@remnic/core 9.3.638 → 9.3.640

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.3.638",
+  "version": "9.3.640",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -2873,6 +2873,7 @@
     "@sinclair/typebox": "^0.34.0",
     "apache-arrow": "^18.1.0",
     "better-sqlite3": "^12.6.2",
+    "cross-spawn": "^7.0.6",
     "meilisearch": "^0.46.0",
     "node-gyp": "^12.3.0",
     "openai": "^6.0.0",
@@ -2885,6 +2886,7 @@
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
+    "@types/cross-spawn": "^6.0.6",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3"

package/src/access-http.test.ts

@@ -5,7 +5,7 @@ import path from "node:path";
 import test from "node:test";
 import { gzipSync } from "node:zlib";
 
-import { EngramAccessHttpServer } from "./access-http.js";
+import { EngramAccessHttpServer, type RemnicAdminControls, type RemnicAdminDashboardStatus } from "./access-http.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import { parseConfig } from "./config.js";
 import { readPair, writePair } from "./contradiction/contradiction-review.js";
@@ -117,7 +117,9 @@ test("HTTP admin console assets are public but API routes require bearer authent
   try {
     const shell = await fetch(`http://127.0.0.1:${status.port}/remnic/ui/`);
     assert.equal(shell.status, 200);
-    assert.match(await shell.text(), /Remnic Admin Console/);
+    const shellText = await shell.text();
+    assert.match(shellText, /Remnic Admin Console/);
+    assert.doesNotMatch(shellText, /test-token/);
 
     const app = await fetch(`http://127.0.0.1:${status.port}/remnic/ui/app.js`);
     assert.equal(app.status, 200);
@@ -133,6 +135,112 @@ test("HTTP admin console assets are public but API routes require bearer authent
   }
 });
 
+test("HTTP admin console can prefill the primary bearer token when explicitly enabled", async () => {
+  const service = {} as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "test-token",
+    adminConsolePrefillToken: true,
+  });
+
+  const status = await server.start();
+  try {
+    const unauthenticatedShell = await fetch(`http://127.0.0.1:${status.port}/engram/ui/`);
+    assert.equal(unauthenticatedShell.status, 200);
+    assert.doesNotMatch(await unauthenticatedShell.text(), /test-token/);
+
+    const shell = await fetch(`http://127.0.0.1:${status.port}/engram/ui/`, {
+      headers: { authorization: "Bearer test-token" },
+    });
+    assert.equal(shell.status, 200);
+    assert.equal(shell.headers.get("cache-control"), "private, no-store");
+    assert.equal(shell.headers.get("vary"), "authorization");
+    const shellText = await shell.text();
+    assert.match(
+      shellText,
+      /window\.__REMNIC_ADMIN_CONSOLE_PREFILL_TOKEN__="test-token"/,
+    );
+
+    const app = await fetch(`http://127.0.0.1:${status.port}/engram/ui/app.js`);
+    assert.equal(app.status, 200);
+    assert.doesNotMatch(await app.text(), /test-token/);
+  } finally {
+    await server.stop();
+  }
+});
+
+test("HTTP admin dashboard endpoints require bearer authentication and apply config patches", async () => {
+  const service = {} as EngramAccessService;
+  const patches: unknown[] = [];
+  const dashboard: RemnicAdminDashboardStatus = {
+    config: {
+      path: "/tmp/remnic/config.json",
+      exists: true,
+      writable: true,
+      restartRequired: false,
+      values: {
+        modelSource: "plugin",
+        model: "gpt-4.1-mini",
+      },
+    },
+    harnesses: [],
+    models: [],
+    features: [],
+  };
+  const adminControls: RemnicAdminControls = {
+    status: async () => dashboard,
+    update: async (patch) => {
+      patches.push(patch);
+      return {
+        ...dashboard,
+        config: {
+          ...dashboard.config,
+          restartRequired: true,
+          values: {
+            ...dashboard.config.values,
+            modelSource: "gateway",
+            gatewayAgentId: "sage-router",
+          },
+        },
+      };
+    },
+  };
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "test-token",
+    adminControls,
+  });
+
+  const status = await server.start();
+  try {
+    const unauthorized = await fetch(`http://127.0.0.1:${status.port}/engram/v1/admin/dashboard`);
+    assert.equal(unauthorized.status, 401);
+
+    const dashboardResponse = await fetch(`http://127.0.0.1:${status.port}/engram/v1/admin/dashboard`, {
+      headers: { authorization: "Bearer test-token" },
+    });
+    assert.equal(dashboardResponse.status, 200);
+    assert.deepEqual(await dashboardResponse.json(), dashboard);
+
+    const patchResponse = await fetch(`http://127.0.0.1:${status.port}/remnic/v1/admin/config`, {
+      method: "PATCH",
+      headers: {
+        authorization: "Bearer test-token",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({ modelSource: "gateway", gatewayAgentId: "sage-router" }),
+    });
+    assert.equal(patchResponse.status, 200);
+    const body = await patchResponse.json() as RemnicAdminDashboardStatus;
+    assert.equal(body.config.restartRequired, true);
+    assert.deepEqual(patches, [{ modelSource: "gateway", gatewayAgentId: "sage-router" }]);
+  } finally {
+    await server.stop();
+  }
+});
+
 test("HTTP coding-context endpoint accepts projectTag shorthand", async () => {
   const calls: unknown[] = [];
   const service = {

