$26.info(`signal for ${type}:${accountId}: not in mirror (Valkey/hub hydrate empty)`);
+		log$27.info(`signal for ${type}:${accountId}: not in mirror (Valkey/hub hydrate empty)`);
 		return;
 	}
 	const shadow = entry.projection;
 	const live = liveProjection(type, accountId);
 	if (!live) {
-		log$26.info(`signal for ${type}:${accountId}: no live comparable (new account or compare-deferred type) [observe-only]`);
+		log$27.info(`signal for ${type}:${accountId}: no live comparable (new account or compare-deferred type) [observe-only]`);
 		return;
 	}
 	const diff = diffFields(shadow, live);
 	const intended = shadow.enabled ? live.enabled ? "noop(running)" : "START" : "STOP";
-	log$26.info(`mirror ${type}:${accountId}: diff=[${diff.join(",") || "none"}] intended=${intended} shadow=${JSON.stringify(shadow)} live=${JSON.stringify(live)} [observe-only]`);
+	log$27.info(`mirror ${type}:${accountId}: diff=[${diff.join(",") || "none"}] intended=${intended} shadow=${JSON.stringify(shadow)} live=${JSON.stringify(live)} [observe-only]`);
 }
 /**
 * Boot parity check: read the seeded mirror snapshot and log how many accounts diverge
@@ -3430,10 +3430,10 @@ async function channelMirrorBootParity() {
 			}
 			if (diffFields(projection, live).length > 0) diffs += 1;
 		}
-		log$26.info(`boot hydration: ${shadows.size} accounts from hub, ${diffs} diff(s), ${deferred} deferred vs gateway.json [observe-only]`);
-		log$26.info(`boot hydration keys: [${Array.from(shadows.keys()).sort().join(", ")}]`);
+		log$27.info(`boot hydration: ${shadows.size} accounts from hub, ${diffs} diff(s), ${deferred} deferred vs gateway.json [observe-only]`);
+		log$27.info(`boot hydration keys: [${Array.from(shadows.keys()).sort().join(", ")}]`);
 	} catch (err) {
-		log$26.warn(`boot hydration parity failed: ${String(err)}`);
+		log$27.warn(`boot hydration parity failed: ${String(err)}`);
 	}
 }
 //#endregion
@@ -3933,7 +3933,7 @@ var ExecApprovalManager = class {
 * Opens the SQLite database, applies WAL pragmas, and runs the
 * 004_free_tier_users migration. Returns the DatabaseSync instance.
 */
-const log$25 = createSubsystemLogger("free-tier/db");
+const log$26 = createSubsystemLogger("free-tier/db");
 const MIGRATION_SQL_PATH = join(dirname(fileURLToPath(import.meta.url)), "../../db/migrations/004_free_tier_users.sql");
 function openFreeTierDb(dbPath) {
 	const { DatabaseSync } = requireNodeSqlite();
@@ -3942,9 +3942,9 @@ function openFreeTierDb(dbPath) {
 	try {
 		const sql = readFileSync(MIGRATION_SQL_PATH, "utf8");
 		db.exec(sql);
-		log$25.info("free-tier DB migration applied", { dbPath });
+		log$26.info("free-tier DB migration applied", { dbPath });
 	} catch (err) {
-		log$25.error("free-tier DB migration failed", {
+		log$26.error("free-tier DB migration failed", {
 			dbPath,
 			error: String(err)
 		});
@@ -4084,13 +4084,13 @@ var UserRepository = class {
 };
 //#endregion
 //#region src/gateway/free-tier/email.ts
-const log$24 = createSubsystemLogger("free-tier/email");
+const log$25 = createSubsystemLogger("free-tier/email");
 const RESEND_API = "https://api.resend.com/emails";
 const FROM = "OpenClaw <noreply@minion.ai>";
 async function send$1(to, subject, html) {
 	const apiKey = process.env["RESEND_API_KEY"];
 	if (!apiKey) {
-		log$24.warn("RESEND_API_KEY not set — email not sent", {
+		log$25.warn("RESEND_API_KEY not set — email not sent", {
 			to,
 			subject
 		});
@@ -4111,7 +4111,7 @@ async function send$1(to, subject, html) {
 	});
 	if (!res.ok) {
 		const text = await res.text().catch(() => "");
-		log$24.error("Resend API error", {
+		log$25.error("Resend API error", {
 			status: res.status,
 			body: text
 		});
@@ -4124,7 +4124,7 @@ async function sendVerificationEmail(email, token, baseUrl) {
