@senpi/runtime 3.0.59 → 3.0.62

package/dist/cli/guide-commands.js

@@ -24,6 +24,7 @@ Quick commands:
   senpi guide actions     Action types and decision modes
   senpi guide dsl         DSL exit: phases, lock modes, tiers, time-based cuts
   senpi validate <pkg>    Prove a strategy runs before funding it (static → import → live)
+  senpi deploy -p <pkg>   Take a proven package live: create+fund → install → verified tick
   senpi scanner           Per-scanner health: runs, errors, liveness, "(no signals yet)" flag
   senpi events            Local domain-event log — the trade narrative
   senpi explain <asset>   Stitch one asset's position lifecycle from the event log
@@ -478,11 +479,75 @@ senpi config — Manage CLI preferences (~/.openclaw/senpi-cli.json)
   config unset <key>                   Remove a key
   config reset                         Clear all preferences
 
+senpi deploy — Take a strategy package live, end to end (the strategy lifecycle)
+  openclaw senpi deploy -p <package-dir> --budget <usd>   # start (detached): preflight → create+fund → install → verified tick
+  openclaw senpi deploy status                            # watch until terminal; quotes the verified report
+    -p, --path <dir>                     Strategy package directory (contains strategy.yaml)
+    --budget <usd>                       Total budget across the package's wallets (min $10/wallet)
+    --decision-model <model>             Required if the package uses decision_mode: llm
+    --tick-wait <seconds>                Wait for one verified scanner tick (default 120, 0 skips)
+    --max-wait <seconds>                 Wait for wallets to reach ACTIVE (default 150)
+    --json                               Raw JSON output
+                                       deploy returns in ~1s; the job runs detached. Poll
+                                       'deploy status' until it is terminal. Exit codes:
+                                       0 live · 2 refused · 3 failed · 4 installed-unobserved ·
+                                       5 interrupted · 6 pending/running · 1 error. An
+                                       unobserved tick reports as "unobserved", never as success.
+                                       'deploy' itself uses the same classes at START: 0 job
+                                       started · 2 refused (the message leads with its code, e.g.
+                                       [INVALID_REQUEST]) · 1 internal/transport. So 2 always
+                                       means obey the message; 1 always means the deploy's state
+                                       is unknown — never retry a 2.
+                                       A package no 'senpi validate' has ever proven — or one whose
+                                       files have changed since, or whose proof predates this
+                                       runtime — is refused BEFORE any money moves. The refusal
+                                       leads with [E_VALIDATE_NO_PROOF] /
+                                       [E_VALIDATE_CONTENT_CHANGED] /
+                                       [E_VALIDATE_RUNTIME_VERSION_CHANGED] and names the exact
+                                       validate command for the instance that failed. Two instances
+                                       sharing one runtime directory are refused outright
+                                       ([INVALID_REQUEST]): a proof lives beside its recipe, one
+                                       file per directory, so it cannot speak for both.
+                                       Budget is two-tier: BELOW the $10/wallet floor it refuses
+                                       [E_FUNDS_BELOW_FLOOR]; and when the split leaves a wallet
+                                       under its OWN sizing it DEPLOYS and warns
+                                       [W_BUDGET_BELOW_STRATEGY_MIN] (that sleeve runs degraded —
+                                       fewer slots than authored). [W_BUDGET_UNRESOLVED] = the
+                                       minimum could not be computed and may be understated.
+                                       Neither warn stops a deploy; both judge each wallet against
+                                       its OWN allocation, not the budget against the package
+                                       total (those differ once a sleeve is adopted). To run the
+                                       authored design you must close and redeploy — a re-run at
+                                       a bigger --budget only adopts the wallet it already made.
+                                       Follow the warn's own close command verbatim; it is scoped
+                                       to the short sleeves so adopted wallets are left alone.
+                                       Some reports deliberately carry NO close command (a funded
+                                       wallet with no runtime installed; a funding_share: 0
+                                       sleeve; or when [E_ROLLBACK_INCOMPLETE] owns the cleanup)
+                                       — that is the correct answer there, not a gap to fill:
+                                       never substitute a package-wide close.
+                                       Both of those judge the PLAN. After the wallets exist the
+                                       report also checks the OUTCOME: when the backend lands under
+                                       90% of what a wallet was asked to be funded, it warns
+                                       [W_BUDGET_PARTIAL_FUND] with both numbers ("funded $60.00 of
+                                       requested $500.00 (12%, short $440.00)"). The strategy is
+                                       still live and the exit code does not move — do NOT close it
+                                       over the shortfall. Quote the FUNDED figure, never the
+                                       requested one. Those figures are AT DEPLOY TIME and the note
+                                       re-renders on every later status read, so re-read the
+                                       current funding (status.py) before moving money, then top up
+                                       via the senpi-deposit-withdraw-transfer skill;
+                                       close-and-redeploy is the destructive fallback. The warn is
+                                       silent wherever a D-6 rollback was attempted — if the create
+                                       step carries [E_ROLLBACK_INCOMPLETE], THAT line owns the
+                                       remediation (reclaim), and it is the one to follow.
+                                       When the backend reports no readable funded amount at all,
+                                       you get [W_BUDGET_FUNDED_UNREADABLE] instead: no percentage,
+                                       no shortfall, no top-up. The funded amount is UNKNOWN, never
+                                       $0.00 — ask the USER to verify what actually landed before
+                                       any money action
+
 senpi runtime — Manage runtimes
-  runtime create                       Add a runtime from a YAML file
-    -p, --path <path>                    Path to strategy YAML file
-    -c, --content <yaml>                 Inline YAML content
-    --runtime-id <id>                    Override auto-derived ID
   runtime delete [id]                  Remove a runtime
     --id <runtime_id>                    Delete by runtime ID
     --address <wallet>                   Delete by wallet address
@@ -510,6 +575,12 @@ senpi validate — Prove a strategy can execute BEFORE it is funded
                  command, not the code
   A full unscoped PASS at live depth writes .senpi-proof.json beside the recipe
   (content-addressed, no expiry); the deploy gate verifies it via verifyProof().
+  That gate REFUSES, before any money moves: [E_VALIDATE_NO_PROOF] nothing here
+  was ever observed to run · [E_VALIDATE_CONTENT_CHANGED] the files moved since
+  the proof, and it names which · [E_VALIDATE_RUNTIME_VERSION_CHANGED] the proof
+  predates the running runtime (the package needs no edit — just re-prove it).
+  A proof attests that this content RAN and passed, not that every check at that
+  depth produced a verdict — deploy re-checks the live instrument universe itself.
 
