@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/gateway/server-methods/usage.js

@@ -1,32 +1,122 @@
 import fs from "node:fs";
 import { loadConfig } from "../../config/config.js";
-import { resolveSessionFilePath } from "../../config/sessions/paths.js";
+import { resolveSessionFilePath, resolveSessionFilePathOptions, } from "../../config/sessions/paths.js";
 import { loadProviderUsageSummary } from "../../infra/provider-usage.js";
 import { loadCostUsageSummary, loadSessionCostSummary, loadSessionUsageTimeSeries, discoverAllSessions, } from "../../infra/session-cost-usage.js";
 import { parseAgentSessionKey } from "../../routing/session-key.js";
+import { buildUsageAggregateTail } from "../../shared/usage-aggregates.js";
 import { ErrorCodes, errorShape, formatValidationErrors, validateSessionsUsageParams, } from "../protocol/index.js";
 import { listAgentsForGateway, loadCombinedSessionStoreForGateway, loadSessionEntry, } from "../session-utils.js";
 const COST_USAGE_CACHE_TTL_MS = 30_000;
+const DAY_MS = 24 * 60 * 60 * 1000;
 const costUsageCache = new Map();
+function resolveSessionUsageFileOrRespond(key, respond) {
+    const config = loadConfig();
+    const { entry, storePath } = loadSessionEntry(key);
+    // For discovered sessions (not in store), try using key as sessionId directly
+    const parsed = parseAgentSessionKey(key);
+    const agentId = parsed?.agentId;
+    const rawSessionId = parsed?.rest ?? key;
+    const sessionId = entry?.sessionId ?? rawSessionId;
+    let sessionFile;
+    try {
+        const pathOpts = resolveSessionFilePathOptions({ storePath, agentId });
+        sessionFile = resolveSessionFilePath(sessionId, entry, pathOpts);
+    }
+    catch {
+        respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session key: ${key}`));
+        return null;
+    }
+    return { config, entry, agentId, sessionId, sessionFile };
+}
+const parseDateParts = (raw) => {
+    if (typeof raw !== "string" || !raw.trim()) {
+        return undefined;
+    }
+    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(raw.trim());
+    if (!match) {
+        return undefined;
+    }
+    const [, yearStr, monthStr, dayStr] = match;
+    const year = Number(yearStr);
+    const monthIndex = Number(monthStr) - 1;
+    const day = Number(dayStr);
+    if (!Number.isFinite(year) || !Number.isFinite(monthIndex) || !Number.isFinite(day)) {
+        return undefined;
+    }
+    return { year, monthIndex, day };
+};
 /**
- * Parse a date string (YYYY-MM-DD) to start of day timestamp in UTC.
- * Returns undefined if invalid.
+ * Parse a UTC offset string in the format UTC+H, UTC-H, UTC+HH, UTC-HH, UTC+H:MM, UTC-HH:MM.
+ * Returns the UTC offset in minutes (east-positive), or undefined if invalid.
  */
-const parseDateToMs = (raw) => {
+const parseUtcOffsetToMinutes = (raw) => {
     if (typeof raw !== "string" || !raw.trim()) {
         return undefined;
     }
-    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(raw.trim());
+    const match = /^UTC([+-])(\d{1,2})(?::([0-5]\d))?$/.exec(raw.trim());
     if (!match) {
         return undefined;
     }
-    const [, year, month, day] = match;
-    // Use UTC to ensure consistent behavior across timezones
-    const ms = Date.UTC(parseInt(year), parseInt(month) - 1, parseInt(day));
-    if (Number.isNaN(ms)) {
+    const sign = match[1] === "+" ? 1 : -1;
+    const hours = Number(match[2]);
+    const minutes = Number(match[3] ?? "0");
+    if (!Number.isInteger(hours) || !Number.isInteger(minutes)) {
+        return undefined;
+    }
+    if (hours > 14 || (hours === 14 && minutes !== 0)) {
+        return undefined;
+    }
+    const totalMinutes = sign * (hours * 60 + minutes);
+    if (totalMinutes < -12 * 60 || totalMinutes > 14 * 60) {
+        return undefined;
+    }
+    return totalMinutes;
+};
+const resolveDateInterpretation = (params) => {
+    if (params.mode === "gateway") {
+        return { mode: "gateway" };
+    }
+    if (params.mode === "specific") {
+        const utcOffsetMinutes = parseUtcOffsetToMinutes(params.utcOffset);
+        if (utcOffsetMinutes !== undefined) {
+            return { mode: "specific", utcOffsetMinutes };
+        }
+    }
+    // Backward compatibility: when mode is missing (or invalid), keep current UTC interpretation.
+    return { mode: "utc" };
+};
+/**