package/src/access-http.ts

@@ -41,6 +41,8 @@ export interface EngramAccessHttpServerOptions {
   maxBodyBytes?: number;
   adminConsoleEnabled?: boolean;
   adminConsolePublicDir?: string;
+  /** Inject the primary auth token into the admin console shell for trusted launch surfaces. */
+  adminConsolePrefillToken?: boolean;
   trustPrincipalHeader?: boolean;
   /** Enable adapter-based identity resolution from request headers */
   enableAdapters?: boolean;
@@ -52,6 +54,8 @@ export interface EngramAccessHttpServerOptions {
   citationsAutoDetect?: boolean;
   /** Advertise legacy engram.* tool aliases on tools/list (issue #1427). Default true. */
   emitLegacyTools?: boolean;
+  /** Optional authenticated admin dashboard/config controls supplied by the host server. */
+  adminControls?: RemnicAdminControls;
 }
 
 export interface EngramAccessHttpServerStatus {
@@ -61,6 +65,57 @@ export interface EngramAccessHttpServerStatus {
   maxBodyBytes: number;
 }
 
+export interface RemnicAdminHarnessStatus {
+  id: string;
+  label: string;
+  detected: boolean;
+  enabled: boolean;
+  source?: string;
+  detail?: string;
+}
+
+export interface RemnicAdminModelOption {
+  id: string;
+  label: string;
+  provider: string;
+  detected: boolean;
+  enabled: boolean;
+  default?: boolean;
+  source?: string;
+  endpoint?: string;
+}
+
+export interface RemnicAdminFeatureStatus {
+  key: string;
+  label: string;
+  enabled: boolean;
+  writable: boolean;
+  restartRequired?: boolean;
+}
+
+export interface RemnicAdminConfigStatus {
+  path: string;
+  exists: boolean;
+  writable: boolean;
+  restartRequired: boolean;
+  values: Record<string, string | number | boolean | null>;
+}
+
+export interface RemnicAdminDashboardStatus {
+  config: RemnicAdminConfigStatus;
+  harnesses: RemnicAdminHarnessStatus[];
+  providers?: RemnicAdminHarnessStatus[];
+  models: RemnicAdminModelOption[];
+  features: RemnicAdminFeatureStatus[];
+}
+
+export type RemnicAdminConfigPatch = Record<string, unknown>;
+
+export interface RemnicAdminControls {
+  status: () => Promise<RemnicAdminDashboardStatus>;
+  update?: (patch: RemnicAdminConfigPatch) => Promise<RemnicAdminDashboardStatus>;
+}
+
 function resolveDefaultAdminConsolePublicDir(): string {
   const thisDir = path.dirname(fileURLToPath(import.meta.url));
   const candidates = [
@@ -210,6 +265,8 @@ export class EngramAccessHttpServer {
   private readonly maxBodyBytes: number;
   private readonly adminConsoleEnabled: boolean;
   private readonly adminConsolePublicDir: string;
+  private readonly adminConsolePrefillToken?: string;
+  private readonly adminControls?: RemnicAdminControls;
   private readonly trustPrincipalHeader: boolean;
   private readonly adapterRegistry: AdapterRegistry | null;
   private readonly writeRequestTimestamps: number[] = [];
@@ -242,6 +299,8 @@ export class EngramAccessHttpServer {
       : 131072;
     this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
     this.adminConsolePublicDir = options.adminConsolePublicDir ?? defaultAdminConsolePublicDir;
+    this.adminConsolePrefillToken = options.adminConsolePrefillToken === true ? this.authToken : undefined;
+    this.adminControls = options.adminControls;
     this.trustPrincipalHeader = options.trustPrincipalHeader === true;
     this.adapterRegistry = options.enableAdapters !== false
       ? (options.adapterRegistry ?? new AdapterRegistry())
@@ -492,6 +551,38 @@ export class EngramAccessHttpServer {
       return;
     }
 
