activeclaw 2026.2.11 → 2026.2.13

package/dist/{gateway-cli-B_xDUDy2.js → gateway-cli-DbvWmE-9.js}

@@ -1,95 +1,97 @@
 import { _ as expandHomePrefix, g as resolveStateDir, i as isNixMode, l as resolveGatewayLockDir, o as resolveConfigPath, r as STATE_DIR, t as CONFIG_PATH, u as resolveGatewayPort } from "./paths-DVBShlw6.js";
-import { B as getLogger, C as getActivePluginRegistry, I as colorize, L as isRich, M as setVerbose, R as theme, V as getResolvedLoggerSettings, a as setConsoleTimestampPrefix, c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL, i as setConsoleSubsystemFilter, n as runtimeForLogger, p as CHANNEL_IDS, t as createSubsystemLogger, z as getChildLogger } from "./subsystem-Bh1Y_6Uv.js";
-import { C as shortenHomePath, D as truncateUtf16Safe, b as resolveUserPath, c as ensureDir, d as isPlainObject, r as clamp, t as CONFIG_DIR } from "./utils-es4ygvQ-.js";
-import { B as normalizeElevatedLevel, H as normalizeThinkLevel, I as formatThinkingLevels, K as supportsXHighThinking, L as formatXHighModelHint, U as normalizeUsageDisplay, V as normalizeReasoningLevel, W as normalizeVerboseLevel } from "./pi-embedded-helpers-DYH6OWft.js";
-import { $ as inferLegacyName, $n as isTtsEnabled, $t as getSkillsSnapshotVersion, An as runSubagentAnnounceFlow, Ar as registerUnhandledRejectionHandler, B as consumeGatewaySigusr1RestartAuthorization, Br as DEFAULT_INPUT_TIMEOUT_MS, Bt as getRemoteSkillEligibility, C as readSessionMessages, Cr as applyVerboseOverride, Dn as isAbortTrigger, E as stripEnvelopeFromMessages, En as formatZonedTimestamp, Er as isSystemEventContextChanged, F as resetDirectoryCache, Fn as onAgentEvent, Fr as DEFAULT_INPUT_IMAGE_MIMES, G as formatDoctorNonInteractiveHint, Gn as resolveUserTimezone, Gr as resolveAgentTimeoutMs, Gt as setSkillsRemoteRegistry, H as scheduleGatewaySigusr1Restart, Hn as resolveMemoryBackendConfig, Hr as extractImageContentFromSource, Ht as recordRemoteNodeInfo, In as registerAgentRunContext, Ir as DEFAULT_INPUT_MAX_REDIRECTS, It as CONTROL_UI_AVATAR_PREFIX, J as summarizeRestartSentinel, Jn as registerInternalHook, Jt as rejectNodePairing, K as formatRestartSentinelMessage, Kn as clearInternalHooks, Kt as approveNodePairing, L as runWithModelFallback, Lr as DEFAULT_INPUT_PDF_MAX_PAGES, Lt as buildControlUiAvatarUrl, M as resolveOutboundTarget, Mn as clearAgentRunContext, Mr as DEFAULT_INPUT_FILE_MAX_CHARS, N as resolveSessionDeliveryTarget, Nn as emitAgentEvent, Nr as DEFAULT_INPUT_FILE_MIMES, O as ensureOutboundSessionEntry, On as stopSubagentsForRequester, Or as loadModelCatalog, Pn as getAgentRunContext, Pr as DEFAULT_INPUT_IMAGE_MAX_BYTES, Q as normalizeCronJobPatch, Qn as getTtsProvider, Qt as verifyNodeToken, Rn as normalizePollInput, Rr as DEFAULT_INPUT_PDF_MAX_PIXELS, Rt as normalizeControlUiBasePath, S as capArrayByJsonBytes, Sr as applyModelOverrideToSessionEntry, T as resolveSessionTranscriptCandidates, Tn as createReplyDispatcher, Tr as enqueueSystemEvent, Tt as handleReset, U as setGatewaySigusr1RestartPolicy, Un as resolveAgentIdentity, Ur as normalizeMimeList, Ut as refreshRemoteBinsForConnectedNodes, V as isGatewaySigusr1RestartExternallyAllowed, Vn as getMemorySearchManager, Vr as extractFileContentFromSource, Vt as primeRemoteSkillsCache, W as consumeRestartSentinel, Wt as refreshRemoteNodeBins, X as writeRestartSentinel, Xn as OPENAI_TTS_MODELS, Xt as requestNodePairing, Yn as triggerInternalHook, Yt as renamePairedNode, Z as normalizeCronJobCreate, Zn as OPENAI_TTS_VOICES, Zt as updatePairedNodeMetadata, _ as loadCombinedSessionStoreForGateway, ar as resolveTtsProviderOrder, b as resolveSessionModelRef, br as lookupContextTokens, c