 }
 //#endregion
 //#region src/gateway/free-tier/auth-http.ts
-const log$23 = createSubsystemLogger("free-tier/auth");
+const log$24 = createSubsystemLogger("free-tier/auth");
 function json$1(res, status, body) {
 	res.statusCode = status;
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -4186,7 +4186,7 @@ async function handleSignup(req, res, users) {
 		passwordHash
 	});
 	await sendVerificationEmail(email, verifyToken, process.env["HUB_BASE_URL"] ?? "https://hub.minion.ai").catch((e) => {
-		log$23.error("failed to send verification email", {
+		log$24.error("failed to send verification email", {
 			userId: user.id,
 			error: String(e)
 		});
@@ -4519,7 +4519,7 @@ function createFreeTierApiHandler(db) {
 *
 * @module
 */
-const log$22 = createSubsystemLogger("gateway/metrics");
+const log$23 = createSubsystemLogger("gateway/metrics");
 /** Cap on retained latency samples per method (reservoir) to bound memory. */
 const MAX_SAMPLES_PER_METHOD = 512;
 /** Default snapshot window. Matches the reliability rate-limiter granularity. */
@@ -4633,7 +4633,7 @@ function startGatewayRequestMetrics(opts) {
 		eventLoopHist = monitorEventLoopDelay({ resolution: 20 });
 		eventLoopHist.enable();
 	} catch (err) {
-		log$22.debug(`event-loop delay monitor unavailable: ${err instanceof Error ? err.message : String(err)}`);
+		log$23.debug(`event-loop delay monitor unavailable: ${err instanceof Error ? err.message : String(err)}`);
 		eventLoopHist = null;
 	}
 	windowStartMs = Date.now();
@@ -4642,7 +4642,7 @@ function startGatewayRequestMetrics(opts) {
 		try {
 			emitSnapshot(now - windowStartMs);
 		} catch (err) {
-			log$22.debug(`perf snapshot emit failed: ${err instanceof Error ? err.message : String(err)}`);
+			log$23.debug(`perf snapshot emit failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		methodStats.clear();
 		eventLoopHist?.reset();
@@ -5815,7 +5815,7 @@ function createAgentEventHandler({ broadcast, broadcastToConnIds, nodeSendToSess
 *
 * See specs/2026-05-22-gateway-turn-recovery.md.
 */
-const log$21 = createSubsystemLogger("agents/in-flight-turns");
+const log$22 = createSubsystemLogger("agents/in-flight-turns");
 const STALE_AFTER_MS = 1800 * 1e3;
 const MAX_RECOVERY_ATTEMPTS = 2;
 const APOLOGY_SEND_TIMEOUT_MS = 3e3;
@@ -5848,7 +5848,7 @@ async function sendApology(cfg, row) {
 		});
 		return await Promise.race([send, timeout]);
 	} catch (err) {
-		log$21.warn(`apology send failed for ${row.channel}:${row.chatId}: ${String(err)}`);
+		log$22.warn(`apology send failed for ${row.channel}:${row.chatId}: ${String(err)}`);
 		return false;
 	} finally {
 		if (timer) clearTimeout(timer);
@@ -5873,14 +5873,14 @@ async function recoverInterruptedTurns(deps) {
 		if (isStale || looped) {
 			deleteRow(row.id);
 			summary.dropped++;
-			log$21.info(`dropped row ${row.id} (${isStale ? "stale" : "loop guard"}): ${row.channel}:${row.chatId} agent=${row.agentId}`);
+			log$22.info(`dropped row ${row.id} (${isStale ? "stale" : "loop guard"}): ${row.channel}:${row.chatId} agent=${row.agentId}`);
 			continue;
 		}
 		markRecoveryAttempt(row.id);
 		if (await sendApology(deps.cfg, row)) summary.apologized++;
 		deleteRow(row.id);
 	}
-	log$21.info(`recovery scanned=${summary.scanned} apologized=${summary.apologized} dropped=${summary.dropped}`);
+	log$22.info(`recovery scanned=${summary.scanned} apologized=${summary.apologized} dropped=${summary.dropped}`);
 	return summary;
 }
 /**
@@ -5903,7 +5903,7 @@ async function drainInFlightTurns(deps) {
 			deleteRow(row.id);
 		}
 	}
-	log$21.info(`drain drained=${summary.drained} apologized=${summary.apologized}`);
+	log$22.info(`drain drained=${summary.drained} apologized=${summary.apologized}`);