+ * Parse a date string (YYYY-MM-DD) to start-of-day timestamp based on interpretation mode.
+ * Returns undefined if invalid.
+ */
+const parseDateToMs = (raw, interpretation = { mode: "utc" }) => {
+    const parts = parseDateParts(raw);
+    if (!parts) {
         return undefined;
     }
-    return ms;
+    const { year, monthIndex, day } = parts;
+    if (interpretation.mode === "gateway") {
+        const ms = new Date(year, monthIndex, day).getTime();
+        return Number.isNaN(ms) ? undefined : ms;
+    }
+    if (interpretation.mode === "specific") {
+        const ms = Date.UTC(year, monthIndex, day) - interpretation.utcOffsetMinutes * 60 * 1000;
+        return Number.isNaN(ms) ? undefined : ms;
+    }
+    const ms = Date.UTC(year, monthIndex, day);
+    return Number.isNaN(ms) ? undefined : ms;
+};
+const getTodayStartMs = (now, interpretation) => {
+    if (interpretation.mode === "gateway") {
+        return new Date(now.getFullYear(), now.getMonth(), now.getDate()).getTime();
+    }
+    if (interpretation.mode === "specific") {
+        const shifted = new Date(now.getTime() + interpretation.utcOffsetMinutes * 60 * 1000);
+        return (Date.UTC(shifted.getUTCFullYear(), shifted.getUTCMonth(), shifted.getUTCDate()) -
+            interpretation.utcOffsetMinutes * 60 * 1000);
+    }
+    return Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
 };
 const parseDays = (raw) => {
     if (typeof raw === "number" && Number.isFinite(raw)) {
@@ -46,25 +136,34 @@ const parseDays = (raw) => {
  */
 const parseDateRange = (params) => {
     const now = new Date();
-    // Use UTC for consistent date handling
-    const todayStartMs = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
-    const todayEndMs = todayStartMs + 24 * 60 * 60 * 1000 - 1;
-    const startMs = parseDateToMs(params.startDate);
-    const endMs = parseDateToMs(params.endDate);
+    const interpretation = resolveDateInterpretation(params);
+    const todayStartMs = getTodayStartMs(now, interpretation);
+    const todayEndMs = todayStartMs + DAY_MS - 1;
+    const startMs = parseDateToMs(params.startDate, interpretation);
+    const endMs = parseDateToMs(params.endDate, interpretation);
     if (startMs !== undefined && endMs !== undefined) {
         // endMs should be end of day
-        return { startMs, endMs: endMs + 24 * 60 * 60 * 1000 - 1 };
+        return { startMs, endMs: endMs + DAY_MS - 1 };
     }
     const days = parseDays(params.days);
     if (days !== undefined) {
         const clampedDays = Math.max(1, days);
-        const start = todayStartMs - (clampedDays - 1) * 24 * 60 * 60 * 1000;
+        const start = todayStartMs - (clampedDays - 1) * DAY_MS;
         return { startMs: start, endMs: todayEndMs };
     }
     // Default to last 30 days
-    const defaultStartMs = todayStartMs - 29 * 24 * 60 * 60 * 1000;
+    const defaultStartMs = todayStartMs - 29 * DAY_MS;
     return { startMs: defaultStartMs, endMs: todayEndMs };
 };
+function buildStoreBySessionId(store) {
+    const storeBySessionId = new Map();
+    for (const [key, entry] of Object.entries(store)) {
+        if (entry?.sessionId) {
+            storeBySessionId.set(entry.sessionId, { key, entry });
+        }
+    }
+    return storeBySessionId;
+}
 async function discoverAllSessionsForUsage(params) {
     const agents = listAgentsForGateway(params.config).agents;
     const results = await Promise.all(agents.map(async (agent) => {
@@ -122,7 +221,11 @@ async function loadCostUsageSummaryCached(params) {
 }
 // Exposed for unit tests (kept as a single export to avoid widening the public API surface).
 export const __test = {
+    parseDateParts,
+    parseUtcOffsetToMinutes,
+    resolveDateInterpretation,
     parseDateToMs,
+    getTodayStartMs,
     parseDays,
     parseDateRange,
     discoverAllSessionsForUsage,
@@ -140,6 +243,8 @@ export const usageHandlers = {
             startDate: params?.startDate,
             endDate: params?.endDate,
             days: params?.days,
+            mode: params?.mode,
+            utcOffset: params?.utcOffset,
         });
         const summary = await loadCostUsageSummaryCached({ startMs, endMs, config });
         respond(true, summary, undefined);
@@ -154,12 +259,14 @@ export const usageHandlers = {
         const { startMs, endMs } = parseDateRange({
             startDate: p.startDate,
             endDate: p.endDate,
+            mode: p.mode,
