@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/cli/daemon-cli/restart-health.js

@@ -0,0 +1,126 @@
+import { classifyPortListener, formatPortDiagnostics, inspectPortUsage, } from "../../infra/ports.js";
+import { sleep } from "../../utils.js";
+export const DEFAULT_RESTART_HEALTH_ATTEMPTS = 8;
+export const DEFAULT_RESTART_HEALTH_DELAY_MS = 450;
+export async function inspectGatewayRestart(params) {
+    const env = params.env ?? process.env;
+    let runtime = { status: "unknown" };
+    try {
+        runtime = await params.service.readRuntime(env);
+    }
+    catch (err) {
+        runtime = { status: "unknown", detail: String(err) };
+    }
+    let portUsage;
+    try {
+        portUsage = await inspectPortUsage(params.port);
+    }
+    catch (err) {
+        portUsage = {
+            port: params.port,
+            status: "unknown",
+            listeners: [],
+            hints: [],
+            errors: [String(err)],
+        };
+    }
+    const gatewayListeners = portUsage.status === "busy"
+        ? portUsage.listeners.filter((listener) => classifyPortListener(listener, params.port) === "gateway")
+        : [];
+    const running = runtime.status === "running";
+    const ownsPort = runtime.pid != null
+        ? portUsage.listeners.some((listener) => listener.pid === runtime.pid)
+        : gatewayListeners.length > 0 ||
+            (portUsage.status === "busy" && portUsage.listeners.length === 0);
+    const healthy = running && ownsPort;
+    const staleGatewayPids = Array.from(new Set(gatewayListeners
+        .map((listener) => listener.pid)
+        .filter((pid) => Number.isFinite(pid))
+        .filter((pid) => runtime.pid == null || pid !== runtime.pid || !running)));
+    return {
+        runtime,
+        portUsage,
+        healthy,
+        staleGatewayPids,
+    };
+}
+export async function waitForGatewayHealthyRestart(params) {
+    const attempts = params.attempts ?? DEFAULT_RESTART_HEALTH_ATTEMPTS;
+    const delayMs = params.delayMs ?? DEFAULT_RESTART_HEALTH_DELAY_MS;
+    let snapshot = await inspectGatewayRestart({
+        service: params.service,
+        port: params.port,
+        env: params.env,
+    });
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        if (snapshot.healthy) {
+            return snapshot;
+        }
+        if (snapshot.staleGatewayPids.length > 0 && snapshot.runtime.status !== "running") {
+            return snapshot;
+        }
+        await sleep(delayMs);
+        snapshot = await inspectGatewayRestart({
+            service: params.service,
+            port: params.port,
+            env: params.env,
+        });
+    }
+    return snapshot;
+}
+export function renderRestartDiagnostics(snapshot) {
+    const lines = [];
+    const runtimeSummary = [
+        snapshot.runtime.status ? `status=${snapshot.runtime.status}` : null,
+        snapshot.runtime.state ? `state=${snapshot.runtime.state}` : null,
+        snapshot.runtime.pid != null ? `pid=${snapshot.runtime.pid}` : null,
+        snapshot.runtime.lastExitStatus != null ? `lastExit=${snapshot.runtime.lastExitStatus}` : null,
+    ]
+        .filter(Boolean)
+        .join(", ");
+    if (runtimeSummary) {
+        lines.push(`Service runtime: ${runtimeSummary}`);
+    }
+    if (snapshot.portUsage.status === "busy") {
+        lines.push(...formatPortDiagnostics(snapshot.portUsage));
+    }
+    else {
+        lines.push(`Gateway port ${snapshot.portUsage.port} status: ${snapshot.portUsage.status}.`);
+    }
+    if (snapshot.portUsage.errors?.length) {
+        lines.push(`Port diagnostics errors: ${snapshot.portUsage.errors.join("; ")}`);
+    }
+    return lines;
+}
+export async function terminateStaleGatewayPids(pids) {
+    const killed = [];
+    for (const pid of pids) {
+        try {
+            process.kill(pid, "SIGTERM");
+            killed.push(pid);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code !== "ESRCH") {
+                throw err;
+            }