 	return summary;
 }
 //#endregion
@@ -5932,7 +5932,7 @@ async function drainInFlightTurns(deps) {
 *
 * Spec: specs/2026-06-11-gog-nuke-execution-plan.md (Phase D)
 */
-const log$20 = createSubsystemLogger("gmail-gws");
+const log$21 = createSubsystemLogger("gmail-gws");
 /**
 * Run a `gws gmail …` command with the watcher's Gmail credentials file
 * injected. Returns parsed JSON on success. A non-zero exit is surfaced as
@@ -6013,7 +6013,7 @@ async function registerWatch(opts) {
 		error: "users.watch response missing historyId"
 	};
 	const expiration = data.expiration != null && Number.isFinite(Number(data.expiration)) ? Number(data.expiration) : void 0;
-	log$20.info(`watch registered (historyId=${historyId}, expiration=${expiration ?? "?"})`);
+	log$21.info(`watch registered (historyId=${historyId}, expiration=${expiration ?? "?"})`);
 	return {
 		ok: true,
 		historyId,
@@ -6147,7 +6147,7 @@ async function getMessage(opts) {
 		timeoutMs: opts.timeoutMs ?? 6e4
 	});
 	if (!res.ok) {
-		log$20.warn(`messages.get ${opts.id} failed: ${res.error}`);
+		log$21.warn(`messages.get ${opts.id} failed: ${res.error}`);
 		return null;
 	}
 	return parseGmailMessage(res.data, {
@@ -6228,6 +6228,177 @@ function truncateUtf8(value, maxBytes) {
 	return `${text}…`;
 }
 //#endregion
+//#region src/hooks/gmail-auto-label.ts
+/**
+* AI auto-labeling for the Gmail pull watcher.
+*
+* As Pub/Sub notifications deliver new messages, each one is classified by a
+* schema-output drone (same primitive as the personal-agent email summaries —
+* works on OpenRouter-only deployments) into ONE of the configured labels,
+* and that Gmail label is applied via `gws gmail users messages modify`.
+*
+* Labels are resolved name → id via `users labels list` and created on first
+* use (`users labels create`), cached per credentials file. Applying a label
+* is idempotent (addLabelIds), so a redelivered notification re-labels
+* harmlessly.
+*
+* Everything here is best-effort: a classify or gws failure logs and skips
+* the message — it never blocks the watcher's history baseline from
+* advancing. Requires the watched account's token to hold gmail.modify scope
+* (a 403 here means the account must be re-linked with the current scopes).
+*/
+const log$20 = createSubsystemLogger("gmail-auto-label");
+const classifyDrone = defineDrone({
+	id: "gmail-auto-label",
+	description: "Classifies an incoming email into one configured Gmail label.",
+	systemPrompt: "You label incoming email for a small-business inbox. Given the allowed labels with their meanings and one email, answer with exactly one label name — the best fit — or \"none\" when no label clearly applies. Never invent labels not in the list.",
+	model: {
+		provider: "anthropic",
+		model: "claude-haiku-4-5"
+	},
+	output: Type.Object({ label: Type.String({ description: "Exactly one of the allowed label names (verbatim), or \"none\" when no label clearly applies." }) }),
+	timeoutMs: 15e3
+});
+/** Cap what we feed the classifier — triage metadata + a body slice is plenty. */
+const BODY_CHARS_FOR_CLASSIFY = 2e3;
+/** Build the classify prompt for one message. Exported for tests. */
+function buildClassifyPrompt(msg, labels) {
+	const lines = [
+		"Allowed labels:",
+		...labels.map((l) => `- ${l.name}${l.description ? `: ${l.description}` : ""}`),
+		"",
+		`From: ${msg.from}`,
+		`Subject: ${msg.subject}`
+	];
+	const preview = (msg.body || msg.snippet || "").slice(0, BODY_CHARS_FOR_CLASSIFY).trim();
+	if (preview) lines.push("", preview);
+	return lines.join("\n");
+}
+/**
+* Match the drone's answer against the configured rules. Case-insensitive;
+* returns the canonical configured name, or null for "none"/unknown answers.