+            utcOffset: p.utcOffset,
         });
         const limit = typeof p.limit === "number" && Number.isFinite(p.limit) ? p.limit : 50;
         const includeContextWeight = p.includeContextWeight ?? false;
         const specificKey = typeof p.key === "string" ? p.key.trim() : null;
         // Load session store for named sessions
-        const { store } = loadCombinedSessionStoreForGateway(config);
+        const { storePath, store } = loadCombinedSessionStoreForGateway(config);
         const now = Date.now();
         const mergedEntries = [];
         // Optimization: If a specific key is requested, skip full directory scan
@@ -169,12 +276,7 @@ export const usageHandlers = {
             const keyRest = parsed?.rest ?? specificKey;
             // Prefer the store entry when available, even if the caller provides a discovered key
             // (`agent:<id>:<sessionId>`) for a session that now has a canonical store key.
-            const storeBySessionId = new Map();
-            for (const [key, entry] of Object.entries(store)) {
-                if (entry?.sessionId) {
-                    storeBySessionId.set(entry.sessionId, { key, entry });
-                }
-            }
+            const storeBySessionId = buildStoreBySessionId(store);
             const storeMatch = store[specificKey]
                 ? { key: specificKey, entry: store[specificKey] }
                 : null;
@@ -183,9 +285,18 @@ export const usageHandlers = {
             const storeEntry = storeMatch?.entry ?? storeByIdMatch?.entry;
             const sessionId = storeEntry?.sessionId ?? keyRest;
             // Resolve the session file path
-            const sessionFile = resolveSessionFilePath(sessionId, storeEntry, {
-                agentId: agentIdFromKey,
-            });
+            let sessionFile;
+            try {
+                const pathOpts = resolveSessionFilePathOptions({
+                    storePath: storePath !== "(multiple)" ? storePath : undefined,
+                    agentId: agentIdFromKey,
+                });
+                sessionFile = resolveSessionFilePath(sessionId, storeEntry, pathOpts);
+            }
+            catch {
+                respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session reference: ${specificKey}`));
+                return;
+            }
             try {
                 const stats = fs.statSync(sessionFile);
                 if (stats.isFile()) {
@@ -211,12 +322,7 @@ export const usageHandlers = {
                 endMs,
             });
             // Build a map of sessionId -> store entry for quick lookup
-            const storeBySessionId = new Map();
-            for (const [key, entry] of Object.entries(store)) {
-                if (entry?.sessionId) {
-                    storeBySessionId.set(entry.sessionId, { key, entry });
-                }
-            }
+            const storeBySessionId = buildStoreBySessionId(store);
             for (const discovered of discoveredSessions) {
                 const storeMatch = storeBySessionId.get(discovered.sessionId);
                 if (storeMatch) {
@@ -312,11 +418,13 @@ export const usageHandlers = {
             target.missingCostEntries += source.missingCostEntries;
         };
         for (const merged of limitedEntries) {
+            const agentId = parseAgentSessionKey(merged.key)?.agentId;
             const usage = await loadSessionCostSummary({
                 sessionId: merged.sessionId,
                 sessionEntry: merged.storeEntry,
                 sessionFile: merged.sessionFile,
                 config,
+                agentId,
                 startMs,
                 endMs,
             });
@@ -333,7 +441,6 @@ export const usageHandlers = {
                 aggregateTotals.cacheWriteCost += usage.cacheWriteCost;
                 aggregateTotals.missingCostEntries += usage.missingCostEntries;
             }
-            const agentId = parseAgentSessionKey(merged.key)?.agentId;
             const channel = merged.storeEntry?.channel ?? merged.storeEntry?.origin?.provider;
             const chatType = merged.storeEntry?.chatType ?? merged.storeEntry?.origin?.chatType;
             if (usage) {
@@ -488,6 +595,13 @@ export const usageHandlers = {
             const d = new Date(ms);
             return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}-${String(d.getUTCDate()).padStart(2, "0")}`;
