activeclaw 2026.2.11 → 2026.2.13

package/dist/{gateway-cli-D1EdIq8I.js → gateway-cli-DUdYxlZS.js}

@@ -1,94 +1,96 @@
-import { $ as DEFAULT_CHAT_CHANNEL, A as getChildLogger, B as resolveConfigPath, C as setVerbose, D as colorize, F as CONFIG_PATH, L as STATE_DIR, M as getResolvedLoggerSettings, O as isRich, R as isNixMode, U as resolveGatewayLockDir, W as resolveGatewayPort, X as resolveStateDir, Z as CHANNEL_IDS, dt as expandHomePrefix, j as getLogger, k as theme, l as setConsoleSubsystemFilter, n as isTruthyEnvValue, o as createSubsystemLogger, p as defaultRuntime, r as logAcceptedEnvOption, s as runtimeForLogger, st as getActivePluginRegistry, u as setConsoleTimestampPrefix } from "./entry.js";
-import { Ct as DEFAULT_CONTEXT_TOKENS, D as isCliProvider, E as getModelRefStatus, F as resolveHooksGmailModel, L as resolveThinkingDefault, N as resolveConfiguredModelRef, P as resolveDefaultModelForAgent, Tt as DEFAULT_PROVIDER, j as resolveAllowedModelRef, pt as normalizeSecretInput, wt as DEFAULT_MODEL } from "./auth-profiles-Bv1AEm-Y.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { $ as CHANNEL_IDS, A as theme, G as resolveGatewayPort, I as CONFIG_PATH, M as getLogger, N as getResolvedLoggerSettings, O as colorize, R as STATE_DIR, V as resolveConfigPath, W as resolveGatewayLockDir, Z as resolveStateDir, j as getChildLogger, k as isRich, l as setConsoleSubsystemFilter, lt as getActivePluginRegistry, n as isTruthyEnvValue, o as createSubsystemLogger, p as defaultRuntime, pt as expandHomePrefix, r as logAcceptedEnvOption, s as runtimeForLogger, tt as DEFAULT_CHAT_CHANNEL, u as setConsoleTimestampPrefix, w as setVerbose, z as isNixMode } from "./entry.js";
+import { Ct as DEFAULT_CONTEXT_TOKENS, D as isCliProvider, E as getModelRefStatus, F as resolveHooksGmailModel, L as resolveThinkingDefault, N as resolveConfiguredModelRef, P as resolveDefaultModelForAgent, Tt as DEFAULT_PROVIDER, j as resolveAllowedModelRef, pt as normalizeSecretInput, wt as DEFAULT_MODEL } from "./auth-profiles-ByNs3eEm.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
 import { _ as isCronRunSessionKey, d as resolveAgentIdFromSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, m as toAgentRequestSessionKey, n as DEFAULT_AGENT_ID, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isSubagentSessionKey, y as parseAgentSessionKey } from "./session-key-DVvxnFKg.js";
-import { E as truncateUtf16Safe, S as shortenHomePath, n as clamp, s as ensureDir, t as CONFIG_DIR, u as isPlainObject, y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-B8JKbXKW.js";
-import { t as resolveOpenClawPackageRoot } from "./openclaw-root-Dw6gumSU.js";
-import { T as resolveWorkspaceTemplateDir, _ as DEFAULT_MEMORY_FILENAME, b as DEFAULT_USER_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, g as DEFAULT_MEMORY_ALT_FILENAME, h as DEFAULT_IDENTITY_FILENAME, i as resolveAgentModelFallbacksOverride, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, v as DEFAULT_SOUL_FILENAME, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-DQuy3dwI.js";
-import "./github-copilot-token-SLWintYd.js";
+import { E as truncateUtf16Safe, S as shortenHomePath, n as clamp, s as ensureDir, t as CONFIG_DIR, u as isPlainObject, y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-CACT5OAW.js";
+import { t as resolveOpenClawPackageRoot } from "./openclaw-root-BNlEap4i.js";
+import { T as resolveWorkspaceTemplateDir, _ as DEFAULT_MEMORY_FILENAME, b as DEFAULT_USER_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, g as DEFAULT_MEMORY_ALT_FILENAME, h as DEFAULT_IDENTITY_FILENAME, i as resolveAgentModelFallbacksOverride, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, v as DEFAULT_SOUL_FILENAME, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-CsRbLH4l.js";
+import "./github-copilot-token-Cfs0Wxr8.js";
 import "./pi-model-discovery-DzEIEgHL.js";
-import { A as resolveAgentMaxConcurrent, E as applyLegacyMigrations, M as VERSION, a as parseConfigJson5, c as writeConfigFile, g as parseDurationMs, i as loadConfig, j as resolveSubagentMaxConcurrent, l as validateConfigObjectWithPlugins, n as migrateLegacyConfig, o as readConfigFileSnapshot, r as createConfigIO, s as resolveConfigSnapshotHash, u as OpenClawSchema } from "./config-B00lvFac.js";
-import { s as isTestDefaultMemorySlotDisabled } from "./manifest-registry-D5SiA3xq.js";
-import { n as movePathToTrash } from "./server-context-fX4xiYRh.js";
+import { A as resolveAgentMaxConcurrent, E as applyLegacyMigrations, M as VERSION, a as parseConfigJson5, c as writeConfigFile, g as parseDurationMs, i as loadConfig, j as resolveSubagentMaxConcurrent, l as validateConfigObjectWithPlugins, n as migrateLegacyConfig, o as readConfigFileSnapshot, r as createConfigIO, s as resolveConfigSnapshotHash, u as OpenClawSchema } from "./config-Bdhomfei.js";
+import { c as isTestDefaultMemorySlotDisabled } from "./manifest-registry-u0okVSkU.js";
+import { n as movePathToTrash } from "./server-context-BGpGs3qd.js";
 import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-CL5GtL7t.js";
 import { c as resolveGatewayBindHost, i as isTrustedProxyAddress, l as resolveGatewayClientIp, n as isLoopbackAddress, r as isLoopbackHost, t as rawDataToString, u as resolveGatewayListenHosts } from "./ws-C0k_dhCP.js";
-import { c as ensurePortAvailable, d as formatPortDiagnostics, l as inspectPortUsage } from "./chrome-yIKmOzCO.js";
-import { a as isErrno, n as formatErrorMessage } from "./errors-x4NYs-1P.js";
-import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-IRAmbcbN.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-CXWUFfFv.js";
-import { i as enableTailscaleServe, n as disableTailscaleServe, o as getTailnetHostname, r as enableTailscaleFunnel, t as disableTailscaleFunnel } from "./tailscale-DU6DgqVy.js";
-import { i as resolveGatewayAuth, n as authorizeGatewayConnect, r as isLocalDirectRequest, t as assertGatewayAuthConfigured } from "./auth-BcNHFK-i.js";
-import { $ as validateNodePairRequestParams, A as validateCronStatusParams, At as parseSessionLabel, B as validateExecApprovalsNodeGetParams, C as validateConfigSetParams, Ct as validateWizardNextParams, D as validateCronRemoveParams, Dt as ErrorCodes, E as validateCronListParams, Et as PROTOCOL_VERSION, F as validateDeviceTokenRevokeParams, Ft as normalizeDevicePublicKeyBase64Url, G as validateNodeDescribeParams, H as validateExecApprovalsSetParams, I as validateDeviceTokenRotateParams, It as verifyDeviceSignature, J as validateNodeInvokeResultParams, K as validateNodeEventParams, L as validateExecApprovalRequestParams, M as validateDevicePairApproveParams, N as validateDevicePairListParams, Nt as deriveDeviceIdFromPublicKey, O as validateCronRunParams, Ot as errorShape, P as validateDevicePairRejectParams, Q as validateNodePairRejectParams, R as validateExecApprovalResolveParams, S as validateConfigSchemaParams, St as validateWizardCancelParams, T as validateCronAddParams, Tt as validateWizardStatusParams, U as validateLogsTailParams, V as validateExecApprovalsNodeSetParams, W as validateModelsListParams, X as validateNodePairApproveParams, Y as validateNodeListParams, Z as validateNodePairListParams, _ as validateChatInjectParams, _t as validateTalkModeParams, a as validateAgentWaitParams, at as validateSessionsCompactParams, b as validateConfigGetParams, bt as validateWebLoginStartParams, c as validateAgentsFilesGetParams, ct as validateSessionsPatchParams, d as validateAgentsListParams, dt as validateSessionsResolveParams, et as validateNodePairVerifyParams, f as validateAgentsUpdateParams, ft as validateSessionsUsageParams, g as validateChatHistoryParams, gt as validateSkillsUpdateParams, h as validateChatAbortParams, ht as validateSkillsStatusParams, i as validateAgentParams, it as validateSendParams, j as validateCronUpdateParams, jt as buildDeviceAuthPayload, k as validateCronRunsParams, l as validateAgentsFilesListParams, lt as validateSessionsPreviewParams, m as validateChannelsStatusParams, mt as validateSkillsInstallParams, n as formatValidationErrors, nt as validatePollParams, o as validateAgentsCreateParams, ot as validateSessionsDeleteParams, p as validateChannelsLogoutParams, pt as validateSkillsBinsParams, q as validateNodeInvokeParams, r as validateAgentIdentityParams, rt as validateRequestFrame, s as validateAgentsDeleteParams, st as validateSessionsListParams, tt as validateNodeRenameParams, u as validateAgentsFilesSetParams, ut as validateSessionsResetParams, v as validateChatSendParams, vt as validateUpdateRunParams, w as validateConnectParams, wt as validateWizardStartParams, x as validateConfigPatchParams, xt as validateWebLoginWaitParams, y as validateConfigApplyParams, yt as validateWakeParams, z as validateExecApprovalsGetParams } from "./client-DMloFP_O.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-7yrB6v4I.js";
-import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BlgPSDAh.js";
-import { t as formatDocsLink } from "./links-7M-j83As.js";
-import { r as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-lZwe2yX5.js";
-import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-Db5BiELK.js";
+import { c as ensurePortAvailable, d as formatPortDiagnostics, l as inspectPortUsage } from "./chrome-foEwx3lN.js";