 senpi status — Lightweight runtime health digest
   status                               Overall health + scanners (with degraded count),
@@ -623,8 +694,9 @@ senpi.installRuntime
   Success: { id, name, wallet }
   Errors:  INVALID_REQUEST (missing YAML, duplicate ID/wallet, or the install gate: a recipe that
            cannot trade — no margin source, no risk guardrails, missing scanner entrypoint, or an
-           unresolvable scanner path — is refused with what/why/fix per problem),
-           UNAVAILABLE (bad YAML, start failure)
+           unresolvable scanner path — is refused with what/why/fix per problem, the message
+           leading with the bracketed code of the first blocking finding, e.g.
+           [E_VALIDATE_UNGATED]), UNAVAILABLE (bad YAML, start failure)
 
 senpi.listRuntimes
   Params:  (none)

package/dist/cli/guide-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"guide-commands.js","sourceRoot":"","sources":["../../src/cli/guide-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,aAAa,GACjB,0EAA0E,CAAC;AAE7E,+EAA+E;AAE/E,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC;qBACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuB3B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoIrB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FhB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+GnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqN9B,CAAC,IAAI,EAAE,CAAC;AAYT;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAAe;IAEf,MAAM,KAAK,GAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAsB;SACvD,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAE3D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAsB;SACvC,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAsB;SAC1C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"guide-commands.js","sourceRoot":"","sources":["../../src/cli/guide-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,aAAa,GACjB,0EAA0E,CAAC;AAE7E,+EAA+E;AAE/E,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC;qBACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwB3B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoIrB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FhB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+GnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4R9B,CAAC,IAAI,EAAE,CAAC;AAYT;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAAe;IAEf,MAAM,KAAK,GAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAsB;SACvD,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAE3D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAsB;SACvC,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAsB;SAC1C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/senpi-commands.d.ts

@@ -24,7 +24,12 @@ export declare function renderEventsDigest(entries: StoredEvent[]): string;
 export declare function renderExplain(asset: string, entries: StoredEvent[]): string;
 /** Minimal Commander command type for subcommands and options. */
 interface CommanderCommand {
-    command(name: string, desc?: string): CommanderCommand;
+    /** Commander 14 accepts either a description string or an options object (e.g. `{ hidden: true }`). */
+    command(name: string, descOrOpts?: string | {
+        hidden?: boolean;
+    }, opts?: {
+        hidden?: boolean;
+    }): CommanderCommand;
     description(desc: string): CommanderCommand;
     argument(name: string, description?: string): CommanderCommand;
     option(flags: string, description?: string): CommanderCommand;

