@senpi/runtime 3.0.22 → 3.0.23

package/dist/runtime/decision-errors.js

@@ -1,5 +1,6 @@
 /**
- * Classification of LLM-decision failures into user-facing messages + a retry flag.
+ * Classification of LLM-decision failures into a stable code, a retry flag, and
+ * a two-bucket user-facing message.
  *
  * ## Why this module exists
  *
@@ -9,21 +10,25 @@
  * need to make decisions from that string:
  *
  *   1. The **notification layer** ({@link formatDecisionErrorNotification} in
- *      `notifications.ts`) — what to tell the skill author in Telegram.
+ *      `notifications.ts`) — what to tell the skill author.
  *   2. The **decision client** (`openclaw-llm-decision.ts`) — whether a retry can
  *      plausibly succeed.
  *
- * ## Three pieces, separated on purpose
+ * ## Two pieces
  *
- *   1. {@link DECISION_ERROR_MESSAGES} — a **flat catalog** of every user-facing
- *      string, keyed by {@link DecisionErrorCode}. This is the single place to read,
- *      review, or edit copy. Templates use `{placeholder}` tokens.
- *   2. {@link DECISION_ERROR_TABLE} — the ordered matchers (raw string → code) and
- *      the `retryable` flag, plus the per-code logic that produces template values.
- *   3. {@link classifyDecisionError} — walks the table, renders the catalog entry.
+ *   1. {@link DECISION_ERROR_TABLE} — the ordered matchers (raw string → code)
+ *      and the `retryable` flag. Per-code detail is preserved here for logs and
+ *      telemetry, even though the two consumers above only see the collapsed
+ *      bucket.
+ *   2. {@link classifyDecisionError} — walks the table, then renders the
+ *      user-facing message from {@link DECISION_ERROR_BUCKET_COPY}, keyed only
+ *      by `retryable` (see {@link decisionErrorBucket}). Author-facing copy
+ *      does not vary by code — dozens of failure-mode-specific messages proved
+ *      to be more than users act on; the two buckets are "this will likely
+ *      sort itself out" vs. "this needs you to look at it."
  *
- * To change wording: edit {@link DECISION_ERROR_MESSAGES} only. To change matching
- * or retry behavior: edit {@link DECISION_ERROR_TABLE} only.
+ * To change matching or retry behavior: edit {@link DECISION_ERROR_TABLE}.
+ * To change user-facing wording: edit {@link DECISION_ERROR_BUCKET_COPY}.
  *
  * ## Where the raw strings come from
  *
@@ -89,79 +94,11 @@ export var DecisionErrorCode;
     DecisionErrorCode["Unknown"] = "UNKNOWN";
 })(DecisionErrorCode || (DecisionErrorCode = {}));
 /**
- * The single catalog of every user-facing message, keyed by {@link DecisionErrorCode}.
- *
- * Templates use `{token}` placeholders, filled by the matching entry's `vars`
- * function in {@link DECISION_ERROR_TABLE} (e.g. `{name}` = action name, `{model}`,
- * `{list}`, `{errors}`, `{level}`, `{hint}`, `{providerModel}`, `{raw}`). A `{token}`
- * with no supplied value is left verbatim so a missing var is visible, not silent.
- *
- * **This is the only place to edit copy.** Nothing else hardcodes a message.
- */
-export const DECISION_ERROR_MESSAGES = {
-    [DecisionErrorCode.GatewayTokenMissing]: "Senpi: OpenClaw gateway token not configured. Set OPENCLAW_GATEWAY_TOKEN.",
-    [DecisionErrorCode.GatewayUnreachable]: "Senpi: OpenClaw Gateway is unreachable.",
-    [DecisionErrorCode.PluginEndpointMissing]: "Senpi: OpenClaw is missing the plugin endpoint. Please reinstall the plugin.",
-    [DecisionErrorCode.PromptRequired]: "Your agent can't trade until its template is fixed. Action `{name}` in your runtime YAML is " +
-        "missing a `decision_prompt`. To recover: delete this runtime, ask your OpenClaw agent to add a " +
-        "`decision_prompt` to that action, and install it again. If you didn't write this skill, contact " +
-        "Senpi support.",
-    [DecisionErrorCode.ProviderModelUnresolved]: "Your agent can't trade because the AI model `{model}` isn't recognized by your OpenClaw host. " +
-        "To recover: delete this runtime, set a valid `decision_model` in your runtime YAML, and install it " +
-        "again. If you didn't write this skill, contact Senpi support.",
-    [DecisionErrorCode.ModelNotAllowed]: "Your agent can't trade because `{model}` isn't on your OpenClaw host's allowed-models list. " +
-        "Allowed: `{list}`. To recover: pick a model from the allowed list (delete the runtime, edit " +
-        "`decision_model` in the runtime YAML, install again) or add it to your host's allowedModels config.",
-    [DecisionErrorCode.InputNotSerializable]: "Your agent hit an internal bug while building the AI request (data wasn't serializable). Please " +
