@senpi/runtime 3.0.59 → 3.0.63

package/dist/cli/guide-commands.js

@@ -24,6 +24,7 @@ Quick commands:
   senpi guide actions     Action types and decision modes
   senpi guide dsl         DSL exit: phases, lock modes, tiers, time-based cuts
   senpi validate <pkg>    Prove a strategy runs before funding it (static → import → live)
+  senpi deploy -p <pkg>   Take a proven package live: create+fund → install → verified tick
   senpi scanner           Per-scanner health: runs, errors, liveness, "(no signals yet)" flag
   senpi events            Local domain-event log — the trade narrative
   senpi explain <asset>   Stitch one asset's position lifecycle from the event log
@@ -478,11 +479,75 @@ senpi config — Manage CLI preferences (~/.openclaw/senpi-cli.json)
   config unset <key>                   Remove a key
   config reset                         Clear all preferences
 
+senpi deploy — Take a strategy package live, end to end (the strategy lifecycle)
+  openclaw senpi deploy -p <package-dir> --budget <usd>   # start (detached): preflight → create+fund → install → verified tick
+  openclaw senpi deploy status                            # watch until terminal; quotes the verified report
+    -p, --path <dir>                     Strategy package directory (contains strategy.yaml)
+    --budget <usd>                       Total budget across the package's wallets (min $10/wallet)
+    --decision-model <model>             Required if the package uses decision_mode: llm
+    --tick-wait <seconds>                Wait for one verified scanner tick (default 120, 0 skips)
+    --max-wait <seconds>                 Wait for wallets to reach ACTIVE (default 150)
+    --json                               Raw JSON output
+                                       deploy returns in ~1s; the job runs detached. Poll
+                                       'deploy status' until it is terminal. Exit codes:
+                                       0 live · 2 refused · 3 failed · 4 installed-unobserved ·
+                                       5 interrupted · 6 pending/running · 1 error. An
+                                       unobserved tick reports as "unobserved", never as success.
+                                       'deploy' itself uses the same classes at START: 0 job
+                                       started · 2 refused (the message leads with its code, e.g.
+                                       [INVALID_REQUEST]) · 1 internal/transport. So 2 always
+                                       means obey the message; 1 always means the deploy's state
+                                       is unknown — never retry a 2.
+                                       A package no 'senpi validate' has ever proven — or one whose
+                                       files have changed since, or whose proof predates this
+                                       runtime — is refused BEFORE any money moves. The refusal
+                                       leads with [E_VALIDATE_NO_PROOF] /
+                                       [E_VALIDATE_CONTENT_CHANGED] /
+                                       [E_VALIDATE_RUNTIME_VERSION_CHANGED] and names the exact
+                                       validate command for the instance that failed. Two instances
+                                       sharing one runtime directory are refused outright
+                                       ([INVALID_REQUEST]): a proof lives beside its recipe, one
+                                       file per directory, so it cannot speak for both.
+                                       Budget is two-tier: BELOW the $10/wallet floor it refuses
+                                       [E_FUNDS_BELOW_FLOOR]; and when the split leaves a wallet
+                                       under its OWN sizing it DEPLOYS and warns
+                                       [W_BUDGET_BELOW_STRATEGY_MIN] (that sleeve runs degraded —
+                                       fewer slots than authored). [W_BUDGET_UNRESOLVED] = the
+                                       minimum could not be computed and may be understated.
+                                       Neither warn stops a deploy; both judge each wallet against
+                                       its OWN allocation, not the budget against the package
+                                       total (those differ once a sleeve is adopted). To run the
+                                       authored design you must close and redeploy — a re-run at
+                                       a bigger --budget only adopts the wallet it already made.
+                                       Follow the warn's own close command verbatim; it is scoped
+                                       to the short sleeves so adopted wallets are left alone.
+                                       Some reports deliberately carry NO close command (a funded
+                                       wallet with no runtime installed; a funding_share: 0
+                                       sleeve; or when [E_ROLLBACK_INCOMPLETE] owns the cleanup)
+                                       — that is the correct answer there, not a gap to fill:
+                                       never substitute a package-wide close.