package/dist/cli/senpi-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"senpi-commands.d.ts","sourceRoot":"","sources":["../../src/cli/senpi-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,gBAAgB,GAAG,OAAO,CAAA;CAAE,GAChF,IAAI,CA4vCN;AAgKD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAWvE;AAmDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CASjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAW3E;AA8HD,kEAAkE;AAClE,UAAU,gBAAgB;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACvD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC9D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACtE,MAAM,CACJ,EAAE,EACE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzD,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzE,gBAAgB,CAAC;CACrB"}
+{"version":3,"file":"senpi-commands.d.ts","sourceRoot":"","sources":["../../src/cli/senpi-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,gBAAgB,GAAG,OAAO,CAAA;CAAE,GAChF,IAAI,CAgxCN;AAyVD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAWvE;AAmDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CASjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAW3E;AA8HD,kEAAkE;AAClE,UAAU,gBAAgB;IACxB,uGAAuG;IACvG,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAC1C,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,gBAAgB,CAAC;IACpB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC9D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACtE,MAAM,CACJ,EAAE,EACE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzD,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzE,gBAAgB,CAAC;CACrB"}

package/dist/cli/senpi-commands.js

@@ -11,6 +11,8 @@ import { spawnSync } from "../utils/safe-spawn.js";
 import path from "node:path";
 import { registerGuideCommands, CHEATSHEET_TEXT } from "./guide-commands.js";
 import { registerSenpiConfigCommands } from "./senpi-config-commands.js";
+import { exitCodeForDeploy, renderDeploySnapshot } from "./deploy-render.js";
+import { isRefusalMessage } from "../deploy/taxonomy.js";
 import { registerValidateCommand } from "./validate-command.js";
 import { VERSION } from "../version.js";
 /**
@@ -27,14 +29,18 @@ export function registerSenpiCli(program) {
     });
     registerSenpiConfigCommands(senpi);
     registerValidateCommand(senpi);
+    registerDeployCommands(senpi);
     const runtime = senpi.command("runtime");
     runtime.description("Manage runtimes");
     runtime
-        .command("create")
-        .description("Add a runtime from a YAML file or paste YAML; the gateway validates and runs it")
+        // Demoted, not deleted: `senpi deploy` is the supported path (funds preflight + attribution +
+        // verified tick). Hidden keeps it out of help/routing while deploy.py keeps working.
+        .command("create", { hidden: true })
+        .description("Internal — prefer `senpi deploy` (funds preflight + attribution + verified tick). Direct create skips those gates.")
         .option("-p, --path <path>", "Path to your strategy YAML file")
         .option("-c, --content <content>", "Paste YAML content directly")
         .option("--runtime-id <id>", "Name for this runtime (default: from file name or content)")
+        .option("--runtime-yaml-dir <dir>", "Directory to resolve relative scanner paths against (content installs only)")
         .action(async (opts) => {
         const hasPath = typeof opts.path === "string" && opts.path.length > 0;
         const hasContent = typeof opts.content === "string";
@@ -75,7 +81,13 @@ export function registerSenpiCli(program) {
             // scanner's relative `path: ./` and the scaffold can import scan.py. We
             // send content (not path) so remote gateways work, but that drops the
             // directory; this hint restores it for FS-sharing (local/box) setups.
-            ...(hasPath ? { runtimeYamlDir: path.dirname(path.resolve(process.cwd(), opts.path)) } : {}),
+            // An explicit --runtime-yaml-dir wins: it is the only way a content install can name
+            // the directory its relative scanner paths resolve against (otherwise refused).
+            ...(typeof opts.runtimeYamlDir === "string" && opts.runtimeYamlDir.length > 0
+                ? { runtimeYamlDir: path.resolve(process.cwd(), opts.runtimeYamlDir) }
+                : hasPath
+                    ? { runtimeYamlDir: path.dirname(path.resolve(process.cwd(), opts.path)) }
+                    : {}),
             ...(typeof opts.runtimeId === "string" && opts.runtimeId.length > 0 ? { id: opts.runtimeId } : {}),
         };
         // Runtime create is a SLOW synchronous call: the handler starts a long-lived
@@ -600,7 +612,9 @@ export function registerSenpiCli(program) {
         const params = {};
         if (typeof opts.runtime === "string" && opts.runtime.length > 0)
             params.runtimeId = opts.runtime;
-        const data = callGatewayJson("senpi.getHealthStatus", params);
+        // Same class as the deploy verbs' null-data path: a health surface that exits 0 after
