@senpi/runtime 3.0.59 → 3.0.63

package/dist/deploy/register.js

@@ -0,0 +1,689 @@
+import { describeScannerEnabledOffense, instancesWithoutDslExit, loadDeployPackage, lowercasePackageIdFix, nonLowercasePackageId, readRuntimeYaml, runtimeUsesLlmDecisions, sanitizeStrategyName, scannersDeclaringEnabled, walletName, } from "./package.js";
+import { budgetArg, MIN_WALLET, usd } from "./funding.js";
+import { deployPyValidateCommand, PROOF_ROUTE_NOTE, recheckBlock, } from "./recheck-commands.js";
+import path from "node:path";
+import { withSpan } from "../telemetry/tracing.js";
+import { recordDeployRollback, recordDeployStep } from "../telemetry/metrics.js";
+import { isClosing, isDead } from "../senpi/strategy-status.js";
+import { DEFAULT_MAX_WAIT_SEC, DEFAULT_TICK_WAIT_SEC, isWaitInRange, jobCapMs, MAX_WAIT_SEC, MIN_WAIT_SEC, } from "./deadlines.js";
+import { extractTaxonomyCode } from "./taxonomy.js";
+import { runDeploy } from "./orchestrator.js";
+import { MCP_CALL_TIMEOUT_MS } from "./job.js";
+/** The real clock for every orchestrator poll loop (create-ACTIVE and observe-tick alike). */
+const POLL_SLEEP = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+// ─── refusal / message builders ─────────────────────────────────────────────
+function invalidRequest(message) {
+    return { code: "INVALID_REQUEST", message };
+}
+function notFound(message) {
+    return { code: "NOT_FOUND", message };
+}
+/**
+ * The package, or one of its instance runtime.yamls, could not be read or parsed.
+ *
+ * Carries the code every other start-time refusal carries, and not for tidiness: the CLI classifies
+ * a start error by its code (`[…]` → exit 2 = refused, otherwise 1 = internal/transport). This was
+ * the one refusal that relayed a bare parser message, so it exited 1 — "retry me" — and retrying a
+ * malformed package never helps.
+ *
+ * TWO states reach it, and they differ in exactly one thing that matters — whether the instances are
+ * known. `loadDeployPackage` failing means there is no package at all, and the root is then the only
+ * target either re-check can take; it is also the right one, since `senpi validate` at a package root
+ * whose manifest will not read refuses with that same manifest error rather than validating
+ * something else. A pre-check failing means the manifest READ fine and one of its recipes will not
+ * parse — the package is fully known there, so the re-check names every instance directory. Naming
+ * the root on that path would send a multi-instance reader to `[E_VALIDATE_NO_RECIPE] … pick an
+ * instance`: a second refusal in place of the check they were told to run.
+ */
+function buildUnreadablePackageRefusal(packageDir, err, pkg) {
+    const what = pkg
+        ? `Could not read a runtime recipe in the strategy package at ${packageDir}`
+        : `Could not read the strategy package at ${packageDir}`;
+    const dirs = pkg ? pkg.instances.map((inst) => inst.runtimeYamlDir) : [packageDir];
+    return (`[INVALID_REQUEST] ${what}: ` +
+        `${err instanceof Error ? err.message : String(err)}. Nothing was started. Fix the package, ` +
+        `then re-check it read-only with either route:\n` +
+        // The python route always takes the package: it validates one, and there is no instance form
+        // of it to render.
+        `${recheckBlock(dirs, deployPyValidateCommand(packageDir))}\n` +
+        `${PROOF_ROUTE_NOTE} Then re-run.`);
+}
+function buildMissingPackageDirRefusal() {
+    return ("[INVALID_REQUEST] A strategy package directory is required. Nothing was started. " +
+        "Run: openclaw senpi deploy -p <package-dir> --budget <usd>");
+}
+/** Hint computed from the LIVE job, never templated — the taxonomy rule for every refusal. */
+function buildInProgressRefusal(running) {
+    return (`[E_DEPLOY_IN_PROGRESS] deploy ${running.deployId} is ${running.phase} for package ` +
+        `${running.packageId}. One deploy runs at a time. Watch it: openclaw senpi deploy status. A wedged job ` +
+        `times out and frees the slot on its own.`);
+}
+function buildDecisionModelRefusal(instances, packageDir) {
+    return (`[INVALID_REQUEST] Instance(s) ${instances.join(", ")} run actions with decision_mode: llm, but ` +
+        `no decision model was given. Nothing was started. Re-run naming the model: ` +
+        `openclaw senpi deploy -p '${packageDir}' --budget <usd> --decision-model <model>`);
+}
+function buildDecisionModelEnvRefusal(instances, packageDir) {
+    return (`[INVALID_REQUEST] Instance(s) ${instances.join(", ")} run actions with decision_mode: llm, but ` +
+        `${packageDir}/strategy.yaml declares no defaults.decision_model_env — there is no token to ` +
+        `substitute the model into. Nothing was started. Add defaults.decision_model_env to ` +
+        `strategy.yaml, bind it in the runtime.yaml, then re-run.`);
+}
+function buildNoDslExitRefusal(instances, packageDir) {
+    return (`[INVALID_REQUEST] Instance(s) ${instances.map((inst) => inst.name).join(", ")} declare no DSL ` +
+        `exit block (\`exit.dsl_preset\`, or \`exit.engine: dsl\`) — every position they open would run ` +
+        `with no stop loss and no trailing floor. Nothing was started. Add an exit block to the instance ` +
+        `runtime.yaml, then re-check read-only with either route:\n` +
+        // One `senpi validate` per OFFENDING instance directory, computed from the instance rather than
+        // templated: the offence is per-recipe, and so is the proof that clears it.