-        "report this to Senpi support — it isn't something you can fix from your side.",
-    [DecisionErrorCode.LlmEmptyOutput]: "Your agent dropped one signal because the AI model returned no answer. This is usually a safety " +
-        "filter or a transient model quirk. If it keeps happening, try a different `decision_model` in your " +
-        "runtime YAML (delete the runtime, edit, reinstall) or rephrase your `decision_prompt` to be less " +
-        "ambiguous.",
-    [DecisionErrorCode.LlmInvalidJson]: "Your agent dropped one signal because the AI model's reply wasn't valid JSON — usually a truncation " +
-        "or a prompt that didn't force JSON output. To recover: tighten your `decision_prompt` in the runtime " +
-        "YAML to require strict JSON, then delete and reinstall the runtime. If you didn't write this skill, " +
-        "contact Senpi support.",
-    [DecisionErrorCode.LlmSchemaMismatch]: "Your agent dropped one signal because the AI model's reply was valid JSON but didn't match the " +
-        "expected shape: `{errors}`. To recover: tweak your `decision_prompt` so the model returns the " +
-        "required fields, or have your OpenClaw agent loosen the schema (delete the runtime, edit the YAML, " +
-        "reinstall). If you didn't write this skill, contact Senpi support.",
-    [DecisionErrorCode.ProviderError]: "Your agent dropped one signal because the AI provider rejected the call (e.g. rate limit or outage). " +
-        "Usually transient — the next signal often goes through. If it keeps happening, try switching " +
-        "providers or using a different `decision_model` in your runtime YAML.",
-    [DecisionErrorCode.Timeout]: "Your agent dropped one signal because the AI model didn't reply in 90 seconds. This is usually " +
-        "transient — the next signal often goes through. If it keeps happening, switch to a faster " +
-        "`decision_model` in your runtime YAML (delete the runtime, edit, reinstall).",
-    [DecisionErrorCode.EmbeddedAgentUnavailable]: "Your agent dropped one signal because OpenClaw's internal LLM helper failed to load on your host. " +
-        "This usually means the OpenClaw install is corrupted or partially upgraded. To recover: reinstall " +
-        "OpenClaw on your host (or upgrade to the latest version — this error no longer exists in v2026.5.7+). " +
-        "If it keeps happening after reinstall, contact Senpi support.",
-    [DecisionErrorCode.InvalidThinkingLevel]: "Your agent's runtime YAML uses an unknown thinking level (`{level}`). Valid options: `{hint}`. " +
-        "To recover: delete this runtime, set `thinking` to a valid value in the runtime YAML, and install it " +
-        "again. If you didn't write this skill, contact Senpi support.",
-    [DecisionErrorCode.ThinkingLevelUnsupported]: "Your agent's model (`{providerModel}`) doesn't support the thinking level `{level}`. Supported for " +
-        "this model: `{hint}`. To recover: delete this runtime, change either the model or the thinking level " +
-        "in the runtime YAML, and install it again.",
-    [DecisionErrorCode.PluginResponseShape]: "Your agent hit an internal bug parsing the AI model's response. Please report this to Senpi support " +
-        "— it isn't something you can fix from your side.",
-    [DecisionErrorCode.OpenClawUnexpected]: "Senpi: Signal Dropped - OpenClaw hit an unexpected error.",
-    [DecisionErrorCode.Unknown]: "Senpi: Trading decision failed — {raw}",
-};
-/** Trim a captured token; falls back to `fallback` when empty/absent. */
-function clean(value, fallback) {
-    const t = value?.trim();
-    return t && t.length > 0 ? t : fallback;
-}
-/** Fill `{token}` placeholders from `vars`; unknown tokens are left verbatim. */
-function renderTemplate(template, vars) {
-    return template.replace(/\{(\w+)\}/g, (whole, key) => Object.prototype.hasOwnProperty.call(vars, key) ? vars[key] : whole);
-}
-/**
- * Ordered classification table — matchers + retry flag + template-variable logic.
- * First match wins, so keep specific matchers above generic ones (e.g.
- * `LlmEmptyOutput` before the catch-all `ProviderError`, since both can appear
- * inside a `"rejected request: ..."` wrapper). Copy lives in
- * {@link DECISION_ERROR_MESSAGES}, not here.
+ * Ordered classification table — matchers + retry flag. First match wins, so
+ * keep specific matchers above generic ones (e.g. `LlmEmptyOutput` before the
+ * catch-all `ProviderError`, since both can appear inside a `"rejected
+ * request: ..."` wrapper). `code` and `retryable` are the source of truth for
+ * logs/telemetry; user-facing copy lives in {@link DECISION_ERROR_BUCKET_COPY}.