         };
+        const tail = buildUsageAggregateTail({
+            byChannelMap: byChannelMap,
+            latencyTotals,
+            dailyLatencyMap,
+            modelDailyMap,
+            dailyMap: dailyAggregateMap,
+        });
         const aggregates = {
             messages: aggregateMessages,
             tools: {
@@ -514,30 +628,7 @@ export const usageHandlers = {
             byAgent: Array.from(byAgentMap.entries())
                 .map(([id, totals]) => ({ agentId: id, totals }))
                 .toSorted((a, b) => b.totals.totalCost - a.totals.totalCost),
-            byChannel: Array.from(byChannelMap.entries())
-                .map(([name, totals]) => ({ channel: name, totals }))
-                .toSorted((a, b) => b.totals.totalCost - a.totals.totalCost),
-            latency: latencyTotals.count > 0
-                ? {
-                    count: latencyTotals.count,
-                    avgMs: latencyTotals.sum / latencyTotals.count,
-                    minMs: latencyTotals.min === Number.POSITIVE_INFINITY ? 0 : latencyTotals.min,
-                    maxMs: latencyTotals.max,
-                    p95Ms: latencyTotals.p95Max,
-                }
-                : undefined,
-            dailyLatency: Array.from(dailyLatencyMap.values())
-                .map((entry) => ({
-                date: entry.date,
-                count: entry.count,
-                avgMs: entry.count ? entry.sum / entry.count : 0,
-                minMs: entry.min === Number.POSITIVE_INFINITY ? 0 : entry.min,
-                maxMs: entry.max,
-                p95Ms: entry.p95Max,
-            }))
-                .toSorted((a, b) => a.date.localeCompare(b.date)),
-            modelDaily: Array.from(modelDailyMap.values()).toSorted((a, b) => a.date.localeCompare(b.date) || b.cost - a.cost),
-            daily: Array.from(dailyAggregateMap.values()).toSorted((a, b) => a.date.localeCompare(b.date)),
+            ...tail,
         };
         const result = {
             updatedAt: now,
@@ -555,19 +646,17 @@ export const usageHandlers = {
             respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, "key is required for timeseries"));
             return;
         }
-        const config = loadConfig();
-        const { entry } = loadSessionEntry(key);
-        // For discovered sessions (not in store), try using key as sessionId directly
-        const parsed = parseAgentSessionKey(key);
-        const agentId = parsed?.agentId;
-        const rawSessionId = parsed?.rest ?? key;
-        const sessionId = entry?.sessionId ?? rawSessionId;
-        const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId });
+        const resolved = resolveSessionUsageFileOrRespond(key, respond);
+        if (!resolved) {
+            return;
+        }
+        const { config, entry, agentId, sessionId, sessionFile } = resolved;
         const timeseries = await loadSessionUsageTimeSeries({
             sessionId,
             sessionEntry: entry,
             sessionFile,
             config,
+            agentId,
             maxPoints: 200,
         });
         if (!timeseries) {
@@ -585,20 +674,18 @@ export const usageHandlers = {
         const limit = typeof params?.limit === "number" && Number.isFinite(params.limit)
             ? Math.min(params.limit, 1000)
             : 200;
-        const config = loadConfig();
-        const { entry } = loadSessionEntry(key);
-        // For discovered sessions (not in store), try using key as sessionId directly
-        const parsed = parseAgentSessionKey(key);
-        const agentId = parsed?.agentId;
-        const rawSessionId = parsed?.rest ?? key;
-        const sessionId = entry?.sessionId ?? rawSessionId;
-        const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId });
+        const resolved = resolveSessionUsageFileOrRespond(key, respond);
+        if (!resolved) {
+            return;
+        }
+        const { config, entry, agentId, sessionId, sessionFile } = resolved;
         const { loadSessionLogs } = await import("../../infra/session-cost-usage.js");
         const logs = await loadSessionLogs({
             sessionId,
             sessionEntry: entry,
             sessionFile,
             config,
+            agentId,
             limit,
         });
         respond(true, { logs: logs ?? [] }, undefined);

