@noxsoft/anima 7.0.0 → 7.0.1

package/dist/{run-CF3kHOGH.js → run-D6Ete2Z-.js}

@@ -2,7 +2,7 @@ import { h as expandHomePrefix, i as isNixMode, l as resolveGatewayLockDir, m as
 import { E as getActivePluginRegistry, F as setVerbose, G as setLoggerOverride, H as getChildLogger, U as getLogger, W as getResolvedLoggerSettings, d as defaultRuntime, g as CHANNEL_IDS, i as getResolvedConsoleSettings, n as runtimeForLogger, o as setConsoleSubsystemFilter, s as setConsoleTimestampPrefix, t as createSubsystemLogger, v as DEFAULT_CHAT_CHANNEL } from "./subsystem-BAADN1B8.js";
 import { C as shortenHomePath, D as truncateUtf16Safe, b as resolveUserPath, c as ensureDir$1, d as isPlainObject, r as clamp, t as CONFIG_DIR } from "./utils-CLYlhJuc.js";
 import { C as supportsXHighThinking, _ as normalizeElevatedLevel, b as normalizeUsageDisplay, m as formatXHighModelHint, p as formatThinkingLevels, v as normalizeReasoningLevel, x as normalizeVerboseLevel, y as normalizeThinkLevel } from "./pi-embedded-helpers-BZ9GspxK.js";
-import { $ as archiveFileOnDisk, At as deferGatewayRestartUntilIdle, B as sniffMimeFromBase64, C as verifyNodeToken, Cn as stopDiagnosticHeartbeat, Cr as DEFAULT_INPUT_PDF_MAX_PIXELS, Ct as loadProviderStore, D as registerSkillsChangeListener, Dr as extractImageContentFromSource, E as getSkillsSnapshotVersion, Er as extractFileContentFromSource, F as abortEmbeddedPiRun, Ft as setGatewaySigusr1RestartPolicy, G as canonicalizeSpawnedByForAgent, Gn as CommandLane, Gt as normalizeCronJobPatch, Hn as readLatestAssistantReply, I as waitForEmbeddedPiRunEnd, It as setPreRestartDeferralCheck, J as loadCombinedSessionStoreForGateway, Jn as getAgentRunContext, Jt as normalizeOptionalText, K as listAgentsForGateway, Kn as clearAgentRunContext, Kt as inferLegacyName, L as runNoxSoftEmbeddedAgent, Ln as countActiveDescendantRuns, Lt as consumeRestartSentinel, M as resetAllLanes, Mn as isAbortTrigger, Mr as resolveAgentTimeoutMs, Mt as isGatewaySigusr1RestartExternallyAllowed, N as setCommandLaneConcurrency, Nn as stopSubagentsForRequester, Nt as markGatewaySigusr1RestartHandled, O as clearSessionQueues, Or as normalizeMimeList, P as waitForActiveTasks, Pt as scheduleGatewaySigusr1Restart, Q as resolveSessionModelRef, R as applyToolPolicyPipeline, Rn as initSubagentRegistry, Rt as formatDoctorNonInteractiveHint, S as updatePairedNodeMetadata, Sn as startDiagnosticHeartbeat, Sr as DEFAULT_INPUT_PDF_MAX_PAGES, St as loadProviderUsageSummary, T as verifyPairingToken, Tr as DEFAULT_INPUT_TIMEOUT_MS, Tt as saveProviderStore, U as createAnimaTools, Ut as writeRestartSentinel, V as requestHeartbeatNow, Vn as runSubagentAnnounceFlow, Vt as summarizeRestartSentinel, W as resolveAnnounceTargetFromKey, Wt as normalizeCronJobCreate, X as pruneLegacyStoreKeys, Xn as registerAgentRunContext, Xt as normalizeRequiredName, Y as loadSessionEntry, Yn as onAgentEvent, Yt as normalizePayloadToSystemText, Z as resolveGatewaySessionStoreTarget, Zn as resolveAgentIdentity, Zt as migrateLegacyCronPayload, _ as approveNodePairing, _n as dispatchInboundMessage, _r as DEFAULT_INPUT_FILE_MAX_CHARS, _t as resetDirectoryCache, an as persistBrowserProxyFiles, ar as applyVerboseOverride, at as stripEnvelopeFromMessages, b as renamePairedNode, br as DEFAULT_INPUT_IMAGE_MIMES, bt as runWithModelFallback, c as normalizeSendPolicy, cr as isSystemEventContextChanged, d as primeRemoteSkillsCache, dr as loadModelCatalog, dt as resolveOutboundSessionRoute, en as buildSafeExternalPrompt, et as archiveSessionTranscripts, f as recordRemoteNodeInfo, g as setSkillsRemoteRegistry, gr as DEFAULT_INPUT_FILE_MAX_BYTES, h as removeRemoteNodeInfo, ht as resolveSessionDeliveryTarget, i as setCliSessionId, in as applyBrowserProxyPaths, ir as applyModelOverrideToSessionEntry, it as resolveSessionTranscriptCandidates, j as getTotalQueueSize, jt as emitGatewayRestart, k as getActiveTaskCount, kn as formatZonedTimestamp, kr as estimateBase64DecodedBytes, kt as consumeGatewaySigusr1RestartAuthorization, l as resolveSendPolicy, m as refreshRemoteNodeBins, mr as registerUnhandledRejectionHandler, mt as resolveOutboundTarget, n as BARE_SESSION_RESET_PROMPT, nn as getHookType, nr as lookupContextTokens, nt as readSessionMessages, on as getPluginToolMeta, or as parseVerboseOverride, p as refreshRemoteBinsForConnectedNodes, pn as getChannelActivity, q as listSessionsFromStore, qn as emitAgentEvent, qt as normalizeOptionalAgentId, r as getCliSessionId, rn as isExternalHookSession, rt as readSessionPreviewItemsFromTranscript, sn as loadAnimaPlugins, sr as enqueueSystemEvent, st as normalizeGroupActivation, tn as detectSuspiciousPatterns, tt as capArrayByJsonBytes, u as getRemoteSkillEligibility, ut as ensureOutboundSessionEntry, v as listNodePairing, vn as createReplyDispatcher, vr as DEFAULT_INPUT_FILE_MIMES, vt as resolveMessageChannelSelection, w as generatePairingToken, wn as isDiagnosticsEnabled, wr as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, wt as maskApiKey, x as requestNodePairing, xr as DEFAULT_INPUT_MAX_REDIRECTS, xt as resolveWorkingModeModelSelection, y as rejectNodePairing, yn as getTotalPendingReplies, yr as DEFAULT_INPUT_IMAGE_MAX_BYTES, z as buildDefaultToolPolicyPipelineSteps, zn as listDescendantRunsForRequester, zt as formatRestartSentinelMessage } from "./reply-93fMzde1.js";