+                                       Both of those judge the PLAN. After the wallets exist the
+                                       report also checks the OUTCOME: when the backend lands under
+                                       90% of what a wallet was asked to be funded, it warns
+                                       [W_BUDGET_PARTIAL_FUND] with both numbers ("funded $60.00 of
+                                       requested $500.00 (12%, short $440.00)"). The strategy is
+                                       still live and the exit code does not move — do NOT close it
+                                       over the shortfall. Quote the FUNDED figure, never the
+                                       requested one. Those figures are AT DEPLOY TIME and the note
+                                       re-renders on every later status read, so re-read the
+                                       current funding (status.py) before moving money, then top up
+                                       via the senpi-deposit-withdraw-transfer skill;
+                                       close-and-redeploy is the destructive fallback. The warn is
+                                       silent wherever a D-6 rollback was attempted — if the create
+                                       step carries [E_ROLLBACK_INCOMPLETE], THAT line owns the
+                                       remediation (reclaim), and it is the one to follow.
+                                       When the backend reports no readable funded amount at all,
+                                       you get [W_BUDGET_FUNDED_UNREADABLE] instead: no percentage,
+                                       no shortfall, no top-up. The funded amount is UNKNOWN, never
+                                       $0.00 — ask the USER to verify what actually landed before
+                                       any money action
+
 senpi runtime — Manage runtimes
-  runtime create                       Add a runtime from a YAML file
-    -p, --path <path>                    Path to strategy YAML file
-    -c, --content <yaml>                 Inline YAML content
-    --runtime-id <id>                    Override auto-derived ID
   runtime delete [id]                  Remove a runtime
     --id <runtime_id>                    Delete by runtime ID
     --address <wallet>                   Delete by wallet address
@@ -510,6 +575,12 @@ senpi validate — Prove a strategy can execute BEFORE it is funded
                  command, not the code
   A full unscoped PASS at live depth writes .senpi-proof.json beside the recipe
   (content-addressed, no expiry); the deploy gate verifies it via verifyProof().
+  That gate REFUSES, before any money moves: [E_VALIDATE_NO_PROOF] nothing here
+  was ever observed to run · [E_VALIDATE_CONTENT_CHANGED] the files moved since
+  the proof, and it names which · [E_VALIDATE_RUNTIME_VERSION_CHANGED] the proof
+  predates the running runtime (the package needs no edit — just re-prove it).
+  A proof attests that this content RAN and passed, not that every check at that
+  depth produced a verdict — deploy re-checks the live instrument universe itself.
 
 senpi status — Lightweight runtime health digest
   status                               Overall health + scanners (with degraded count),
@@ -623,8 +694,9 @@ senpi.installRuntime
   Success: { id, name, wallet }
   Errors:  INVALID_REQUEST (missing YAML, duplicate ID/wallet, or the install gate: a recipe that
            cannot trade — no margin source, no risk guardrails, missing scanner entrypoint, or an
-           unresolvable scanner path — is refused with what/why/fix per problem),
-           UNAVAILABLE (bad YAML, start failure)
+           unresolvable scanner path — is refused with what/why/fix per problem, the message
+           leading with the bracketed code of the first blocking finding, e.g.