  */
 export const DECISION_ERROR_TABLE = [
     // ── Pre-HTTP / infra (not retryable) ──────────────────────────────────────
@@ -185,22 +122,16 @@ export const DECISION_ERROR_TABLE = [
         code: DecisionErrorCode.PromptRequired,
         match: (s) => /prompt required/i.test(s),
         retryable: false,
-        vars: (_caps, ctx) => ({ name: clean(ctx.actionName, "<name>") }),
     },
     {
         code: DecisionErrorCode.ProviderModelUnresolved,
         match: (s) => s.match(/provider\/model could not be resolved \(provider=(.*?), model=(.*?)\)/),
         retryable: false,
-        vars: (caps, ctx) => ({ model: clean(caps?.[2], clean(ctx.model, "your configured model")) }),
     },
     {
         code: DecisionErrorCode.ModelNotAllowed,
         match: (s) => s.match(/Model not allowed by llm-task plugin config:\s*([^.]+)\.\s*Allowed models:\s*([^"}]+)/),
         retryable: false,
-        vars: (caps, ctx) => ({
-            model: clean(caps?.[1], clean(ctx.model, "that model")),
-            list: clean(caps?.[2], "(see your host's allowedModels config)"),
-        }),
     },
     {
         code: DecisionErrorCode.InputNotSerializable,
@@ -225,27 +156,17 @@ export const DECISION_ERROR_TABLE = [
         code: DecisionErrorCode.LlmSchemaMismatch,
         match: (s) => s.match(/LLM JSON did not match schema:\s*([^"}]+)/),
         retryable: false,
-        vars: (caps) => ({ errors: clean(caps?.[1], "(schema validation failed)") }),
     },
     // ── Thinking-level misconfig (v2026.5.7+, not retryable) ──────────────────
     {
         code: DecisionErrorCode.InvalidThinkingLevel,
         match: (s) => s.match(/Invalid thinking level "(.*?)"\.\s*Use one of:\s*([^"}]+?)\./),
         retryable: false,
-        vars: (caps) => ({
-            level: clean(caps?.[1], "that value"),
-            hint: clean(caps?.[2], "the supported levels"),
-        }),
     },
     {
         code: DecisionErrorCode.ThinkingLevelUnsupported,
         match: (s) => s.match(/Thinking level "(.*?)" is not supported for (.+?)\.\s*Use one of:\s*([^"}]+?)\./),
         retryable: false,
-        vars: (caps, ctx) => ({
-            level: clean(caps?.[1], "that level"),
-            providerModel: clean(caps?.[2], clean(ctx.model, "this model")),
-            hint: clean(caps?.[3], "the supported levels"),
-        }),
     },
     // ── Host/load failure (not retryable) ─────────────────────────────────────
     {
@@ -284,35 +205,51 @@ export const DECISION_ERROR_TABLE = [
         retryable: false,
     },
 ];
+/** Map a classified error's retry flag to its user-facing bucket. */
+export function decisionErrorBucket(retryable) {
+    return retryable ? "transient" : "attention";
+}
+/** Label-free copy for each bucket — the emit site applies the `[strategy]` prefix. */
+export const DECISION_ERROR_BUCKET_COPY = {
+    transient: {
+        pushTitle: "⚠️ Signal skipped",
+        pushBody: "Skipped a signal (transient) — still running, next one will go",
+        inApp: "⚠️ Skipped one trade signal — a brief issue deciding the trade. Still running; it'll take the next one. " +
+            "We've logged it — contact support and we'll help fix it.",
+    },
+    attention: {
+        pushTitle: "⚠️ Needs attention",
+        pushBody: "Your strategy needs attention before it can trade",
+        inApp: "⚠️ Your strategy needs attention before it can trade. We've logged it — contact support and we'll help fix it.",
+    },
+};
 /**
  * Classify a raw LLM-decision error string into a {@link ClassifiedDecisionError}.
  *
- * Walks {@link DECISION_ERROR_TABLE} in order; the first matching entry wins. If
- * nothing matches, returns {@link DecisionErrorCode.Unknown} (not retryable). The
- * message is always rendered from {@link DECISION_ERROR_MESSAGES}.
+ * Walks {@link DECISION_ERROR_TABLE} in order; the first matching entry wins,
+ * giving `code` + `retryable` (preserved for logs/telemetry). If nothing
+ * matches, returns {@link DecisionErrorCode.Unknown} (not retryable). The
+ * user-facing `userMessage` is always the collapsed bucket's in-app copy from
+ * {@link DECISION_ERROR_BUCKET_COPY} — it does not vary by code.
  *
  * @param rawMessage - The error string thrown by the decision client (may embed an
  *   OpenClaw gateway message). Non-string / empty inputs are coerced safely.
- * @param ctx - Optional plugin-side context for placeholders the gateway can't supply.