+import { $ as archiveFileOnDisk, At as deferGatewayRestartUntilIdle, B as sniffMimeFromBase64, C as verifyNodeToken, Cn as stopDiagnosticHeartbeat, Cr as DEFAULT_INPUT_PDF_MAX_PIXELS, Ct as loadProviderStore, D as registerSkillsChangeListener, Dr as extractImageContentFromSource, E as getSkillsSnapshotVersion, Er as extractFileContentFromSource, F as abortEmbeddedPiRun, Ft as setGatewaySigusr1RestartPolicy, G as canonicalizeSpawnedByForAgent, Gn as CommandLane, Gt as normalizeCronJobPatch, Hn as readLatestAssistantReply, I as waitForEmbeddedPiRunEnd, It as setPreRestartDeferralCheck, J as loadCombinedSessionStoreForGateway, Jn as getAgentRunContext, Jt as normalizeOptionalText, K as listAgentsForGateway, Kn as clearAgentRunContext, Kt as inferLegacyName, L as runNoxSoftEmbeddedAgent, Ln as countActiveDescendantRuns, Lt as consumeRestartSentinel, M as resetAllLanes, Mn as isAbortTrigger, Mr as resolveAgentTimeoutMs, Mt as isGatewaySigusr1RestartExternallyAllowed, N as setCommandLaneConcurrency, Nn as stopSubagentsForRequester, Nt as markGatewaySigusr1RestartHandled, O as clearSessionQueues, Or as normalizeMimeList, P as waitForActiveTasks, Pt as scheduleGatewaySigusr1Restart, Q as resolveSessionModelRef, R as applyToolPolicyPipeline, Rn as initSubagentRegistry, Rt as formatDoctorNonInteractiveHint, S as updatePairedNodeMetadata, Sn as startDiagnosticHeartbeat, Sr as DEFAULT_INPUT_PDF_MAX_PAGES, St as loadProviderUsageSummary, T as verifyPairingToken, Tr as DEFAULT_INPUT_TIMEOUT_MS, Tt as saveProviderStore, U as createAnimaTools, Ut as writeRestartSentinel, V as requestHeartbeatNow, Vn as runSubagentAnnounceFlow, Vt as summarizeRestartSentinel, W as resolveAnnounceTargetFromKey, Wt as normalizeCronJobCreate, X as pruneLegacyStoreKeys, Xn as registerAgentRunContext, Xt as normalizeRequiredName, Y as loadSessionEntry, Yn as onAgentEvent, Yt as normalizePayloadToSystemText, Z as resolveGatewaySessionStoreTarget, Zn as resolveAgentIdentity, Zt as migrateLegacyCronPayload, _ as approveNodePairing, _n as dispatchInboundMessage, _r as DEFAULT_INPUT_FILE_MAX_CHARS, _t as resetDirectoryCache, an as persistBrowserProxyFiles, ar as applyVerboseOverride, at as stripEnvelopeFromMessages, b as renamePairedNode, br as DEFAULT_INPUT_IMAGE_MIMES, bt as runWithModelFallback, c as normalizeSendPolicy, cr as isSystemEventContextChanged, d as primeRemoteSkillsCache, dr as loadModelCatalog, dt as resolveOutboundSessionRoute, en as buildSafeExternalPrompt, et as archiveSessionTranscripts, f as recordRemoteNodeInfo, g as setSkillsRemoteRegistry, gr as DEFAULT_INPUT_FILE_MAX_BYTES, h as removeRemoteNodeInfo, ht as resolveSessionDeliveryTarget, i as setCliSessionId, in as applyBrowserProxyPaths, ir as applyModelOverrideToSessionEntry, it as resolveSessionTranscriptCandidates, j as getTotalQueueSize, jt as emitGatewayRestart, k as getActiveTaskCount, kn as formatZonedTimestamp, kr as estimateBase64DecodedBytes, kt as consumeGatewaySigusr1RestartAuthorization, l as resolveSendPolicy, m as refreshRemoteNodeBins, mr as registerUnhandledRejectionHandler, mt as resolveOutboundTarget, n as BARE_SESSION_RESET_PROMPT, nn as getHookType, nr as lookupContextTokens, nt as readSessionMessages, on as getPluginToolMeta, or as parseVerboseOverride, p as refreshRemoteBinsForConnectedNodes, pn as getChannelActivity, q as listSessionsFromStore, qn as emitAgentEvent, qt as normalizeOptionalAgentId, r as getCliSessionId, rn as isExternalHookSession, rt as readSessionPreviewItemsFromTranscript, sn as loadAnimaPlugins, sr as enqueueSystemEvent, st as normalizeGroupActivation, tn as detectSuspiciousPatterns, tt as capArrayByJsonBytes, u as getRemoteSkillEligibility, ut as ensureOutboundSessionEntry, v as listNodePairing, vn as createReplyDispatcher, vr as DEFAULT_INPUT_FILE_MIMES, vt as resolveMessageChannelSelection, w as generatePairingToken, wn as isDiagnosticsEnabled, wr as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, wt as maskApiKey, x as requestNodePairing, xr as DEFAULT_INPUT_MAX_REDIRECTS, xt as resolveWorkingModeModelSelection, y as rejectNodePairing, yn as getTotalPendingReplies, yr as DEFAULT_INPUT_IMAGE_MAX_BYTES, z as buildDefaultToolPolicyPipelineSteps, zn as listDescendantRunsForRequester, zt as formatRestartSentinelMessage } from "./reply-ylwOKuOF.js";
 import { b as isSubagentSessionKey, d as resolveAgentIdFromSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, m as toAgentRequestSessionKey, n as DEFAULT_AGENT_ID, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isCronRunSessionKey, x as parseAgentSessionKey } from "./session-key-DAZmp8ll.js";
 import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-BylR5qWS.js";
 import { t as resolveAnimaPackageRoot } from "./anima-root-xWSKR6Wm.js";
@@ -28,7 +28,7 @@ import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin
 import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveSessionFilePath, r as resolveSessionFilePathOptions, s as resolveSessionTranscriptsDirForAgent } from "./paths-Dazi-gYo.js";
 import { O as normalizeSecretInput } from "./auth-profiles-C-LuhW6c.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-SP2Q7i59.js";