+        `${recheckBlock(instances.map((inst) => inst.runtimeYamlDir), deployPyValidateCommand(packageDir))}\n` +
+        `${PROOF_ROUTE_NOTE} Then re-run.`);
+}
+/**
+ * D-2 (revised 2026-08-05): a scanner-level `enabled` key is refused outright — the engine never
+ * reads it, so accepting `enabled: false` would ship a strategy that ticks and trades while its
+ * author believes it is switched off. Package-derivable, so it refuses here with the other local
+ * pre-checks, before a job exists let alone a wallet; the orchestrator keeps its own copy.
+ *
+ * Every offense is enumerated in ONE refusal, each as a delete-this-line instruction naming the
+ * key, the scanner, the instance and the file: a reader (agent or human) fixes the whole package in
+ * one pass instead of re-running to discover the next one.
+ */
+function buildScannerEnabledUnsupportedRefusal(offenders, packageDir) {
+    return (`[INVALID_REQUEST] Unsupported \`enabled\` key on ${offenders.length} scanner entr` +
+        `${offenders.length === 1 ? "y" : "ies"}. Nothing was started. Fix — delete these lines:\n` +
+        offenders.map((entry) => `  - ${describeScannerEnabledOffense(entry)}`).join("\n") +
+        `\nWhy: the runtime engine never reads a scanner-level \`enabled\` (the scanner schema passes ` +
+        `it through untyped and registration comes from the strategy, not the scanner entry), so an ` +
+        `\`enabled: false\` scanner registers ENABLED and ticks — the package would trade while you ` +
+        `believe it is off. A scanner runs because the package declares it: to stop one, remove the ` +
+        `scanner entry itself, or disable it after install through the runtime API (\`disableScanner\`). ` +
+        `Then re-run: openclaw senpi deploy -p '${packageDir}' --budget <usd>`);
+}
+/**
+ * A package id carrying capitals, refused before a job exists.
+ *
+ * The id becomes each wallet's `skillName` attribution stamp VERBATIM at create, and the backend
+ * stores what it is given case-normalized — so a mixed-case id is stamped under one spelling and
+ * looked up under another. Package-derivable, so it refuses here with the other local pre-checks;
+ * the orchestrator keeps its own copy, and both build their fix from the one producer so the edit
+ * an author reads is word-for-word the same wherever the refusal is raised.
+ *
+ * The re-run command names the directory the fix LEAVES BEHIND, not the one that failed: this is
+ * the only refusal in the verb whose own instruction can move the package.
+ */
+function buildNonLowercaseIdRefusal(pkg) {
+    const fix = lowercasePackageIdFix(pkg.id, pkg.dir);
+    return (`[INVALID_REQUEST] strategy.yaml id "${pkg.id}" must be lowercase. Nothing was started. ` +
+        `Fix — ${fix.instruction}. Why: deploy writes the id into each wallet's \`skillName\` ` +
+        `attribution stamp VERBATIM at create, and the backend stores what it is given ` +
+        `case-normalized, so a mixed-case id is stamped under one spelling and looked up under ` +
+        `another — that is how \`close.py '${pkg.id}'\` came to report "no OPEN strategies to close." ` +
+        `over a live, funded, trading wallet. Every reader now folds case, so wallets already stamped ` +
+        `in any case are still found and this package will ADOPT the ones it already owns rather than ` +
+        `fund a second set beside them. Then re-run: ` +
+        `openclaw senpi deploy -p '${fix.dirAfterFix}' --budget <usd>`);
+}
+/**
+ * `--budget 0` parses (`readNumber(0)` → 0) and the required-budget gate checks only `undefined`,
+ * so without this gate a zero budget reaches `planFunding`, which floors every wallet to
+ * MIN_WALLET — funding money the user never asked to spend. `--budget ≤ $0` is the taxonomy's
+ * rule-4 field case: its only known source is a buggy computed hint, so the refusal names the real
+ * fix. The orchestrator's preflight keeps its own copy of this gate, so every caller stays gated.
+ */
+function buildNonPositiveBudgetRefusal(budget, packageDir) {
+    return (`[INVALID_REQUEST] --budget must be a positive USD amount (got ${budgetArg(budget)}): a zero or ` +
+        `negative budget cannot fund any wallet at the ${usd(MIN_WALLET)}/wallet floor. Nothing was ` +
+        `started. If a report suggested \`--budget ${budgetArg(budget)}\`, that hint was a bug, not an ` +
+        `instruction — a sleeve declaring \`funding_share: 0\` is fixed by giving it a share in ` +
+        `strategy.yaml, never by re-deploying. Re-run: openclaw senpi deploy -p '${packageDir}' --budget <usd>`);
+}
+/**
+ * A wait the verb will not run on. Money-safe either way — nothing is created before this gate —
+ * so what it prevents is narration: an out-of-range wait produces a job cap that the timer rewrites
+ * (Node clamps a delay past 2^31-1 to 1ms) or that is already in the past, and the journal then
+ * reports "deploy deadline (999999999s) exceeded" about a run that lasted milliseconds.