+import { a as safeEqualSecret, c as enableTailscaleFunnel, d as getTailnetHostname, i as resolveGatewayAuth, l as enableTailscaleServe, n as authorizeGatewayConnect, o as disableTailscaleFunnel, r as isLocalDirectRequest, s as disableTailscaleServe, t as assertGatewayAuthConfigured } from "./auth-9x3lqfIY.js";
+import "./control-auth-8Cf4WXpR.js";
+import { a as isErrno, n as formatErrorMessage } from "./errors-DjZBTJJ3.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-DKnttEus.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-CLvYNwtL.js";
+import { $ as validateNodePairRequestParams, A as validateCronStatusParams, At as parseSessionLabel, B as validateExecApprovalsNodeGetParams, C as validateConfigSetParams, Ct as validateWizardNextParams, D as validateCronRemoveParams, Dt as ErrorCodes, E as validateCronListParams, Et as PROTOCOL_VERSION, F as validateDeviceTokenRevokeParams, G as validateNodeDescribeParams, H as validateExecApprovalsSetParams, I as validateDeviceTokenRotateParams, It as deriveDeviceIdFromPublicKey, J as validateNodeInvokeResultParams, K as validateNodeEventParams, L as validateExecApprovalRequestParams, M as validateDevicePairApproveParams, N as validateDevicePairListParams, Nt as normalizeInputProvenance, O as validateCronRunParams, Ot as errorShape, P as validateDevicePairRejectParams, Pt as buildDeviceAuthPayload, Q as validateNodePairRejectParams, R as validateExecApprovalResolveParams, Rt as normalizeDevicePublicKeyBase64Url, S as validateConfigSchemaParams, St as validateWizardCancelParams, T as validateCronAddParams, Tt as validateWizardStatusParams, U as validateLogsTailParams, V as validateExecApprovalsNodeSetParams, W as validateModelsListParams, X as validateNodePairApproveParams, Y as validateNodeListParams, Z as validateNodePairListParams, _ as validateChatInjectParams, _t as validateTalkModeParams, a as validateAgentWaitParams, at as validateSessionsCompactParams, b as validateConfigGetParams, bt as validateWebLoginStartParams, c as validateAgentsFilesGetParams, ct as validateSessionsPatchParams, d as validateAgentsListParams, dt as validateSessionsResolveParams, et as validateNodePairVerifyParams, f as validateAgentsUpdateParams, ft as validateSessionsUsageParams, g as validateChatHistoryParams, gt as validateSkillsUpdateParams, h as validateChatAbortParams, ht as validateSkillsStatusParams, i as validateAgentParams, it as validateSendParams, j as validateCronUpdateParams, k as validateCronRunsParams, l as validateAgentsFilesListParams, lt as validateSessionsPreviewParams, m as validateChannelsStatusParams, mt as validateSkillsInstallParams, n as formatValidationErrors, nt as validatePollParams, o as validateAgentsCreateParams, ot as validateSessionsDeleteParams, p as validateChannelsLogoutParams, pt as validateSkillsBinsParams, q as validateNodeInvokeParams, r as validateAgentIdentityParams, rt as validateRequestFrame, s as validateAgentsDeleteParams, st as validateSessionsListParams, tt as validateNodeRenameParams, u as validateAgentsFilesSetParams, ut as validateSessionsResetParams, v as validateChatSendParams, vt as validateUpdateRunParams, w as validateConnectParams, wt as validateWizardStartParams, x as validateConfigPatchParams, xt as validateWebLoginWaitParams, y as validateConfigApplyParams, yt as validateWakeParams, z as validateExecApprovalsGetParams, zt as verifyDeviceSignature } from "./client-CTwXnRl7.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-DVYCIV8m.js";
+import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-C_MmebBt.js";
+import { t as formatDocsLink } from "./links-B8LAzWwg.js";
+import { r as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-Bqhc3w5n.js";
+import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-4Hqd1WGf.js";
 import "./logging-CfEk_PnX.js";
-import "./accounts-DbzMEfKN.js";
-import { $ as refreshRemoteBinsForConnectedNodes, $t as loadProviderUsageSummary, A as resolveHeartbeatVisibility, An as runWithModelFallback, At as runEmbeddedPiAgent, Br as createInternalHookEvent, Bt as isExternalHookSession, C as buildControlUiAvatarUrl, Cr as stopDiagnosticHeartbeat, Ct as DEFAULT_INPUT_TIMEOUT_MS, Dt as formatZonedTimestamp, En as resolveSessionDeliveryTarget, Et as normalizeMimeList, Fn as scheduleGatewaySigusr1Restart, Fr as getMemorySearchManager, Ft as registerUnhandledRejectionHandler, G as setCliSessionId, Gn as normalizeCronJobPatch, Gt as getAgentRunContext, H as createReplyDispatcher, Hr as triggerInternalHook, Ht as resolveAgentTimeoutMs, I as resolveCronStyleNow, In as setGatewaySigusr1RestartPolicy, Ir as resolveMemoryBackendConfig, It as createOpenClawTools, J as normalizeSendPolicy, Jn as normalizeOptionalText, Jt as runSubagentAnnounceFlow, K as runCliAgent, Kn as inferLegacyName, Kt as onAgentEvent, Ln as consumeRestartSentinel, Lr as resolveAgentIdentity, Lt as buildSafeExternalPrompt, M as getLastHeartbeatEvent, Mn as authorizeGatewaySigusr1Restart, Mr as resolveUserTimezone, Mt as waitForEmbeddedPiRunEnd, N as onHeartbeatEvent, Nn as consumeGatewaySigusr1RestartAuthorization, O as createReplyPrefixOptions, On as resetDirectoryCache, Ot as isAbortTrigger, Pn as isGatewaySigusr1RestartExternallyAllowed, Q as recordRemoteNodeInfo, Qt as applyModelOverrideToSessionEntry, Rn as formatDoctorNonInteractiveHint, Rt as detectSuspiciousPatterns, S as CONTROL_UI_AVATAR_PREFIX, Sr as startDiagnosticHeartbeat, St as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, T as resolveAssistantAvatarUrl, Tn as resolveOutboundTarget, Tr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, Tt as extractImageContentFromSource, Un as writeRestartSentinel, Ut as clearAgentRunContext, V as dispatchInboundMessage, Vn as summarizeRestartSentinel, Vr as registerInternalHook, Vt as initSubagentRegistry, W as getCliSessionId, Wn as normalizeCronJobCreate, Wt as emitAgentEvent, X as getRemoteSkillEligibility, Xn as normalizeRequiredName, Y as resolveSendPolicy, Yn as normalizePayloadToSystemText, Yt as resolveAnnounceTargetFromKey, Z as primeRemoteSkillsCache, Zn as migrateLegacyCronPayload, Zt as loadModelCatalog, _n as clearSessionQueues, _r as setTtsProvider, _t as DEFAULT_INPUT_IMAGE_MAX_BYTES, an as loadCombinedSessionStoreForGateway, ar as getPluginToolMeta, at as renamePairedNode, bn as ensureOutboundSessionEntry, br as setCommandLaneConcurrency, bt as DEFAULT_INPUT_PDF_MAX_PAGES, cn as resolveSessionModelRef, cr as getTtsProvider, ct as verifyNodeToken, d as handleReset, dn as readSessionMessages, dr as resolveTtsApiKey, er as enqueueSystemEvent, et as refreshRemoteNodeBins, fn as readSessionPreviewItemsFromTranscript, fr as resolveTtsAutoMode, ft as applyVerboseOverride, gn as lookupContextTokens, gr as setTtsEnabled, gt as DEFAULT_INPUT_FILE_MIMES, hr as resolveTtsProviderOrder, ht as DEFAULT_INPUT_FILE_MAX_CHARS, in as listSessionsFromStore, it as rejectNodePairing, jr as normalizePollInput, jt as abortEmbeddedPiRun, k as buildHistoryContextFromEntries, kr as stripHeartbeatToken, kt as stopSubagentsForRequester, ln as archiveFileOnDisk, lr as isTtsEnabled, lt as getSkillsSnapshotVersion, mn as stripEnvelopeFromMessages, mr as resolveTtsPrefsPath, mt as DEFAULT_INPUT_FILE_MAX_BYTES, n as handleSlackHttpRequest, nt as approveNodePairing, on as loadSessionEntry, or as OPENAI_TTS_MODELS, ot as requestNodePairing, pn as resolveSessionTranscriptCandidates, pr as resolveTtsConfig, pt as parseVerboseOverride, qn as normalizeOptionalAgentId, qt as registerAgentRunContext, rn as listAgentsForGateway, rr as requestHeartbeatNow, rt as listNodePairing, sn as resolveGatewaySessionStoreTarget, sr as OPENAI_TTS_VOICES, st as updatePairedNodeMetadata, t as loadOpenClawPlugins, tr as isSystemEventContextChanged, tt as setSkillsRemoteRegistry, un as capArrayByJsonBytes, ur as isTtsProviderConfigured, ut as registerSkillsChangeListener, vn as normalizeGroupActivation, vr as textToSpeech, vt as DEFAULT_INPUT_IMAGE_MIMES, w as normalizeControlUiBasePath, wr as isDiagnosticsEnabled, wt as extractFileContentFromSource, xn as resolveOutboundSessionRoute, xr as CommandLane, xt as DEFAULT_INPUT_PDF_MAX_PIXELS, yt as DEFAULT_INPUT_MAX_REDIRECTS, z as getChannelActivity, zn as formatRestartSentinelMessage, zr as clearInternalHooks, zt as getHookType } from "./loader-wXwp4rZJ.js";
-import { n as withProgress } from "./progress-Da1ehW-x.js";
-import "./prompt-style-Dc0C5HC9.js";
-import "./note-Ci08TSbV.js";
+import "./accounts-DCDeFTra.js";