+        }
+    }
+    if (killed.length === 0) {
+        return killed;
+    }
+    await sleep(400);
+    for (const pid of killed) {
+        try {
+            process.kill(pid, 0);
+            process.kill(pid, "SIGKILL");
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code !== "ESRCH") {
+                throw err;
+            }
+        }
+    }
+    return killed;
+}

package/dist/cli/daemon-cli/status.gather.js

@@ -1,19 +1,20 @@
 import { createConfigIO, resolveConfigPath, resolveGatewayPort, resolveStateDir, } from "../../config/config.js";
 import { readLastGatewayErrorLine } from "../../daemon/diagnostics.js";
 import { findExtraGatewayServices } from "../../daemon/inspect.js";
-import { findLegacyGatewayServices } from "../../daemon/legacy.js";
-import { resolveGatewayService } from "../../daemon/service.js";
 import { auditGatewayServiceConfig } from "../../daemon/service-audit.js";
+import { resolveGatewayService } from "../../daemon/service.js";
 import { resolveGatewayBindHost } from "../../gateway/net.js";
 import { formatPortDiagnostics, inspectPortUsage, } from "../../infra/ports.js";
 import { pickPrimaryTailnetIPv4 } from "../../infra/tailnet.js";
 import { probeGatewayStatus } from "./probe.js";
 import { normalizeListenerAddress, parsePortFromArgs, pickProbeHostForBind } from "./shared.js";
 function shouldReportPortUsage(status, rpcOk) {
-    if (status !== "busy")
+    if (status !== "busy") {
         return false;
-    if (rpcOk === true)
+    }
+    if (rpcOk === true) {
         return false;
+    }
     return true;
 }
 export async function gatherDaemonStatus(opts) {
@@ -73,7 +74,7 @@ export async function gatherDaemonStatus(opts) {
     const probeUrlOverride = typeof opts.rpc.url === "string" && opts.rpc.url.trim().length > 0 ? opts.rpc.url.trim() : null;
     const probeUrl = probeUrlOverride ?? `ws://${probeHost}:${daemonPort}`;
     const probeNote = !probeUrlOverride && bindMode === "lan"
-        ? "Local probe uses loopback (127.0.0.1). bind=lan listens on 0.0.0.0 (all interfaces); use a LAN IP for remote clients."
+        ? `bind=lan listens on 0.0.0.0 (all interfaces); probing via ${probeHost}.`
         : !probeUrlOverride && bindMode === "loopback"
             ? "Loopback-only gateway; only local clients can connect."
             : undefined;
@@ -98,20 +99,15 @@ export async function gatherDaemonStatus(opts) {
             hints: portCliDiagnostics.hints,
         }
         : undefined;
-    const legacyServices = await findLegacyGatewayServices(process.env).catch(() => []);
     const extraServices = await findExtraGatewayServices(process.env, { deep: Boolean(opts.deep) }).catch(() => []);
     const timeoutMsRaw = Number.parseInt(String(opts.rpc.timeout ?? "10000"), 10);
     const timeoutMs = Number.isFinite(timeoutMsRaw) && timeoutMsRaw > 0 ? timeoutMsRaw : 10_000;
     const rpc = opts.probe
         ? await probeGatewayStatus({
             url: probeUrl,
-            token: opts.rpc.token ||
-                mergedDaemonEnv.POOLBOT_GATEWAY_TOKEN ||
-                mergedDaemonEnv.CLAWDBOT_GATEWAY_TOKEN ||
-                daemonCfg.gateway?.auth?.token,
+            token: opts.rpc.token || mergedDaemonEnv.POOLBOT_GATEWAY_TOKEN || daemonCfg.gateway?.auth?.token,
             password: opts.rpc.password ||
                 mergedDaemonEnv.POOLBOT_GATEWAY_PASSWORD ||
-                mergedDaemonEnv.CLAWDBOT_GATEWAY_PASSWORD ||
                 daemonCfg.gateway?.auth?.password,
             timeoutMs,
             json: opts.rpc.json,
@@ -150,13 +146,13 @@ export async function gatherDaemonStatus(opts) {
         ...(portCliStatus ? { portCli: portCliStatus } : {}),
         lastError,
         ...(rpc ? { rpc: { ...rpc, url: probeUrl } } : {}),
-        legacyServices,
         extraServices,
     };
 }
 export function renderPortDiagnosticsForCli(status, rpcOk) {
-    if (!status.port || !shouldReportPortUsage(status.port.status, rpcOk))