+ *
+ * Names the value it got, the range, and the default the flag falls back to when omitted — the
+ * three things a caller needs to fix a typo without guessing.
+ */
+function buildWaitOutOfRangeRefusal(bad, packageDir) {
+    return (`[INVALID_REQUEST] ${bad.flag} must be between ${MIN_WAIT_SEC} and ${MAX_WAIT_SEC} seconds ` +
+        `(got ${bad.value}). Nothing was started. Outside that range the job's wall-clock cap is not a ` +
+        `deadline the run can honour — a negative one is already past, and a huge one overflows the ` +
+        `timer and fires at once — so the deploy would be abandoned before it began while the journal ` +
+        `narrated the deadline you asked for. Re-run with a value in range, or omit the flag for the ` +
+        `default (${bad.fallback}s): openclaw senpi deploy -p '${packageDir}' --budget <usd>`);
+}
+function buildNoJobsRefusal() {
+    return ("[NOT_FOUND] No deploy has been started on this agent. Start one: " +
+        "openclaw senpi deploy -p <package-dir> --budget <usd>");
+}
+/**
+ * D-6, crash case: the boot scan never moves money, so an interrupted deploy may have left a funded
+ * wallet with no runtime on it. The resume command alone would hide that — name BOTH exits, and the
+ * amount, computed from the fresh live read rather than from the journal.
+ *
+ * A wallet whose `totalFunded` the backend did not report is IN this warning with its figure named
+ * unreadable: dropping it (what `?? 0` did) is the not-funded direction of the same rule that
+ * forbids printing it as `$0.00`, and it silenced the whole warning whenever that was the only
+ * wallet. No sum is quoted over a set that contains one.
+ *
+ * SCOPED by the same one-authority/precondition rule as the budget escape (this was the last
+ * un-scoped teardown hint in the verb): the live read includes the runtime registry, so "nothing is
+ * watching it" is only ever said about a wallet with NO registered runtime, and every teardown this
+ * function offers targets the addresses the read actually returned. A runtimeless wallet's route is
+ * a direct `strategy_close` on the address — `close.py --instance` resolves through the runtime it
+ * does not have (mirrors E_ROLLBACK_INCOMPLETE's instruction). The package-wide `close.py <id>` is
+ * never the offered route, on any branch: it discovers targets by attribution stamp and can reach
+ * strategies this read cannot enumerate, so it is named only with that radius stated. A wallet WITH
+ * a registered runtime gets no teardown offer at all: closing it would tear down a strategy that
+ * may be running as intended.
+ */
+function buildInterruptedNext(meta, live) {
+    const resume = buildResumeCommand(meta);
+    // An UNREADABLE `totalFunded` stays in: `?? 0` read it as not-funded and dropped the wallet from
+    // this warning altogether, so a lone stranded wallet whose figure the backend never reported got
+    // the bare resume command with no mention of money at all. Under-warning is the same failure as
+    // rendering the figure as $0.00 — unknown is money of unknown size until someone reads it.
+    const funded = live.strategies.filter((s) => (s.totalFunded === undefined || s.totalFunded > 0) && !isDead(s.status) && !isClosing(s.status));
+    if (funded.length === 0)
+        return resume;
+    const runtimeWallets = new Set(live.runtimes.map((rt) => rt.wallet?.toLowerCase()).filter((w) => Boolean(w)));
+    /**
+     * "Is a LIVE runtime on this wallet?" — `live.runtimes` now carries only ids with a live handle
+     * (see `readDeployLiveLayer`), so this answers that and not the weaker "was one installed here
+     * once". The wording of both branches below is written to that meaning.
+     */
+    const hasRuntime = (s) => Boolean(s.strategyWalletAddress) && runtimeWallets.has(s.strategyWalletAddress.toLowerCase());
+    const unwatched = funded.filter((s) => !hasRuntime(s));
+    const watched = funded.filter(hasRuntime);
+    const total = (rows) => rows.reduce((sum, s) => sum + (s.totalFunded ?? 0), 0);
+    /** Bare addresses — the form that goes into a command, where a figure would read as an argument. */
+    const addresses = (rows) => rows.map((s) => s.strategyWalletAddress || "(address unreadable)").join(", ");
+    /** Each wallet carries its OWN figure — a set that mixes read and unread amounts has no total. */
+    const names = (rows) => rows
+        .map((s) => `${s.strategyWalletAddress || "(address unreadable)"} ` +
+        `(${s.totalFunded === undefined ? "funded amount unreadable" : usd(s.totalFunded)})`)
+        .join(", ");
+    /**
+     * The aggregate that follows the list. A sum is only honest when every figure in it was read, so
+     * an unread one turns the sum into a floor (or removes it) and carries the caution instead.