+    if (
+      req.method === "GET" &&
+      (pathname === "/engram/v1/admin/dashboard" || pathname === "/remnic/v1/admin/dashboard")
+    ) {
+      if (!this.adminControls) {
+        this.respondJson(res, 404, { error: "admin_controls_unavailable", code: "admin_controls_unavailable" });
+        return;
+      }
+      this.respondJson(res, 200, await this.adminControls.status());
+      return;
+    }
+
+    if (
+      req.method === "PATCH" &&
+      (pathname === "/engram/v1/admin/config" || pathname === "/remnic/v1/admin/config")
+    ) {
+      if (!this.adminControls?.update) {
+        this.respondJson(res, 404, { error: "admin_controls_unavailable", code: "admin_controls_unavailable" });
+        return;
+      }
+      try {
+        this.respondJson(res, 200, await this.adminControls.update(await this.readJsonBody(req)));
+      } catch (error) {
+        throw new HttpError(
+          400,
+          error instanceof Error ? error.message : "invalid_admin_config_patch",
+          "invalid_admin_config_patch",
+        );
+      }
+      return;
+    }
+
     if (req.method === "POST" && pathname === "/engram/v1/recall") {
       const body = await this.readValidatedBody(req, "recall");
       // Preserve the distinction between `codingContext: null` (explicit
@@ -2244,7 +2335,7 @@ export class EngramAccessHttpServer {
       return true;
     }
     if (pathname === "/remnic/ui/" || pathname === "/engram/ui/") {
-      await this.respondStatic(res, path.join(this.adminConsolePublicDir, "index.html"), "text/html; charset=utf-8");
+      await this.respondAdminConsoleShell(req, res, pathname);
       return true;
     }
     if (pathname === "/remnic/ui/app.js" || pathname === "/engram/ui/app.js") {
@@ -2254,6 +2345,31 @@ export class EngramAccessHttpServer {
     return false;
   }
 
+  private async respondAdminConsoleShell(
+    req: IncomingMessage,
+    res: ServerResponse,
+    pathname: string,
+  ): Promise<void> {
+    try {
+      let body = await readFile(path.join(this.adminConsolePublicDir, "index.html"), "utf-8");
+      const canPrefillToken = this.adminConsolePrefillToken && this.isAuthorized(req, pathname);
+      if (canPrefillToken) {
+        const script = `<script>window.__REMNIC_ADMIN_CONSOLE_PREFILL_TOKEN__=${JSON.stringify(this.adminConsolePrefillToken)};</script>`;
+        body = body.includes("</head>")
+          ? body.replace("</head>", `${script}</head>`)
+          : `${script}${body}`;
+        res.setHeader("cache-control", "private, no-store");
+      }
+      res.setHeader("vary", "authorization");
+      res.statusCode = 200;
+      res.setHeader("content-type", "text/html; charset=utf-8");
+      res.setHeader("content-length", String(Buffer.byteLength(body)));
+      res.end(body);
+    } catch {
+      this.respondJson(res, 404, { error: "not_found" });
+    }
+  }
+
   private async respondStatic(res: ServerResponse, filePath: string, contentType: string): Promise<void> {
     try {
       const body = await readFile(filePath, "utf-8");

package/src/access-mcp.ts

@@ -8,6 +8,7 @@ import {
   type CapsuleExportRequest,
   type CapsuleImportRequest,
   type CapsuleListRequest,
+  type DaySummaryRequest,
   type MemoryStoreRequest,
   type SchemaName,
   type SchemaTypeFor,
@@ -102,6 +103,14 @@ function resolveChatGptInspectorRecallSessionKey(
 }
 