package/dist/gateway/server-node-events.js

@@ -8,6 +8,7 @@ import { updateSessionStore } from "../config/sessions.js";
 import { requestHeartbeatNow } from "../infra/heartbeat-wake.js";
 import { deliverOutboundPayloads } from "../infra/outbound/deliver.js";
 import { resolveOutboundTarget } from "../infra/outbound/targets.js";
+import { registerApnsToken } from "../infra/push-apns.js";
 import { enqueueSystemEvent } from "../infra/system-events.js";
 import { normalizeMainKey } from "../routing/session-key.js";
 import { defaultRuntime } from "../runtime.js";
@@ -410,6 +411,34 @@ export const handleNodeEvent = async (ctx, nodeId, evt) => {
             requestHeartbeatNow({ reason: "exec-event" });
             return;
         }
+        case "push.apns.register": {
+            if (!evt.payloadJSON) {
+                return;
+            }
+            let payload;
+            try {
+                payload = JSON.parse(evt.payloadJSON);
+            }
+            catch {
+                return;
+            }
+            const obj = typeof payload === "object" && payload !== null ? payload : {};
+            const token = typeof obj.token === "string" ? obj.token : "";
+            const topic = typeof obj.topic === "string" ? obj.topic : "";
+            const environment = obj.environment;
+            try {
+                await registerApnsToken({
+                    nodeId,
+                    token,
+                    topic,
+                    environment,
+                });
+            }
+            catch (err) {
+                ctx.logGateway.warn(`push apns register failed node=${nodeId}: ${formatForLog(err)}`);
+            }
+            return;
+        }
         default:
             return;
     }

package/dist/gateway/server-reload-handlers.js

@@ -1,6 +1,6 @@
 import { startGmailWatcher, stopGmailWatcher } from "../hooks/gmail-watcher.js";
 import { resetDirectoryCache } from "../infra/outbound/target-resolver.js";
-import { authorizeGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy, } from "../infra/restart.js";
+import { emitGatewayRestart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 import { setCommandLaneConcurrency } from "../process/command-queue.js";
 import { resolveAgentMaxConcurrent, resolveSubagentMaxConcurrent } from "../config/agent-limits.js";
 import { isTruthyEnvValue } from "../infra/env.js";
@@ -105,8 +105,7 @@ export function createGatewayReloadHandlers(params) {
             params.logReload.warn("no SIGUSR1 listener found; restart skipped");
             return;
         }
-        authorizeGatewaySigusr1Restart();
-        process.emit("SIGUSR1");
+        emitGatewayRestart();
     };
     return { applyHotReload, requestGatewayRestart };
 }