+           [E_VALIDATE_UNGATED]), UNAVAILABLE (bad YAML, start failure)
 
 senpi.listRuntimes
   Params:  (none)

package/dist/cli/guide-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"guide-commands.js","sourceRoot":"","sources":["../../src/cli/guide-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,aAAa,GACjB,0EAA0E,CAAC;AAE7E,+EAA+E;AAE/E,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC;qBACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuB3B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoIrB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FhB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+GnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqN9B,CAAC,IAAI,EAAE,CAAC;AAYT;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAAe;IAEf,MAAM,KAAK,GAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAsB;SACvD,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAE3D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAsB;SACvC,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAsB;SAC1C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"guide-commands.js","sourceRoot":"","sources":["../../src/cli/guide-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,aAAa,GACjB,0EAA0E,CAAC;AAE7E,+EAA+E;AAE/E,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC;qBACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwB3B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoIrB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FhB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+GnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCpB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4R9B,CAAC,IAAI,EAAE,CAAC;AAYT;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAAe;IAEf,MAAM,KAAK,GAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAsB;SACvD,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAE3D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAsB;SACvC,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAsB;SAC5C,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAsB;SAC1C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAsB;SAC3C,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/senpi-commands.d.ts

@@ -24,7 +24,12 @@ export declare function renderEventsDigest(entries: StoredEvent[]): string;
 export declare function renderExplain(asset: string, entries: StoredEvent[]): string;
 /** Minimal Commander command type for subcommands and options. */
 interface CommanderCommand {
-    command(name: string, desc?: string): CommanderCommand;
+    /** Commander 14 accepts either a description string or an options object (e.g. `{ hidden: true }`). */
+    command(name: string, descOrOpts?: string | {
+        hidden?: boolean;
+    }, opts?: {
+        hidden?: boolean;
+    }): CommanderCommand;
     description(desc: string): CommanderCommand;
     argument(name: string, description?: string): CommanderCommand;
     option(flags: string, description?: string): CommanderCommand;

package/dist/cli/senpi-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"senpi-commands.d.ts","sourceRoot":"","sources":["../../src/cli/senpi-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,gBAAgB,GAAG,OAAO,CAAA;CAAE,GAChF,IAAI,CA4vCN;AAgKD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAWvE;AAmDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CASjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAW3E;AA8HD,kEAAkE;AAClE,UAAU,gBAAgB;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACvD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC9D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACtE,MAAM,CACJ,EAAE,EACE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzD,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzE,gBAAgB,CAAC;CACrB"}
+{"version":3,"file":"senpi-commands.d.ts","sourceRoot":"","sources":["../../src/cli/senpi-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,gBAAgB,GAAG,OAAO,CAAA;CAAE,GAChF,IAAI,CAmxCN;AAuaD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAWvE;AAmDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CASjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAW3E;AA8HD,kEAAkE;AAClE,UAAU,gBAAgB;IACxB,uGAAuG;IACvG,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAC1C,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,gBAAgB,CAAC;IACpB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC9D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACtE,MAAM,CACJ,EAAE,EACE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzD,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GACzE,gBAAgB,CAAC;CACrB"}

package/dist/cli/senpi-commands.js

@@ -11,6 +11,8 @@ import { spawnSync } from "../utils/safe-spawn.js";
 import path from "node:path";
 import { registerGuideCommands, CHEATSHEET_TEXT } from "./guide-commands.js";
 import { registerSenpiConfigCommands } from "./senpi-config-commands.js";
+import { exitCodeForDeploy, renderDeploySnapshot } from "./deploy-render.js";
+import { isRefusalMessage } from "../deploy/taxonomy.js";
 import { registerValidateCommand } from "./validate-command.js";
 import { VERSION } from "../version.js";
 /**
@@ -27,14 +29,18 @@ export function registerSenpiCli(program) {
     });
     registerSenpiConfigCommands(senpi);
     registerValidateCommand(senpi);
+    registerDeployCommands(senpi);
     const runtime = senpi.command("runtime");
     runtime.description("Manage runtimes");
     runtime
-        .command("create")
-        .description("Add a runtime from a YAML file or paste YAML; the gateway validates and runs it")
+        // Demoted, not deleted: `senpi deploy` is the supported path (funds preflight + attribution +
+        // verified tick). Hidden keeps it out of help/routing while deploy.py keeps working.
+        .command("create", { hidden: true })
+        .description("Internal — prefer `senpi deploy` (funds preflight + attribution + verified tick). Direct create skips those gates.")
         .option("-p, --path <path>", "Path to your strategy YAML file")
         .option("-c, --content <content>", "Paste YAML content directly")
         .option("--runtime-id <id>", "Name for this runtime (default: from file name or content)")
+        .option("--runtime-yaml-dir <dir>", "Directory to resolve relative scanner paths against (content installs only)")
         .action(async (opts) => {
         const hasPath = typeof opts.path === "string" && opts.path.length > 0;
         const hasContent = typeof opts.content === "string";
@@ -75,7 +81,13 @@ export function registerSenpiCli(program) {
             // scanner's relative `path: ./` and the scaffold can import scan.py. We
             // send content (not path) so remote gateways work, but that drops the
             // directory; this hint restores it for FS-sharing (local/box) setups.