  */
-export function classifyDecisionError(rawMessage, ctx = {}) {
+export function classifyDecisionError(rawMessage) {
     const raw = typeof rawMessage === "string" ? rawMessage : String(rawMessage ?? "");
     for (const entry of DECISION_ERROR_TABLE) {
-        const result = entry.match(raw);
-        if (!result)
+        if (!entry.match(raw))
             continue;
-        const caps = Array.isArray(result) ? result : null;
-        const vars = entry.vars ? entry.vars(caps, ctx, raw) : {};
         return {
             code: entry.code,
             retryable: entry.retryable,
-            userMessage: renderTemplate(DECISION_ERROR_MESSAGES[entry.code], vars),
+            userMessage: DECISION_ERROR_BUCKET_COPY[decisionErrorBucket(entry.retryable)].inApp,
         };
     }
     return {
         code: DecisionErrorCode.Unknown,
         retryable: false,
-        userMessage: renderTemplate(DECISION_ERROR_MESSAGES[DecisionErrorCode.Unknown], { raw }),
+        userMessage: DECISION_ERROR_BUCKET_COPY.attention.inApp,
     };
 }
 /**

package/dist/runtime/decision-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"decision-errors.js","sourceRoot":"","sources":["../../src/runtime/decision-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,uEAAuE;AACvE,MAAM,CAAN,IAAY,iBAqCX;AArCD,WAAY,iBAAiB;IAC3B,8EAA8E;IAC9E,kEAA6C,CAAA;IAC7C,2EAA2E;IAC3E,+DAA0C,CAAA;IAC1C,mFAAmF;IACnF,sEAAiD,CAAA;IACjD,mFAAmF;IACnF,uDAAkC,CAAA;IAClC,uEAAuE;IACvE,0EAAqD,CAAA;IACrD,wEAAwE;IACxE,0DAAqC,CAAA;IACrC,qFAAqF;IACrF,oEAA+C,CAAA;IAC/C,4FAA4F;IAC5F,wDAAmC,CAAA;IACnC,gFAAgF;IAChF,wDAAmC,CAAA;IACnC,+DAA+D;IAC/D,8DAAyC,CAAA;IACzC,6EAA6E;IAC7E,qDAAgC,CAAA;IAChC,wFAAwF;IACxF,wCAAmB,CAAA;IACnB,yFAAyF;IACzF,4EAAuD,CAAA;IACvD,gFAAgF;IAChF,oEAA+C,CAAA;IAC/C,kFAAkF;IAClF,4EAAuD,CAAA;IACvD,yFAAyF;IACzF,kEAA6C,CAAA;IAC7C,0DAA0D;IAC1D,+DAA0C,CAAA;IAC1C,qFAAqF;IACrF,wCAAmB,CAAA;AACrB,CAAC,EArCW,iBAAiB,KAAjB,iBAAiB,QAqC5B;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsC;IACxE,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EACrC,2EAA2E;IAE7E,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IAEjF,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,EACvC,8EAA8E;IAEhF,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAChC,8FAA8F;QAC9F,iGAAiG;QACjG,kGAAkG;QAClG,gBAAgB;IAElB,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,EACzC,gGAAgG;QAChG,qGAAqG;QACrG,+DAA+D;IAEjE,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,8FAA8F;QAC9F,8FAA8F;QAC9F,qGAAqG;IAEvG,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACtC,kGAAkG;QAClG,+EAA+E;IAEjF,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAChC,kGAAkG;QAClG,qGAAqG;QACrG,mGAAmG;QACnG,YAAY;IAEd,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAChC,sGAAsG;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,wBAAwB;IAE1B,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EACnC,iGAAiG;QACjG,gGAAgG;QAChG,qGAAqG;QACrG,oEAAoE;IAEtE,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAC/B,uGAAuG;QACvG,+FAA+F;QAC/F,uEAAuE;IAEzE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EACzB,iGAAiG;QACjG,4FAA4F;QAC5F,8EAA8E;IAEhF,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,EAC1C,oGAAoG;QACpG,oGAAoG;QACpG,wGAAwG;QACxG,+DAA+D;IAEjE,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EACtC,iGAAiG;QACjG,uGAAuG;QACvG,+DAA+D;IAEjE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,EAC1C,qGAAqG;QACrG,uGAAuG;QACvG,4CAA4C;IAE9C,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EACrC,sGAAsG;QACtG,kDAAkD;IAEpD,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,2DAA2D;IAEnG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,wCAAwC;CACtE,CAAC;AA8CF,yEAAyE;AACzE,SAAS,KAAK,CAAC,KAAyB,EAAE,QAAgB;IACxD,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,QAAgB,EAAE,IAA4B;IACpE,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAC3D,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkC;IACjE,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,mBAAmB;QAC3C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qDAAqD,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,kBAAkB;QAC1C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oFAAoF,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;QAC7C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,cAAc;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;KAClE;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;QAC/C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uEAAuE,CAAC;QAC9F,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC;KAC9F;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,eAAe;QACvC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uFAAuF,CAAC;QAC9G,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,wCAAwC,CAAC;SACjE,CAAC;KACH;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;QAC5C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,0EAA0E;QAC1E,IAAI,EAAE,iBAAiB,CAAC,cAAc;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,gFAAgF;QAChF,IAAI,EAAE,iBAAiB,CAAC,cAAc;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,SAAS,EAAE,KAAK;KACjB;IACD;QACE,8DAA8D;QAC9D,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC;QAClE,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC,EAAE,CAAC;KAC7E;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;QAC5C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,8DAA8D,CAAC;QACrF,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACf,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC;SAC/C,CAAC;KACH;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,wBAAwB;QAChD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,iFAAiF,CAAC;QACxG,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;YACrC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC;SAC/C,CAAC;KACH;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,wBAAwB;QAChD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,mBAAmB;QAC3C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,EAAE,iBAAiB,CAAC,OAAO;QAC/B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CACX,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,SAAS,EAAE,KAAK;KACjB;IACD;QACE,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CACX,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3C,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS,EAAE,IAAI;KAChB;IACD;QACE,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,EAAE,iBAAiB,CAAC,kBAAkB;QAC1C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,SAAS,EAAE,KAAK;KACjB;CACO,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,MAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAEnF,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,cAAc,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,iBAAiB,CAAC,OAAO;QAC/B,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,cAAc,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;KACzF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC"}