+    if (!status.port || !shouldReportPortUsage(status.port.status, rpcOk)) {
         return [];
+    }
     return formatPortDiagnostics({
         port: status.port.port,
         status: status.port.status,

package/dist/cli/daemon-cli/status.print.js

@@ -42,7 +42,7 @@ export function printDaemonStatus(status, opts) {
     const warnText = (value) => colorize(rich, theme.warn, value);
     const errorText = (value) => colorize(rich, theme.error, value);
     const spacer = () => defaultRuntime.log("");
-    const { service, rpc, legacyServices, extraServices } = status;
+    const { service, rpc, extraServices } = status;
     const serviceStatus = service.loaded
         ? okText(service.loadedText)
         : warnText(service.notLoadedText);
@@ -213,14 +213,6 @@ export function printDaemonStatus(status, opts) {
         }
         spacer();
     }
-    if (legacyServices.length > 0) {
-        defaultRuntime.error(errorText("Legacy gateway services detected:"));
-        for (const svc of legacyServices) {
-            defaultRuntime.error(`- ${errorText(svc.label)} (${svc.detail})`);
-        }
-        defaultRuntime.error(errorText(`Cleanup: ${formatCliCommand("poolbot doctor")}`));
-        spacer();
-    }
     if (extraServices.length > 0) {
         defaultRuntime.error(errorText("Other gateway-like services detected (best effort):"));
         for (const svc of extraServices) {
@@ -231,7 +223,7 @@ export function printDaemonStatus(status, opts) {
         }
         spacer();
     }
-    if (legacyServices.length > 0 || extraServices.length > 0) {
+    if (extraServices.length > 0) {
         defaultRuntime.error(errorText("Recommendation: run a single gateway per machine for most setups. One gateway supports multiple agents (see docs: /gateway#multiple-gateways-same-host)."));
         defaultRuntime.error(errorText("If you need multiple gateways (e.g., a rescue bot on the same host), isolate ports + config/state (see docs: /gateway#multiple-gateways-same-host)."));
         spacer();

package/dist/cli/deps.js

@@ -1,28 +1,33 @@
-import { logWebSelfId, sendMessageWhatsApp } from "../channels/web/index.js";
-import { sendMessageDiscord } from "../discord/send.js";
-import { sendMessageIMessage } from "../imessage/send.js";
-import { sendMessageSignal } from "../signal/send.js";
-import { sendMessageSlack } from "../slack/send.js";
-import { sendMessageTelegram } from "../telegram/send.js";
+import { createOutboundSendDepsFromCliSource } from "./outbound-send-mapping.js";
 export function createDefaultDeps() {
     return {
-        sendMessageWhatsApp,
-        sendMessageTelegram,
-        sendMessageDiscord,
-        sendMessageSlack,
-        sendMessageSignal,
-        sendMessageIMessage,
+        sendMessageWhatsApp: async (...args) => {
+            const { sendMessageWhatsApp } = await import("../channels/web/index.js");
+            return await sendMessageWhatsApp(...args);
+        },
+        sendMessageTelegram: async (...args) => {
+            const { sendMessageTelegram } = await import("../telegram/send.js");
+            return await sendMessageTelegram(...args);
+        },
+        sendMessageDiscord: async (...args) => {
+            const { sendMessageDiscord } = await import("../discord/send.js");
+            return await sendMessageDiscord(...args);
+        },
+        sendMessageSlack: async (...args) => {
+            const { sendMessageSlack } = await import("../slack/send.js");
+            return await sendMessageSlack(...args);
+        },
+        sendMessageSignal: async (...args) => {
+            const { sendMessageSignal } = await import("../signal/send.js");
+            return await sendMessageSignal(...args);
+        },
+        sendMessageIMessage: async (...args) => {
+            const { sendMessageIMessage } = await import("../imessage/send.js");
+            return await sendMessageIMessage(...args);
+        },
     };
 }
-// Provider docking: extend this mapping when adding new outbound send deps.