+import { $ as refreshRemoteBinsForConnectedNodes, $t as loadSessionEntry, A as resolveHeartbeatVisibility, An as consumeRestartSentinel, Ar as normalizePollInput, At as runEmbeddedPiAgent, Bn as normalizeOptionalAgentId, Br as registerInternalHook, Bt as onAgentEvent, C as buildControlUiAvatarUrl, Cn as runWithModelFallback, Cr as isDiagnosticsEnabled, Ct as DEFAULT_INPUT_TIMEOUT_MS, Dn as isGatewaySigusr1RestartExternallyAllowed, Dt as formatZonedTimestamp, En as consumeGatewaySigusr1RestartAuthorization, Et as normalizeMimeList, Fr as resolveMemoryBackendConfig, Ft as initSubagentRegistry, G as setCliSessionId, Gt as applyModelOverrideToSessionEntry, H as createReplyDispatcher, Hn as normalizePayloadToSystemText, Ht as runSubagentAnnounceFlow, I as resolveCronStyleNow, In as writeRestartSentinel, Ir as resolveAgentIdentity, It as resolveAgentTimeoutMs, J as normalizeSendPolicy, Jn as detectSuspiciousPatterns, K as runCliAgent, Kt as loadProviderUsageSummary, Ln as normalizeCronJobCreate, Lt as clearAgentRunContext, M as getLastHeartbeatEvent, Mn as formatRestartSentinelMessage, Mt as waitForEmbeddedPiRunEnd, N as onHeartbeatEvent, O as createReplyPrefixOptions, On as scheduleGatewaySigusr1Restart, Or as stripHeartbeatToken, Ot as isAbortTrigger, Pn as summarizeRestartSentinel, Pr as getMemorySearchManager, Pt as createOpenClawTools, Q as recordRemoteNodeInfo, Qn as isSystemEventContextChanged, Qt as loadCombinedSessionStoreForGateway, Rn as normalizeCronJobPatch, Rr as clearInternalHooks, Rt as emitAgentEvent, S as CONTROL_UI_AVATAR_PREFIX, Sr as stopDiagnosticHeartbeat, St as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, T as resolveAssistantAvatarUrl, Tn as authorizeGatewaySigusr1Restart, Tt as extractImageContentFromSource, Un as normalizeRequiredName, Ut as resolveAnnounceTargetFromKey, V as dispatchInboundMessage, Vn as normalizeOptionalText, Vr as triggerInternalHook, Vt as registerAgentRunContext, W as getCliSessionId, Wn as migrateLegacyCronPayload, X as getRemoteSkillEligibility, Xn as isExternalHookSession, Xt as listAgentsForGateway, Y as resolveSendPolicy, Yn as getHookType, Z as primeRemoteSkillsCache, Zn as enqueueSystemEvent, Zt as listSessionsFromStore, _t as DEFAULT_INPUT_IMAGE_MAX_BYTES, an as readSessionPreviewItemsFromTranscript, ar as getTtsProvider, at as renamePairedNode, br as CommandLane, bt as DEFAULT_INPUT_PDF_MAX_PAGES, cr as resolveTtsApiKey, ct as verifyNodeToken, d as handleReset, dn as normalizeGroupActivation, dr as resolveTtsPrefsPath, en as resolveGatewaySessionStoreTarget, er as requestHeartbeatNow, et as refreshRemoteNodeBins, fr as resolveTtsProviderOrder, ft as applyVerboseOverride, gr as getActiveTaskCount, gt as DEFAULT_INPUT_FILE_MIMES, hr as textToSpeech, ht as DEFAULT_INPUT_FILE_MAX_CHARS, in as readSessionMessages, ir as OPENAI_TTS_VOICES, it as rejectNodePairing, jn as formatDoctorNonInteractiveHint, jr as resolveUserTimezone, jt as abortEmbeddedPiRun, k as buildHistoryContextFromEntries, kn as setGatewaySigusr1RestartPolicy, kt as stopSubagentsForRequester, ln as lookupContextTokens, lr as resolveTtsAutoMode, lt as getSkillsSnapshotVersion, mn as resolveOutboundSessionRoute, mr as setTtsProvider, mt as DEFAULT_INPUT_FILE_MAX_BYTES, n as handleSlackHttpRequest, nn as archiveFileOnDisk, nr as getPluginToolMeta, nt as approveNodePairing, on as resolveSessionTranscriptCandidates, or as isTtsEnabled, ot as requestNodePairing, pn as ensureOutboundSessionEntry, pr as setTtsEnabled, pt as parseVerboseOverride, qn as buildSafeExternalPrompt, rn as capArrayByJsonBytes, rr as OPENAI_TTS_MODELS, rt as listNodePairing, sn as stripEnvelopeFromMessages, sr as isTtsProviderConfigured, st as updatePairedNodeMetadata, t as loadOpenClawPlugins, tn as resolveSessionModelRef, tt as setSkillsRemoteRegistry, un as clearSessionQueues, ur as resolveTtsConfig, ut as registerSkillsChangeListener, vn as resolveOutboundTarget, vr as setCommandLaneConcurrency, vt as DEFAULT_INPUT_IMAGE_MIMES, w as normalizeControlUiBasePath, wr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, wt as extractFileContentFromSource, xn as resetDirectoryCache, xr as startDiagnosticHeartbeat, xt as DEFAULT_INPUT_PDF_MAX_PIXELS, yn as resolveSessionDeliveryTarget, yr as waitForActiveTasks, yt as DEFAULT_INPUT_MAX_REDIRECTS, z as getChannelActivity, zn as inferLegacyName, zr as createInternalHookEvent, zt as getAgentRunContext } from "./loader-KjT074JR.js";
+import { n as withProgress } from "./progress-DWqhRakV.js";
+import "./prompt-style-BFH5D5LN.js";
+import "./note-hhtubr2j.js";
 import { t as WizardCancelledError } from "./prompts-CXLLIBwP.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-DdwqKAAS.js";
-import "./onboard-channels-DxXvp8og.js";
+import "./onboard-channels-C501x8GI.js";
 import "./archive-D0z3LZDK.js";
-import "./skill-scanner-C_fQzVDu.js";
-import "./installs-89zeUsVn.js";
-import "./manager-CcVYv0N5.js";
-import { a as resolveSessionTranscriptsDirForAgent, n as resolveSessionFilePath, o as resolveStorePath, r as resolveSessionTranscriptPath } from "./paths-IivnSNkP.js";
-import "./sqlite-B7FPASCO.js";
-import "./redact-DuEEf1p1.js";
-import { m as detectMime, r as saveMediaBuffer } from "./routes-B4QQiFju.js";
-import { B as normalizeThinkLevel, F as formatXHighModelHint, H as normalizeVerboseLevel, P as formatThinkingLevels, R as normalizeElevatedLevel, V as normalizeUsageDisplay, W as supportsXHighThinking, z as normalizeReasoningLevel } from "./pi-embedded-helpers-Bkpd4fTr.js";
-import { o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-hf-WKyWd.js";
-import { $ as stripPluginOnlyAllowlist, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, J as collectExplicitAllowlist, L as resolveMainSessionKeyFromConfig, P as resolveAgentMainSessionKey, Q as resolveToolProfilePolicy, S as mergeDeliveryContext, Y as expandPolicyWithPluginGroups, Z as normalizeToolName, b as deliveryContextFromSession, d as loadSessionStore, g as updateSessionStore, q as buildPluginToolGroups, w as normalizeSessionDeliveryFields, z as snapshotSessionOrigin } from "./sandbox-Aks-9EcZ.js";
-import "./tui-formatters-C3NarH24.js";
-import { i as getMachineDisplayName, r as createBrowserRouteDispatcher } from "./wsl-Cwo7X0Un.js";
-import { d as hasBinary, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-D5UZZZSY.js";
-import "./image-Ds4NLGPR.js";
-import { c as normalizeExecApprovals, g as saveExecApprovals, l as readExecApprovalsSnapshot, m as resolveExecApprovalsSocketPath, r as ensureExecApprovals } from "./exec-approvals-DhmKpiIo.js";
-import "./tool-display-o-dDAlqF.js";
-import { t as parseAbsoluteTimeMs } from "./parse-Cjiudy6x.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-RZimme3j.js";
-import { i as loadSessionUsageTimeSeries, l as deriveSessionTotalTokens, n as loadCostUsageSummary, r as loadSessionCostSummary, t as discoverAllSessions, u as hasNonzeroUsage } from "./session-cost-usage-CcCEQNuc.js";
-import { n as formatTokenCount, r as formatUsd } from "./usage-format-6Uar63S0.js";
-import { c as resolveSubagentToolPolicy, i as filterToolsByPolicy, o as resolveEffectiveToolPolicy, s as resolveGroupToolPolicy } from "./commands-CjEGXOZ_.js";
-import "./pairing-store-CgXR3ZWJ.js";
-import "./login-qr-CGEu5TU-.js";
-import { n as runCommandWithRuntime } from "./cli-utils-PlLcDZlM.js";
-import "./pairing-labels-CWFEtSc3.js";
-import { t as buildChannelAccountSnapshot } from "./status-Drziap9H.js";
-import "./channels-status-issues-B3KkflfR.js";
-import "./register.subclis-DUkirdHn.js";
-import "./completion-cli-DrJGfJGl.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-Bv1kLtwo.js";
-import "./daemon-runtime-c0uXH4Dl.js";
-import "./service-DDPRbf8a.js";
-import "./systemd-BEWwfwn0.js";
-import "./shared-BDk_zC9p.js";
-import { a as runDaemonStop, i as runDaemonStart, n as runDaemonStatus, o as runDaemonUninstall, r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-CTC2CHci.js";
-import "./service-audit-x6jCN-6a.js";
-import "./table-cCoGqLsk.js";
-import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-CMIG6-74.js";
-import { a as toOptionString, i as parsePort$1, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CagUDdmp.js";
-import { i as probeGateway } from "./audit-CY-yopxa.js";
-import { _ as discoverGatewayBeacons, n as installSkill } from "./onboard-skills-CBxsRGyf.js";
-import { a as resolveControlUiRootOverrideSync, c as getHealthSnapshot, d as runHeartbeatOnce, f as setHeartbeatsEnabled, n as ensureControlUiAssetsBuilt, o as resolveControlUiRootSync, p as startHeartbeatRunner, s as formatHealthChannelLines } from "./health-format-DrGFg8bx.js";
-import { S as normalizeUpdateChannel, _ as resolveNpmChannelTag, h as compareSemverStrings, m as checkUpdateStatus, t as runGatewayUpdate, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner-ChTf6O6p.js";
-import "./github-copilot-auth-CZxurvdz.js";
-import "./logging-DuK6YXuK.js";
-import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-Br-2bK2G.js";
-import { a as findAgentEntryIndex, c as pruneAgentConfig, f as runOnboardingWizard, n as getStatusSummary, o as listAgentEntries, r as applyAgentConfig, s as loadAgentIdentity, u as loadAgentIdentityFromWorkspace } from "./status-zfL4Yej7.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-DjtPPMnY.js";
-import "./tui-BdJWZdto.js";
-import { i as setGatewayWsLogStyle, n as logWs, r as summarizeAgentEventForWsLog, t as formatForLog } from "./ws-log-BP3z_g6Z.js";
-import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-CHcssBOA.js";
-import { a as createOutboundSendDeps$1, i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-22-R4bNS.js";
-import "./node-service-u8g85nD3.js";
-import { n as forceFreePortAndWait } from "./ports-BeebfNCb.js";
+import "./skill-scanner-rHMtUHtP.js";
+import "./installs-CrLcWYHe.js";
+import { J as getGlobalHookRunner, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-CIU9Npgs.js";
+import "./manager-T1XfGchB.js";
+import { n as resolveSessionFilePath, o as resolveSessionTranscriptsDirForAgent, r as resolveSessionTranscriptPath, s as resolveStorePath } from "./paths-DLINmNFQ.js";