+{"version":3,"file":"decision-errors.js","sourceRoot":"","sources":["../../src/runtime/decision-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAIH,uEAAuE;AACvE,MAAM,CAAN,IAAY,iBAqCX;AArCD,WAAY,iBAAiB;IAC3B,8EAA8E;IAC9E,kEAA6C,CAAA;IAC7C,2EAA2E;IAC3E,+DAA0C,CAAA;IAC1C,mFAAmF;IACnF,sEAAiD,CAAA;IACjD,mFAAmF;IACnF,uDAAkC,CAAA;IAClC,uEAAuE;IACvE,0EAAqD,CAAA;IACrD,wEAAwE;IACxE,0DAAqC,CAAA;IACrC,qFAAqF;IACrF,oEAA+C,CAAA;IAC/C,4FAA4F;IAC5F,wDAAmC,CAAA;IACnC,gFAAgF;IAChF,wDAAmC,CAAA;IACnC,+DAA+D;IAC/D,8DAAyC,CAAA;IACzC,6EAA6E;IAC7E,qDAAgC,CAAA;IAChC,wFAAwF;IACxF,wCAAmB,CAAA;IACnB,yFAAyF;IACzF,4EAAuD,CAAA;IACvD,gFAAgF;IAChF,oEAA+C,CAAA;IAC/C,kFAAkF;IAClF,4EAAuD,CAAA;IACvD,yFAAyF;IACzF,kEAA6C,CAAA;IAC7C,0DAA0D;IAC1D,+DAA0C,CAAA;IAC1C,qFAAqF;IACrF,wCAAmB,CAAA;AACrB,CAAC,EArCW,iBAAiB,KAAjB,iBAAiB,QAqC5B;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkC;IACjE,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,mBAAmB;QAC3C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,qDAAqD,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,kBAAkB;QAC1C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oFAAoF,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;QAC7C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,cAAc;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;QAC/C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uEAAuE,CAAC;QAC9F,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,eAAe;QACvC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uFAAuF,CAAC;QAC9G,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;QAC5C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,0EAA0E;QAC1E,IAAI,EAAE,iBAAiB,CAAC,cAAc;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,SAAS,EAAE,IAAI;KAChB;IACD;QACE,gFAAgF;QAChF,IAAI,EAAE,iBAAiB,CAAC,cAAc;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,SAAS,EAAE,KAAK;KACjB;IACD;QACE,8DAA8D;QAC9D,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC;QAClE,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;QAC5C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,8DAA8D,CAAC;QACrF,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,wBAAwB;QAChD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,iFAAiF,CAAC;QACxG,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB,CAAC,wBAAwB;QAChD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,SAAS,EAAE,KAAK;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,mBAAmB;QAC3C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,SAAS,EAAE,KAAK;KACjB;IAED,6EAA6E;IAC7E;QACE,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,EAAE,iBAAiB,CAAC,OAAO;QAC/B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CACX,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,SAAS,EAAE,KAAK;KACjB;IACD;QACE,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CACX,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3C,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS,EAAE,IAAI;KAChB;IACD;QACE,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,EAAE,iBAAiB,CAAC,kBAAkB;QAC1C,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,SAAS,EAAE,KAAK;KACjB;CACO,CAAC;AAUX,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,OAAO,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;AAC/C,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,0BAA0B,GAAkD;IACvF,SAAS,EAAE;QACT,SAAS,EAAE,mBAAmB;QAC9B,QAAQ,EAAE,gEAAgE;QAC1E,KAAK,EACH,0GAA0G;YAC1G,0DAA0D;KAC7D;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,mDAAmD;QAC7D,KAAK,EACH,gHAAgH;KACnH;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,GAAG,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAEnF,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,0BAA0B,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,iBAAiB,CAAC,OAAO;QAC/B,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,0BAA0B,CAAC,SAAS,CAAC,KAAK;KACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC"}

package/dist/runtime/notifications.d.ts

@@ -1,33 +1,40 @@
 import type { McpTransport } from "../senpi/types.js";
 import type { NotificationService } from "../types/notification.js";
-import { type DecisionErrorContext } from "./decision-errors.js";
 export interface NotificationServiceOptions {
-    telegram_chat_id?: string;
     mcpTransport?: McpTransport;
-    gateway_url?: string;
-    gateway_token?: string;
+    /** Override for the `NOTIFICATIONS_INGEST_URL` env (tests / non-standard hosting). */
+    ingest_url?: string;
+    /** The runtime's own Senpi auth token (MCP bearer). Doubles as the ingest-endpoint
+     * bearer credential and, via its `senpi_user_id` claim, the recipient every
+     * outgoing notification is stamped with. */
+    senpi_auth_token?: string;
+    /** Override the per-request timeout in ms (tests). */
+    ingest_timeout_ms?: number;
     [key: string]: unknown;
 }
 /**
- * Map a raw LLM-decision error string to the user-facing Telegram message.
+ * Map a raw LLM-decision error string to a user-facing notification message.
  *
- * Thin wrapper over {@link classifyDecisionError} — all message wording and the
+ * Thin wrapper over {@link classifyDecisionError} — the two-bucket copy and the
  * failure-mode lookup live in `decision-errors.ts` (the single source of truth
  * shared with the retry logic in `openclaw-llm-decision.ts`). The runtime catches
  * errors from the LLM-decision call and passes `err.message` here.
  *
  * @param rawMessage - Error message thrown by the decision client (may embed an
  *   OpenClaw gateway message).
- * @param ctx - Optional plugin-side context (action name, configured model) for
- *   placeholders the gateway error string cannot supply.