 export function createOutboundSendDeps(deps) {
-    return {
-        sendWhatsApp: deps.sendMessageWhatsApp,
-        sendTelegram: deps.sendMessageTelegram,
-        sendDiscord: deps.sendMessageDiscord,
-        sendSlack: deps.sendMessageSlack,
-        sendSignal: deps.sendMessageSignal,
-        sendIMessage: deps.sendMessageIMessage,
-    };
+    return createOutboundSendDepsFromCliSource(deps);
 }
-export { logWebSelfId };
+export { logWebSelfId } from "../web/auth-store.js";

package/dist/cli/exec-approvals-cli.js

@@ -1,26 +1,14 @@
 import fs from "node:fs/promises";
 import JSON5 from "json5";
 import { readExecApprovalsSnapshot, saveExecApprovals, } from "../infra/exec-approvals.js";
+import { formatTimeAgo } from "../infra/format-time/format-relative.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { isRich, theme } from "../terminal/theme.js";
 import { renderTable } from "../terminal/table.js";
-import { callGatewayFromCli } from "./gateway-rpc.js";
+import { isRich, theme } from "../terminal/theme.js";
 import { describeUnknownError } from "./gateway-cli/shared.js";
+import { callGatewayFromCli } from "./gateway-rpc.js";
 import { nodesCallOpts, resolveNodeId } from "./nodes-cli/rpc.js";
-function formatAge(msAgo) {
-    const s = Math.max(0, Math.floor(msAgo / 1000));
-    if (s < 60)
-        return `${s}s`;
-    const m = Math.floor(s / 60);
-    if (m < 60)
-        return `${m}m`;
-    const h = Math.floor(m / 60);
-    if (h < 24)
-        return `${h}h`;
-    const d = Math.floor(h / 24);
-    return `${d}d`;
-}
 async function readStdin() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -29,11 +17,13 @@ async function readStdin() {
     return Buffer.concat(chunks).toString("utf8");
 }
 async function resolveTargetNodeId(opts) {
-    if (opts.gateway)
+    if (opts.gateway) {
         return null;
+    }
     const raw = opts.node?.trim() ?? "";
-    if (!raw)
+    if (!raw) {
         return null;
+    }
     return await resolveNodeId(opts, raw);
 }
 async function loadSnapshot(opts, nodeId) {
@@ -63,6 +53,41 @@ async function loadSnapshotTarget(opts) {
     const snapshot = await loadSnapshot(opts, nodeId);
     return { snapshot, nodeId, source: nodeId ? "node" : "gateway" };
 }
+function exitWithError(message) {
+    defaultRuntime.error(message);
+    defaultRuntime.exit(1);
+    throw new Error(message);
+}
+function requireTrimmedNonEmpty(value, message) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        exitWithError(message);
+    }
+    return trimmed;
+}
+async function loadWritableSnapshotTarget(opts) {
+    const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
+    if (source === "local") {
+        defaultRuntime.log(theme.muted("Writing local approvals."));
+    }
+    const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
+    const baseHash = snapshot.hash;
+    if (!baseHash) {
+        exitWithError("Exec approvals hash missing; reload and retry.");
+    }
+    return { snapshot, nodeId, source, targetLabel, baseHash };
+}
+async function saveSnapshotTargeted(params) {
+    const next = params.source === "local"
+        ? saveSnapshotLocal(params.file)
+        : await saveSnapshot(params.opts, params.nodeId, params.file, params.baseHash);
+    if (params.opts.json) {
+        defaultRuntime.log(JSON.stringify(next));
+        return;
+    }
+    defaultRuntime.log(theme.muted(`Target: ${params.targetLabel}`));
+    renderApprovalsSnapshot(next, params.targetLabel);
+}
 function formatCliError(err) {
     const msg = describeUnknownError(err);
     return msg.includes("\n") ? msg.split("\n")[0] : msg;
@@ -89,14 +114,15 @@ function renderApprovalsSnapshot(snapshot, targetLabel) {
         const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
         for (const entry of allowlist) {
             const pattern = entry?.pattern?.trim() ?? "";
-            if (!pattern)
+            if (!pattern) {
                 continue;
+            }
             const lastUsedAt = typeof entry.lastUsedAt === "number" ? entry.lastUsedAt : null;