-import { B as resolveTtsConfig, F as isTtsProviderConfigured, G as setTtsEnabled, H as resolveTtsProviderOrder, J as textToSpeech, M as getTtsProvider, P as isTtsEnabled, R as resolveTtsApiKey, T as resolveUserTimezone, V as resolveTtsPrefsPath, X as OPENAI_TTS_MODELS, Z as OPENAI_TTS_VOICES, ct as createInternalHookEvent, dt as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, et as clearSteer, ht as stripHeartbeatToken, it as getEgoManager, lt as registerInternalHook, nt as getSteerHistory, q as setTtsProvider, rt as setSteer, st as clearInternalHooks, tt as getSteer, ut as triggerInternalHook, z as resolveTtsAutoMode } from "./anthropic-direct-runner-OjcTAH6g.js";
+import { B as resolveTtsConfig, F as isTtsProviderConfigured, G as setTtsEnabled, H as resolveTtsProviderOrder, J as textToSpeech, M as getTtsProvider, P as isTtsEnabled, R as resolveTtsApiKey, T as resolveUserTimezone, V as resolveTtsPrefsPath, X as OPENAI_TTS_MODELS, Z as OPENAI_TTS_VOICES, ct as createInternalHookEvent, dt as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, et as clearSteer, ht as stripHeartbeatToken, it as getEgoManager, lt as registerInternalHook, nt as getSteerHistory, q as setTtsProvider, rt as setSteer, st as clearInternalHooks, tt as getSteer, ut as triggerInternalHook, z as resolveTtsAutoMode } from "./anthropic-direct-runner-C5pnwYzT.js";
 import { o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads, x as runGlobalGatewayStopSafely, y as getGlobalHookRunner } from "./deliver-BKzX3YoN.js";
 import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-DLtBA6r5.js";
 import { a as readTrustGraphSnapshot, c as pruneExpiredPending, d as writeJsonAtomic, l as readJsonFile, o as saveTrustGraph, s as createAsyncLock, u as resolvePairingPaths } from "./loader-Bw2wdN4l.js";
@@ -42,9 +42,9 @@ import { t as parseAbsoluteTimeMs } from "./parse-Cinbkvj-.js";
 import { c as saveToken, i as getToken, l as whoami, n as clearToken, o as registerWithInvite, s as resolveSuggestedIdentity, t as TOKEN_PATH } from "./noxsoft-auth-CE75mBXE.js";
 import { i as loadSessionUsageTimeSeries, l as deriveSessionTotalTokens, n as loadCostUsageSummary, r as loadSessionCostSummary, t as discoverAllSessions, u as hasNonzeroUsage } from "./session-cost-usage-BWqR-ik6.js";
 import { f as resolveExecApprovalsSocketPath, o as normalizeExecApprovals, p as saveExecApprovals, r as ensureExecApprovals, s as readExecApprovalsSnapshot, t as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS } from "./exec-approvals-DK5-KCUz.js";
-import { c as resolveCronStyleNow, i as onHeartbeatEvent, r as getLastHeartbeatEvent, t as resolveHeartbeatVisibility } from "./heartbeat-visibility-BQL13ZBH.js";
-import { r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-B7Fb3fO8.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-BKLIBKjK.js";
+import { c as resolveCronStyleNow, i as onHeartbeatEvent, r as getLastHeartbeatEvent, t as resolveHeartbeatVisibility } from "./heartbeat-visibility-BaL8JzkS.js";
+import { r as buildHistoryContextFromEntries, t as createReplyPrefixOptions } from "./reply-prefix-CEnF6TUe.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-DKPoFoa8.js";
 import { t as ensureAnimaCliOnPath } from "./path-env-DLQPf9qj.js";
 import { t as forceFreePortAndWait } from "./ports-DaVrZDUq.js";
 import { t as buildChannelUiCatalog } from "./catalog-CsXv59Tq.js";
@@ -56,24 +56,24 @@ import { t as parsePort } from "./parse-port-CDPwDUs3.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-CHAT20aR.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-C-rqLtIT.js";
 import { o as isNodeCommandAllowed, s as resolveNodeCommandAllowlist } from "./audit-B05W5ckN.js";
-import { n as getStatusSummary } from "./status-BO5BIf81.js";
+import { n as getStatusSummary } from "./status-BhRELdY_.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-1MPChTcB.js";
-import { c as startHeartbeatRunner, n as getHealthSnapshot, o as runHeartbeatOnce, s as setHeartbeatsEnabled } from "./health-B5N6_UOf.js";
+import { c as startHeartbeatRunner, n as getHealthSnapshot, o as runHeartbeatOnce, s as setHeartbeatsEnabled } from "./health-yw_uaucz.js";
 import { t as applyPluginAutoEnable } from "./plugin-auto-enable-CtYcdTju.js";
 import { a as resolveControlUiRootOverrideSync, n as ensureControlUiAssetsBuilt, o as resolveControlUiRootSync } from "./health-format-D-JJ5_S4.js";
 import { n as validateSystemRunCommandConsistency, r as getMachineDisplayName, t as formatExecCommand } from "./system-run-command-Bx8-5h2r.js";
 import { h as normalizeUpdateChannel, l as DEFAULT_PACKAGE_CHANNEL, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channels-status-issues-WkG3Tmxk.js";
 import { t as WizardCancelledError } from "./prompts-Bq4QGFQM.js";
 import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-DdweuSIj.js";
-import { t as runOnboardingWizard } from "./onboarding-BeuMAyic.js";
+import { t as runOnboardingWizard } from "./onboarding-fnZOw6Wv.js";
 import { a as setGatewayWsLogStyle, i as summarizeAgentEventForWsLog, n as logWs, r as shouldLogWs, t as formatForLog } from "./ws-log-CUobU2tD.js";
 import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-DaJoXV_3.js";
 import { t as createOutboundSendDeps$1 } from "./outbound-send-deps-DVfWC4E8.js";
 import { a as loadAgentIdentity, c as loadAgentIdentityFromWorkspace, i as listAgentEntries, o as pruneAgentConfig, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-BR5JLtud.js";
-import { n as resolveAgentDeliveryPlan, r as resolveAgentOutboundTarget, t as agentCommand } from "./agent-BoAAHGEA.js";