  */
-export declare function formatDecisionErrorNotification(rawMessage: string, ctx?: DecisionErrorContext): string;
+export declare function formatDecisionErrorNotification(rawMessage: string): string;
 /**
- * IMPORTANT: Do NOT use logger.error(...) anywhere inside this service.
- * NotificationService is itself the Telegram delivery path for error notifications.
- * Using logger.error here would trigger the error notifier hook recursively,
- * which is blocked by the reentrancy guard (causing the notification to be silently dropped)
- * or could cause unexpected feedback loops in future. Use logger.warn for all failure paths.
+ * Create the runtime's notification service. Every notification is delivered by
+ * POSTing the full structured envelope to the authenticated notification-ingest
+ * endpoint (`NOTIFICATIONS_INGEST_URL`) — there is no other delivery path. Missing
+ * configuration is a startup error (thrown here, not discovered later as silent
+ * notification loss), so callers must construct this before a runtime starts
+ * trading, not lazily on first notify.
+ *
+ * Failure paths inside this service log at warn, not error: a delivery failure is a
+ * handled, degraded condition — the caller's notify() contract is fire-and-forget and
+ * the next notification retries the transport fresh.
  */
 export declare function createNotificationService(options?: NotificationServiceOptions): NotificationService;
 //# sourceMappingURL=notifications.d.ts.map

package/dist/runtime/notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../src/runtime/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAIxF,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,oBAAoB,GACzB,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,mBAAmB,CAyEnG"}
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../src/runtime/notifications.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAyC,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AA+B3G,MAAM,WAAW,0BAA0B;IACzC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;gDAE4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1E;AA8FD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,mBAAmB,CAsHnG"}

package/dist/runtime/notifications.js

@@ -1,92 +1,225 @@
+import { toPayload, truncateForPush, PUSH_TITLE_MAX, PUSH_BODY_MAX } from "../types/notification.js";
+import { decodeSenpiUserId } from "../telemetry/otel-sdk.js";
 import { createLogger } from "../utils/logger.js";
 import { classifyDecisionError } from "./decision-errors.js";
+import { randomUUID } from "node:crypto";
 const logger = createLogger("[senpi-core][notifications]");
 /**
- * Map a raw LLM-decision error string to the user-facing Telegram message.
+ * Every notification the runtime emits is a strategy/trading alert, so the ingest
+ * envelope's top-level category is fixed. Per-alert differentiation (limit trip,
+ * decision error, scanner alert, ...) travels in `actionMetadata.notificationSubtype`.
+ */
+const NOTIFICATION_CATEGORY = "PERPS";
+const NOTIFICATION_SOURCE = "senpi-trading-runtime";
+/**
+ * Bounded per-request timeout for the ingest POST. The service is called both
+ * fire-and-forget and awaited inline by producers on the serial signal path, so
+ * this must never hang indefinitely: one retry on a retryable failure, no more.
+ * Worst-case latency is therefore ~2x this value, never unbounded.
+ */
+const DEFAULT_TIMEOUT_MS = 5000;
+/** Only one retry attempt on a retryable failure — see {@link classifyOutcome}. */
+const MAX_ATTEMPTS = 2;
+/** Suppress repeat WARN logs for the same failure reason within this window. */
+const WARN_REPEAT_WINDOW_MS = 30_000;
+/**
+ * Map a raw LLM-decision error string to a user-facing notification message.
  *
- * Thin wrapper over {@link classifyDecisionError} — all message wording and the
+ * Thin wrapper over {@link classifyDecisionError} — the two-bucket copy and the
  * failure-mode lookup live in `decision-errors.ts` (the single source of truth
  * shared with the retry logic in `openclaw-llm-decision.ts`). The runtime catches
  * errors from the LLM-decision call and passes `err.message` here.
  *
  * @param rawMessage - Error message thrown by the decision client (may embed an
  *   OpenClaw gateway message).
- * @param ctx - Optional plugin-side context (action name, configured model) for
- *   placeholders the gateway error string cannot supply.
  */
-export function formatDecisionErrorNotification(rawMessage, ctx) {
-    return classifyDecisionError(rawMessage, ctx).userMessage;
+export function formatDecisionErrorNotification(rawMessage) {
+    return classifyDecisionError(rawMessage).userMessage;
+}
+/** Strip anything shaped like a bearer credential before it can reach a log line. */
+function redactSecrets(text) {
+    return text.replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]");
+}
+function describeError(err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    return redactSecrets(raw);
+}
+/** Classify an HTTP response status into a delivery outcome. 503 and any 5xx are
+ * transient (server-side produce failure) and get one retry; every other non-2xx
+ * (400 malformed envelope, 401 bad/expired token, 403 recipient mismatch, or any
+ * other 4xx) is a caller-side condition a retry cannot fix, so it drops immediately. */
+function classifyStatus(status) {
+    if (status >= 200 && status < 300)
+        return "ok";
+    if (status === 503 || status >= 500)
+        return "retry";
+    return "drop";
+}
+const lastWarnedAt = new Map();
+/** Log a WARN, but suppress repeats of the same reason within {@link WARN_REPEAT_WINDOW_MS}
+ * so a hot failure path (e.g. a sustained outage) doesn't flood the log. */
+function warnRateLimited(key, message, attributes) {
+    const now = Date.now();
+    const last = lastWarnedAt.get(key);
+    if (last !== undefined && now - last < WARN_REPEAT_WINDOW_MS)
+        return;
+    lastWarnedAt.set(key, now);
+    logger.warn(message, undefined, attributes);
+}
+async function postOnce(ingestUrl, authToken, envelope, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(ingestUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${authToken}`,
+            },
+            body: JSON.stringify(envelope),
+            signal: controller.signal,
+        });
+        if (res.ok)
+            return { kind: "ok" };
+        const bodyText = await res.text().catch(() => "");
+        const kind = classifyStatus(res.status);
+        return { kind, status: res.status, reason: redactSecrets(bodyText).slice(0, 300) };
+    }
+    catch (err) {
+        // Network failure, DNS failure, connection refused, or our own timeout abort.