             allowlistRows.push({
                 Target: targetLabel,
                 Agent: agentId,
                 Pattern: pattern,
-                LastUsed: lastUsedAt ? `${formatAge(Math.max(0, now - lastUsedAt))} ago` : muted("unknown"),
+                LastUsed: lastUsedAt ? formatTimeAgo(Math.max(0, now - lastUsedAt)) : muted("unknown"),
             });
         }
     }
@@ -166,6 +192,37 @@ function isEmptyAgent(agent) {
         agent.autoAllowSkills === undefined &&
         allowlist.length === 0);
 }
+async function loadWritableAllowlistAgent(opts) {
+    const { snapshot, nodeId, source, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
+    const file = snapshot.file ?? { version: 1 };
+    file.version = 1;
+    const agentKey = resolveAgentKey(opts.agent);
+    const agent = ensureAgent(file, agentKey);
+    const allowlistEntries = Array.isArray(agent.allowlist) ? agent.allowlist : [];
+    return { nodeId, source, targetLabel, baseHash, file, agentKey, agent, allowlistEntries };
+}
+async function runAllowlistMutation(pattern, opts, mutate) {
+    try {
+        const trimmedPattern = requireTrimmedNonEmpty(pattern, "Pattern required.");
+        const context = await loadWritableAllowlistAgent(opts);
+        const shouldSave = await mutate({ ...context, trimmedPattern });
+        if (!shouldSave) {
+            return;
+        }
+        await saveSnapshotTargeted({
+            opts,
+            source: context.source,
+            nodeId: context.nodeId,
+            file: context.file,
+            baseHash: context.baseHash,
+            targetLabel: context.targetLabel,
+        });
+    }
+    catch (err) {
+        defaultRuntime.error(formatCliError(err));
+        defaultRuntime.exit(1);
+    }
+}
 export function registerExecApprovalsCli(program) {
     const formatExample = (cmd, desc) => `  ${theme.command(cmd)}\n    ${theme.muted(desc)}`;
     const approvals = program
@@ -209,45 +266,22 @@ export function registerExecApprovalsCli(program) {
         .action(async (opts) => {
         try {
             if (!opts.file && !opts.stdin) {
-                defaultRuntime.error("Provide --file or --stdin.");
-                defaultRuntime.exit(1);
-                return;
+                exitWithError("Provide --file or --stdin.");
             }
             if (opts.file && opts.stdin) {
-                defaultRuntime.error("Use either --file or --stdin (not both).");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-            if (source === "local") {
-                defaultRuntime.log(theme.muted("Writing local approvals."));
-            }
-            const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-            if (!snapshot.hash) {
-                defaultRuntime.error("Exec approvals hash missing; reload and retry.");
-                defaultRuntime.exit(1);
-                return;
+                exitWithError("Use either --file or --stdin (not both).");
             }
+            const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
             const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
             let file;
             try {
                 file = JSON5.parse(raw);
             }
             catch (err) {
-                defaultRuntime.error(`Failed to parse approvals JSON: ${String(err)}`);
-                defaultRuntime.exit(1);
-                return;
+                exitWithError(`Failed to parse approvals JSON: ${String(err)}`);
             }
             file.version = 1;
-            const next = source === "local"
-                ? saveSnapshotLocal(file)
-                : await saveSnapshot(opts, nodeId, file, snapshot.hash);
-            if (opts.json) {
-                defaultRuntime.log(JSON.stringify(next));
-                return;
-            }
-            defaultRuntime.log(theme.muted(`Target: ${targetLabel}`));
-            renderApprovalsSnapshot(next, targetLabel);
+            await saveSnapshotTargeted({ opts, source, nodeId, file, baseHash, targetLabel });