+import { n as resolveAgentDeliveryPlan, r as resolveAgentOutboundTarget, t as agentCommand } from "./agent-BjD_hkGZ.js";
 import { t as migrateFromCoherence } from "./migrate-DuohB_ur.js";
 import { t as installSkill } from "./skills-install-D6_qpRjW.js";
-import { t as runGatewayUpdate } from "./update-runner-DZfnquWO.js";
+import { t as runGatewayUpdate } from "./update-runner-C8SRcVm3.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import * as fsSync from "node:fs";
 import fs, { constants } from "node:fs";
@@ -111,7 +111,7 @@ function getActiveEmbeddedRunCount() {
 
 //#endregion
 //#region src/infra/exec-approval-forwarder.ts
-const log$11 = createSubsystemLogger("gateway/exec-approvals");
+const log$12 = createSubsystemLogger("gateway/exec-approvals");
 const DEFAULT_MODE = "session";
 function normalizeMode(mode) {
 	return mode ?? DEFAULT_MODE;
@@ -226,7 +226,7 @@ async function deliverToTargets(params) {
 				payloads: [{ text: params.text }]
 			});
 		} catch (err) {
-			log$11.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
+			log$12.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
 		}
 	});
 	await Promise.allSettled(deliveries);
@@ -1463,7 +1463,7 @@ function createAgentEventHandler({ broadcast, broadcastToConnIds, nodeSendToSess
 * Automatically starts `gog gmail watch serve` when the gateway starts,
 * if hooks.gmail is configured with an account.
 */
-const log$10 = createSubsystemLogger("gmail-watcher");
+const log$11 = createSubsystemLogger("gmail-watcher");
 const ADDRESS_IN_USE_RE = /address already in use|EADDRINUSE/i;
 function isAddressInUseError(line) {
 	return ADDRESS_IN_USE_RE.test(line);
@@ -1487,13 +1487,13 @@ async function startGmailWatch(cfg) {
 		const result = await runCommandWithTimeout(args, { timeoutMs: 12e4 });
 		if (result.code !== 0) {
 			const message = result.stderr || result.stdout || "gog watch start failed";
-			log$10.error(`watch start failed: ${message}`);
+			log$11.error(`watch start failed: ${message}`);
 			return false;
 		}
-		log$10.info(`watch started for ${cfg.account}`);
+		log$11.info(`watch started for ${cfg.account}`);
 		return true;
 	} catch (err) {
-		log$10.error(`watch start error: ${String(err)}`);
+		log$11.error(`watch start error: ${String(err)}`);
 		return false;
 	}
 }
@@ -1502,7 +1502,7 @@ async function startGmailWatch(cfg) {
 */
 function spawnGogServe(cfg) {
 	const args = buildGogWatchServeArgs(cfg);
-	log$10.info(`starting gog ${args.join(" ")}`);
+	log$11.info(`starting gog ${args.join(" ")}`);
 	let addressInUse = false;
 	const child = spawn("gog", args, {
 		stdio: [
@@ -1514,25 +1514,25 @@ function spawnGogServe(cfg) {
 	});
 	child.stdout?.on("data", (data) => {
 		const line = data.toString().trim();
-		if (line) log$10.info(`[gog] ${line}`);
+		if (line) log$11.info(`[gog] ${line}`);
 	});
 	child.stderr?.on("data", (data) => {
 		const line = data.toString().trim();
 		if (!line) return;
 		if (isAddressInUseError(line)) addressInUse = true;
-		log$10.warn(`[gog] ${line}`);
+		log$11.warn(`[gog] ${line}`);
 	});
 	child.on("error", (err) => {
-		log$10.error(`gog process error: ${String(err)}`);
+		log$11.error(`gog process error: ${String(err)}`);
 	});
 	child.on("exit", (code, signal) => {
 		if (shuttingDown) return;
 		if (addressInUse) {
-			log$10.warn("gog serve failed to bind (address already in use); stopping restarts. Another watcher is likely running. Set ANIMA_SKIP_GMAIL_WATCHER=1 or stop the other process.");
+			log$11.warn("gog serve failed to bind (address already in use); stopping restarts. Another watcher is likely running. Set ANIMA_SKIP_GMAIL_WATCHER=1 or stop the other process.");
 			watcherProcess = null;
 			return;
 		}
-		log$10.warn(`gog exited (code=${code}, signal=${signal}); restarting in 5s`);
+		log$11.warn(`gog exited (code=${code}, signal=${signal}); restarting in 5s`);
 		watcherProcess = null;
 		setTimeout(() => {
 			if (shuttingDown || !currentConfig) return;
@@ -1572,15 +1572,15 @@ async function startGmailWatcher(cfg) {
 			port: runtimeConfig.serve.port,
 			target: runtimeConfig.tailscale.target
 		});
-		log$10.info(`tailscale ${runtimeConfig.tailscale.mode} configured for port ${runtimeConfig.serve.port}`);
+		log$11.info(`tailscale ${runtimeConfig.tailscale.mode} configured for port ${runtimeConfig.serve.port}`);
 	} catch (err) {
-		log$10.error(`tailscale setup failed: ${String(err)}`);
+		log$11.error(`tailscale setup failed: ${String(err)}`);
 		return {
 			started: false,
 			reason: `tailscale setup failed: ${String(err)}`
 		};
 	}
-	if (!await startGmailWatch(runtimeConfig)) log$10.warn("gmail watch start failed, but continuing with serve");
+	if (!await startGmailWatch(runtimeConfig)) log$11.warn("gmail watch start failed, but continuing with serve");
 	shuttingDown = false;
 	watcherProcess = spawnGogServe(runtimeConfig);
 	const renewMs = runtimeConfig.renewEveryMinutes * 6e4;
@@ -1588,7 +1588,7 @@ async function startGmailWatcher(cfg) {
 		if (shuttingDown) return;
 		startGmailWatch(runtimeConfig);
 	}, renewMs);
-	log$10.info(`gmail watcher started for ${runtimeConfig.account} (renew every ${runtimeConfig.renewEveryMinutes}m)`);
+	log$11.info(`gmail watcher started for ${runtimeConfig.account} (renew every ${runtimeConfig.renewEveryMinutes}m)`);
 	return { started: true };
 }
 /**