+        return { kind: "retry", reason: describeError(err) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** POST the envelope with a single bounded retry on a transient failure (5xx / network / timeout).
+ * Never throws — every outcome resolves, so a delivery failure can never surface as a rejected
+ * promise into the caller's (often serial, trading-critical) code path. */
+async function deliver(ingestUrl, authToken, envelope, timeoutMs) {
+    let outcome = await postOnce(ingestUrl, authToken, envelope, timeoutMs);
+    for (let attempt = 2; outcome.kind === "retry" && attempt <= MAX_ATTEMPTS; attempt++) {
+        outcome = await postOnce(ingestUrl, authToken, envelope, timeoutMs);
+    }
+    if (outcome.kind === "ok")
+        return;
+    const notificationId = envelope.notificationId;
+    const subtype = envelope.actionMetadata?.notificationSubtype;
+    const rateLimitKey = `${outcome.status ?? "network"}:${typeof subtype === "string" ? subtype : "unknown"}`;
+    warnRateLimited(rateLimitKey, `Notification delivery dropped notificationId=${String(notificationId)} status=${outcome.status ?? "n/a"}: ${outcome.reason}`, { notificationId, status: outcome.status });
 }
 /**
- * IMPORTANT: Do NOT use logger.error(...) anywhere inside this service.
- * NotificationService is itself the Telegram delivery path for error notifications.
- * Using logger.error here would trigger the error notifier hook recursively,
- * which is blocked by the reentrancy guard (causing the notification to be silently dropped)
- * or could cause unexpected feedback loops in future. Use logger.warn for all failure paths.
+ * Create the runtime's notification service. Every notification is delivered by
+ * POSTing the full structured envelope to the authenticated notification-ingest
+ * endpoint (`NOTIFICATIONS_INGEST_URL`) — there is no other delivery path. Missing
+ * configuration is a startup error (thrown here, not discovered later as silent
+ * notification loss), so callers must construct this before a runtime starts
+ * trading, not lazily on first notify.
+ *
+ * Failure paths inside this service log at warn, not error: a delivery failure is a
+ * handled, degraded condition — the caller's notify() contract is fire-and-forget and
+ * the next notification retries the transport fresh.
  */
 export function createNotificationService(options) {
-    const chatId = typeof options?.telegram_chat_id === "string" ? options.telegram_chat_id.trim() : undefined;
     const mcpTransport = options?.mcpTransport;
-    const gatewayUrl = options?.gateway_url || process.env.OPENCLAW_GATEWAY_URL || "http://127.0.0.1:18789";
-    const gatewayToken = options?.gateway_token || process.env.OPENCLAW_GATEWAY_TOKEN;
-    if (chatId) {
-        logger.info(`Notifications enabled for ${chatId}; routing via OpenClaw /tools/invoke`);
+    const ingestUrl = (options?.ingest_url || process.env.NOTIFICATIONS_INGEST_URL)?.trim();
+    if (!ingestUrl) {
+        throw new Error("NotificationService misconfigured: NOTIFICATIONS_INGEST_URL is not set. " +
+            "The runtime has no notification transport — set NOTIFICATIONS_INGEST_URL " +
+            "(or pass options.ingest_url) before starting.");
+    }
+    const authToken = (options?.senpi_auth_token ||
+        process.env.SENPI_AUTH_TOKEN ||
+        process.env.SENPI_API_KEY)?.trim();
+    if (!authToken) {
+        throw new Error("NotificationService misconfigured: no Senpi auth token available. " +
+            "Set options.senpi_auth_token, or SENPI_AUTH_TOKEN / SENPI_API_KEY in the environment — " +
+            "the runtime authenticates to the notification-ingest endpoint with its own Senpi token.");
     }
+    const timeoutMs = options?.ingest_timeout_ms ?? DEFAULT_TIMEOUT_MS;
+    // Telegram delivery is gone; a recipe still carrying telegram_chat_id from before
+    // the cutover is a silent misconfiguration footgun otherwise — the operator set it
+    // expecting delivery and gets nothing. Ignore it, but say so loudly once.
+    if (typeof options?.telegram_chat_id === "string" && options.telegram_chat_id.trim().length > 0) {
+        logger.warn("telegram_chat_id is set but ignored: Telegram delivery has been removed.");
+    }
+    // Resolve the recipient once from THIS service's own token — never a process
+    // global — so sibling services with different tokens stamp different users.