         }
         catch (err) {
             defaultRuntime.error(formatCliError(err));
@@ -266,49 +300,16 @@ export function registerExecApprovalsCli(program) {
         .option("--gateway", "Force gateway approvals", false)
         .option("--agent <id>", 'Agent id (defaults to "*")')
         .action(async (pattern, opts) => {
-        try {
-            const trimmed = pattern.trim();
-            if (!trimmed) {
-                defaultRuntime.error("Pattern required.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-            if (source === "local") {
-                defaultRuntime.log(theme.muted("Writing local approvals."));
-            }
-            const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-            if (!snapshot.hash) {
-                defaultRuntime.error("Exec approvals hash missing; reload and retry.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const file = snapshot.file ?? { version: 1 };
-            file.version = 1;
-            const agentKey = resolveAgentKey(opts.agent);
-            const agent = ensureAgent(file, agentKey);
-            const allowlistEntries = Array.isArray(agent.allowlist) ? agent.allowlist : [];
-            if (allowlistEntries.some((entry) => normalizeAllowlistEntry(entry) === trimmed)) {
+        await runAllowlistMutation(pattern, opts, ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
+            if (allowlistEntries.some((entry) => normalizeAllowlistEntry(entry) === trimmedPattern)) {
                 defaultRuntime.log("Already allowlisted.");
-                return;
+                return false;
             }
-            allowlistEntries.push({ pattern: trimmed, lastUsedAt: Date.now() });
+            allowlistEntries.push({ pattern: trimmedPattern, lastUsedAt: Date.now() });
             agent.allowlist = allowlistEntries;
             file.agents = { ...file.agents, [agentKey]: agent };
-            const next = source === "local"
-                ? saveSnapshotLocal(file)
-                : await saveSnapshot(opts, nodeId, file, snapshot.hash);
-            if (opts.json) {
-                defaultRuntime.log(JSON.stringify(next));
-                return;
-            }
-            defaultRuntime.log(theme.muted(`Target: ${targetLabel}`));
-            renderApprovalsSnapshot(next, targetLabel);
-        }
-        catch (err) {
-            defaultRuntime.error(formatCliError(err));
-            defaultRuntime.exit(1);
-        }
+            return true;
+        });
     });
     nodesCallOpts(allowlistAdd);
     const allowlistRemove = allowlist
@@ -318,32 +319,11 @@ export function registerExecApprovalsCli(program) {
         .option("--gateway", "Force gateway approvals", false)
         .option("--agent <id>", 'Agent id (defaults to "*")')
         .action(async (pattern, opts) => {
-        try {
-            const trimmed = pattern.trim();
-            if (!trimmed) {
-                defaultRuntime.error("Pattern required.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-            if (source === "local") {
-                defaultRuntime.log(theme.muted("Writing local approvals."));
-            }
-            const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-            if (!snapshot.hash) {
-                defaultRuntime.error("Exec approvals hash missing; reload and retry.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const file = snapshot.file ?? { version: 1 };
-            file.version = 1;
-            const agentKey = resolveAgentKey(opts.agent);
-            const agent = ensureAgent(file, agentKey);
-            const allowlistEntries = Array.isArray(agent.allowlist) ? agent.allowlist : [];
-            const nextEntries = allowlistEntries.filter((entry) => normalizeAllowlistEntry(entry) !== trimmed);
+        await runAllowlistMutation(pattern, opts, ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
+            const nextEntries = allowlistEntries.filter((entry) => normalizeAllowlistEntry(entry) !== trimmedPattern);