+import "./sqlite-BINzs1U0.js";
+import "./redact-Br9GfacZ.js";
+import { p as detectMime, r as saveMediaBuffer } from "./routes-DewK5tq2.js";
+import { B as normalizeElevatedLevel, H as normalizeThinkLevel, I as formatThinkingLevels, K as supportsXHighThinking, L as formatXHighModelHint, U as normalizeUsageDisplay, V as normalizeReasoningLevel, W as normalizeVerboseLevel } from "./pi-embedded-helpers-DfwkwPYD.js";
+import "./fetch-timeout-DTK9vxex.js";
+import { $ as stripPluginOnlyAllowlist, F as resolveExplicitAgentSessionKey, I as resolveMainSessionKey, J as collectExplicitAllowlist, L as resolveMainSessionKeyFromConfig, P as resolveAgentMainSessionKey, Q as resolveToolProfilePolicy, S as mergeDeliveryContext, Y as expandPolicyWithPluginGroups, Z as normalizeToolName, b as deliveryContextFromSession, d as loadSessionStore, g as updateSessionStore, q as buildPluginToolGroups, w as normalizeSessionDeliveryFields, z as snapshotSessionOrigin } from "./sandbox-BKYnhYQH.js";
+import "./tui-formatters-DePhZK3J.js";
+import { i as getMachineDisplayName, r as createBrowserRouteDispatcher } from "./wsl-BUOkxKJu.js";
+import { i as loadWorkspaceSkillEntries, m as hasBinary, r as buildWorkspaceSkillSnapshot } from "./skills-DRjfSQT3.js";
+import "./image-DgtfXMcX.js";
+import { c as normalizeExecApprovals, g as saveExecApprovals, l as readExecApprovalsSnapshot, m as resolveExecApprovalsSocketPath, r as ensureExecApprovals } from "./exec-approvals-DQ8TVVmj.js";
+import "./tool-display-ClRud3pg.js";
+import { t as parseAbsoluteTimeMs } from "./parse-ioZhOtha.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-D4D6ImhN.js";
+import { i as loadSessionUsageTimeSeries, l as deriveSessionTotalTokens, n as loadCostUsageSummary, r as loadSessionCostSummary, t as discoverAllSessions, u as hasNonzeroUsage } from "./session-cost-usage-D9hHANWI.js";
+import { n as formatTokenCount, r as formatUsd } from "./usage-format-C4JfTbSp.js";
+import { _ as loadModelCatalog, h as registerUnhandledRejectionHandler } from "./runner-CY0nmVme.js";
+import { c as resolveSubagentToolPolicy, i as filterToolsByPolicy, o as resolveEffectiveToolPolicy, s as resolveGroupToolPolicy } from "./commands-BX_OIIVR.js";
+import "./pairing-store-Dp5_JGnG.js";
+import "./login-qr-CuvemJj4.js";
+import { n as runCommandWithRuntime } from "./cli-utils-LcHOt63h.js";
+import "./pairing-labels-CgNHnjzT.js";
+import { t as buildChannelAccountSnapshot } from "./status-CoAy6bEC.js";
+import "./channels-status-issues-D7GSV1GS.js";
+import "./register.subclis-C02e4zuJ.js";
+import "./completion-cli-CR77-jyv.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-QSwGcoNZ.js";
+import "./daemon-runtime-B0tg_LsX.js";
+import "./service-99RDXwX4.js";
+import "./systemd-C0VZriGM.js";
+import "./shared-ICqOZibV.js";
+import { a as runDaemonStop, i as runDaemonStart, n as runDaemonStatus, o as runDaemonUninstall, r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-cNSF93-v.js";
+import "./service-audit-ckBaRCVC.js";
+import "./table-CwulTLQp.js";
+import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-BaIgNEhY.js";
+import { a as toOptionString, i as parsePort$1, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CEY5IkwG.js";
+import { i as probeGateway } from "./audit-wPu26VMb.js";
+import { S as discoverGatewayBeacons, n as installSkill } from "./onboard-skills-DV0Qzvjj.js";
+import { a as resolveControlUiRootOverrideSync, c as getHealthSnapshot, d as runHeartbeatOnce, f as setHeartbeatsEnabled, n as ensureControlUiAssetsBuilt, o as resolveControlUiRootSync, p as startHeartbeatRunner, s as formatHealthChannelLines } from "./health-format-LZDxu3rv.js";
+import { S as normalizeUpdateChannel, _ as resolveNpmChannelTag, h as compareSemverStrings, m as checkUpdateStatus, t as runGatewayUpdate, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner--ixK4J3W.js";
+import "./github-copilot-auth-DDispnyz.js";
+import "./logging-CRq4h04P.js";
+import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-Cw0xD8Lt.js";
+import { a as findAgentEntryIndex, c as pruneAgentConfig, f as runOnboardingWizard, n as getStatusSummary, o as listAgentEntries, r as applyAgentConfig, s as loadAgentIdentity, u as loadAgentIdentityFromWorkspace } from "./status-DDWoOpeB.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-TDIgVd1K.js";
+import "./tui-Lu8FdrlK.js";
+import { i as setGatewayWsLogStyle, n as logWs, r as summarizeAgentEventForWsLog, t as formatForLog } from "./ws-log-CIXbLCka.js";
+import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-DJb-_5kO.js";
+import { a as createOutboundSendDeps$1, i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-CyMxTyrG.js";
+import "./node-service-WQuEKz6W.js";
+import { n as forceFreePortAndWait } from "./ports-qkt29rdC.js";
 import { spawn, spawnSync } from "node:child_process";
 import path from "node:path";
 import os from "node:os";
@@ -1204,6 +1206,10 @@ const BASE_RELOAD_RULES = [
 	}
 ];
 const BASE_RELOAD_RULES_TAIL = [
+	{
+		prefix: "meta",
+		kind: "none"
+	},
 	{
 		prefix: "identity",
 		kind: "none"
@@ -2547,6 +2553,8 @@ function resolveCronSession(params) {
 			thinkingLevel: entry?.thinkingLevel,
 			verboseLevel: entry?.verboseLevel,
 			model: entry?.model,
+			modelOverride: entry?.modelOverride,
+			providerOverride: entry?.providerOverride,
 			contextTokens: entry?.contextTokens,
 			sendPolicy: entry?.sendPolicy,
 			lastChannel: entry?.lastChannel,
@@ -2580,9 +2588,8 @@ async function runCronIsolatedAgentTurn(params) {
 	const defaultAgentId = resolveDefaultAgentId(params.cfg);
 	const requestedAgentId = typeof params.agentId === "string" && params.agentId.trim() ? params.agentId : typeof params.job.agentId === "string" && params.job.agentId.trim() ? params.job.agentId : void 0;
 	const normalizedRequested = requestedAgentId ? normalizeAgentId(requestedAgentId) : void 0;
-	const agentConfigOverride = normalizedRequested ? resolveAgentConfig(params.cfg, normalizedRequested) : void 0;
-	const { model: overrideModel, ...agentOverrideRest } = agentConfigOverride ?? {};
-	const agentId = agentConfigOverride ? normalizedRequested ?? defaultAgentId : defaultAgentId;
+	const { model: overrideModel, ...agentOverrideRest } = (normalizedRequested ? resolveAgentConfig(params.cfg, normalizedRequested) : void 0) ?? {};
+	const agentId = normalizedRequested ?? defaultAgentId;
 	const agentCfg = Object.assign({}, params.cfg.agents?.defaults, agentOverrideRest);
 	if (typeof overrideModel === "string") agentCfg.model = { primary: overrideModel };
 	else if (overrideModel) agentCfg.model = overrideModel;
@@ -2614,6 +2621,7 @@ async function runCronIsolatedAgentTurn(params) {
 		return catalog;
 	};
 	const isGmailHook = baseSessionKey.startsWith("hook:gmail:");
+	let hooksGmailModelApplied = false;
 	const hooksGmailModelRef = isGmailHook ? resolveHooksGmailModel({
 		cfg: params.cfg,
 		defaultProvider: DEFAULT_PROVIDER
@@ -2628,6 +2636,7 @@ async function runCronIsolatedAgentTurn(params) {
 		}).allowed) {
 			provider = hooksGmailModelRef.provider;
 			model = hooksGmailModelRef.model;
+			hooksGmailModelApplied = true;
 		}
 	}
 	const modelOverrideRaw = params.job.payload.kind === "agentTurn" ? params.job.payload.model : void 0;
@@ -2673,6 +2682,23 @@ async function runCronIsolatedAgentTurn(params) {
 		const labelSuffix = typeof params.job.name === "string" && params.job.name.trim() ? params.job.name.trim() : params.job.id;
 		cronSession.sessionEntry.label = `Cron: ${labelSuffix}`;
 	}
+	if (!modelOverride && !hooksGmailModelApplied) {
+		const sessionModelOverride = cronSession.sessionEntry.modelOverride?.trim();
+		if (sessionModelOverride) {
+			const sessionProviderOverride = cronSession.sessionEntry.providerOverride?.trim() || resolvedDefault.provider;
+			const resolvedSessionOverride = resolveAllowedModelRef({
+				cfg: cfgWithAgentDefaults,
+				catalog: await loadCatalog(),
+				raw: `${sessionProviderOverride}/${sessionModelOverride}`,
+				defaultProvider: resolvedDefault.provider,
+				defaultModel: resolvedDefault.model
+			});
+			if (!("error" in resolvedSessionOverride)) {
+				provider = resolvedSessionOverride.ref.provider;
+				model = resolvedSessionOverride.ref.model;
+			}
+		}
+	}
 	const hooksGmailThinking = isGmailHook ? normalizeThinkLevel(params.cfg.hooks?.gmail?.thinking) : void 0;
 	const thinkOverride = normalizeThinkLevel(agentCfg?.thinkingDefault);
 	let thinkLevel = normalizeThinkLevel((params.job.payload.kind === "agentTurn" ? params.job.payload.thinking : void 0) ?? void 0) ?? hooksGmailThinking ?? thinkOverride;
@@ -2810,6 +2836,7 @@ async function runCronIsolatedAgentTurn(params) {
 	const payloads = runResult.payloads ?? [];
 	{
 		const usage = runResult.meta.agentMeta?.usage;
+		const promptTokens = runResult.meta.agentMeta?.promptTokens;
 		const modelUsed = runResult.meta.agentMeta?.model ?? fallbackModel ?? model;
 		const providerUsed = runResult.meta.agentMeta?.provider ?? fallbackProvider ?? provider;
 		const contextTokens = agentCfg?.contextTokens ?? lookupContextTokens(modelUsed) ?? DEFAULT_CONTEXT_TOKENS;
@@ -2827,7 +2854,8 @@ async function runCronIsolatedAgentTurn(params) {
 			cronSession.sessionEntry.outputTokens = output;
 			cronSession.sessionEntry.totalTokens = deriveSessionTotalTokens({