+     */
+    const money = (rows) => {
+        const unread = rows.filter((s) => s.totalFunded === undefined).length;
+        const parts = [];
+        if (rows.length > 1) {
+            parts.push(unread === rows.length
+                ? "no readable funded amount on any of them"
+                : `${usd(total(rows))} in total${unread > 0 ? " across the readable ones" : ""}`);
+        }
+        if (unread > 0) {
+            parts.push(`an unreadable amount is UNKNOWN, never zero — treat ` +
+                `${unread === 1 ? "that wallet" : "those wallets"} as funded until the balance is verified`);
+        }
+        return parts.join("; ");
+    };
+    const aggregate = (rows) => {
+        const clause = money(rows);
+        return clause === "" ? "" : ` (${clause})`;
+    };
+    if (unwatched.length === 0) {
+        return (`${resume}. ${watched.length} live wallet(s) already carry a LIVE runtime: ` +
+            `${names(watched)}${aggregate(watched)} — no teardown is needed to recover; re-run to ` +
+            `adopt and verify. If you meant to undo this deploy instead, ` +
+            `\`python3 senpi-strategy-ops/scripts/close.py '${meta.packageId}'\` closes every live sleeve ` +
+            `of ${meta.packageId} and returns the funds.`);
+    }
+    const one = unwatched.length === 1;
+    const subject = one
+        ? `Wallet ${names(unwatched)} has`
+        : `${unwatched.length} wallets (${names(unwatched)}) have`;
+    const lead = `${resume}. ${subject} NO live runtime on it${aggregate(unwatched)} — ` +
+        `nothing is watching ${one ? "it" : "them"} right now: either re-run to adopt`;
+    /**
+     * The reclaim route is the SAME on both branches, and it is the narrow one: a `strategy_close` on
+     * the addresses this read actually returned.
+     *
+     * The wide `close.py '<id>'` cannot be it, on either branch. It discovers its targets from
+     * `strategy_list` by attribution stamp — every live strategy stamped with this package id —
+     * whereas `live.strategies` is deliberately scoped to the names the manifest produces TODAY plus
+     * the create keys THIS deployId journaled. The two diverge whenever an earlier sleeve is live
+     * under a name the current manifest does not produce: an instance renamed, or the reachable one —
+     * a prior create whose custom name the backend rejected, which lands under a backend-assigned
+     * name and which this very verb has a retry for because it was observed in production (SERR083).
+     * So "nothing else of <id> is live, so that closes exactly the wallet(s) named above" was a claim
+     * about a set this read never enumerated, printed one branch away from the sibling branch's
+     * explicit "Do NOT use close.py". The narrow route names exactly what was read.
+     */
+    const reclaim = `, or reclaim ${one ? "it" : "them"} with a direct MCP \`strategy_close\` on ` +
+        `${addresses(unwatched)} (a wallet with no runtime cannot be reached by \`close.py --instance\`)`;
+    if (watched.length === 0) {
+        return (`${lead}${reclaim}. \`python3 senpi-strategy-ops/scripts/close.py '${meta.packageId}'\` is a ` +
+            `wider move than that: it closes every live strategy stamped ${meta.packageId}, and this read ` +
+            `covers only the wallets this package's manifest names plus what this deploy created — an ` +
+            `earlier sleeve live under a name the manifest no longer produces is not in the list above ` +
+            `but IS in that command's blast radius. Use it only to undo the whole package.`);
+    }
+    return (`${lead}${reclaim}. ` +
+        `Do NOT use \`python3 senpi-strategy-ops/scripts/close.py '${meta.packageId}'\` for this: ` +
+        `${watched.length} other wallet(s) (${addresses(watched)}) carry an installed runtime and that ` +
+        `command would close them too.`);
+}
+function buildResumeCommand(meta) {
+    const budget = meta.budget === undefined ? "" : ` --budget ${budgetArg(meta.budget)}`;
+    return (`re-run \`openclaw senpi deploy -p '${meta.packageDir}'${budget}\` to resume — reconciliation adopts what ` +
+        `exists; nothing is lost`);
+}
+// ─── deps assembly ──────────────────────────────────────────────────────────
+/**
+ * One fresh timeout signal per call. `MCP_CALL_TIMEOUT_MS` lives in `job.ts` beside the watchdog
+ * grace it determines — the grace MUST outlast the longest in-flight call, and two hand-synced
+ * constants in two files is how that stops being true.
+ */
+function callDeadline() {
+    return { signal: AbortSignal.timeout(MCP_CALL_TIMEOUT_MS) };
+}
+/**
+ * Map the gateway context onto the orchestrator's injected collaborators. The
+ * MCP-backed ones share one connected client for the whole job.
+ */
+/**
+ * The `span` dep: a real OTel span per deploy phase, plus the phase metric.
+ *
+ * M6: a phase fn never throws (the orchestrator records refusals and failures as outcomes), so
+ * `withSpan` never paints one of these spans red for a refusal. Only a genuine escape — a bug —
+ * marks a deploy span errored.
+ *
+ * `deploy.rollback` resolves with its own result, which is the D-6 rollback metric: `incomplete`
+ * means a funded wallet is stranded, and that is the alert.