-            ...(hasPath ? { runtimeYamlDir: path.dirname(path.resolve(process.cwd(), opts.path)) } : {}),
+            // An explicit --runtime-yaml-dir wins: it is the only way a content install can name
+            // the directory its relative scanner paths resolve against (otherwise refused).
+            ...(typeof opts.runtimeYamlDir === "string" && opts.runtimeYamlDir.length > 0
+                ? { runtimeYamlDir: path.resolve(process.cwd(), opts.runtimeYamlDir) }
+                : hasPath
+                    ? { runtimeYamlDir: path.dirname(path.resolve(process.cwd(), opts.path)) }
+                    : {}),
             ...(typeof opts.runtimeId === "string" && opts.runtimeId.length > 0 ? { id: opts.runtimeId } : {}),
         };
         // Runtime create is a SLOW synchronous call: the handler starts a long-lived
@@ -600,14 +612,19 @@ export function registerSenpiCli(program) {
         const params = {};
         if (typeof opts.runtime === "string" && opts.runtime.length > 0)
             params.runtimeId = opts.runtime;
-        const data = callGatewayJson("senpi.getHealthStatus", params);
+        // Same class as the deploy verbs' null-data path: a health surface that exits 0 after
+        // reading no health is the one thing it exists not to do.
+        const data = callGatewayJson("senpi.getHealthStatus", params, (cause) => reportUnreadableGateway("senpi status", cause, " No health was read."));
         if (!data) {
             return;
         }
         if (data.ok === false) {
             const err = data.error;
-            console.error(err?.message ?? "Request failed.");
-            process.exitCode = 1;
+            const message = err?.message ?? "Request failed.";
+            console.error(message);
+            // Same reading as the deploy verbs, and the same reason: a coded refusal is something to
+            // obey, not to retry. Kept here so this branch and the subprocess-level one below agree.
+            process.exitCode = isRefusalMessage(message) ? DEPLOY_REFUSED_EXIT : 1;
             return;
         }
         const payload = (data.payload ?? data);
@@ -1101,11 +1118,225 @@ function fmtMetricNum(n) {
         return String(n);
     return n.toFixed(2);
 }
-function callGatewayJson(method, params) {
-    const result = spawnSync(process.argv[0], [process.argv[1], "gateway", "call", method, "--json", "--params", JSON.stringify(params)], { stdio: ["inherit", "pipe", "inherit"], cwd: process.cwd(), encoding: "utf8" });
+/**
+ * The `senpi deploy` verb pair — the agent-facing surface for the whole go-live
+ * path. There is no `cancel` (D-4): undeploying a strategy is closing it, and a
+ * wedged job frees its own slot at the deadline. `deploy` starts a DETACHED job and returns in ~1s; monitoring is explicit
+ * polling of `deploy status`. The `senpi.deploy.*` gateway methods behind these
+ * verbs are internal transport and are deliberately not documented anywhere an
+ * agent reads.
+ */
+function registerDeployCommands(senpi) {
+    const deploy = senpi
+        .command("deploy")
+        .description("Deploy a strategy package end-to-end (detached): funds preflight, wallet create+fund, install, one observed tick. " +
+        "Starts the job and returns — watch with `senpi deploy status`. " +
+        "Start exit codes: 0 job started · 2 refused (the message leads with the code) · 1 internal/transport error")
+        // NOT `requiredOption`: Commander checks mandatory options by walking the ancestor chain from
+        // the leaf command, so a mandatory `-p` on this parent makes `deploy status` fail before
+        // dispatch ("required option '-p, --path <dir>' not specified"). The start action carries its
+        // own explicit guard below, so nothing is lost.