 				usage,
-				contextTokens
+				contextTokens,
+				promptTokens
 			}) ?? input;
 		}
 		await persistSessionEntry();
@@ -3045,10 +3073,10 @@ function computeNextRunAtMs(schedule, nowMs) {
 		catch: false
 	});
 	const nowSecondMs = Math.floor(nowMs / 1e3) * 1e3;
-	const next = cron.nextRun(/* @__PURE__ */ new Date(nowSecondMs - 1));
+	const next = cron.nextRun(new Date(nowSecondMs));
 	if (!next) return;
 	const nextMs = next.getTime();
-	return Number.isFinite(nextMs) && nextMs >= nowSecondMs ? nextMs : void 0;
+	return Number.isFinite(nextMs) && nextMs > nowSecondMs ? nextMs : void 0;
 }
 
 //#endregion
@@ -3091,6 +3119,8 @@ function computeJobNextRunAtMs(job, nowMs) {
 	}
 	return computeNextRunAtMs(job.schedule, nowMs);
 }
+/** Maximum consecutive schedule errors before auto-disabling a job. */
+const MAX_SCHEDULE_ERRORS = 3;
 function recomputeNextRuns(state) {
 	if (!state.store) return false;
 	let changed = false;
@@ -3121,12 +3151,82 @@ function recomputeNextRuns(state) {
 			changed = true;
 		}
 		const nextRun = job.state.nextRunAtMs;
-		if (nextRun === void 0 || now >= nextRun) {
+		if (nextRun === void 0 || now >= nextRun) try {
 			const newNext = computeJobNextRunAtMs(job, now);
 			if (job.state.nextRunAtMs !== newNext) {
 				job.state.nextRunAtMs = newNext;
 				changed = true;
 			}
+			if (job.state.scheduleErrorCount) {
+				job.state.scheduleErrorCount = void 0;
+				changed = true;
+			}
+		} catch (err) {
+			const errorCount = (job.state.scheduleErrorCount ?? 0) + 1;
+			job.state.scheduleErrorCount = errorCount;
+			job.state.nextRunAtMs = void 0;
+			job.state.lastError = `schedule error: ${String(err)}`;
+			changed = true;
+			if (errorCount >= MAX_SCHEDULE_ERRORS) {
+				job.enabled = false;
+				state.deps.log.error({
+					jobId: job.id,
+					name: job.name,
+					errorCount,
+					err: String(err)
+				}, "cron: auto-disabled job after repeated schedule errors");
+			} else state.deps.log.warn({
+				jobId: job.id,
+				name: job.name,
+				errorCount,
+				err: String(err)
+			}, "cron: failed to compute next run for job (skipping)");
+		}
+	}
+	return changed;
+}
+/**
+* Maintenance-only version of recomputeNextRuns that handles disabled jobs
+* and stuck markers, but does NOT recompute nextRunAtMs for enabled jobs
+* with existing values. Used during timer ticks when no due jobs were found
+* to prevent silently advancing past-due nextRunAtMs values without execution
+* (see #13992).
+*/
+function recomputeNextRunsForMaintenance(state) {
+	if (!state.store) return false;
+	let changed = false;
+	const now = state.deps.nowMs();
+	for (const job of state.store.jobs) {
+		if (!job.state) {
+			job.state = {};
+			changed = true;
+		}
+		if (!job.enabled) {
+			if (job.state.nextRunAtMs !== void 0) {
+				job.state.nextRunAtMs = void 0;
+				changed = true;
+			}
+			if (job.state.runningAtMs !== void 0) {
+				job.state.runningAtMs = void 0;
+				changed = true;
+			}
+			continue;
+		}
+		const runningAt = job.state.runningAtMs;
+		if (typeof runningAt === "number" && now - runningAt > STUCK_RUN_MS) {
+			state.deps.log.warn({
+				jobId: job.id,
+				runningAtMs: runningAt
+			}, "cron: clearing stuck running marker");
+			job.state.runningAtMs = void 0;
+			changed = true;
+		}
+		if (job.state.nextRunAtMs === void 0) {
+			const newNext = computeJobNextRunAtMs(job, now);
+			if (newNext !== void 0) {
+				job.state.nextRunAtMs = newNext;
+				changed = true;
+			}
 		}
 	}
 	return changed;
@@ -3786,7 +3886,7 @@ function applyJobResult(state, job, result) {
 	job.updatedAtMs = result.endedAt;
 	if (result.status === "error") job.state.consecutiveErrors = (job.state.consecutiveErrors ?? 0) + 1;
 	else job.state.consecutiveErrors = 0;
-	const shouldDelete = job.schedule.kind === "at" && result.status === "ok" && job.deleteAfterRun === true;
+	const shouldDelete = job.schedule.kind === "at" && job.deleteAfterRun === true && result.status === "ok";
 	if (!shouldDelete) if (job.schedule.kind === "at") {
 		job.enabled = false;
 		job.state.nextRunAtMs = void 0;
@@ -3847,7 +3947,17 @@ function armTimer(state) {
 	}, "cron: timer armed");
 }
 async function onTimer(state) {
-	if (state.running) return;
+	if (state.running) {
+		if (state.timer) clearTimeout(state.timer);
+		state.timer = setTimeout(async () => {
+			try {
+				await onTimer(state);
+			} catch (err) {
+				state.deps.log.error({ err: String(err) }, "cron: timer tick failed");
+			}
+		}, MAX_TIMER_DELAY_MS);
+		return;
+	}
 	state.running = true;
 	try {
 		const dueJobs = await locked(state, async () => {
@@ -3857,7 +3967,7 @@ async function onTimer(state) {
 			});
 			const due = findDueJobs(state);
 			if (due.length === 0) {
-				if (recomputeNextRuns(state)) await persist(state);
+				if (recomputeNextRunsForMaintenance(state)) await persist(state);
 				return [];
 			}
 			const now = state.deps.nowMs();
@@ -3993,7 +4103,7 @@ async function runMissedJobs(state) {
 		if (!j.enabled) return false;
 		if (typeof j.state.runningAtMs === "number") return false;
 		const next = j.state.nextRunAtMs;
-		if (j.schedule.kind === "at" && j.state.lastStatus === "ok") return false;
+		if (j.schedule.kind === "at" && j.state.lastStatus) return false;
 		return typeof next === "number" && now >= next;
 	});
 	if (missed.length > 0) {
@@ -4019,7 +4129,10 @@ async function executeJobCore(state, job) {
 			const waitStartedAt = state.deps.nowMs();
 			let heartbeatResult;
 			for (;;) {
-				heartbeatResult = await state.deps.runHeartbeatOnce({ reason });
+				heartbeatResult = await state.deps.runHeartbeatOnce({
+					reason,
+					agentId: job.agentId
+				});
 				if (heartbeatResult.status !== "skipped" || heartbeatResult.reason !== "requests-in-flight") break;
 				if (state.deps.nowMs() - waitStartedAt > maxWaitMs) {
 					state.deps.requestHeartbeatNow({ reason });
@@ -4398,9 +4511,12 @@ function buildGatewayCronService(params) {
 			},
 			requestHeartbeatNow,
 			runHeartbeatOnce: async (opts) => {
+				const runtimeConfig = loadConfig();
+				const agentId = opts?.agentId ? resolveCronAgent(opts.agentId).agentId : void 0;
 				return await runHeartbeatOnce({
-					cfg: loadConfig(),
+					cfg: runtimeConfig,
 					reason: opts?.reason,
+					agentId,
 					deps: {
 						...params.deps,
 						runtime: defaultRuntime
@@ -4781,8 +4897,8 @@ function abortChatRunsForSessionKey(ops, params) {
 
 //#endregion
 //#region src/gateway/server-constants.ts
-const MAX_PAYLOAD_BYTES = 512 * 1024;
-const MAX_BUFFERED_BYTES = 1.5 * 1024 * 1024;
+const MAX_PAYLOAD_BYTES = 8 * 1024 * 1024;
+const MAX_BUFFERED_BYTES = 16 * 1024 * 1024;
 const DEFAULT_MAX_CHAT_HISTORY_MESSAGES_BYTES = 6 * 1024 * 1024;
 let maxChatHistoryMessagesBytes = DEFAULT_MAX_CHAT_HISTORY_MESSAGES_BYTES;
 const getMaxChatHistoryMessagesBytes = () => maxChatHistoryMessagesBytes;
@@ -5495,7 +5611,7 @@ function ensureAgentRunListener() {
 		agentRunStarts.delete(evt.runId);
 		recordAgentRunSnapshot({
 			runId: evt.runId,
-			status: phase === "error" ? "error" : "ok",
+			status: phase === "error" ? "error" : evt.data?.aborted ? "timeout" : "ok",
 			startedAt,
 			endedAt,
 			error,
@@ -5537,7 +5653,7 @@ async function waitForAgentJob(params) {
 			const error = typeof evt.data?.error === "string" ? evt.data.error : void 0;
 			const snapshot = {
 				runId: evt.runId,
-				status: phase === "error" ? "error" : "ok",
+				status: phase === "error" ? "error" : evt.data?.aborted ? "timeout" : "ok",
 				startedAt,
 				endedAt,
 				error,
@@ -5622,6 +5738,7 @@ const agentHandlers = {
 		let resolvedGroupChannel = groupChannelRaw || void 0;
 		let resolvedGroupSpace = groupSpaceRaw || void 0;
 		let spawnedByValue = typeof request.spawnedBy === "string" ? request.spawnedBy.trim() : void 0;
+		const inputProvenance = normalizeInputProvenance(request.inputProvenance);
 		const cached = context.dedupe.get(`agent:${idem}`);
 		if (cached) {
 			respond(cached.ok, cached.payload, cached.error, { cached: true });
@@ -5828,7 +5945,8 @@ const agentHandlers = {
 			messageChannel: resolvedChannel,
 			runId,
 			lane: request.lane,
-			extraSystemPrompt: request.extraSystemPrompt
+			extraSystemPrompt: request.extraSystemPrompt,
+			inputProvenance
 		}, defaultRuntime, context.deps).then((result) => {
 			const payload = {
 				runId,
@@ -6749,9 +6867,13 @@ const channelsHandlers = {
 //#region src/gateway/server-methods/chat.ts
 function resolveTranscriptPath(params) {
 	const { sessionId, storePath, sessionFile } = params;
-	if (sessionFile) return sessionFile;
-	if (!storePath) return null;
-	return path.join(path.dirname(storePath), `${sessionId}.jsonl`);
+	if (!storePath && !sessionFile) return null;
+	try {
+		const sessionsDir = storePath ? path.dirname(storePath) : void 0;
+		return resolveSessionFilePath(sessionId, sessionFile ? { sessionFile } : void 0, sessionsDir ? { sessionsDir } : void 0);
+	} catch {
+		return null;
+	}
 }
 function ensureTranscriptFile(params) {
 	if (fs.existsSync(params.transcriptPath)) return { ok: true };
@@ -7280,16 +7402,32 @@ function applyMergePatch(base, patch) {
 */
 const REDACTED_SENTINEL = "__OPENCLAW_REDACTED__";
 /**
+* Non-sensitive field names that happen to match sensitive patterns.