+* Exported for tests.
+*/
+function matchLabel(raw, labels) {
+	const answer = raw.trim().toLowerCase();
+	if (!answer || answer === "none") return null;
+	return labels.find((l) => l.name.trim().toLowerCase() === answer)?.name ?? null;
+}
+const labelCaches = /* @__PURE__ */ new Map();
+async function loadLabelCache(credentialsFile) {
+	const res = await runGwsGmail([
+		"gmail",
+		"users",
+		"labels",
+		"list",
+		"--params",
+		JSON.stringify({ userId: "me" })
+	], {
+		credentialsFile,
+		timeoutMs: 3e4
+	});
+	if (!res.ok) {
+		log$20.warn(`labels.list failed: ${res.error}`);
+		return null;
+	}
+	const cache = /* @__PURE__ */ new Map();
+	for (const label of res.data.labels ?? []) if (label.id && label.name) cache.set(label.name.trim().toLowerCase(), label.id);
+	return cache;
+}
+async function createLabel(credentialsFile, name) {
+	const res = await runGwsGmail([
+		"gmail",
+		"users",
+		"labels",
+		"create",
+		"--params",
+		JSON.stringify({ userId: "me" }),
+		"--json",
+		JSON.stringify({
+			name,
+			labelListVisibility: "labelShow",
+			messageListVisibility: "show"
+		})
+	], {
+		credentialsFile,
+		timeoutMs: 3e4
+	});
+	if (!res.ok) {
+		log$20.warn(`labels.create "${name}" failed: ${res.error}`);
+		return null;
+	}
+	return res.data.id ?? null;
+}
+/** Resolve a label name to its Gmail id, creating the label on first use. */
+async function ensureLabelId(credentialsFile, name) {
+	let cache = labelCaches.get(credentialsFile);
+	if (!cache) {
+		const loaded = await loadLabelCache(credentialsFile);
+		if (!loaded) return null;
+		cache = loaded;
+		labelCaches.set(credentialsFile, cache);
+	}
+	const key = name.trim().toLowerCase();
+	const existing = cache.get(key);
+	if (existing) return existing;
+	const created = await createLabel(credentialsFile, name);
+	if (created) cache.set(key, created);
+	return created;
+}
+async function applyLabel(credentialsFile, messageId, labelId) {
+	const res = await runGwsGmail([
+		"gmail",
+		"users",
+		"messages",
+		"modify",
+		"--params",
+		JSON.stringify({
+			userId: "me",
+			id: messageId
+		}),
+		"--json",
+		JSON.stringify({ addLabelIds: [labelId] })
+	], {
+		credentialsFile,
+		timeoutMs: 3e4
+	});
+	if (!res.ok) {
+		log$20.warn(`messages.modify ${messageId} failed: ${res.error}`);
+		return false;
+	}
+	return true;
+}
+async function classifyWithDrone(prompt) {
+	const result = await runDrone(classifyDrone, { prompt }, createGatewayDroneHost());
+	if (!result.ok) {
+		log$20.debug(`classify drone failed: ${result.error.code} ${result.error.message}`);
+		return null;
+	}
+	return result.data.label;
+}
+/**
+* Classify + label a batch of freshly delivered messages. Never throws;
+* per-message failures are logged and skipped. `classify` is injectable for
+* tests and defaults to the Haiku drone.
+*/
+async function autoLabelMessages(opts) {
+	const classify = opts.classify ?? classifyWithDrone;
+	for (const msg of opts.messages) try {
+		const answer = await classify(buildClassifyPrompt(msg, opts.labels));
+		if (answer === null) continue;
+		const name = matchLabel(answer, opts.labels);
+		if (!name) {
+			log$20.debug(`no label for ${msg.id} (classifier said "${answer}")`);
+			continue;
+		}
+		const labelId = await ensureLabelId(opts.credentialsFile, name);
+		if (!labelId) continue;
+		if (await applyLabel(opts.credentialsFile, msg.id, labelId)) log$20.info(`labeled ${msg.id} as "${name}"`);
+	} catch (err) {
+		log$20.warn(`auto-label failed for ${msg.id}: ${String(err)}`);
+	}
+}
+//#endregion
 //#region src/hooks/gmail-history-state.ts
 /**
 * Durable historyId persistence for the Gmail pull watcher.