 const STRICT_MCP_SCHEMA_KEYS: Partial<Record<SchemaName, readonly string[]>> = {
+  daySummary: [
+    "memories",
+    "sessionKey",
+    "namespace",
+    "timeZone",
+    "cwd",
+    "projectTag",
+  ],
   memoryStore: [
     "schemaVersion",
     "idempotencyKey",
@@ -765,6 +774,8 @@ export class EngramMcpServer {
             memories: { type: "string" },
             sessionKey: { type: "string" },
             namespace: { type: "string" },
+            timeZone: { type: "string" },
+            ...MCP_GIT_CONTEXT_SCHEMA_PROPS_IGNORED,
           },
           required: [],
           additionalProperties: false,
@@ -2638,12 +2649,10 @@ export class EngramMcpServer {
           actionConfidence,
         );
       }
-      case "engram.day_summary":
-        return this.service.daySummary({
-          memories: typeof args.memories === "string" ? args.memories : "",
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : undefined,
-          namespace: typeof args.namespace === "string" ? args.namespace : undefined,
-        });
+      case "engram.day_summary": {
+        const body: DaySummaryRequest = parseMcpRequest("daySummary", args);
+        return this.service.daySummary(body);
+      }
       case "engram.capsule_export": {
         const body: CapsuleExportRequest = parseMcpRequest("capsuleExport", args);
         return this.service.capsuleExport({

package/src/access-schema.ts

@@ -46,6 +46,19 @@ const sessionKeySchema = z.string().trim().min(1).max(512).optional();
 const idempotencyKeySchema = z.string().trim().min(1).max(256).optional();
 const dryRunSchema = z.boolean().optional();
 const schemaVersionSchema = z.number().int().optional();
+const timeZoneSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .max(128)
+  .refine((value) => {
+    try {
+      Intl.DateTimeFormat(undefined, { timeZone: value });
+      return true;
+    } catch {
+      return false;
+    }
+  }, "must be a valid IANA timezone");
 
 // ---------------------------------------------------------------------------
 // Recall
@@ -330,6 +343,7 @@ export const daySummaryRequestSchema = z.object({
   memories: z.string().max(100000).optional(),
   sessionKey: sessionKeySchema,
   namespace: namespaceSchema,
+  timeZone: timeZoneSchema.optional(),
 });
 
 // ---------------------------------------------------------------------------

package/src/access-service.ts

@@ -425,6 +425,7 @@ export interface EngramAccessDaySummaryRequest {
   memories?: string;
   sessionKey?: string;
   namespace?: string;
+  timeZone?: string;
 }
 
 /** Inputs accepted by the `remnic_briefing` MCP tool. */
@@ -2021,7 +2022,9 @@ export class EngramAccessService {
 
     if (memories.length === 0) {
       // Auto-gather today's facts from the resolved namespace
-      return this.orchestrator.generateDaySummaryAuto(namespace);
+      return this.orchestrator.generateDaySummaryAuto(namespace, {
+        timeZone: request.timeZone,
+      });
     }
     return this.orchestrator.generateDaySummary(memories);
   }

package/src/config.ts

@@ -2059,6 +2059,20 @@ export function parseConfig(raw: unknown): PluginConfig {
     hourlySummariesEnabled: cfg.hourlySummariesEnabled !== false, // default: true
     daySummaryEnabled: cfg.daySummaryEnabled !== false, // default: true
     hourlySummaryCronAutoRegister: cfg.hourlySummaryCronAutoRegister === true,
+    // Day summary timezone override (issue #1475). When unset, the plugin
+    // falls back to the server's local timezone.
+    daySummaryTimezone:
+      typeof cfg.daySummaryTimezone === "string" && cfg.daySummaryTimezone.trim().length > 0
+        ? (() => {
+            const tz = (cfg.daySummaryTimezone as string).trim();
+            try {
+              Intl.DateTimeFormat(undefined, { timeZone: tz });
+              return tz;
+            } catch {
+              throw new Error(`daySummaryTimezone must be a valid IANA timezone: ${tz}`);
+            }
+          })()
+        : undefined,
     // Codex P1 on PR 763 round 2: gate the nightly-governance cron
     // (deep-sleep's primary scheduled execution path) on
     // dreams.phases.deepSleep.enabled. When the phase is disabled the

package/src/fallback-llm.ts

@@ -109,6 +109,16 @@ const LEGACY_PROVIDER_IDS = new Set(["openai-codex", "claude-cli"]);
 const MANAGED_SECRETREF_MARKER = ["secretref", "managed"].join("-");
 const PROVIDER_API_KEY_FIELD = ["api", "Key"].join("") as keyof ModelProviderConfig;
 