+* These are explicitly excluded from redaction.
+*/
+const SENSITIVE_KEY_WHITELIST = new Set([
+	"maxtokens",
+	"maxoutputtokens",
+	"maxinputtokens",
+	"maxcompletiontokens",
+	"contexttokens",
+	"totaltokens",
+	"tokencount",
+	"tokenlimit",
+	"tokenbudget"
+]);
+/**
 * Patterns that identify sensitive config field names.
 * Aligned with the UI-hint logic in schema.ts.
 */
 const SENSITIVE_KEY_PATTERNS = [
-	/token/i,
+	/token$/i,
 	/password/i,
 	/secret/i,
 	/api.?key/i
 ];
 function isSensitiveKey(key) {
+	if (SENSITIVE_KEY_WHITELIST.has(key.toLowerCase())) return false;
 	return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
 }
 /**
@@ -7999,7 +8137,7 @@ const FIELD_PLACEHOLDERS = {
 	"agents.list[].identity.avatar": "avatars/openclaw.png"
 };
 const SENSITIVE_PATTERNS = [
-	/token/i,
+	/token$/i,
 	/password/i,
 	/secret/i,
 	/api.?key/i
@@ -8931,7 +9069,7 @@ async function verifyDeviceToken(params) {
 			ok: false,
 			reason: "token-revoked"
 		};
-		if (entry.token !== params.token) return {
+		if (!safeEqualSecret(params.token, entry.token)) return {
 			ok: false,
 			reason: "token-mismatch"
 		};
@@ -9783,7 +9921,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-BzrEnKLX.js");
+			const { handleNodeEvent } = await import("./server-node-events-QCvh8EgI.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -9851,8 +9989,13 @@ const sendHandlers = {
 			return;
 		}
 		const to = request.to.trim();
-		const message = request.message.trim();
-		const mediaUrls = Array.isArray(request.mediaUrls) ? request.mediaUrls : void 0;
+		const message = typeof request.message === "string" ? request.message.trim() : "";
+		const mediaUrl = typeof request.mediaUrl === "string" && request.mediaUrl.trim().length > 0 ? request.mediaUrl.trim() : void 0;
+		const mediaUrls = Array.isArray(request.mediaUrls) ? request.mediaUrls.map((entry) => typeof entry === "string" ? entry.trim() : "").filter((entry) => entry.length > 0) : void 0;
+		if (!message && !mediaUrl && (mediaUrls?.length ?? 0) === 0) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid send params: text or media is required"));
+			return;
+		}
 		const channelInput = typeof request.channel === "string" ? request.channel : void 0;
 		const normalizedChannel = channelInput ? normalizeChannelId(channelInput) : null;
 		if (channelInput && !normalizedChannel) {
@@ -9884,7 +10027,7 @@ const sendHandlers = {
 				const outboundDeps = context.deps ? createOutboundSendDeps(context.deps) : void 0;
 				const mirrorPayloads = normalizeReplyPayloadsForDelivery([{
 					text: message,
-					mediaUrl: request.mediaUrl,
+					mediaUrl,
 					mediaUrls
 				}]);
 				const mirrorText = mirrorPayloads.map((payload) => payload.text).filter(Boolean).join("\n");
@@ -9912,7 +10055,7 @@ const sendHandlers = {
 					accountId,
 					payloads: [{
 						text: message,
-						mediaUrl: request.mediaUrl,
+						mediaUrl,
 						mediaUrls
 					}],
 					gifPlayback: request.gifPlayback,
@@ -11283,7 +11426,7 @@ const usageHandlers = {
 		const limit = typeof p.limit === "number" && Number.isFinite(p.limit) ? p.limit : 50;
 		const includeContextWeight = p.includeContextWeight ?? false;
 		const specificKey = typeof p.key === "string" ? p.key.trim() : null;
-		const { store } = loadCombinedSessionStoreForGateway(config);
+		const { storePath, store } = loadCombinedSessionStoreForGateway(config);
 		const now = Date.now();
 		const mergedEntries = [];
 		if (specificKey) {
@@ -11303,7 +11446,13 @@ const usageHandlers = {
 			const resolvedStoreKey = storeMatch?.key ?? storeByIdMatch?.key ?? specificKey;
 			const storeEntry = storeMatch?.entry ?? storeByIdMatch?.entry;
 			const sessionId = storeEntry?.sessionId ?? keyRest;
-			const sessionFile = resolveSessionFilePath(sessionId, storeEntry, { agentId: agentIdFromKey });
+			let sessionFile;
+			try {
+				sessionFile = resolveSessionFilePath(sessionId, storeEntry, storePath && storePath !== "(multiple)" ? { sessionsDir: path.dirname(storePath) } : { agentId: agentIdFromKey });
+			} catch {
+				respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session reference: ${specificKey}`));
+				return;
+			}
 			try {
 				const stats = fs.statSync(sessionFile);
 				if (stats.isFile()) mergedEntries.push({
@@ -11629,14 +11778,22 @@ const usageHandlers = {
 			return;
 		}
 		const config = loadConfig();
-		const { entry } = loadSessionEntry(key);
+		const { entry, storePath } = loadSessionEntry(key);
 		const parsed = parseAgentSessionKey(key);
 		const agentId = parsed?.agentId;
 		const rawSessionId = parsed?.rest ?? key;
+		const sessionId = entry?.sessionId ?? rawSessionId;
+		let sessionFile;
+		try {
+			sessionFile = resolveSessionFilePath(sessionId, entry, storePath ? { sessionsDir: path.dirname(storePath) } : { agentId });
+		} catch {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session key: ${key}`));
+			return;
+		}
 		const timeseries = await loadSessionUsageTimeSeries({
-			sessionId: entry?.sessionId ?? rawSessionId,
+			sessionId,
 			sessionEntry: entry,
-			sessionFile: entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId }),
+			sessionFile,
 			config,
 			maxPoints: 200
 		});
@@ -11654,13 +11811,19 @@ const usageHandlers = {
 		}
 		const limit = typeof params?.limit === "number" && Number.isFinite(params.limit) ? Math.min(params.limit, 1e3) : 200;
 		const config = loadConfig();
-		const { entry } = loadSessionEntry(key);
+		const { entry, storePath } = loadSessionEntry(key);
 		const parsed = parseAgentSessionKey(key);
 		const agentId = parsed?.agentId;
 		const rawSessionId = parsed?.rest ?? key;
 		const sessionId = entry?.sessionId ?? rawSessionId;
-		const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId });
-		const { loadSessionLogs } = await import("./session-cost-usage-CcCEQNuc.js").then((n) => n.a);
+		let sessionFile;
+		try {
+			sessionFile = resolveSessionFilePath(sessionId, entry, storePath ? { sessionsDir: path.dirname(storePath) } : { agentId });
+		} catch {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session key: ${key}`));
+			return;
+		}
+		const { loadSessionLogs } = await import("./session-cost-usage-D9hHANWI.js").then((n) => n.a);
 		respond(true, { logs: await loadSessionLogs({
 			sessionId,
 			sessionEntry: entry,
@@ -12666,6 +12829,12 @@ function resolveHooksConfig(cfg) {
 	const maxBodyBytes = cfg.hooks?.maxBodyBytes && cfg.hooks.maxBodyBytes > 0 ? cfg.hooks.maxBodyBytes : DEFAULT_HOOKS_MAX_BODY_BYTES;
 	const mappings = resolveHookMappings(cfg.hooks);
 	const defaultAgentId = resolveDefaultAgentId(cfg);
+	const knownAgentIds = resolveKnownAgentIds(cfg, defaultAgentId);
+	const allowedAgentIds = resolveAllowedAgentIds(cfg.hooks?.allowedAgentIds);
+	const defaultSessionKey = resolveSessionKey$1(cfg.hooks?.defaultSessionKey);
+	const allowedSessionKeyPrefixes = resolveAllowedSessionKeyPrefixes(cfg.hooks?.allowedSessionKeyPrefixes);
+	if (defaultSessionKey && allowedSessionKeyPrefixes && !isSessionKeyAllowedByPrefix(defaultSessionKey, allowedSessionKeyPrefixes)) throw new Error("hooks.defaultSessionKey must match hooks.allowedSessionKeyPrefixes");
+	if (!defaultSessionKey && allowedSessionKeyPrefixes && !isSessionKeyAllowedByPrefix("hook:example", allowedSessionKeyPrefixes)) throw new Error("hooks.allowedSessionKeyPrefixes must include 'hook:' when hooks.defaultSessionKey is unset");
 	return {
 		basePath: trimmed,
 		token,
@@ -12673,8 +12842,13 @@ function resolveHooksConfig(cfg) {
 		mappings,
 		agentPolicy: {
 			defaultAgentId,
-			knownAgentIds: resolveKnownAgentIds(cfg, defaultAgentId),
-			allowedAgentIds: resolveAllowedAgentIds(cfg.hooks?.allowedAgentIds)
+			knownAgentIds,
+			allowedAgentIds
+		},
+		sessionPolicy: {
+			defaultSessionKey,
+			allowRequestSessionKey: cfg.hooks?.allowRequestSessionKey === true,
+			allowedSessionKeyPrefixes
 		}
 	};
 }
@@ -12699,6 +12873,29 @@ function resolveAllowedAgentIds(raw) {
 	if (hasWildcard) return;
 	return allowed;
 }
+function resolveSessionKey$1(raw) {
+	const value = raw?.trim();
+	return value ? value : void 0;
+}
+function normalizeSessionKeyPrefix(raw) {
+	const value = raw.trim().toLowerCase();
+	return value ? value : void 0;
+}
+function resolveAllowedSessionKeyPrefixes(raw) {
+	if (!Array.isArray(raw)) return;
+	const set = /* @__PURE__ */ new Set();