@@ -6516,12 +6687,17 @@ async function syncOnce(notification) {
 		if (msg) messages.push(msg);
 	}
 	if (messages.length > 0) {
-		if (!await postToHook(cfg, messages)) {
+		if (cfg.autoLabel.enabled) await autoLabelMessages({
+			credentialsFile: cfg.credentialsFile,
+			labels: cfg.autoLabel.labels,
+			messages
+		});
+		if (!(cfg.deliver ? await postToHook(cfg, messages) : true)) {
 			log$17.warn("hook POST failed; will retry on next notification");
 			return;
 		}
 		for (const msg of messages) rememberProcessed(current, msg.id);
-		log$17.info(`delivered ${messages.length} message(s) to ${cfg.hookUrl}`);
+		if (cfg.deliver) log$17.info(`delivered ${messages.length} message(s) to ${cfg.hookUrl}`);
 	} else for (const id of freshIds) rememberProcessed(current, id);
 	advanceHistory(current, history.historyId ?? notification.historyId);
 	await saveHistoryId(current.stateDir, cfg.account, current.lastHistoryId);
@@ -6553,19 +6729,34 @@ async function renewWatch() {
 /**
 * POST the normalized payload to the gateway's local `/hooks/gmail` endpoint
 * with the bearer hook token. Returns true on a 2xx response.
+*
+* Uses node:http(s) directly instead of global fetch: the default hookUrl is
+* the gateway POSTing to itself on 127.0.0.1, and undici's process-global
+* dispatcher state (mutable by other subsystems/extensions) broke that fetch
+* in production for weeks ("TypeError: fetch failed") while the endpoint was
+* reachable from every other client.
 */
 async function postToHook(cfg, messages) {
+	const body = JSON.stringify({ messages });
 	try {
-		const res = await fetch(cfg.hookUrl, {
-			method: "POST",
-			headers: {
-				"content-type": "application/json",
-				authorization: `Bearer ${cfg.hookToken}`
-			},
-			body: JSON.stringify({ messages })
+		const status = await new Promise((resolve, reject) => {
+			const req = (cfg.hookUrl.startsWith("https:") ? https : http).request(cfg.hookUrl, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${cfg.hookToken}`,
+					"content-length": Buffer.byteLength(body)
+				}
+			}, (res) => {
+				res.resume();
+				res.on("end", () => resolve(res.statusCode ?? 0));
+			});
+			req.setTimeout(3e4, () => req.destroy(/* @__PURE__ */ new Error("hook POST timed out")));
+			req.on("error", reject);
+			req.end(body);
 		});
-		if (!res.ok) {
-			log$17.warn(`hook POST returned ${res.status}`);
+		if (status < 200 || status >= 300) {
+			log$17.warn(`hook POST returned ${status}`);
 			return false;
 		}
 		return true;
@@ -19727,7 +19918,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-DE9awsGD.js");
+			const { handleNodeEvent } = await import("./server-node-events-SK_JbV5S.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			const nodeConnId = client?.connId;
 			await handleNodeEvent({
@@ -27503,7 +27694,7 @@ function normalizeAgentPayload(payload) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.MINION_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.MINION_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./control-service-BomzHVkf.js").then((n) => n.t);
+	const mod = override ? await import(override) : await import("./control-service-B4NmPTp4.js").then((n) => n.t);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -33465,7 +33656,7 @@ async function deliverFlowReply(sessionKey, reply) {
 	}
 	try {
 		const cfg = loadConfig();
-		const { deliverOutboundPayloads } = await import("./deliver-Ckze82mh.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-C97xbDFj.js").then((n) => n.n);
 		await deliverOutboundPayloads({
 			cfg,
 			channel: target.channel,
@@ -37184,7 +37375,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	}
 	if (!minimalTestGateway) (async () => {
 		const { recoverPendingDeliveries } = await import("./delivery-queue-BTPlqn4c.js").then((n) => n.n);
-		const { deliverOutboundPayloads } = await import("./deliver-Ckze82mh.js").then((n) => n.n);
+		const { deliverOutboundPayloads } = await import("./deliver-C97xbDFj.js").then((n) => n.n);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),