+/**
+ * Built-in provider fallbacks for providers that are commonly configured via
+ * OAuth or gateway-managed auth rather than an explicit apiKey in
+ * openclaw.json. These entries let resolveProviderConfig() succeed so the
+ * chain proceeds to tryModel() → resolveRuntimeAuth(), which is where the
+ * gateway's native OAuth token exchange happens.
+ *
+ * Without these, OAuth-only providers like `openai` are rejected with
+ * "provider not found" before runtime auth is ever attempted.
+ */
 const BUILT_IN_PROVIDER_FALLBACKS: Record<string, ModelProviderConfig> = {
   anthropic: {
     baseUrl: "https://api.anthropic.com/v1",
@@ -116,6 +126,12 @@ const BUILT_IN_PROVIDER_FALLBACKS: Record<string, ModelProviderConfig> = {
     models: [],
     [PROVIDER_API_KEY_FIELD]: MANAGED_SECRETREF_MARKER,
   },
+  openai: {
+    baseUrl: "https://api.openai.com/v1",
+    api: "openai-responses",
+    models: [],
+    [PROVIDER_API_KEY_FIELD]: MANAGED_SECRETREF_MARKER,
+  },
 };
 
 /**

package/src/index.ts

@@ -341,7 +341,15 @@ export {
 // ---------------------------------------------------------------------------
 
 export { EngramAccessService, EngramAccessInputError } from "./access-service.js";
-export { EngramAccessHttpServer } from "./access-http.js";
+export {
+  EngramAccessHttpServer,
+  type RemnicAdminConfigPatch,
+  type RemnicAdminControls,
+  type RemnicAdminDashboardStatus,
+  type RemnicAdminFeatureStatus,
+  type RemnicAdminHarnessStatus,
+  type RemnicAdminModelOption,
+} from "./access-http.js";
 export { EngramMcpServer } from "./access-mcp.js";
 
 // agentAccessHttp.authToken SecretRef resolution (issue #757). Exposed so

package/src/maintenance/memory-governance-cron.ts

@@ -72,7 +72,11 @@ export async function ensureCronJob(
   jobsPath: string,
   jobId: string,
   buildJob: () => Record<string, unknown>,
-  options: { updateExisting?: boolean; updateFields?: string[] } = {},
+  options: {
+    updateExisting?: boolean;
+    updateFields?: string[];
+    deepMerge?: Record<string, unknown>;
+  } = {},
 ): Promise<{ created: boolean; updated: boolean; jobId: string }> {
   const releaseLock = await acquireCronJobsLock(jobsPath);
   try {
@@ -87,7 +91,7 @@ export async function ensureCronJob(
 
       const desired = buildJob();
       const existing = jobs[existingIndex];
-      const next = mergeCronJobUpdate(existing, desired, options.updateFields);
+      const next = mergeCronJobUpdate(existing, desired, options.updateFields, options.deepMerge);
       if (stableJson(existing) === stableJson(next)) {
         return { created: false, updated: false, jobId };
       }
@@ -107,23 +111,56 @@ export async function ensureCronJob(
   }
 }
 
+function deepMergeObjects(
+  target: Record<string, unknown>,
+  source: Record<string, unknown>,
+): Record<string, unknown> {
+  const result = { ...target };
+  for (const [key, value] of Object.entries(source)) {
+    if (value === null) {
+      // null means "remove this key"
+      delete result[key];
+    } else if (
+      value && typeof value === "object" && !Array.isArray(value) &&
+      result[key] && typeof result[key] === "object" && !Array.isArray(result[key])
+    ) {
+      result[key] = deepMergeObjects(
+        result[key] as Record<string, unknown>,
+        value as Record<string, unknown>,
+      );
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
 function mergeCronJobUpdate(
   existing: Record<string, unknown>,
   desired: Record<string, unknown>,
   updateFields?: string[],
+  deepMerge?: Record<string, unknown>,
 ): Record<string, unknown> {
-  if (!updateFields) {
+  let next = { ...existing };
+
+  if (!updateFields && !deepMerge) {
     return desired;
   }
 