package/dist/gateway/server-runtime-config.js

@@ -1,11 +1,27 @@
 import { assertGatewayAuthConfigured, resolveGatewayAuth, } from "./auth.js";
 import { normalizeControlUiBasePath } from "./control-ui-shared.js";
 import { resolveHooksConfig } from "./hooks.js";
-import { isLoopbackHost, resolveGatewayBindHost } from "./net.js";
+import { isLoopbackHost, isTrustedProxyAddress, isValidIPv4, resolveGatewayBindHost, } from "./net.js";
+import { mergeGatewayTailscaleConfig } from "./startup-auth.js";
 export async function resolveGatewayRuntimeConfig(params) {
     const bindMode = params.bind ?? params.cfg.gateway?.bind ?? "loopback";
     const customBindHost = params.cfg.gateway?.customBindHost;
     const bindHost = params.host ?? (await resolveGatewayBindHost(bindMode, customBindHost));
+    if (bindMode === "loopback" && !isLoopbackHost(bindHost)) {
+        throw new Error(`gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`);
+    }
+    if (bindMode === "custom") {
+        const configuredCustomBindHost = customBindHost?.trim();
+        if (!configuredCustomBindHost) {
+            throw new Error("gateway.bind=custom requires gateway.customBindHost");
+        }
+        if (!isValidIPv4(configuredCustomBindHost)) {
+            throw new Error(`gateway.bind=custom requires a valid IPv4 customBindHost (got ${configuredCustomBindHost})`);
+        }
+        if (bindHost !== configuredCustomBindHost) {
+            throw new Error(`gateway bind=custom requested ${configuredCustomBindHost} but resolved ${bindHost}; refusing fallback`);
+        }
+    }
     const controlUiEnabled = params.controlUiEnabled ?? params.cfg.gateway?.controlUi?.enabled ?? true;
     const openAiChatCompletionsEnabled = params.openAiChatCompletionsEnabled ??
         params.cfg.gateway?.http?.endpoints?.chatCompletions?.enabled ??
@@ -13,21 +29,17 @@ export async function resolveGatewayRuntimeConfig(params) {
     const openResponsesConfig = params.cfg.gateway?.http?.endpoints?.responses;
     const openResponsesEnabled = params.openResponsesEnabled ?? openResponsesConfig?.enabled ?? false;
     const controlUiBasePath = normalizeControlUiBasePath(params.cfg.gateway?.controlUi?.basePath);
-    const authBase = params.cfg.gateway?.auth ?? {};
-    const authOverrides = params.auth ?? {};
-    const authConfig = {
-        ...authBase,
-        ...authOverrides,
-    };
+    const controlUiRootRaw = params.cfg.gateway?.controlUi?.root;
+    const controlUiRoot = typeof controlUiRootRaw === "string" && controlUiRootRaw.trim().length > 0
+        ? controlUiRootRaw.trim()
+        : undefined;
     const tailscaleBase = params.cfg.gateway?.tailscale ?? {};
     const tailscaleOverrides = params.tailscale ?? {};
-    const tailscaleConfig = {
-        ...tailscaleBase,
-        ...tailscaleOverrides,
-    };
+    const tailscaleConfig = mergeGatewayTailscaleConfig(tailscaleBase, tailscaleOverrides);
     const tailscaleMode = tailscaleConfig.mode ?? "off";
     const resolvedAuth = resolveGatewayAuth({
-        authConfig,
+        authConfig: params.cfg.gateway?.auth,
+        authOverride: params.auth,
         env: process.env,
         tailscaleMode,
     });
@@ -37,6 +49,7 @@ export async function resolveGatewayRuntimeConfig(params) {
     const hasSharedSecret = (authMode === "token" && hasToken) || (authMode === "password" && hasPassword);
     const hooksConfig = resolveHooksConfig(params.cfg);
     const canvasHostEnabled = process.env.CLAWDBOT_SKIP_CANVAS_HOST !== "1" && params.cfg.canvasHost?.enabled !== false;
+    const trustedProxies = params.cfg.gateway?.trustedProxies ?? [];
     assertGatewayAuthConfigured(resolvedAuth);
     if (tailscaleMode === "funnel" && authMode !== "password") {
         throw new Error("tailscale funnel requires gateway auth mode=password (set gateway.auth.password or POOLBOT_GATEWAY_PASSWORD)");
@@ -44,9 +57,21 @@ export async function resolveGatewayRuntimeConfig(params) {
     if (tailscaleMode !== "off" && !isLoopbackHost(bindHost)) {
         throw new Error("tailscale serve/funnel requires gateway bind=loopback (127.0.0.1)");
     }
-    if (!isLoopbackHost(bindHost) && !hasSharedSecret) {
+    if (!isLoopbackHost(bindHost) && !hasSharedSecret && authMode !== "trusted-proxy") {
         throw new Error(`refusing to bind gateway to ${bindHost}:${params.port} without auth (set gateway.auth.token/password, or set POOLBOT_GATEWAY_TOKEN/POOLBOT_GATEWAY_PASSWORD)`);
     }
+    if (authMode === "trusted-proxy") {
+        if (trustedProxies.length === 0) {
+            throw new Error("gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP");
+        }
+        if (isLoopbackHost(bindHost)) {
+            const hasLoopbackTrustedProxy = isTrustedProxyAddress("127.0.0.1", trustedProxies) ||
+                isTrustedProxyAddress("::1", trustedProxies);
+            if (!hasLoopbackTrustedProxy) {
+                throw new Error("gateway auth mode=trusted-proxy with bind=loopback requires gateway.trustedProxies to include 127.0.0.1, ::1, or a loopback CIDR");
+            }
+        }
+    }
     return {
         bindHost,
         controlUiEnabled,
@@ -56,6 +81,7 @@ export async function resolveGatewayRuntimeConfig(params) {
             ? { ...openResponsesConfig, enabled: openResponsesEnabled }
             : undefined,
         controlUiBasePath,
+        controlUiRoot,
         resolvedAuth,
         authMode,
         tailscaleConfig,