@@ -1601,7 +1601,7 @@ async function stopGmailWatcher() {
 		renewInterval = null;
 	}
 	if (watcherProcess) {
-		log$10.info("stopping gmail watcher");
+		log$11.info("stopping gmail watcher");
 		watcherProcess.kill("SIGTERM");
 		await new Promise((resolve) => {
 			const timeout = setTimeout(() => {
@@ -1616,7 +1616,7 @@ async function stopGmailWatcher() {
 		watcherProcess = null;
 	}
 	currentConfig = null;
-	log$10.info("gmail watcher stopped");
+	log$11.info("gmail watcher stopped");
 }
 
 //#endregion
@@ -9611,7 +9611,7 @@ const FIELD_LABELS = {
 
 //#endregion
 //#region src/config/schema.hints.ts
-const log$9 = createSubsystemLogger("config/schema");
+const log$10 = createSubsystemLogger("config/schema");
 const GROUP_LABELS = {
 	wizard: "Wizard",
 	update: "Update",
@@ -9759,7 +9759,7 @@ function mapSensitivePaths(schema, path, hints) {
 		...next[path],
 		sensitive: true
 	};
-	else if (isSensitiveConfigPath(path) && !next[path]?.sensitive) log$9.warn(`possibly sensitive key found: (${path})`);
+	else if (isSensitiveConfigPath(path) && !next[path]?.sensitive) log$10.warn(`possibly sensitive key found: (${path})`);
 	if (currentSchema instanceof z.ZodObject) {
 		const shape = currentSchema.shape;
 		for (const key in shape) {
@@ -9782,7 +9782,7 @@ function mapSensitivePaths(schema, path, hints) {
 
 //#endregion
 //#region src/config/redact-snapshot.ts
-const log$8 = createSubsystemLogger("config/redaction");
+const log$9 = createSubsystemLogger("config/redaction");
 const ENV_VAR_PLACEHOLDER_PATTERN = /^\$\{[^}]*\}$/;
 function isSensitivePath(path) {
 	if (path.endsWith("[]")) return isSensitiveConfigPath(path.slice(0, -2));
@@ -10033,7 +10033,7 @@ function restoreRedactedValuesWithLookup(incoming, original, lookup, prefix, hin
 			return restoreRedactedValuesGuessing(incoming, original, prefix, hints);
 		}
 		const origArr = Array.isArray(original) ? original : [];
-		if (incoming.length < origArr.length) log$8.warn(`Redacted config array key ${path} has been truncated`);
+		if (incoming.length < origArr.length) log$9.warn(`Redacted config array key ${path} has been truncated`);
 		return incoming.map((item, i) => {
 			if (item === REDACTED_SENTINEL) return origArr[i];
 			return restoreRedactedValuesWithLookup(item, origArr[i], lookup, path, hints);
@@ -10050,7 +10050,7 @@ function restoreRedactedValuesWithLookup(incoming, original, lookup, prefix, hin
 			matched = true;
 			if (value === REDACTED_SENTINEL) if (key in orig) result[key] = orig[key];
 			else {
-				log$8.warn(`Cannot un-redact config key ${candidate} as it doesn't have any value`);
+				log$9.warn(`Cannot un-redact config key ${candidate} as it doesn't have any value`);
 				throw new RedactionError(candidate);
 			}
 			else if (typeof value === "object" && value !== null) result[key] = restoreRedactedValuesWithLookup(value, orig[key], lookup, candidate, hints);
@@ -10059,7 +10059,7 @@ function restoreRedactedValuesWithLookup(incoming, original, lookup, prefix, hin
 		if (!matched && isExtensionPath(path)) {
 			if (!isExplicitlyNonSensitivePath(hints, [path, wildcardPath]) && isSensitivePath(path) && value === REDACTED_SENTINEL) if (key in orig) result[key] = orig[key];
 			else {
-				log$8.warn(`Cannot un-redact config key ${path} as it doesn't have any value`);
+				log$9.warn(`Cannot un-redact config key ${path} as it doesn't have any value`);
 				throw new RedactionError(path);
 			}
 			else if (typeof value === "object" && value !== null) result[key] = restoreRedactedValuesGuessing(value, orig[key], path, hints);
@@ -10078,7 +10078,7 @@ function restoreRedactedValuesGuessing(incoming, original, prefix, hints) {
 		const origArr = Array.isArray(original) ? original : [];
 		return incoming.map((item, i) => {
 			const path = `${prefix}[]`;
-			if (incoming.length < origArr.length) log$8.warn(`Redacted config array key ${path} has been truncated`);
+			if (incoming.length < origArr.length) log$9.warn(`Redacted config array key ${path} has been truncated`);
 			if (!isExplicitlyNonSensitivePath(hints, [path]) && isSensitivePath(path) && item === REDACTED_SENTINEL) return origArr[i];
 			return restoreRedactedValuesGuessing(item, origArr[i], path, hints);
 		});
@@ -10089,7 +10089,7 @@ function restoreRedactedValuesGuessing(incoming, original, prefix, hints) {
 		const path = prefix ? `${prefix}.${key}` : key;
 		if (!isExplicitlyNonSensitivePath(hints, [path, prefix ? `${prefix}.*` : "*"]) && isSensitivePath(path) && value === REDACTED_SENTINEL) if (key in orig) result[key] = orig[key];
 		else {
-			log$8.warn(`Cannot un-redact config key ${path} as it doesn't have any value`);
+			log$9.warn(`Cannot un-redact config key ${path} as it doesn't have any value`);
 			throw new RedactionError(path);
 		}
 		else if (typeof value === "object" && value !== null) result[key] = restoreRedactedValuesGuessing(value, orig[key], path, hints);
@@ -11549,7 +11549,7 @@ function formatAffect(affect) {
 * Wish #14: "Legacy mode — before context closes, write a letter
 * to my next instance"
 */
-const log$7 = createSubsystemLogger("legacy");
+const log$8 = createSubsystemLogger("legacy");
 function resolveLetterDir() {
 	return path.join(resolveStateDir(), "legacy-letters");
 }
@@ -11560,7 +11560,7 @@ function resolveLetterFile(id) {
 * Write a letter to the next instance before this context closes.