-  const next = { ...existing };
-  for (const field of updateFields) {
-    if (Object.prototype.hasOwnProperty.call(desired, field)) {
-      next[field] = desired[field];
-    } else {
-      delete next[field];
+  if (updateFields) {
+    for (const field of updateFields) {
+      if (Object.prototype.hasOwnProperty.call(desired, field)) {
+        next[field] = desired[field];
+      } else {
+        delete next[field];
+      }
     }
   }
+
+  if (deepMerge) {
+    next = deepMergeObjects(next, deepMerge);
+  }
+
   return next;
 }
 
@@ -146,34 +183,80 @@ export async function ensureDaySummaryCron(
   options: {
     timezone: string;
     agentId?: string;
+    /** Whether agentId was explicitly provided (vs defaulted to "main"). */
+    hasExplicitAgentId?: boolean;
+    /** Optional model override (e.g. from summaryModel or taskModelChain.primary). */
+    model?: string;
+    /** Optional fallbacks to include alongside the model. */
+    fallbacks?: string[];
   },
-): Promise<{ created: boolean; jobId: string }> {
+): Promise<{ created: boolean; updated: boolean; jobId: string }> {
   const agentId =
     typeof options.agentId === "string" && options.agentId.trim().length > 0
       ? options.agentId.trim()
       : "main";
+  const daySummaryParams = JSON.stringify({ timeZone: options.timezone });
 
-  return ensureCronJob(jobsPath, DAY_SUMMARY_CRON_ID, () => ({
-    id: DAY_SUMMARY_CRON_ID,
-    agentId,
-    name: "Remnic Day Summary (auto)",
-    enabled: true,
-    schedule: {
-      kind: "cron",
-      expr: "47 23 * * *",
-      tz: options.timezone,
-    },
-    sessionTarget: "isolated",
-    wakeMode: "now",
-    payload: {
-      kind: "agentTurn",
-      timeoutSeconds: 900,
-      thinking: "off",
-      message:
-        "You are OpenClaw automation. Call tool engram.day_summary with empty params (it will auto-gather today's facts). If successful output exactly NO_REPLY. On error output one concise line. Do NOT use message tool.",
+  const payload: Record<string, unknown> = {
+    kind: "agentTurn",
+    timeoutSeconds: 900,
+    thinking: "off",
+    message:
+      `You are OpenClaw automation. Call tool engram.day_summary with params ${daySummaryParams} (it will auto-gather today's facts for that timezone). If successful output exactly NO_REPLY. On error output one concise line. Do NOT use message tool.`,
+  };
+  if (options.model) {
+    payload.model = options.model;
+  }
+  if (options.fallbacks && options.fallbacks.length > 0) {
+    payload.fallbacks = options.fallbacks;
+  }
+
+  return ensureCronJob(
+    jobsPath,
+    DAY_SUMMARY_CRON_ID,
+    () => ({
+      id: DAY_SUMMARY_CRON_ID,
+      agentId,
+      name: "Remnic Day Summary (auto)",
+      enabled: true,
+      schedule: {
+        kind: "cron",
+        expr: "47 23 * * *",
+        tz: options.timezone,
+      },
+      sessionTarget: "isolated",
+      wakeMode: "now",
+      // Mirror model at job root for backward compat with older OpenClaw
+      // builds that read root model instead of payload.model.
+      ...(options.model ? { model: options.model } : {}),
+      payload,
+      delivery: { mode: "none" },
+    }),
+    // Reconcile on every startup so model/timezone changes propagate.
+    // Issue #1474 (model reconcile) + #1475 (timezone reconcile).
+    // Only update managed leaves to avoid clobbering user edits to
+    // schedule.expr, payload.message, payload.timeoutSeconds, etc.
+    // Only reconcile agentId when explicitly provided, so manually-set
+    // cron personas are preserved.
+    {
+      updateExisting: true,
+      updateFields: options.hasExplicitAgentId ? ["agentId"] : [],
+      deepMerge: {
+        schedule: { tz: options.timezone },
+        // Mirror model at job root for backward compat with older OpenClaw
+        // builds that read root model instead of payload.model.
+        model: options.model ?? null,
+        // Always write model/fallbacks so stale values are cleared when
+        // an operator removes summaryModel or taskModelChain from config.
+        payload: {
+          model: options.model ?? null,
+          fallbacks: (options.fallbacks && options.fallbacks.length > 0)
+            ? options.fallbacks
+            : null,
+        },
+      },
     },
-    delivery: { mode: "none" },
-  }));
+  );
 }
 
 export async function ensureNightlyGovernanceCron(