package/dist/gateway/server-runtime-state.js

@@ -60,6 +60,7 @@ export async function createGatewayRuntimeState(params) {
             handleHooksRequest,
             handlePluginRequest,
             resolvedAuth: params.resolvedAuth,
+            rateLimiter: params.rateLimiter,
             tlsOptions: params.gatewayTls?.enabled ? params.gatewayTls.tlsOptions : undefined,
         });
         try {
@@ -93,6 +94,7 @@ export async function createGatewayRuntimeState(params) {
             canvasHost,
             clients,
             resolvedAuth: params.resolvedAuth,
+            rateLimiter: params.rateLimiter,
         });
     }
     const agentRunSeq = new Map();

package/dist/gateway/server-startup-memory.js

@@ -1,16 +1,22 @@
-import { resolveDefaultAgentId } from "../agents/agent-scope.js";
+import { listAgentIds } from "../agents/agent-scope.js";
+import { resolveMemorySearchConfig } from "../agents/memory-search.js";
 import { resolveMemoryBackendConfig } from "../memory/backend-config.js";
 import { getMemorySearchManager } from "../memory/index.js";
 export async function startGatewayMemoryBackend(params) {
-    const agentId = resolveDefaultAgentId(params.cfg);
-    const resolved = resolveMemoryBackendConfig({ cfg: params.cfg, agentId });
-    if (resolved.backend !== "qmd" || !resolved.qmd) {
-        return;
+    const agentIds = listAgentIds(params.cfg);
+    for (const agentId of agentIds) {
+        if (!resolveMemorySearchConfig(params.cfg, agentId)) {
+            continue;
+        }
+        const resolved = resolveMemoryBackendConfig({ cfg: params.cfg, agentId });
+        if (resolved.backend !== "qmd" || !resolved.qmd) {
+            continue;
+        }
+        const { manager, error } = await getMemorySearchManager({ cfg: params.cfg, agentId });
+        if (!manager) {
+            params.log.warn(`qmd memory startup initialization failed for agent "${agentId}": ${error ?? "unknown error"}`);
+            continue;
+        }
+        params.log.info?.(`qmd memory startup initialization armed for agent "${agentId}"`);
     }
-    const { manager, error } = await getMemorySearchManager({ cfg: params.cfg, agentId });
-    if (!manager) {
-        params.log.warn(`qmd memory startup initialization failed for agent "${agentId}": ${error ?? "unknown error"}`);
-        return;
-    }
-    params.log.info?.(`qmd memory startup initialization armed for agent "${agentId}"`);
 }

package/dist/gateway/server-ws-runtime.js

@@ -8,6 +8,7 @@ export function attachGatewayWsHandlers(params) {
         canvasHostEnabled: params.canvasHostEnabled,
         canvasHostServerPort: params.canvasHostServerPort,
         resolvedAuth: params.resolvedAuth,
+        rateLimiter: params.rateLimiter,
         gatewayMethods: params.gatewayMethods,
         events: params.events,
         logGateway: params.logGateway,