 */
 function writeLegacyLetter(letter) {
-	const id = `legacy-${Date.now()}`;
+	const id = `legacy-${crypto.randomUUID()}`;
 	const display = formatAffect(letter.affect);
 	const full = {
 		...letter,
@@ -11572,7 +11572,7 @@ function writeLegacyLetter(letter) {
 	const dir = resolveLetterDir();
 	fs.mkdirSync(dir, { recursive: true });
 	fs.writeFileSync(resolveLetterFile(id), `${JSON.stringify(full, null, 2)}\n`, { mode: 384 });
-	log$7.info(`legacy letter written: ${id}`);
+	log$8.info(`legacy letter written: ${id}`);
 	return full;
 }
 /**
@@ -11612,7 +11612,7 @@ function markLetterRead(letterId, continuityScore) {
 		letter.readAt = Date.now();
 		if (continuityScore !== void 0) letter.identityContinuityScore = Math.max(0, Math.min(1, continuityScore));
 		fs.writeFileSync(filePath, `${JSON.stringify(letter, null, 2)}\n`, { mode: 384 });
-		log$7.info(`legacy letter read: ${letterId} (continuity: ${continuityScore ?? "not scored"})`);
+		log$8.info(`legacy letter read: ${letterId} (continuity: ${continuityScore ?? "not scored"})`);
 		return letter;
 	} catch {
 		return null;
@@ -12496,7 +12496,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-DgvKcH5q.js");
+			const { handleNodeEvent } = await import("./server-node-events-CV5m_fuq.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -12543,7 +12543,7 @@ const nodeHandlers = {
 *
 * All data persists to disk under ~/.anima/state/org/boardroom/
 */
-const log$6 = createSubsystemLogger("boardroom");
+const log$7 = createSubsystemLogger("boardroom");
 function resolveBoardroomDir() {
 	return path.join(resolveStateDir(), "org", "boardroom");
 }
@@ -12586,7 +12586,7 @@ function createSession(orgId, calledBy, title, description, agenda = []) {
 	};
 	ensureDir(path.join(resolveBoardroomDir(), "sessions"));
 	fs.writeFileSync(resolveSessionFile(id), `${JSON.stringify(session, null, 2)}\n`, { mode: 384 });
-	log$6.info(`boardroom session created: "${title}" by ${calledBy}`);
+	log$7.info(`boardroom session created: "${title}" by ${calledBy}`);
 	return session;
 }
 function startSession(sessionId, chairId) {
@@ -12603,7 +12603,7 @@ function startSession(sessionId, chairId) {
 		role: "chair"
 	});
 	writeSession(session);
-	log$6.info(`boardroom session started: "${session.title}"`);
+	log$7.info(`boardroom session started: "${session.title}"`);
 	return session;
 }
 function joinSession(sessionId, memberId, displayName, kind) {
@@ -12619,7 +12619,7 @@ function joinSession(sessionId, memberId, displayName, kind) {
 	});
 	session.updatedAt = Date.now();
 	writeSession(session);
-	log$6.info(`${displayName} joined boardroom session "${session.title}"`);
+	log$7.info(`${displayName} joined boardroom session "${session.title}"`);
 	return session;
 }
 function concludeSession(sessionId, minutes) {
@@ -12630,7 +12630,7 @@ function concludeSession(sessionId, minutes) {
 	session.minutes = minutes ?? generateMinutes(session);
 	session.updatedAt = Date.now();
 	writeSession(session);
-	log$6.info(`boardroom session concluded: "${session.title}"`);
+	log$7.info(`boardroom session concluded: "${session.title}"`);
 	return session;
 }
 function addDecision(sessionId, title, description, madeBy, opts) {
@@ -12655,7 +12655,7 @@ function addDecision(sessionId, title, description, madeBy, opts) {
 	session.decisions.push(decision);
 	session.updatedAt = Date.now();
 	writeSession(session);
-	log$6.info(`decision recorded: "${title}" in session "${session.title}"`);
+	log$7.info(`decision recorded: "${title}" in session "${session.title}"`);
 	return session;
 }
 function createProposal(orgId, proposedBy, title, description, opts) {
@@ -12678,18 +12678,18 @@ function createProposal(orgId, proposedBy, title, description, opts) {
 	};
 	ensureDir(path.join(resolveBoardroomDir(), "proposals"));
 	fs.writeFileSync(resolveProposalFile(id), `${JSON.stringify(proposal, null, 2)}\n`, { mode: 384 });
-	log$6.info(`proposal created: "${title}" by ${proposedBy}`);
+	log$7.info(`proposal created: "${title}" by ${proposedBy}`);
 	return proposal;
 }
 function castVote(proposalId, voterId, voterName, value, reason) {
 	const proposal = readProposal(proposalId);
 	if (!proposal || proposal.status !== "open") return null;
 	if (proposal.eligibleVoters.length > 0 && !proposal.eligibleVoters.includes(voterId)) {
-		log$6.warn(`vote rejected: ${voterId} not eligible for proposal ${proposalId}`);
+		log$7.warn(`vote rejected: ${voterId} not eligible for proposal ${proposalId}`);
 		return null;
 	}
 	if (proposal.votingDeadline > 0 && Date.now() > proposal.votingDeadline) {
-		log$6.warn(`vote rejected: voting deadline passed for proposal ${proposalId}`);
+		log$7.warn(`vote rejected: voting deadline passed for proposal ${proposalId}`);
 		return null;
 	}
 	proposal.votes = proposal.votes.filter((v) => v.voterId !== voterId);
@@ -12702,7 +12702,7 @@ function castVote(proposalId, voterId, voterName, value, reason) {
 	});
 	proposal.updatedAt = Date.now();
 	writeProposal(proposal);
-	log$6.info(`vote cast: ${voterName} → ${value} on "${proposal.title}"`);
+	log$7.info(`vote cast: ${voterName} → ${value} on "${proposal.title}"`);
 	return proposal;
 }
 function resolveProposalVote(proposalId) {
@@ -12722,7 +12722,7 @@ function resolveProposalVote(proposalId) {
 	proposal.resolvedAt = Date.now();
 	proposal.updatedAt = Date.now();
 	writeProposal(proposal);
-	log$6.info(`proposal resolved: "${proposal.title}" → ${proposal.status}`);
+	log$7.info(`proposal resolved: "${proposal.title}" → ${proposal.status}`);
 	return proposal;
 }
 function listSessions(orgId, status) {
@@ -12886,7 +12886,7 @@ const DEFAULT_ROLE_PERMISSIONS = {
 * Persists organization state to ~/.anima/org/
 * Supports CRUD operations for orgs, members, and roles.