+ */
+function buildSpanDep() {
+    return async (name, attrs, fn) => withSpan(name, attrs, async (span) => {
+        const startedMs = Date.now();
+        let status = "error";
+        try {
+            const result = await fn();
+            status = typeof result === "string" ? result : "ok";
+            if (name === "deploy.rollback" && (status === "ok" || status === "incomplete")) {
+                span.setAttribute("senpi.deploy.rollback.result", status);
+                recordDeployRollback({ result: status });
+            }
+            span.setAttribute("senpi.deploy.step.status", status);
+            return result;
+        }
+        finally {
+            recordDeployStep({
+                step: String(attrs["senpi.deploy.step"] ?? name),
+                status,
+                durationSec: (Date.now() - startedMs) / 1000,
+            });
+        }
+    });
+}
+function buildDeployDeps(ctx, client, job) {
+    return {
+        listStrategies: (filters) => client.listStrategies(filters, callDeadline()),
+        createCustomStrategy: (params) => client.createCustomStrategy(params, callDeadline()),
+        getPortfolio: () => client.getPortfolio({ forceFetch: true, ...callDeadline() }),
+        listLiveInstruments: () => client.listInstrumentNames(callDeadline()),
+        installRuntime: (params) => ctx.installRuntime({
+            runtimeYamlContent: params.runtimeYamlContent,
+            runtimeYamlDir: params.runtimeYamlDir,
+            id: params.id,
+        }),
+        deleteRuntime: (id) => ctx.deleteRuntime(id),
+        registryFindByWallet: (wallet) => ctx.registryFindByWallet(wallet),
+        registryFindById: (id) => ctx.registryFindById(id),
+        getScannerRows: (runtimeId) => ctx.getScannerRows(runtimeId),
+        runtimeIsLive: (id) => ctx.runtimeIsLive(id),
+        // D-6 rollback surfaces, both deadline-bounded. The flat check especially: it runs INSIDE the
+        // rollback, so a hung one costs the `[E_ROLLBACK_INCOMPLETE]` report itself — the job cap would
+        // force-terminate with a generic `instances: []` terminal and the stranded funded wallet would
+        // never be named. Its clearinghouse ladder bounds attempt count, not wall time; one shared
+        // timeout signal across those attempts is the wall-clock bound.
+        walletIsFlat: async (wallet) => (await client.listOpenPositions(wallet, callDeadline())).length === 0,
+        closeStrategy: (wallet) => client.closeStrategy(wallet, callDeadline()),
+        span: buildSpanDep(),
+        emit: job.emit,
+        shouldAbandon: job.shouldAbandon,
+        now: () => Date.now(),
+        sleep: POLL_SLEEP,
+        log: (line) => ctx.logger.info(line),
+    };
+}
+/**
+ * Fresh read of the surfaces that actually prove what exists, for an
+ * `interrupted` snapshot. Strictly read-only: it never creates, installs or
+ * deletes anything, so rendering an interrupted deploy can never mutate one.
+ */
+async function readDeployLiveLayer(ctx, meta) {
+    let pkg;
+    try {
+        pkg = loadDeployPackage(meta.packageDir);
+    }
+    catch (err) {
+        return { strategies: [], runtimes: [], unavailable: err instanceof Error ? err.message : String(err) };
+    }
+    const names = new Set(pkg.instances.map((inst) => walletName(pkg, inst)));
+    // C2 again, on the read side: a create whose custom name the backend rejected lands under a
+    // backend-assigned name, so a name-only lookup is blind in EXACTLY the crash window this render
+    // exists for — a job that created and funded a wallet and then died. Feed the same journaled
+    // lookup keys in, and let the backend decide (same carve-out, same one sanctioned reader).
+    //
+    // Scoped to THIS deploy's journal, unlike reconcile's deliberately package-wide read (D-9): the
+    // render attributes what it lists to this job, and an earlier COMPLETED deploy's still-live
+    // wallet would be offered up as "re-run to adopt it, or close it to reclaim $X" — an invitation
+    // to close a strategy that is running as intended.
+    const priorIds = [...ctx.controller.priorCreatedStrategyIds(meta.packageId, meta.deployId).values()].flat();
+    let summaries;
+    try {
+        summaries = await ctx.withSenpiClient(async (client) => {
+            const byName = await client.listStrategies(undefined, callDeadline());
+            const matched = byName.filter((s) => names.has(s.strategyName));
+            if (priorIds.length === 0)
+                return matched;
+            const byKey = await client.listStrategies({ strategyIds: priorIds }, callDeadline());
+            const seen = new Set(matched.map((s) => s.id));
+            return [...matched, ...byKey.filter((s) => !seen.has(s.id))];
+        });
+    }
+    catch (err) {
+        // `listStrategies` fails closed, so this is a strategy list that could NOT be read — the one
+        // thing this layer exists to prove. Rendering it as an empty list would print "strategies: none
+        // matching this package" over a job that may have funded wallets, which is the exact claim an
+        // interrupted report must never make. Say unavailable instead; the journal narration still
+        // prints beside it.