+        // reading no health is the one thing it exists not to do.
+        const data = callGatewayJson("senpi.getHealthStatus", params, (cause) => reportUnreadableGateway("senpi status", cause, " No health was read."));
         if (!data) {
             return;
         }
@@ -1101,11 +1115,151 @@ function fmtMetricNum(n) {
         return String(n);
     return n.toFixed(2);
 }
-function callGatewayJson(method, params) {
+/**
+ * The `senpi deploy` verb pair — the agent-facing surface for the whole go-live
+ * path. There is no `cancel` (D-4): undeploying a strategy is closing it, and a
+ * wedged job frees its own slot at the deadline. `deploy` starts a DETACHED job and returns in ~1s; monitoring is explicit
+ * polling of `deploy status`. The `senpi.deploy.*` gateway methods behind these
+ * verbs are internal transport and are deliberately not documented anywhere an
+ * agent reads.
+ */
+function registerDeployCommands(senpi) {
+    const deploy = senpi
+        .command("deploy")
+        .description("Deploy a strategy package end-to-end (detached): funds preflight, wallet create+fund, install, one observed tick. " +
+        "Starts the job and returns — watch with `senpi deploy status`. " +
+        "Start exit codes: 0 job started · 2 refused (the message leads with the code) · 1 internal/transport error")
+        // NOT `requiredOption`: Commander checks mandatory options by walking the ancestor chain from
+        // the leaf command, so a mandatory `-p` on this parent makes `deploy status` fail before
+        // dispatch ("required option '-p, --path <dir>' not specified"). The start action carries its
+        // own explicit guard below, so nothing is lost.
+        .option("-p, --path <dir>", "Strategy package directory (contains strategy.yaml)")
+        .option("--budget <usd>", "Total budget in USD across the package's wallets (min $10/wallet)")
+        .option("--decision-model <model>", "Model for llm-decision actions (required if the package uses decision_mode: llm)")
+        .option("--tick-wait <seconds>", "How long the job waits to observe one verified scanner tick (default 120, 0 skips)")
+        .option("--max-wait <seconds>", "How long the job waits for wallets to reach ACTIVE (default 150)")
+        .option("--json", "Print the raw start response JSON")
+        .action(async (opts) => {
+        // Every numeric flag is validated the same way. A silently-dropped NaN would run the job
+        // with the default window while the agent believes its own value took effect.
+        // These local guards are REFUSALS, not usage errors: nothing was started, and re-running
+        // the same command can only refuse again. They carry the taxonomy code and exit 2 like
+        // every other start-time refusal — reported as 1 the newly-taught start map reads them as
+        // "transport error, state unknown", whose natural handling is to poll `deploy status`.
+        const numeric = (flag, raw, example) => {
+            if (raw === undefined)
+                return undefined;
+            const value = Number(raw);
+            if (!Number.isFinite(value)) {
+                console.error(`[INVALID_REQUEST] ${flag} must be a number, e.g. ${flag} ${example}. Nothing was started.`);
+                return null;
+            }
+            return value;
+        };
+        const budget = numeric("--budget", opts.budget, "500");
+        const tickWaitSec = numeric("--tick-wait", opts.tickWait, "120");
+        const maxWaitSec = numeric("--max-wait", opts.maxWait, "150");
+        if (budget === null || tickWaitSec === null || maxWaitSec === null) {
+            process.exitCode = DEPLOY_REFUSED_EXIT;
+            return;
+        }
+        if (!opts.path) {
+            // This guard fires BEFORE the gateway is called, so the gateway's own coded
+            // missing-package-dir refusal is unreachable from the CLI — this surface has to carry
+            // it verbatim rather than degrade it to a codeless usage error.
+            console.error("[INVALID_REQUEST] A strategy package directory is required. Nothing was started. " +
+                "Run: senpi deploy -p <package-dir> --budget <usd>");
+            process.exitCode = DEPLOY_REFUSED_EXIT;
+            return;
+        }
+        const params = {
+            packageDir: path.resolve(process.cwd(), opts.path),
+            ...(budget !== undefined ? { budget } : {}),
+            ...(opts.decisionModel ? { decisionModel: opts.decisionModel } : {}),
+            ...(tickWaitSec !== undefined ? { tickWaitSec } : {}),
+            ...(maxWaitSec !== undefined ? { maxWaitSec } : {}),
+        };
+        const data = callGatewayJson("senpi.deploy.start", params, (cause) => reportUnreadableGateway("senpi deploy", cause, DEPLOY_STATE_UNKNOWN_HINT));
+        if (!data)
+            return;
+        if (data.ok === false) {
+            const err = data.error;