as clearSessionQueues, cn as createReplyPrefixOptions, cr as textToSpeech, d as waitForEmbeddedPiRunEnd, dn as buildHistoryContextFromEntries, dr as CommandLane, dt as loadProviderUsageSummary, en as registerSkillsChangeListener, er as isTtsProviderConfigured, et as normalizeOptionalAgentId, fn as resolveHeartbeatVisibility, fr as startDiagnosticHeartbeat, g as listSessionsFromStore, gt as handleSlackHttpRequest, h as listAgentsForGateway, hn as onHeartbeatEvent, hr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, i as runCliAgent, in as isExternalHookSession, ir as resolveTtsPrefsPath, it as migrateLegacyCronPayload, jr as DEFAULT_INPUT_FILE_MAX_BYTES, k as resolveOutboundSessionRoute, kn as initSubagentRegistry, l as runEmbeddedPiAgent, ln as normalizeGroupActivation, lt as getPluginToolMeta, m as resolveAnnounceTargetFromKey, mn as getLastHeartbeatEvent, mr as isDiagnosticsEnabled, n as getCliSessionId, nn as detectSuspiciousPatterns, nr as resolveTtsAutoMode, nt as normalizePayloadToSystemText, o as normalizeSendPolicy, or as setTtsEnabled, p as createOpenClawTools, pr as stopDiagnosticHeartbeat, qn as createInternalHookEvent, qt as listNodePairing, r as setCliSessionId, rn as getHookType, rr as resolveTtsConfig, rt as normalizeRequiredName, s as resolveSendPolicy, sr as setTtsProvider, st as requestHeartbeatNow, tn as buildSafeExternalPrompt, tr as resolveTtsApiKey, tt as normalizeOptionalText, u as abortEmbeddedPiRun, ur as setCommandLaneConcurrency, ut as loadOpenClawPlugins, v as loadSessionEntry, vn as resolveCronStyleNow, w as readSessionPreviewItemsFromTranscript, wn as dispatchInboundMessage, wr as parseVerboseOverride, x as archiveFileOnDisk, xn as getChannelActivity, y as resolveGatewaySessionStoreTarget, yr as stripHeartbeatToken, z as authorizeGatewaySigusr1Restart, zr as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, zt as resolveAssistantAvatarUrl } from "./reply--b7BsXGP.js";
+import { B as getLogger, C as getActivePluginRegistry, I as colorize, L as isRich, M as setVerbose, R as theme, V as getResolvedLoggerSettings, a as setConsoleTimestampPrefix, c as defaultRuntime, h as DEFAULT_CHAT_CHANNEL, i as setConsoleSubsystemFilter, n as runtimeForLogger, p as CHANNEL_IDS, t as createSubsystemLogger, z as getChildLogger } from "./subsystem-BoExtIHo.js";
+import { C as shortenHomePath, D as truncateUtf16Safe, b as resolveUserPath, c as ensureDir, d as isPlainObject, r as clamp, t as CONFIG_DIR } from "./utils-Cd9QdCHh.js";
+import { G as normalizeUsageDisplay, H as normalizeElevatedLevel, J as supportsXHighThinking, K as normalizeVerboseLevel, R as formatThinkingLevels, U as normalizeReasoningLevel, W as normalizeThinkLevel, z as formatXHighModelHint } from "./pi-embedded-helpers-CMKLjW6X.js";
+import { $ as inferLegacyName, $n as isTtsEnabled, $t as getSkillsSnapshotVersion, An as runSubagentAnnounceFlow, Ar as DEFAULT_INPUT_FILE_MAX_BYTES, B as consumeGatewaySigusr1RestartAuthorization, Br as extractFileContentFromSource, Bt as getRemoteSkillEligibility, C as readSessionMessages, Dn as isAbortTrigger, Dr as enqueueSystemEvent, E as stripEnvelopeFromMessages, En as formatZonedTimestamp, Er as parseVerboseOverride, F as resetDirectoryCache, Fn as onAgentEvent, Fr as DEFAULT_INPUT_MAX_REDIRECTS, G as formatDoctorNonInteractiveHint, Gn as resolveUserTimezone, Gt as setSkillsRemoteRegistry, H as scheduleGatewaySigusr1Restart, Hn as resolveMemoryBackendConfig, Hr as normalizeMimeList, Ht as recordRemoteNodeInfo, In as registerAgentRunContext, Ir as DEFAULT_INPUT_PDF_MAX_PAGES, It as CONTROL_UI_AVATAR_PREFIX, J as summarizeRestartSentinel, Jn as registerInternalHook, Jt as