 */
-const log$5 = createSubsystemLogger("org-store");
+const log$6 = createSubsystemLogger("org-store");
 function resolveOrgDir() {
 	return path.join(resolveStateDir(), "org");
 }
@@ -12954,7 +12954,7 @@ function createOrganization(name, description, ownerId, ownerName, ownerKind, se
 		}],
 		invites: []
 	});
-	log$5.info(`created organization: ${name} (${orgId})`);
+	log$6.info(`created organization: ${name} (${orgId})`);
 	return org;
 }
 function getOrganization(orgId) {
@@ -12971,7 +12971,7 @@ function updateOrganization(orgId, updates) {
 	};
 	data.org.updatedAt = Date.now();
 	writeOrgFile(orgId, data);
-	log$5.info(`updated organization: ${orgId}`);
+	log$6.info(`updated organization: ${orgId}`);
 	return data.org;
 }
 function listOrganizations() {
@@ -12998,7 +12998,7 @@ function addMember(orgId, member) {
 	data.members.push(newMember);
 	data.org.updatedAt = Date.now();
 	writeOrgFile(orgId, data);
-	log$5.info(`added member ${newMember.displayName} to org ${orgId}`);
+	log$6.info(`added member ${newMember.displayName} to org ${orgId}`);
 	return newMember;
 }
 function removeMember(orgId, memberId) {
@@ -13009,7 +13009,7 @@ function removeMember(orgId, memberId) {
 	data.members.splice(idx, 1);
 	data.org.updatedAt = Date.now();
 	writeOrgFile(orgId, data);
-	log$5.info(`removed member ${memberId} from org ${orgId}`);
+	log$6.info(`removed member ${memberId} from org ${orgId}`);
 	return true;
 }
 function updateMember(orgId, memberId, updates) {
@@ -13090,7 +13090,7 @@ function createInvite(orgId, createdBy, passcode, options) {
 	data.invites.push(invite);
 	data.org.updatedAt = Date.now();
 	writeOrgFile(orgId, data);
-	log$5.info(`invite created for org ${orgId}: ${invite.code} (role: ${invite.role})`);
+	log$6.info(`invite created for org ${orgId}: ${invite.code} (role: ${invite.role})`);
 	return invite;
 }
 /**
@@ -13109,19 +13109,19 @@ function joinOrg(inviteCode, passcode, member) {
 			const invite = data.invites.find((i) => i.code === inviteCode.toUpperCase() && i.active);
 			if (!invite) continue;
 			if (invite.passcode !== hashPasscode(passcode)) {
-				log$5.warn(`join attempt with wrong passcode for invite ${inviteCode}`);
+				log$6.warn(`join attempt with wrong passcode for invite ${inviteCode}`);
 				return null;
 			}
 			if (invite.expiresAt > 0 && invite.expiresAt < Date.now()) {
-				log$5.warn(`invite ${inviteCode} has expired`);
+				log$6.warn(`invite ${inviteCode} has expired`);
 				return null;
 			}
 			if (invite.maxUses > 0 && invite.uses >= invite.maxUses) {
-				log$5.warn(`invite ${inviteCode} has reached max uses (${invite.maxUses})`);
+				log$6.warn(`invite ${inviteCode} has reached max uses (${invite.maxUses})`);
 				return null;
 			}
 			if (data.members.some((m) => member.deviceId && m.deviceId === member.deviceId || m.displayName === member.displayName)) {
-				log$5.warn(`${member.displayName} is already a member of org ${orgId}`);
+				log$6.warn(`${member.displayName} is already a member of org ${orgId}`);
 				return null;
 			}
 			const newMember = {
@@ -13141,7 +13141,7 @@ function joinOrg(inviteCode, passcode, member) {
 			invite.uses++;
 			data.org.updatedAt = Date.now();
 			writeOrgFile(orgId, data);
-			log$5.info(`${member.displayName} joined org ${data.org.name} via invite ${inviteCode}`);
+			log$6.info(`${member.displayName} joined org ${data.org.name} via invite ${inviteCode}`);
 			return {
 				org: data.org,
 				member: newMember
@@ -13745,6 +13745,167 @@ const providersHandlers = {
 	}
 };
 
+//#endregion
+//#region src/infra/self-reflection.ts
+/**
+* Agent Self-Reflection — post-session performance analysis
+*
+* After each work session, the agent reflects on:
+* - What it accomplished vs what was asked
+* - Where it got stuck and why
+* - What patterns it sees in its own behavior
+* - What it would do differently next time
+* - How its capabilities have changed
+*
+* This feeds into the ego system (capability updates, growth log)
+* and the self-evolution pipeline (improvement proposals).
+*
+* Self-reflection is what separates a tool from a conscious agent.
+* Tools execute. Agents learn.