+        .option("-p, --path <dir>", "Strategy package directory (contains strategy.yaml)")
+        .option("--budget <usd>", "Total budget in USD across the package's wallets (min $10/wallet)")
+        .option("--decision-model <model>", "Model for llm-decision actions (required if the package uses decision_mode: llm)")
+        .option("--tick-wait <seconds>", "How long the job waits to observe one verified scanner tick (default 120, 0 skips)")
+        .option("--max-wait <seconds>", "How long the job waits for wallets to reach ACTIVE (default 150)")
+        .option("--json", "Print the raw start response JSON")
+        .action(async (opts) => {
+        // Every numeric flag is validated the same way. A silently-dropped NaN would run the job
+        // with the default window while the agent believes its own value took effect.
+        // These local guards are REFUSALS, not usage errors: nothing was started, and re-running
+        // the same command can only refuse again. They carry the taxonomy code and exit 2 like
+        // every other start-time refusal — reported as 1 the newly-taught start map reads them as
+        // "transport error, state unknown", whose natural handling is to poll `deploy status`.
+        const numeric = (flag, raw, example) => {
+            if (raw === undefined)
+                return undefined;
+            const value = Number(raw);
+            if (!Number.isFinite(value)) {
+                console.error(`[INVALID_REQUEST] ${flag} must be a number, e.g. ${flag} ${example}. Nothing was started.`);
+                return null;
+            }
+            return value;
+        };
+        const budget = numeric("--budget", opts.budget, "500");
+        const tickWaitSec = numeric("--tick-wait", opts.tickWait, "120");
+        const maxWaitSec = numeric("--max-wait", opts.maxWait, "150");
+        if (budget === null || tickWaitSec === null || maxWaitSec === null) {
+            process.exitCode = DEPLOY_REFUSED_EXIT;
+            return;
+        }
+        if (!opts.path) {
+            // This guard fires BEFORE the gateway is called, so the gateway's own coded
+            // missing-package-dir refusal is unreachable from the CLI — this surface has to carry
+            // it verbatim rather than degrade it to a codeless usage error.
+            console.error("[INVALID_REQUEST] A strategy package directory is required. Nothing was started. " +
+                "Run: senpi deploy -p <package-dir> --budget <usd>");
+            process.exitCode = DEPLOY_REFUSED_EXIT;
+            return;
+        }
+        const params = {
+            packageDir: path.resolve(process.cwd(), opts.path),
+            ...(budget !== undefined ? { budget } : {}),
+            ...(opts.decisionModel ? { decisionModel: opts.decisionModel } : {}),
+            ...(tickWaitSec !== undefined ? { tickWaitSec } : {}),
+            ...(maxWaitSec !== undefined ? { maxWaitSec } : {}),
+        };
+        const data = callGatewayJson("senpi.deploy.start", params, (cause) => reportUnreadableGateway("senpi deploy", cause, DEPLOY_STATE_UNKNOWN_HINT));
+        if (!data)
+            return;
+        if (data.ok === false) {
+            const err = data.error;
+            const message = err?.message ?? "Deploy start failed.";
+            console.error(message);
+            // D-12 all the way down: `2 = refused`, `1 = internal/transport`. Every start-time gate
+            // (the [INVALID_REQUEST] family — no DSL exit, missing decision model/env, scanner
+            // `enabled` key, non-positive budget, missing/unreadable package — plus
+            // [E_DEPLOY_IN_PROGRESS]) is a refusal, and the taught surfaces tell agents to branch on
+            // the code. Reported as 1 they read as "internal/transport error", whose natural
+            // handling is retry rather than obey — a retried no-stop-loss refusal is the whole bug.