+    const recipientUserId = decodeSenpiUserId(authToken);
+    if (recipientUserId === undefined) {
+        // A live runtime always holds a valid token, so an undecodable one is an
+        // anomaly. WARN only (never logger.error — see the reentrancy note above);
+        // delivery still proceeds unstamped.
+        logger.warn("Could not resolve recipient senpi_user_id from auth token; delivering notification unstamped.");
+    }
+    logger.info(`Notifications enabled; routing via POST ${ingestUrl}`);
     return {
-        async notify(message) {
+        async notify(input) {
+            const p = toPayload(input);
+            const message = p.message;
             if (typeof message !== "string" || message.length === 0)
                 return;
+            // Precedence: the service's own resolved recipient wins, but an
+            // unresolved token must never clobber a value already on the payload.
+            const recipient = recipientUserId ?? p.recipientUserId;
             const preview = message.length > 120 ? message.slice(0, 120) + "…" : message;
             logger.info("Notification service invoked", { messagePreview: preview });
-            if (!chatId) {
-                logger.warn("Notification not sent: no telegram_chat_id in runtime config.");
-                return;
-            }
-            // 1. Prefer MCP transport if host injects it in the future
+            // The openability fields (canOpenAgentChat + context) forward verbatim — never inferred,
+            // never repaired. notificationId/subtype fall back to the payload's own
+            // context when present (the producer already minted one), else this is the
+            // first and only place an id is minted for a bare-string/non-openable call.
+            const notificationId = p.context?.notificationId ?? randomUUID();
+            const subtype = p.subtype ?? p.context?.subtype;
+            // notifications-service renders user-visible text ONLY from these three
+            // actionMetadata fields (each `|| ""`) — it never displays the top-level
+            // `message`. A bare-string / copy-less notify() would otherwise ship a
+            // blank notification, so a copy-less payload always gets a synthesized
+            // fallback derived from `message` — every family ships non-empty copy.
+            const copy = p.copy ?? {
+                pushTitle: truncateForPush(message.split("\n")[0], PUSH_TITLE_MAX),
+                pushBody: truncateForPush(message.replace(/\n/g, " · "), PUSH_BODY_MAX),
+                inApp: message,
+            };
+            const envelope = {
+                notificationId,
+                message,
+                category: NOTIFICATION_CATEGORY,
+                source: NOTIFICATION_SOURCE,
+                timestamp: p.context?.createdAt ?? new Date().toISOString(),
+                canOpenAgentChat: p.canOpenAgentChat === true,
+                actionMetadata: {
+                    uniqueKeys: [notificationId],
+                    ...(subtype !== undefined ? { notificationSubtype: subtype } : {}),
+                    id: notificationId,
+                    pushNotificationTitle: copy.pushTitle,
+                    pushNotificationMessage: copy.pushBody,
+                    inAppNotificationMessage: copy.inApp,
+                    senpiFormattedMessage: copy.inApp,
+                    ctas: [],
+                    category: NOTIFICATION_CATEGORY,
+                },
+                // Same id drives the ingest endpoint's idempotency precedence, so the two
+                // attempts of one delivery (see `deliver`'s bounded retry) collapse to a
+                // single ledger row even if the first attempt's response was lost.
+                idempotencyKey: notificationId,
+            };
+            if (p.context !== undefined)
+                envelope.context = p.context;
+            if (recipient !== undefined)
+                envelope.recipientUserId = recipient;
+            // Test-only seam: the deployed OpenClaw gateway never injects mcpTransport
+            // for notifications, so this branch only ever runs under test. When present
+            // it short-circuits before any HTTP call.
             if (mcpTransport) {
                 try {
-                    await mcpTransport("send_telegram_notification", { target: `telegram:${chatId}`, message });
-                    return;
-                }
-                catch (err) {
-                    logger.warn("MCP transport failed; falling back to Gateway HTTP", err);
-                }
-            }
-            // 2. HTTP Gateway Tool Invocation (Matches your LLM Engine)
-            if (gatewayToken) {
-                try {
-                    const baseUrl = gatewayUrl.endsWith("/") ? gatewayUrl.slice(0, -1) : gatewayUrl;
-                    const res = await fetch(`${baseUrl}/tools/invoke`, {
-                        method: "POST",
-                        headers: {
-                            "Content-Type": "application/json",
-                            "Authorization": `Bearer ${gatewayToken}`
-                        },
-                        body: JSON.stringify({
-                            tool: "message",
-                            args: {
-                                action: "send",
-                                target: `telegram:${chatId}`,
-                                message: message,
-                            },
-                        })
-                    });
-                    if (!res.ok) {
-                        const errText = await res.text().catch(() => "No response body");
-                        throw new Error(`HTTP ${res.status}: ${errText}`);
-                    }
-                    const body = await res.json();
-                    if (!body.ok) {
-                        throw new Error(`Gateway rejected message tool: ${body.error ?? JSON.stringify(body)}`);
-                    }
-                    return;
+                    await mcpTransport("notify", envelope);
                 }
                 catch (err) {
-                    logger.warn("Gateway tool invocation failed", err);
+                    logger.warn("mcpTransport notify failed", undefined, { err: describeError(err) });
                 }
                 return;
             }
-            logger.warn("Notification dropped: Missing OPENCLAW_GATEWAY_TOKEN in environment.");
+            await deliver(ingestUrl, authToken, envelope, timeoutMs);
         },
     };
 }