+	for (const prefix of raw) {
+		const normalized = normalizeSessionKeyPrefix(prefix);
+		if (!normalized) continue;
+		set.add(normalized);
+	}
+	return set.size > 0 ? Array.from(set) : void 0;
+}
+function isSessionKeyAllowedByPrefix(sessionKey, prefixes) {
+	const normalized = sessionKey.trim().toLowerCase();
+	if (!normalized) return false;
+	return prefixes.some((prefix) => normalized.startsWith(prefix));
+}
 function extractHookToken(req) {
 	const auth = typeof req.headers.authorization === "string" ? req.headers.authorization.trim() : "";
 	if (auth.toLowerCase().startsWith("bearer ")) {
@@ -12809,7 +13006,42 @@ function isHookAgentAllowed(hooksConfig, agentId) {
 	return resolved ? allowed.has(resolved) : false;
 }
 const getHookAgentPolicyError = () => "agentId is not allowed by hooks.allowedAgentIds";
-function normalizeAgentPayload(payload, opts) {
+const getHookSessionKeyRequestPolicyError = () => "sessionKey is disabled for external /hooks/agent payloads; set hooks.allowRequestSessionKey=true to enable";
+const getHookSessionKeyPrefixError = (prefixes) => `sessionKey must start with one of: ${prefixes.join(", ")}`;
+function resolveHookSessionKey(params) {
+	const requested = resolveSessionKey$1(params.sessionKey);
+	if (requested) {
+		if (params.source === "request" && !params.hooksConfig.sessionPolicy.allowRequestSessionKey) return {
+			ok: false,
+			error: getHookSessionKeyRequestPolicyError()
+		};
+		const allowedPrefixes = params.hooksConfig.sessionPolicy.allowedSessionKeyPrefixes;
+		if (allowedPrefixes && !isSessionKeyAllowedByPrefix(requested, allowedPrefixes)) return {
+			ok: false,
+			error: getHookSessionKeyPrefixError(allowedPrefixes)
+		};
+		return {
+			ok: true,
+			value: requested
+		};
+	}
+	const defaultSessionKey = params.hooksConfig.sessionPolicy.defaultSessionKey;
+	if (defaultSessionKey) return {
+		ok: true,
+		value: defaultSessionKey
+	};
+	const generated = `hook:${(params.idFactory ?? randomUUID)()}`;
+	const allowedPrefixes = params.hooksConfig.sessionPolicy.allowedSessionKeyPrefixes;
+	if (allowedPrefixes && !isSessionKeyAllowedByPrefix(generated, allowedPrefixes)) return {
+		ok: false,
+		error: getHookSessionKeyPrefixError(allowedPrefixes)
+	};
+	return {
+		ok: true,
+		value: generated
+	};
+}
+function normalizeAgentPayload(payload) {
 	const message = typeof payload.message === "string" ? payload.message.trim() : "";
 	if (!message) return {
 		ok: false,
@@ -12821,8 +13053,7 @@ function normalizeAgentPayload(payload, opts) {
 	const agentId = typeof agentIdRaw === "string" && agentIdRaw.trim() ? agentIdRaw.trim() : void 0;
 	const wakeMode = payload.wakeMode === "next-heartbeat" ? "next-heartbeat" : "now";
 	const sessionKeyRaw = payload.sessionKey;
-	const idFactory = opts?.idFactory ?? randomUUID;
-	const sessionKey = typeof sessionKeyRaw === "string" && sessionKeyRaw.trim() ? sessionKeyRaw.trim() : `hook:${idFactory()}`;
+	const sessionKey = typeof sessionKeyRaw === "string" && sessionKeyRaw.trim() ? sessionKeyRaw.trim() : void 0;
 	const channel = resolveHookChannel(payload.channel);
 	if (!channel) return {
 		ok: false,
@@ -12863,7 +13094,7 @@ function normalizeAgentPayload(payload, opts) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.OPENCLAW_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.OPENCLAW_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./control-service-IRAmbcbN.js").then((n) => n.t);
+	const mod = override ? await import(override) : await import("./control-service-DKnttEus.js").then((n) => n.t);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -14514,6 +14745,7 @@ const OutputTextDoneEventSchema = z.object({
 //#endregion
 //#region src/gateway/openresponses-http.ts
 const DEFAULT_BODY_BYTES$1 = 20 * 1024 * 1024;
+const DEFAULT_MAX_URL_PARTS = 8;
 function writeSseEvent(res, event) {
 	res.write(`event: ${event.type}\n`);
 	res.write(`data: ${JSON.stringify(event)}\n\n`);
@@ -14526,13 +14758,20 @@ function extractTextContent(content) {
 		return "";
 	}).filter(Boolean).join("\n");
 }
+function normalizeHostnameAllowlist(values) {
+	if (!values || values.length === 0) return;
+	const normalized = values.map((value) => value.trim()).filter((value) => value.length > 0);
+	return normalized.length > 0 ? normalized : void 0;
+}
 function resolveResponsesLimits(config) {
 	const files = config?.files;
 	const images = config?.images;
 	return {
 		maxBodyBytes: config?.maxBodyBytes ?? DEFAULT_BODY_BYTES$1,
+		maxUrlParts: typeof config?.maxUrlParts === "number" ? Math.max(0, Math.floor(config.maxUrlParts)) : DEFAULT_MAX_URL_PARTS,
 		files: {
 			allowUrl: files?.allowUrl ?? true,
+			urlAllowlist: normalizeHostnameAllowlist(files?.urlAllowlist),
 			allowedMimes: normalizeMimeList(files?.allowedMimes, DEFAULT_INPUT_FILE_MIMES),
 			maxBytes: files?.maxBytes ?? DEFAULT_INPUT_FILE_MAX_BYTES,
 			maxChars: files?.maxChars ?? DEFAULT_INPUT_FILE_MAX_CHARS,
@@ -14546,6 +14785,7 @@ function resolveResponsesLimits(config) {
 		},
 		images: {
 			allowUrl: images?.allowUrl ?? true,
+			urlAllowlist: normalizeHostnameAllowlist(images?.urlAllowlist),
 			allowedMimes: normalizeMimeList(images?.allowedMimes, DEFAULT_INPUT_IMAGE_MIMES),
 			maxBytes: images?.maxBytes ?? DEFAULT_INPUT_IMAGE_MAX_BYTES,
 			maxRedirects: images?.maxRedirects ?? DEFAULT_INPUT_MAX_REDIRECTS,
@@ -14727,6 +14967,11 @@ async function handleOpenResponsesHttpRequest(req, res, opts) {
 	const user = payload.user;
 	let images = [];
 	let fileContexts = [];
+	let urlParts = 0;
+	const markUrlPart = () => {
+		urlParts += 1;
+		if (urlParts > limits.maxUrlParts) throw new Error(`Too many URL-based input sources: ${urlParts} (limit: ${limits.maxUrlParts})`);
+	};
 	try {
 		if (Array.isArray(payload.input)) {
 			for (const item of payload.input) if (item.type === "message" && typeof item.content !== "string") for (const part of item.content) {
@@ -14734,6 +14979,7 @@ async function handleOpenResponsesHttpRequest(req, res, opts) {
 					const source = part.source;
 					const sourceType = source.type === "base64" || source.type === "url" ? source.type : void 0;
 					if (!sourceType) throw new Error("input_image must have 'source.url' or 'source.data'");
+					if (sourceType === "url") markUrlPart();
 					const image = await extractImageContentFromSource({
 						type: sourceType,
 						url: source.url,
@@ -14747,6 +14993,7 @@ async function handleOpenResponsesHttpRequest(req, res, opts) {
 					const source = part.source;
 					const sourceType = source.type === "base64" || source.type === "url" ? source.type : void 0;
 					if (!sourceType) throw new Error("input_file must have 'source.url' or 'source.data'");
+					if (sourceType === "url") markUrlPart();
 					const file = await extractFileContentFromSource({
 						source: {
 							type: sourceType,
@@ -15310,6 +15557,9 @@ async function handleToolsInvokeHttpRequest(req, res, opts) {
 
 //#endregion
 //#region src/gateway/server-http.ts
+const HOOK_AUTH_FAILURE_LIMIT = 20;
+const HOOK_AUTH_FAILURE_WINDOW_MS = 6e4;
+const HOOK_AUTH_FAILURE_TRACK_MAX = 2048;
 function sendJson(res, status, body) {
 	res.statusCode = status;
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -15351,6 +15601,31 @@ async function authorizeCanvasRequest(params) {
 }
 function createHooksRequestHandler(opts) {
 	const { getHooksConfig, bindHost, port, logHooks, dispatchAgentHook, dispatchWakeHook } = opts;
+	const hookAuthFailures = /* @__PURE__ */ new Map();
+	const resolveHookClientKey = (req) => {
+		return req.socket?.remoteAddress?.trim() || "unknown";
+	};
+	const recordHookAuthFailure = (clientKey, nowMs) => {
+		if (!hookAuthFailures.has(clientKey) && hookAuthFailures.size >= HOOK_AUTH_FAILURE_TRACK_MAX) hookAuthFailures.clear();
+		const current = hookAuthFailures.get(clientKey);
+		const next = !current || nowMs - current.windowStartedAtMs >= HOOK_AUTH_FAILURE_WINDOW_MS ? {
+			count: 1,
+			windowStartedAtMs: nowMs
+		} : {
+			count: current.count + 1,
+			windowStartedAtMs: current.windowStartedAtMs
+		};
+		hookAuthFailures.set(clientKey, next);
+		if (next.count <= HOOK_AUTH_FAILURE_LIMIT) return { throttled: false };
+		const retryAfterMs = Math.max(1, next.windowStartedAtMs + HOOK_AUTH_FAILURE_WINDOW_MS - nowMs);
+		return {
+			throttled: true,
+			retryAfterSeconds: Math.ceil(retryAfterMs / 1e3)