+            process.exitCode = isRefusalMessage(message) ? DEPLOY_REFUSED_EXIT : 1;
+            return;
+        }
+        const started = (data.payload ?? data);
+        if (opts.json) {
+            console.log(JSON.stringify(started, null, 2));
+            return;
+        }
+        console.log(`deploy ${started.deployId} started — phase: ${started.phase}`);
+        console.log("  watch:  openclaw senpi deploy status");
+    });
+    deploy
+        .command("status [deployId]")
+        .description("Show the deploy job: phase while running; the full verified report once terminal. " +
+        "Exit codes: 0 live · 2 refused · 3 failed · 4 installed-unobserved · 5 interrupted · " +
+        "6 pending/still running · 1 error")
+        .option("--json", "Print the raw snapshot JSON")
+        .action(async (deployId, opts) => {
+        const data = callGatewayJson("senpi.deploy.status", deployId ? { deployId } : {}, (cause) => reportUnreadableGateway("senpi deploy status", cause, DEPLOY_STATUS_STATE_UNKNOWN_HINT));
+        if (!data)
+            return;
+        if (data.ok === false) {
+            const message = data.error?.message ?? "Status failed.";
+            console.error(message);
+            // Read the same way the start verb reads its own gateway error, and for the same reason:
+            // `[NOT_FOUND] No deploy has been started on this agent` is a fact, not a fault. Exit 1
+            // would tell an agent to retry a read whose answer cannot change until a deploy is started.
+            process.exitCode = isRefusalMessage(message) ? DEPLOY_REFUSED_EXIT : 1;
+            return;
+        }
+        const snap = (data.payload ?? data);
+        // D-12: the exit code applies on the --json path too, so a JSON consumer gets the code AND
+        // the payload rather than having to choose.
+        process.exitCode = exitCodeForDeploy(snap);
+        if (opts?.json) {
+            console.log(JSON.stringify(snap, null, 2));
+            return;
+        }
+        renderDeploySnapshot(snap);
+    });
+}
+/**
+ * D-12: `2 = refused`. Named so the start action's guards, its gateway branch, and the one place
+ * every verb's gateway call is classified (`callGatewayJson`) cannot drift. `2` means the same thing
+ * wherever it comes from — a deliberate no, to obey rather than retry — so `senpi status` reports a
+ * coded refusal with it too, even though only the deploy verbs publish the full map.
+ */
+const DEPLOY_REFUSED_EXIT = 2;
+/** Appended to a deploy verb's unreadable-gateway message: the one surface that can still answer. */
+const DEPLOY_STATE_UNKNOWN_HINT = " This says nothing about the deploy itself — if the gateway is up, ask `senpi deploy status` " +
+    "for the job's real state, and check the gateway log if that keeps failing.";
+/**
+ * The `deploy status` variant of the same teaching.
+ *
+ * `DEPLOY_STATE_UNKNOWN_HINT` names `senpi deploy status` as the surface that can still answer,
+ * which is a loop when the verb the reader just ran IS status. Same content — the deploy is
+ * untouched by this failure, and the job may be running right now — routed to the thing that
+ * actually has to change first.
+ */
+const DEPLOY_STATUS_STATE_UNKNOWN_HINT = " This says nothing about the deploy itself — a started job may be running right now. Start the " +
+    "gateway if it is down (`openclaw gateway run`), check the gateway log, then re-read.";
+/**
+ * Did the gateway ANSWER this failed `gateway call`, with a refusal?
+ *
+ * `openclaw gateway call` collapses two different worlds into one process status: it catches
+ * everything its RPC throws, prints `Gateway call failed: <error>` to stderr, and exits **1** —
+ * whether the gateway was never reachable or the gateway answered `respond(false, undefined, error)`
+ * and the client rethrew that answer as a `GatewayClientRequestError`. There is no second signal to
+ * read: stdout carries the payload only on success, and the exit code is a constant.
+ *
+ * What DOES separate them is this plugin's own message taxonomy. Every refusal these gateway methods
+ * produce leads with its bracketed code — `[INVALID_REQUEST]`, `[E_UNIVERSE_NOT_LIVE]`,
+ * `[E_NO_DSL_EXIT]`, `[NOT_FOUND]` — and no transport failure does: those read `gateway closed
+ * (1006 …)`, `gateway timeout after 10000ms`, `connect ECONNREFUSED …`, `gateway … requires
+ * credentials`. So the classifier is the taxonomy, not openclaw's error class names (which are its
+ * internals and free to change), and the reader is the ONE reader — `isRefusalMessage`, which is
+ * built on `extractTaxonomyCode` and already knows the advisory `W_` family is not a refusal.
+ *
+ * Every bracket is tried, not just the first: the code sits behind a `Gateway call failed: ` label
+ * and an error name, and a colourised or otherwise decorated stderr can put other brackets ahead
+ * of it.