rejectNodePairing, K as formatRestartSentinelMessage, Kn as clearInternalHooks, Kt as approveNodePairing, L as runWithModelFallback, Lr as DEFAULT_INPUT_PDF_MAX_PIXELS, Lt as buildControlUiAvatarUrl, M as resolveOutboundTarget, Mn as clearAgentRunContext, Mr as DEFAULT_INPUT_FILE_MIMES, N as resolveSessionDeliveryTarget, Nn as emitAgentEvent, Nr as DEFAULT_INPUT_IMAGE_MAX_BYTES, O as ensureOutboundSessionEntry, On as stopSubagentsForRequester, Or as isSystemEventContextChanged, Pn as getAgentRunContext, Pr as DEFAULT_INPUT_IMAGE_MIMES, Q as normalizeCronJobPatch, Qn as getTtsProvider, Qt as verifyNodeToken, Rn as normalizePollInput, Rr as DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, Rt as normalizeControlUiBasePath, S as capArrayByJsonBytes, Sr as lookupContextTokens, T as resolveSessionTranscriptCandidates, Tn as createReplyDispatcher, Tr as applyVerboseOverride, Tt as handleReset, U as setGatewaySigusr1RestartPolicy, Un as resolveAgentIdentity, Ur as resolveAgentTimeoutMs, Ut as refreshRemoteBinsForConnectedNodes, V as isGatewaySigusr1RestartExternallyAllowed, Vn as getMemorySearchManager, Vr as extractImageContentFromSource, Vt as primeRemoteSkillsCache, W as consumeRestartSentinel, Wt as refreshRemoteNodeBins, X as writeRestartSentinel, Xn as OPENAI_TTS_MODELS, Xt as requestNodePairing, Yn as triggerInternalHook, Yt as renamePairedNode, Z as normalizeCronJobCreate, Zn as OPENAI_TTS_VOICES, Zt as updatePairedNodeMetadata, _ as loadCombinedSessionStoreForGateway, _r as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, ar as resolveTtsProviderOrder, b as resolveSessionModelRef, c as clearSessionQueues, cn as createReplyPrefixOptions, cr as textToSpeech, d as waitForEmbeddedPiRunEnd, dn as buildHistoryContextFromEntries, dr as setCommandLaneConcurrency, dt as loadProviderUsageSummary, en as registerSkillsChangeListener, er as isTtsProviderConfigured, et as normalizeOptionalAgentId, fn as resolveHeartbeatVisibility, fr as waitForActiveTasks, g as listSessionsFromStore, gr as isDiagnosticsEnabled, gt as handleSlackHttpRequest, h as listAgentsForGateway, hn as onHeartbeatEvent, hr as stopDiagnosticHeartbeat, i as runCliAgent, in as isExternalHookSession, ir as resolveTtsPrefsPath, it as migrateLegacyCronPayload, jr as DEFAULT_INPUT_FILE_MAX_CHARS, k as resolveOutboundSessionRoute, kn as initSubagentRegistry, l as runEmbeddedPiAgent, ln as normalizeGroupActivation, lr as getActiveTaskCount, lt as getPluginToolMeta, m as resolveAnnounceTargetFromKey, mn as getLastHeartbeatEvent, mr as startDiagnosticHeartbeat, n as getCliSessionId, nn as detectSuspiciousPatterns, nr as resolveTtsAutoMode, nt as normalizePayloadToSystemText, o as normalizeSendPolicy, or as setTtsEnabled, p as createOpenClawTools, pr as CommandLane, qn as createInternalHookEvent, qt as listNodePairing, r as setCliSessionId, rn as getHookType, rr as resolveTtsConfig, rt as normalizeRequiredName, s as resolveSendPolicy, sr as setTtsProvider, st as requestHeartbeatNow, tn as buildSafeExternalPrompt, tr as resolveTtsApiKey, tt as normalizeOptionalText, u as abortEmbeddedPiRun, ut as loadOpenClawPlugins, v as loadSessionEntry, vn as resolveCronStyleNow, w as readSessionPreviewItemsFromTranscript, wn as dispatchInboundMessage, wr as applyModelOverrideToSessionEntry, x as archiveFileOnDisk, xn as getChannelActivity, xr as stripHeartbeatToken, y as resolveGatewaySessionStoreTarget, z as authorizeGatewaySigusr1Restart, zr as DEFAULT_INPUT_TIMEOUT_MS, zt as resolveAssistantAvatarUrl } from "./reply-DICXkh_C.js";