+        return {
+            strategies: [],
+            runtimes: [],
+            unavailable: `could not read your strategies: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    const runtimes = [];
+    for (const inst of pkg.instances) {
+        const id = sanitizeStrategyName(`${pkg.id}-${inst.name}`);
+        const entry = await ctx.registryFindById(id);
+        if (!entry)
+            continue;
+        // H4, and the only question this list is asked: is a wallet's money being WATCHED right now? A
+        // registry row does not answer it. The row is written at install time and is never removed by a
+        // runtime that then died at boot or never wired its entry scanners, so it is evidence that an
+        // install once happened — not that an exit engine is running. Rendered from the row alone,
+        // `buildInterruptedNext` told the reader "N live wallet(s) already carry an installed runtime …
+        // no teardown is needed to recover" over a funded wallet with no stop loss running: the
+        // under-warning direction this whole render forbids elsewhere (an unreadable `totalFunded` is
+        // kept IN the warning for the same reason). `runtimeIsLive` is the live-handle check the
+        // orchestrator already gates adoption on; it is an in-memory lookup, so this costs nothing and
+        // cannot fail on its own.
+        //
+        // (`readRegistry` swallowing a non-ENOENT read error is a DIFFERENT failure and points the
+        // other way: it returns an empty registry, so rows go missing rather than linger. That one is
+        // already fail-closed here — no row, no claim that anything is watching.)
+        if (!(await ctx.runtimeIsLive(entry.id)))
+            continue;
+        runtimes.push({ id: entry.id, wallet: entry.wallet });
+    }
+    return {
+        strategies: summaries
+            .map((s) => ({
+            strategyName: s.strategyName,
+            status: s.status,
+            strategyWalletAddress: s.strategyWalletAddress,
+            totalFunded: s.totalFunded,
+        })),
+        runtimes,
+    };
+}
+// ─── handlers ───────────────────────────────────────────────────────────────
+function readNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+/**
+ * The refusals decidable from the package alone — no MCP, no job. Returns the message, or null when
+ * the package is startable.
+ *
+ * Every check here reads and parses an instance recipe off disk, so this MUST be guarded — a
+ * malformed `runtime.yaml` would otherwise escape the gateway handler as a raw throw. Guard it in
+ * its OWN try, separate from the one around `loadDeployPackage`: sharing one collapses two states
+ * that need different refusals. A throw from the load means there is no package; a throw from here
+ * means the manifest read fine and the package's instances are fully known, which is what lets the
+ * refusal name each instance directory instead of a package root that `senpi validate` will not
+ * take. Merging the guards silently reinstates that defect.
+ */
+function localStartRefusal(pkg, decisionModel) {
+    const needsModel = pkg.instances
+        .filter((inst) => runtimeUsesLlmDecisions(readRuntimeYaml(inst)))
+        .map((inst) => inst.name);
+    if (needsModel.length > 0) {
+        if (!decisionModel)
+            return buildDecisionModelRefusal(needsModel, pkg.dir);
+        // The other half of the same gate, and the one that used to be missing here: WITH a model but
+        // with no token in strategy.yaml to substitute it into, the old code sailed past this check and
+        // refused at install — after create+fund had already made and funded a wallet.
+        if (!pkg.decisionModelEnv)
+            return buildDecisionModelEnvRefusal(needsModel, pkg.dir);
+    }
+    const unprotected = instancesWithoutDslExit(pkg);
+    if (unprotected.length > 0)
+        return buildNoDslExitRefusal(unprotected, pkg.dir);
+    const enabledKeys = scannersDeclaringEnabled(pkg);
+    if (enabledKeys.length > 0)
+        return buildScannerEnabledUnsupportedRefusal(enabledKeys, pkg.dir);
+    // Last of the local gates: the ones above are money-safety findings (a package that cannot stop
+    // itself out, a package that trades while its author believes it is off), and they lead when a
+    // package trips several. This one is the canonical-stamp rule.
+    if (nonLowercasePackageId(pkg) !== null)
+        return buildNonLowercaseIdRefusal(pkg);
+    return null;
+}
+/**
+ * The synchronous half of a deploy: validate, refuse, claim the slot, return. Wrapped in its own
+ * short `deploy.start` span so a refusal (which never creates a job, and so never produces a
+ * `deploy.run` span) is still visible in the trace — with its taxonomy code, not an error status.
+ */
+async function handleStart(ctx, params, respond) {
+    return withSpan("deploy.start", {}, async (span) => {
+        const refuse = (error) => {
+            const code = extractTaxonomyCode(error.message);
+            span.setAttribute("senpi.deploy.outcome", "refused");
+            if (code)
+                span.setAttribute("senpi.deploy.refusal.code", code);
+            respond(false, undefined, error);
+        };
+        await startBody(ctx, params, respond, refuse, span);
+    });
+}
+async function startBody(ctx, params, respond, refuse, span) {
+    const requestedDir = typeof params?.packageDir === "string" ? params.packageDir : "";
+    if (!requestedDir) {
+        refuse(invalidRequest(buildMissingPackageDirRefusal()));
+        return;
+    }
+    // Resolved HERE, at the one place a caller's string enters the verb, and not left to each
+    // refusal. `loadDeployPackage` resolves its own copy, so every path derived from a LOADED package
+    // (`pkg.dir`, every `runtimeYamlDir`) is already absolute — but the package that would not load
+    // has no `pkg`, and its refusal was rendering the caller's string verbatim. A relative path in a
+    // command an agent copies into some other working directory is a command that fails, or resolves
+    // somewhere nobody meant. Resolution happens after the empty check because `resolve("")` is the
+    // process's cwd, which is not what an absent argument means.