+ */
+function gatewayAnsweredRefusal(stderr) {
+    for (let i = stderr.indexOf("["); i >= 0; i = stderr.indexOf("[", i + 1)) {
+        if (isRefusalMessage(stderr.slice(i)))
+            return true;
+    }
+    return false;
+}
+/**
+ * The answer for a `gateway call` that produced nothing this CLI could read.
+ *
+ * Always 1 (internal/transport), never 0 — under D-12 a 0 from a deploy verb means `live`, and this
+ * path learned nothing about the job. Deliberately overrides whatever exit code the subprocess
+ * carried, so a `gateway call` that happened to exit 3 cannot masquerade as D-12 `failed`. It never
+ * claims the deploy failed either: a started job may be running right now.
+ */
+function reportUnreadableGateway(verb, cause, followUp = "") {
+    process.exitCode = 1;
+    console.error((cause === "dispatch"
+        ? `${verb}: the \`gateway call\` subprocess failed, so nothing was read back — exit 1 (transport/internal).`
+        : `${verb}: the gateway answered but its response could not be read — exit 1 (transport/internal).`) +
+        followUp);
+}
+/**
+ * `onFailure` fires on either null path, naming which one. Callers that pass it own the exit code
+ * and the message; callers that omit it keep the historical behaviour (the subprocess's own code
+ * plus the gateway-not-running tip, and a silent return on unparseable stdout).
+ *
+ * A gateway-answered REFUSAL takes neither path: it is classified and exited here, so no caller can
+ * print an unreadable-gateway message over an answer the user has already read.
+ */
+function callGatewayJson(method, params, onFailure) {
+    const result = spawnSync(process.argv[0], [process.argv[1], "gateway", "call", method, "--json", "--params", JSON.stringify(params)], 
+    // stderr is PIPED, where it used to be inherited, for one reason: a gateway REFUSAL arrives
+    // only there, and a stderr this process never sees is a stderr it can contradict. The child
+    // still owns every character of it — see the verbatim re-emit directly below.
+    { stdio: ["inherit", "pipe", "pipe"], cwd: process.cwd(), encoding: "utf8" });
+    const stderr = typeof result.stderr === "string" ? result.stderr : "";
+    // FIRST, before anything this CLI prints, which is exactly where an inherited stderr put it —
+    // the child has already exited, so its whole output is ordered ahead of ours. Unmodified: no
+    // reformatting, no truncation, no prefix. The only edit is a terminating newline when the child
+    // did not write one, so the next line cannot be glued onto the last word of a refusal.
+    if (stderr.length > 0) {
+        process.stderr.write(stderr.endsWith("\n") ? stderr : `${stderr}\n`);
+    }
     if (result.status !== 0) {
+        if (gatewayAnsweredRefusal(stderr)) {
+            // The gateway answered, and it refused. D-12: `2 = refused` — the code agents branch on to
+            // OBEY rather than retry. Reported as 1 (internal/transport) these read as "try again", and
+            // a delisted instrument, a package with no DSL exit, or a wallet another package's stamp
+            // claims will refuse identically forever.
+            //
+            // Nothing further is printed. The refusal above is the answer; the unreadable-gateway text
+            // ("nothing was read back", "if the gateway is not running") would contradict it one line
+            // later, which is the defect this branch exists to end.
+            process.exitCode = DEPLOY_REFUSED_EXIT;
+            return null;
+        }
         process.exitCode = result.status ?? 1;
         console.error("\nTip: If the gateway is not running, start it with: openclaw gateway run");
+        onFailure?.("dispatch");
         return null;
     }
     try {
@@ -1113,6 +1344,11 @@ function callGatewayJson(method, params) {
     }
     catch {
         process.stdout.write(result.stdout ?? "");
+        // Unparseable stdout means this command did NOT do what its output implies, so it must never
+        // exit 0. Set here rather than per-verb so the swallow cannot re-seed itself on the next
+        // caller; verbs that pass `onFailure` refine the message, not the code.
+        process.exitCode = 1;
+        onFailure?.("unreadable");
         return null;
     }
 }