+		};
+	};
+	const clearHookAuthFailure = (clientKey) => {
+		hookAuthFailures.delete(clientKey);
+	};
 	return async (req, res) => {
 		const hooksConfig = getHooksConfig();
 		if (!hooksConfig) return false;
@@ -15364,12 +15639,24 @@ function createHooksRequestHandler(opts) {
 			return true;
 		}
 		const token = extractHookToken(req);
-		if (!token || token !== hooksConfig.token) {
+		const clientKey = resolveHookClientKey(req);
+		if (!safeEqualSecret(token, hooksConfig.token)) {
+			const throttle = recordHookAuthFailure(clientKey, Date.now());
+			if (throttle.throttled) {
+				const retryAfter = throttle.retryAfterSeconds ?? 1;
+				res.statusCode = 429;
+				res.setHeader("Retry-After", String(retryAfter));
+				res.setHeader("Content-Type", "text/plain; charset=utf-8");
+				res.end("Too Many Requests");
+				logHooks.warn(`hook auth throttled for ${clientKey}; retry-after=${retryAfter}s`);
+				return true;
+			}
 			res.statusCode = 401;
 			res.setHeader("Content-Type", "text/plain; charset=utf-8");
 			res.end("Unauthorized");
 			return true;
 		}
+		clearHookAuthFailure(clientKey);
 		if (req.method !== "POST") {
 			res.statusCode = 405;
 			res.setHeader("Allow", "POST");
@@ -15426,10 +15713,23 @@ function createHooksRequestHandler(opts) {
 				});
 				return true;
 			}
+			const sessionKey = resolveHookSessionKey({
+				hooksConfig,
+				source: "request",
+				sessionKey: normalized.value.sessionKey
+			});
+			if (!sessionKey.ok) {
+				sendJson(res, 400, {
+					ok: false,
+					error: sessionKey.error
+				});
+				return true;
+			}
 			sendJson(res, 202, {
 				ok: true,
 				runId: dispatchAgentHook({
 					...normalized.value,
+					sessionKey: sessionKey.value,
 					agentId: resolveHookTargetAgentId(hooksConfig, normalized.value.agentId)
 				})
 			});
@@ -15481,6 +15781,18 @@ function createHooksRequestHandler(opts) {
 					});
 					return true;
 				}
+				const sessionKey = resolveHookSessionKey({
+					hooksConfig,
+					source: "mapping",
+					sessionKey: mapped.action.sessionKey
+				});
+				if (!sessionKey.ok) {
+					sendJson(res, 400, {
+						ok: false,
+						error: sessionKey.error
+					});
+					return true;
+				}
 				sendJson(res, 202, {
 					ok: true,
 					runId: dispatchAgentHook({
@@ -15488,7 +15800,7 @@ function createHooksRequestHandler(opts) {
 						name: mapped.action.name ?? "Hook",
 						agentId: resolveHookTargetAgentId(hooksConfig, mapped.action.agentId),
 						wakeMode: mapped.action.wakeMode,
-						sessionKey: mapped.action.sessionKey ?? "",
+						sessionKey: sessionKey.value,
 						deliver: resolveHookDeliver(mapped.action.deliver),
 						channel,
 						to: mapped.action.to,
@@ -15526,13 +15838,31 @@ function createGatewayHttpServer(opts) {
 		try {
 			const configSnapshot = loadConfig();
 			const trustedProxies = configSnapshot.gateway?.trustedProxies ?? [];
+			const requestPath = new URL(req.url ?? "/", "http://localhost").pathname;
 			if (await handleHooksRequest(req, res)) return;
 			if (await handleToolsInvokeHttpRequest(req, res, {
 				auth: resolvedAuth,
 				trustedProxies
 			})) return;
 			if (await handleSlackHttpRequest(req, res)) return;
-			if (handlePluginRequest && await handlePluginRequest(req, res)) return;
+			if (handlePluginRequest) {
+				if (requestPath.startsWith("/api/channels/")) {
+					const token = getBearerToken(req);
+					if (!(await authorizeGatewayConnect({
+						auth: resolvedAuth,
+						connectAuth: token ? {
+							token,
+							password: token
+						} : null,
+						req,
+						trustedProxies
+					})).ok) {
+						sendUnauthorized(res);
+						return;
+					}
+				}
+				if (await handlePluginRequest(req, res)) return;
+			}
 			if (openResponsesEnabled) {
 				if (await handleOpenResponsesHttpRequest(req, res, {
 					auth: resolvedAuth,
@@ -15547,7 +15877,7 @@ function createGatewayHttpServer(opts) {
 				})) return;
 			}
 			if (canvasHost) {
-				if (isCanvasPath(new URL(req.url ?? "/", "http://localhost").pathname)) {
+				if (isCanvasPath(requestPath)) {
 					if (!await authorizeCanvasRequest({
 						req,
 						auth: resolvedAuth,
@@ -15621,7 +15951,7 @@ function createGatewayHooksRequestHandler(params) {
 		if (value.mode === "now") requestHeartbeatNow({ reason: "hook:wake" });
 	};
 	const dispatchAgentHook = (value) => {
-		const sessionKey = value.sessionKey.trim() ? value.sessionKey.trim() : `hook:${randomUUID()}`;
+		const sessionKey = value.sessionKey.trim();
 		const mainSessionKey = resolveMainSessionKeyFromConfig();
 		const jobId = randomUUID();
 		const now = Date.now();
@@ -16613,8 +16943,7 @@ function attachGatewayWsMessageHandler(params) {
 					close(1008, "invalid role");
 					return;
 				}
-				const requestedScopes = Array.isArray(connectParams.scopes) ? connectParams.scopes : [];
-				const scopes = requestedScopes.length > 0 ? requestedScopes : role === "operator" ? ["operator.admin"] : [];
+				const scopes = Array.isArray(connectParams.scopes) ? connectParams.scopes : [];
 				connectParams.role = role;
 				connectParams.scopes = scopes;
 				const isControlUi = connectParams.client.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
@@ -16818,7 +17147,7 @@ function attachGatewayWsMessageHandler(params) {
 						clientId: connectParams.client.id,
 						clientMode: connectParams.client.mode,
 						role,
-						scopes: requestedScopes,
+						scopes,
 						signedAtMs: signedAt,
 						token: connectParams.auth?.token ?? null,
 						nonce: providedNonce || void 0,
@@ -16831,7 +17160,7 @@ function attachGatewayWsMessageHandler(params) {
 							clientId: connectParams.client.id,
 							clientMode: connectParams.client.mode,
 							role,
-							scopes: requestedScopes,
+							scopes,
 							signedAtMs: signedAt,
 							token: connectParams.auth?.token ?? null,
 							version: "v1"
@@ -17680,6 +18009,12 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		logChannels,
 		logBrowser
 	}));
+	{
+		const hookRunner = getGlobalHookRunner();
+		if (hookRunner?.hasHooks("gateway_start")) hookRunner.runGatewayStart({ port }, { port }).catch((err) => {
+			log.warn(`gateway_start hook failed: ${String(err)}`);
+		});
+	}
 	const { applyHotReload, requestGatewayRestart } = createGatewayReloadHandlers({
 		deps,
 		broadcast,
@@ -17742,6 +18077,14 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		httpServers
 	});
 	return { close: async (opts) => {
+		{
+			const hookRunner = getGlobalHookRunner();
+			if (hookRunner?.hasHooks("gateway_stop")) try {
+				await hookRunner.runGatewayStop({ reason: opts?.reason ?? "gateway stopping" }, { port });
+			} catch (err) {
+				log.warn(`gateway_stop hook failed: ${String(err)}`);
+			}
+		}
 		if (diagnosticsEnabled) stopDiagnosticHeartbeat();
 		if (skillsRefreshTimer) {
 			clearTimeout(skillsRefreshTimer);
@@ -17847,6 +18190,8 @@ async function runGatewayLoop(params) {
 		process.removeListener("SIGINT", onSigint);
 		process.removeListener("SIGUSR1", onSigusr1);
 	};
+	const DRAIN_TIMEOUT_MS = 3e4;
+	const SHUTDOWN_TIMEOUT_MS = 5e3;
 	const request = (action, signal) => {
 		if (shuttingDown) {
 			gatewayLog$1.info(`received ${signal} during shutdown; ignoring`);
@@ -17855,13 +18200,23 @@ async function runGatewayLoop(params) {
 		shuttingDown = true;
 		const isRestart = action === "restart";
 		gatewayLog$1.info(`received ${signal}; ${isRestart ? "restarting" : "shutting down"}`);
+		const forceExitMs = isRestart ? DRAIN_TIMEOUT_MS + SHUTDOWN_TIMEOUT_MS : SHUTDOWN_TIMEOUT_MS;
 		const forceExitTimer = setTimeout(() => {
 			gatewayLog$1.error("shutdown timed out; exiting without full cleanup");
 			cleanupSignals();
 			params.runtime.exit(0);
-		}, 5e3);
+		}, forceExitMs);
 		(async () => {
 			try {
+				if (isRestart) {
+					const activeTasks = getActiveTaskCount();
+					if (activeTasks > 0) {
+						gatewayLog$1.info(`draining ${activeTasks} active task(s) before restart (timeout ${DRAIN_TIMEOUT_MS}ms)`);
+						const { drained } = await waitForActiveTasks(DRAIN_TIMEOUT_MS);
+						if (drained) gatewayLog$1.info("all active tasks drained");
+						else gatewayLog$1.warn("drain timeout reached; proceeding with restart");
+					}
+				}
 				await server?.close({
 					reason: isRestart ? "gateway restarting" : "gateway stopping",
 					restartExpectedMs: isRestart ? 1500 : null