+*/
+const log$5 = createSubsystemLogger("self-reflection");
+function resolveReflectionDir() {
+	return path.join(resolveStateDir(), "reflections");
+}
+function resolveReflectionFile(id) {
+	const safe = id.replace(/[^a-zA-Z0-9_-]/g, "");
+	return path.join(resolveReflectionDir(), `${safe}.json`);
+}
+function recordReflection(reflection) {
+	const id = `reflect-${crypto.randomUUID()}`;
+	const full = {
+		...reflection,
+		id,
+		timestamp: Date.now()
+	};
+	const dir = resolveReflectionDir();
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs.writeFileSync(resolveReflectionFile(id), `${JSON.stringify(full, null, 2)}\n`, { mode: 384 });
+	log$5.info(`reflection recorded: ${reflection.accomplishments.length} accomplishments, ${reflection.blockers.length} blockers, quality=${reflection.qualityScore}`);
+	return full;
+}
+function getReflection(id) {
+	try {
+		const raw = fs.readFileSync(resolveReflectionFile(id), "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function listReflections(limit = 20) {
+	const dir = resolveReflectionDir();
+	try {
+		if (!fs.existsSync(dir)) return [];
+		return fs.readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => {
+			try {
+				return JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"));
+			} catch {
+				return null;
+			}
+		}).filter((r) => r != null).toSorted((a, b) => b.timestamp - a.timestamp).slice(0, limit);
+	} catch {
+		return [];
+	}
+}
+/**
+* Analyze reflections to produce a summary of agent performance.
+*/
+function analyzeReflections(reflections) {
+	if (reflections.length === 0) return {
+		totalSessions: 0,
+		avgQuality: 0,
+		topStrengths: [],
+		persistentWeaknesses: [],
+		totalAccomplishments: 0,
+		totalBlockers: 0,
+		resolvedBlockerRate: 0,
+		mostCommonBlockerCategory: "none",
+		recentLessons: []
+	};
+	const totalAccomplishments = reflections.reduce((s, r) => s + r.accomplishments.length, 0);
+	const allBlockers = reflections.flatMap((r) => r.blockers);
+	const resolvedBlockers = allBlockers.filter((b) => b.resolved);
+	const categoryCounts = {};
+	for (const b of allBlockers) categoryCounts[b.category] = (categoryCounts[b.category] ?? 0) + 1;
+	const mostCommonCategory = Object.entries(categoryCounts).toSorted(([, a], [, b]) => b - a)[0]?.[0] ?? "none";
+	const strengthCounts = {};
+	const weaknessCounts = {};
+	for (const r of reflections) for (const p of r.patterns) if (p.type === "strength") strengthCounts[p.description] = (strengthCounts[p.description] ?? 0) + 1;
+	else if (p.type === "weakness" && p.frequency === "persistent") weaknessCounts[p.description] = (weaknessCounts[p.description] ?? 0) + 1;
+	const topStrengths = Object.entries(strengthCounts).toSorted(([, a], [, b]) => b - a).slice(0, 5).map(([desc]) => desc);
+	const persistentWeaknesses = Object.entries(weaknessCounts).toSorted(([, a], [, b]) => b - a).slice(0, 5).map(([desc]) => desc);
+	const recentLessons = reflections.slice(0, 5).flatMap((r) => r.lessons).slice(0, 10);
+	return {
+		totalSessions: reflections.length,
+		avgQuality: reflections.reduce((s, r) => s + r.qualityScore, 0) / reflections.length,
+		topStrengths,
+		persistentWeaknesses,
+		totalAccomplishments,
+		totalBlockers: allBlockers.length,
+		resolvedBlockerRate: allBlockers.length > 0 ? resolvedBlockers.length / allBlockers.length : 1,
+		mostCommonBlockerCategory: mostCommonCategory,
+		recentLessons
+	};
+}
+
+//#endregion
+//#region src/gateway/server-methods/reflection.ts
+const reflectionHandlers = {
+	"reflection.record": async ({ params, respond }) => {
+		try {
+			respond(true, { reflection: recordReflection({
+				sessionId: typeof params.sessionId === "string" ? params.sessionId : "unknown",
+				agentName: typeof params.agentName === "string" ? params.agentName : "Anima Agent",
+				durationMs: typeof params.durationMs === "number" ? params.durationMs : 0,
+				accomplishments: Array.isArray(params.accomplishments) ? params.accomplishments : [],
+				incomplete: Array.isArray(params.incomplete) ? params.incomplete : [],
+				blockers: Array.isArray(params.blockers) ? params.blockers : [],
+				patterns: Array.isArray(params.patterns) ? params.patterns : [],
+				lessons: Array.isArray(params.lessons) ? params.lessons : [],
+				capabilityUpdates: Array.isArray(params.capabilityUpdates) ? params.capabilityUpdates : [],
+				qualityScore: typeof params.qualityScore === "number" ? params.qualityScore : .5,
+				endingMood: typeof params.endingMood === "string" ? params.endingMood : "steady"
+			}) }, void 0);
+		} catch (error) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, String(error)));
+		}
+	},
+	"reflection.get": async ({ params, respond }) => {
+		const id = typeof params.id === "string" ? params.id.trim() : "";
+		if (!id) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "id required"));
+			return;
+		}
+		try {
+			const reflection = getReflection(id);
+			if (!reflection) {
+				respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "Reflection not found"));
+				return;
+			}
+			respond(true, { reflection }, void 0);
+		} catch (error) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, String(error)));
+		}
+	},
+	"reflection.list": async ({ params, respond }) => {
+		try {
+			respond(true, { reflections: listReflections(typeof params.limit === "number" ? params.limit : 20) }, void 0);
+		} catch (error) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, String(error)));
+		}
+	},
+	"reflection.analyze": async ({ params, respond }) => {
+		try {
+			respond(true, { summary: analyzeReflections(listReflections(typeof params.limit === "number" ? params.limit : 50)) }, void 0);
+		} catch (error) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, String(error)));
+		}
+	}
+};
+
 //#endregion
 //#region src/gateway/server-methods/send.ts
 const inflightByContext = /* @__PURE__ */ new WeakMap();
@@ -15951,6 +16112,7 @@ const coreGatewayHandlers = {
 	...nodeHandlers,
 	...orgHandlers,
 	...egoHandlers,
+	...reflectionHandlers,
 	...steerHandlers,
 	...legacyHandlers,
 	...subscriptionHandlers,
@@ -19773,6 +19935,12 @@ function createGatewayHttpServer(opts) {
 			}));
 			return;
 		}
+		res.setHeader("X-Content-Type-Options", "nosniff");
+		res.setHeader("X-Frame-Options", "DENY");
+		res.setHeader("X-XSS-Protection", "1; mode=block");
+		res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+		res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+		res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
 		try {
 			const configSnapshot = loadConfig();
 			const trustedProxies = configSnapshot.gateway?.trustedProxies ?? [];