+    const packageDir = path.resolve(requestedDir);
+    const decisionModel = typeof params?.decisionModel === "string" ? params.decisionModel : undefined;
+    // Package load AND both local pre-checks are guarded: each of them parses YAML off disk, so a
+    // malformed instance runtime.yaml must surface as this teaching refusal rather than escaping the
+    // handler as a raw throw. The pre-checks run here (not just in the orchestrator) so the refusal is
+    // immediate and no job is ever created; the orchestrator keeps its own copies of both gates, so
+    // every caller stays gated.
+    //
+    // TWO guards, not one, and the difference is what the refusal may say. A throw from the load means
+    // there is no package to speak of. A throw from the pre-checks means the manifest read fine and a
+    // RECIPE will not parse — the package is known there, so the refusal can name each instance
+    // directory instead of a package root a multi-instance `senpi validate` refuses to take.
+    let pkg;
+    try {
+        pkg = loadDeployPackage(packageDir);
+    }
+    catch (err) {
+        refuse(invalidRequest(buildUnreadablePackageRefusal(packageDir, err)));
+        return;
+    }
+    let refusal = null;
+    try {
+        refusal = localStartRefusal(pkg, decisionModel);
+    }
+    catch (err) {
+        refuse(invalidRequest(buildUnreadablePackageRefusal(packageDir, err, pkg)));
+        return;
+    }
+    if (refusal) {
+        refuse(invalidRequest(refusal));
+        return;
+    }
+    const running = ctx.controller.running();
+    if (running) {
+        refuse({ code: "CONFLICT", message: buildInProgressRefusal(running) });
+        return;
+    }
+    const budget = readNumber(params?.budget);
+    if (budget !== undefined && budget <= 0) {
+        refuse(invalidRequest(buildNonPositiveBudgetRefusal(budget, pkg.dir)));
+        return;
+    }
+    const maxWaitSec = readNumber(params?.maxWaitSec);
+    const tickWaitSec = readNumber(params?.tickWaitSec);
+    // Range-checked here for the same reason `budget` is, one gate up: this is where a caller's
+    // number enters the verb, and the CLI's own guard only rejects a non-finite one. Both waits feed
+    // the job cap, and the cap feeds `setTimeout` — see `deadlines.ts` for what an out-of-range value
+    // does to it and to the deadline the journal then narrates.
+    const outOfRange = !isWaitInRange(maxWaitSec)
+        ? { flag: "--max-wait", value: maxWaitSec, fallback: DEFAULT_MAX_WAIT_SEC }
+        : !isWaitInRange(tickWaitSec)
+            ? { flag: "--tick-wait", value: tickWaitSec, fallback: DEFAULT_TICK_WAIT_SEC }
+            : null;
+    if (outOfRange) {
+        refuse(invalidRequest(buildWaitOutOfRangeRefusal(outOfRange, pkg.dir)));
+        return;
+    }
+    // C2 carve-out: journaled create keys for this package. They are lookup keys only — reconcile
+    // re-reads every one of them from the backend before it may adopt anything.
+    const priorStrategyIds = ctx.controller.priorCreatedStrategyIds(pkg.id);
+    // D-9, narration tier: strategyId → the amount a prior run journaled as its ask. Feeds the
+    // report's funded-vs-requested warn ONLY, so a crash between a partial fund and the report does
+    // not resume as a silent adoption. `funded` is still re-read live on this run.
+    const priorRequested = ctx.controller.priorRequestedFunding(pkg.id);
+    // D-5: the job's wall-clock cap. Sized to what the run can legitimately spend — every instance
+    // may burn a full ACTIVE poll plus a full tick-wait — plus 300s of headroom for the install and
+    // the un-timed steps. Past it the watchdog stops the run and takes the slot back.
+    const capMs = jobCapMs(maxWaitSec, tickWaitSec, pkg.instances.length);
+    // L5: the package attribute is the BASENAME, never the absolute path — a user's home directory
+    // is not a span dimension, and the basename is what identifies the package anyway.
+    const runAttrs = {
+        "senpi.deploy.package": path.basename(pkg.dir),
+        "senpi.deploy.instance.count": pkg.instances.length,
+        ...(budget !== undefined ? { "senpi.deploy.budget.usd": budget } : {}),
+    };
+    // The slot claim, guarded. `start` throws when a job is already running — the ordinary case is
+    // refused by the `running()` check above, but that check and this call are two statements apart,
+    // and `handleStart` does not catch: an unguarded throw returns no response at all, so the CLI
+    // takes its "unreadable gateway" path and tells the operator the deploy's state is UNKNOWN over a
+    // deploy that plainly never started. Nothing between the two awaits today; that is a property of
+    // the current code, not something a future edit is obliged to preserve.