             if (nextEntries.length === allowlistEntries.length) {
                 defaultRuntime.log("Pattern not found.");
-                return;
+                return false;
             }
             if (nextEntries.length === 0) {
                 delete agent.allowlist;
@@ -359,20 +339,8 @@ export function registerExecApprovalsCli(program) {
             else {
                 file.agents = { ...file.agents, [agentKey]: agent };
             }
-            const next = source === "local"
-                ? saveSnapshotLocal(file)
-                : await saveSnapshot(opts, nodeId, file, snapshot.hash);
-            if (opts.json) {
-                defaultRuntime.log(JSON.stringify(next));
-                return;
-            }
-            defaultRuntime.log(theme.muted(`Target: ${targetLabel}`));
-            renderApprovalsSnapshot(next, targetLabel);
-        }
-        catch (err) {
-            defaultRuntime.error(formatCliError(err));
-            defaultRuntime.exit(1);
-        }
+            return true;
+        });
     });
     nodesCallOpts(allowlistRemove);
 }

package/dist/cli/gateway-cli/run-loop.js

@@ -1,5 +1,6 @@
 import { acquireGatewayLock } from "../../infra/gateway-lock.js";
-import { consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, } from "../../infra/restart.js";
+import { restartGatewayProcessWithFreshPid } from "../../infra/process-respawn.js";
+import { consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, markGatewaySigusr1RestartHandled, } from "../../infra/restart.js";
 import { createSubsystemLogger } from "../../logging/subsystem.js";
 import { getActiveTaskCount, resetAllLanes, waitForActiveTasks, } from "../../process/command-queue.js";
 import { createRestartIterationHook } from "../../process/restart-recovery.js";
@@ -60,9 +61,25 @@ export async function runGatewayLoop(params) {
                 clearTimeout(forceExitTimer);
                 server = null;
                 if (isRestart) {
-                    // In-process restart (no process-respawn in pool-bot).
-                    shuttingDown = false;
-                    restartResolver?.();
+                    const respawn = restartGatewayProcessWithFreshPid();
+                    if (respawn.mode === "spawned" || respawn.mode === "supervised") {
+                        const modeLabel = respawn.mode === "spawned"
+                            ? `spawned pid ${respawn.pid ?? "unknown"}`
+                            : "supervisor restart";
+                        gatewayLog.info(`restart mode: full process restart (${modeLabel})`);
+                        cleanupSignals();
+                        params.runtime.exit(0);
+                    }
+                    else {
+                        if (respawn.mode === "failed") {
+                            gatewayLog.warn(`full process restart failed (${respawn.detail ?? "unknown error"}); falling back to in-process restart`);
+                        }
+                        else {
+                            gatewayLog.info("restart mode: in-process restart (POOLBOT_NO_RESPAWN)");
+                        }
+                        shuttingDown = false;
+                        restartResolver?.();
+                    }
                 }
                 else {
                     cleanupSignals();
@@ -83,9 +100,10 @@ export async function runGatewayLoop(params) {
         gatewayLog.info("signal SIGUSR1 received");
         const authorized = consumeGatewaySigusr1RestartAuthorization();
         if (!authorized && !isGatewaySigusr1RestartExternallyAllowed()) {
-            gatewayLog.warn("SIGUSR1 restart ignored (not authorized; enable commands.restart or use gateway tool).");
+            gatewayLog.warn("SIGUSR1 restart ignored (not authorized; commands.restart=false or use gateway tool).");
             return;
         }
+        markGatewaySigusr1RestartHandled();
         request("restart", "SIGUSR1");
     };
     process.on("SIGTERM", onSigterm);