 import { _ as isCronRunSessionKey, d as resolveAgentIdFromSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, m as toAgentRequestSessionKey, n as DEFAULT_AGENT_ID, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isSubagentSessionKey, y as parseAgentSessionKey } from "./session-key-BWxPj0z_.js";
-import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-Cv_Ofd1m.js";
-import { t as resolveOpenClawPackageRoot } from "./openclaw-root-JLDMp6ux.js";
-import { T as resolveWorkspaceTemplateDir, _ as DEFAULT_MEMORY_FILENAME, b as DEFAULT_USER_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, g as DEFAULT_MEMORY_ALT_FILENAME, h as DEFAULT_IDENTITY_FILENAME, i as resolveAgentModelFallbacksOverride, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, v as DEFAULT_SOUL_FILENAME, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-CGmuusG9.js";
-import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, St as normalizeSecretInput, a as isCliProvider, d as resolveConfiguredModelRef, f as resolveDefaultModelForAgent, h as resolveThinkingDefault, i as getModelRefStatus, l as resolveAllowedModelRef, p as resolveHooksGmailModel } from "./model-selection-BK7DuyH8.js";
+import { a as logDebug, c as logWarn, n as runExec, t as runCommandWithTimeout } from "./exec-YIosokWE.js";
+import { t as resolveOpenClawPackageRoot } from "./openclaw-root-1VeFrph_.js";
+import { T as resolveWorkspaceTemplateDir, _ as DEFAULT_MEMORY_FILENAME, b as DEFAULT_USER_FILENAME, c as resolveDefaultAgentId, d as DEFAULT_AGENTS_FILENAME, g as DEFAULT_MEMORY_ALT_FILENAME, h as DEFAULT_IDENTITY_FILENAME, i as resolveAgentModelFallbacksOverride, l as resolveSessionAgentId, m as DEFAULT_HEARTBEAT_FILENAME, n as resolveAgentConfig, p as DEFAULT_BOOTSTRAP_FILENAME, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, v as DEFAULT_SOUL_FILENAME, w as resolveDefaultAgentWorkspaceDir, x as ensureAgentWorkspace, y as DEFAULT_TOOLS_FILENAME } from "./agent-scope-CQCus0rI.js";
+import { Dt as DEFAULT_MODEL, Et as DEFAULT_CONTEXT_TOKENS, Ot as DEFAULT_PROVIDER, St as normalizeSecretInput, a as isCliProvider, d as resolveConfiguredModelRef, f as resolveDefaultModelForAgent, h as resolveThinkingDefault, i as getModelRefStatus, l as resolveAllowedModelRef, p as resolveHooksGmailModel } from "./model-selection-BLuqsGVB.js";
 import "./github-copilot-token-BW-SEg7E.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
 import "./boolean-BgXe2hyu.js";
-import { n as logAcceptedEnvOption, t as isTruthyEnvValue } from "./env-BxRc6wWv.js";
-import { A as resolveAgentMaxConcurrent, E as applyLegacyMigrations, M as VERSION, a as parseConfigJson5, c as writeConfigFile, g as parseDurationMs, i as loadConfig, j as resolveSubagentMaxConcurrent, l as validateConfigObjectWithPlugins, n as migrateLegacyConfig, o as readConfigFileSnapshot, r as createConfigIO, s as resolveConfigSnapshotHash, u as OpenClawSchema } from "./config--NUdpACy.js";
-import { s as isTestDefaultMemorySlotDisabled } from "./manifest-registry-3It8Z8yN.js";
-import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-CNaHNND_.js";
-import { B as snapshotSessionOrigin, F as resolveAgentMainSessionKey, I as resolveExplicitAgentSessionKey, L as resolveMainSessionKey, R as resolveMainSessionKeyFromConfig, S as mergeDeliveryContext, at as normalizeToolName, b as deliveryContextFromSession, d as loadSessionStore, g as updateSessionStore, nt as collectExplicitAllowlist, ot as resolveToolProfilePolicy, rt as expandPolicyWithPluginGroups, st as stripPluginOnlyAllowlist, tt as buildPluginToolGroups, w as normalizeSessionDeliveryFields } from "./sandbox-DqUO2K83.js";
-import "./image-fUwR7slg.js";
-import "./pi-model-discovery-CV2V1HHz.js";
-import { d as inspectPortUsage, l as ensurePortAvailable, p as formatPortDiagnostics } from "./chrome-Dm-EgOjJ.js";