+    let meta;
+    try {
+        meta = ctx.controller.start({ packageId: pkg.id, version: pkg.version, packageDir: pkg.dir, ...(budget !== undefined ? { budget } : {}) }, capMs, (job) => withSpan("deploy.run", { ...runAttrs, "senpi.deploy.id": job.deployId }, async (span) => {
+            const report = await ctx.withSenpiClient((client) => runDeploy({
+                pkg,
+                ...(budget !== undefined ? { budget } : {}),
+                ...(decisionModel ? { decisionModel } : {}),
+                ...(maxWaitSec !== undefined ? { maxWaitSec } : {}),
+                ...(tickWaitSec !== undefined ? { tickWaitSec } : {}),
+                priorStrategyIds,
+                priorRequested,
+            }, buildDeployDeps(ctx, client, job)));
+            // M6: `runDeploy` never throws, so `withSpan` never sets ERROR status on a refusal — a
+            // refusal sets an OUTCOME attribute instead. Only a genuine escape (a bug) marks it errored.
+            span.setAttribute("senpi.deploy.outcome", report.overall);
+            const firstRefusal = report.instances
+                .flatMap((instance) => Object.values(instance.steps))
+                .find((step) => step.status === "refused");
+            const code = extractTaxonomyCode(firstRefusal?.detail);
+            if (code)
+                span.setAttribute("senpi.deploy.refusal.code", code);
+            // The SOFT calculated-minimum tier rides ATTRIBUTES, deliberately never
+            // `senpi.deploy.refusal.code` and never a span error: it warned, the deploy proceeded, and
+            // a dashboard that counted it as a refusal would report healthy deploys as failures. What
+            // it is worth measuring is how often users size a budget below the authored design.
+            //
+            // `below_min` is a claim about the funding PLAN, not about wallets that ended up funded: it
+            // stays true when the deploy later failed for an unrelated reason, because the budget was
+            // still sized too small and that is the population worth counting. The report's note is the
+            // surface that distinguishes "funded" from "would have funded"; this attribute does not.
+            if (report.minBudget !== undefined) {
+                span.setAttribute("senpi.deploy.budget.min_usd", report.minBudget);
+                span.setAttribute("senpi.deploy.budget.below_min", report.belowMin === true);
+            }
+            const warnCode = extractTaxonomyCode(report.minBudgetNote);
+            if (warnCode)
+                span.setAttribute("senpi.deploy.budget.warn.code", warnCode);
+            // Its OWN attribute, not a second write to `warn.code`: the plan-side warn above and this
+            // outcome-side one can both hold on one deploy, and sharing a key would silently drop
+            // whichever landed first. This is the population worth alerting on — the platform accepted
+            // a funded create and landed materially less on the wallet.
+            if (report.partialFundNote)
+                span.setAttribute("senpi.deploy.budget.partial_fund", true);
+            // Its own attribute again, for the same reason: an unreadable funded figure is a distinct
+            // population from a measured shortfall, and it is the one where the platform stopped
+            // reporting a number at all.
+            if (report.fundedUnreadableNote)
+                span.setAttribute("senpi.deploy.budget.funded_unreadable", true);
+            return report;
+        }));
+    }
+    catch (err) {
+        const running = ctx.controller.running();
+        refuse({
+            code: "CONFLICT",
+            message: running
+                ? buildInProgressRefusal(running)
+                : `[E_DEPLOY_IN_PROGRESS] the deploy slot could not be claimed: ` +
+                    `${err instanceof Error ? err.message : String(err)}. Nothing was started. ` +
+                    `Read \`openclaw senpi deploy status\`, then re-run.`,
+        });
+        return;
+    }
+    span.setAttribute("senpi.deploy.id", meta.deployId);
+    span.setAttribute("senpi.deploy.package", path.basename(pkg.dir));
+    span.setAttribute("senpi.deploy.instance.count", pkg.instances.length);
+    respond(true, {
+        deployId: meta.deployId,
+        state: "running",
+        phase: "reconcile",
+        monitor: "openclaw senpi deploy status",
+    });
+}
+async function handleStatus(ctx, params, respond) {
+    const deployId = typeof params?.deployId === "string" ? params.deployId : undefined;
+    const snapshot = await ctx.controller.status(deployId);
+    if (!snapshot) {
+        respond(false, undefined, notFound(buildNoJobsRefusal()));
+        return;
+    }
+    if (snapshot.state.status !== "interrupted") {
+        respond(true, snapshot);
+        return;
+    }
+    // Journal narration alone would gaslight here: the process died, so the journal's last word is
+    // whatever it managed to write. Pair it with a fresh read of what actually exists.
+    const live = await readDeployLiveLayer(ctx, snapshot.meta);
+    respond(true, {
+        ...snapshot,
+        live,
+        next: buildInterruptedNext(snapshot.meta, live),
+    });
+}
+/** Register the internal deploy transport pair. */
+export function registerDeployGatewayMethods(api, ctx) {
+    api.registerGatewayMethod("senpi.deploy.start", async (gwCtx) => handleStart(ctx, gwCtx.params, gwCtx.respond), { scope: "operator.write" });
+    api.registerGatewayMethod("senpi.deploy.status", async (gwCtx) => handleStatus(ctx, gwCtx.params, gwCtx.respond), { scope: "operator.read" });
+}
+//# sourceMappingURL=register.js.map