+            const message = err?.message ?? "Deploy start failed.";
+            console.error(message);
+            // D-12 all the way down: `2 = refused`, `1 = internal/transport`. Every start-time gate
+            // (the [INVALID_REQUEST] family — no DSL exit, missing decision model/env, scanner
+            // `enabled` key, non-positive budget, missing/unreadable package — plus
+            // [E_DEPLOY_IN_PROGRESS]) is a refusal, and the taught surfaces tell agents to branch on
+            // the code. Reported as 1 they read as "internal/transport error", whose natural
+            // handling is retry rather than obey — a retried no-stop-loss refusal is the whole bug.
+            process.exitCode = isRefusalMessage(message) ? DEPLOY_REFUSED_EXIT : 1;
+            return;
+        }
+        const started = (data.payload ?? data);
+        if (opts.json) {
+            console.log(JSON.stringify(started, null, 2));
+            return;
+        }
+        console.log(`deploy ${started.deployId} started — phase: ${started.phase}`);
+        console.log("  watch:  openclaw senpi deploy status");
+    });
+    deploy
+        .command("status [deployId]")
+        .description("Show the deploy job: phase while running; the full verified report once terminal. " +
+        "Exit codes: 0 live · 2 refused · 3 failed · 4 installed-unobserved · 5 interrupted · " +
+        "6 pending/still running · 1 error")
+        .option("--json", "Print the raw snapshot JSON")
+        .action(async (deployId, opts) => {
+        const data = callGatewayJson("senpi.deploy.status", deployId ? { deployId } : {}, (cause) => reportUnreadableGateway("senpi deploy status", cause, DEPLOY_STATE_UNKNOWN_HINT));
+        if (!data)
+            return;
+        if (data.ok === false) {
+            console.error(data.error?.message ?? "Status failed.");
+            process.exitCode = 1;
+            return;
+        }
+        const snap = (data.payload ?? data);
+        // D-12: the exit code applies on the --json path too, so a JSON consumer gets the code AND
+        // the payload rather than having to choose.
+        process.exitCode = exitCodeForDeploy(snap);
+        if (opts?.json) {
+            console.log(JSON.stringify(snap, null, 2));
+            return;
+        }
+        renderDeploySnapshot(snap);
+    });
+}
+/** D-12: `2 = refused`. Named so the start action's guards and its gateway branch cannot drift. */
+const DEPLOY_REFUSED_EXIT = 2;
+/** Appended to a deploy verb's unreadable-gateway message: the one surface that can still answer. */
+const DEPLOY_STATE_UNKNOWN_HINT = " This says nothing about the deploy itself — if the gateway is up, ask `senpi deploy status` " +
+    "for the job's real state, and check the gateway log if that keeps failing.";
+/**
+ * The answer for a `gateway call` that produced nothing this CLI could read.
+ *
+ * Always 1 (internal/transport), never 0 — under D-12 a 0 from a deploy verb means `live`, and this
+ * path learned nothing about the job. Deliberately overrides whatever exit code the subprocess
+ * carried, so a `gateway call` that happened to exit 3 cannot masquerade as D-12 `failed`. It never
+ * claims the deploy failed either: a started job may be running right now.
+ */
+function reportUnreadableGateway(verb, cause, followUp = "") {
+    process.exitCode = 1;
+    console.error((cause === "dispatch"
+        ? `${verb}: the \`gateway call\` subprocess failed, so nothing was read back — exit 1 (transport/internal).`
+        : `${verb}: the gateway answered but its response could not be read — exit 1 (transport/internal).`) +
+        followUp);
+}
+/**
+ * `onFailure` fires on either null path, naming which one. Callers that pass it own the exit code
+ * and the message; callers that omit it keep the historical behaviour (the subprocess's own code
+ * plus the gateway-not-running tip, and a silent return on unparseable stdout).
+ */
+function callGatewayJson(method, params, onFailure) {
     const result = spawnSync(process.argv[0], [process.argv[1], "gateway", "call", method, "--json", "--params", JSON.stringify(params)], { stdio: ["inherit", "pipe", "inherit"], cwd: process.cwd(), encoding: "utf8" });
     if (result.status !== 0) {
         process.exitCode = result.status ?? 1;
         console.error("\nTip: If the gateway is not running, start it with: openclaw gateway run");
+        onFailure?.("dispatch");
         return null;
     }
     try {
@@ -1113,6 +1267,11 @@ function callGatewayJson(method, params) {
     }
     catch {
         process.stdout.write(result.stdout ?? "");
+        // Unparseable stdout means this command did NOT do what its output implies, so it must never
+        // exit 0. Set here rather than per-verb so the swallow cannot re-seed itself on the next
+        // caller; verbs that pass `onFailure` refine the message, not the code.
+        process.exitCode = 1;
+        onFailure?.("unreadable");
         return null;
     }
 }