-import { d as hasBinary, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-ccAgQ3Ad.js";
-import { c as saveMediaBuffer, l as detectMime } from "./routes-DUkEKAc1.js";
-import { a as isErrno, n as formatErrorMessage } from "./errors-B0eT3jVv.js";
-import { n as movePathToTrash } from "./server-context-8Qt35QdF.js";
-import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-DGRSvYuQ.js";
-import { c as resolveGatewayBindHost, i as isTrustedProxyAddress, l as resolveGatewayClientIp, n as isLoopbackAddress, r as isLoopbackHost, t as rawDataToString, u as resolveGatewayListenHosts } from "./ws-DtDKpbLR.js";
-import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-Cu61-7H6.js";
-import "./logging-BzvBIA3Y.js";
-import "./accounts-C2elk6PC.js";
-import { a as resolveSessionTranscriptsDirForAgent, n as resolveSessionFilePath, o as resolveStorePath, r as resolveSessionTranscriptPath } from "./paths-Bkhd_qY8.js";
-import "./redact-DAKeu7PA.js";
-import "./tool-display-DskiU8Kt.js";
-import { o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-T9d44OpZ.js";
-import { i as getMachineDisplayName, t as createBrowserRouteDispatcher } from "./dispatcher-3ElQWGVI.js";
-import "./manager-BbnHek5T.js";
-import "./sqlite-Btrgi7-j.js";
-import "./tui-formatters-CA85v4U2.js";
-import { $ as validateNodePairRequestParams, A as validateCronStatusParams, At as parseSessionLabel, B as validateExecApprovalsNodeGetParams, C as validateConfigSetParams, Ct as validateWizardNextParams, D as validateCronRemoveParams, Dt as ErrorCodes, E as validateCronListParams, Et as PROTOCOL_VERSION, F as validateDeviceTokenRevokeParams, Ft as normalizeDevicePublicKeyBase64Url, G as validateNodeDescribeParams, H as validateExecApprovalsSetParams, I as validateDeviceTokenRotateParams, It as verifyDeviceSignature, J as validateNodeInvokeResultParams, K as validateNodeEventParams, L as validateExecApprovalRequestParams, M as validateDevicePairApproveParams, N as validateDevicePairListParams, Nt as deriveDeviceIdFromPublicKey, O as validateCronRunParams, Ot as errorShape, P as validateDevicePairRejectParams, Q as validateNodePairRejectParams, R as validateExecApprovalResolveParams, S as validateConfigSchemaParams, St as validateWizardCancelParams, T as validateCronAddParams, Tt as validateWizardStatusParams, U as validateLogsTailParams, V as validateExecApprovalsNodeSetParams, W as validateModelsListParams, X as validateNodePairApproveParams, Y as validateNodeListParams, Z as validateNodePairListParams, _ as validateChatInjectParams, _t as validateTalkModeParams, a as validateAgentWaitParams, at as validateSessionsCompactParams, b as validateConfigGetParams, bt as validateWebLoginStartParams, c as validateAgentsFilesGetParams, ct as validateSessionsPatchParams, d as validateAgentsListParams, dt as validateSessionsResolveParams, et as validateNodePairVerifyParams, f as validateAgentsUpdateParams, ft as validateSessionsUsageParams, g as validateChatHistoryParams, gt as validateSkillsUpdateParams, h as validateChatAbortParams, ht as validateSkillsStatusParams, i as validateAgentParams, it as validateSendParams, j as validateCronUpdateParams, jt as buildDeviceAuthPayload, k as validateCronRunsParams, l as validateAgentsFilesListParams, lt as validateSessionsPreviewParams, m as validateChannelsStatusParams, mt as validateSkillsInstallParams, n as formatValidationErrors, nt as validatePollParams, o as validateAgentsCreateParams, ot as validateSessionsDeleteParams, p as validateChannelsLogoutParams, pt as validateSkillsBinsParams, q as validateNodeInvokeParams, r as validateAgentIdentityParams, rt as validateRequestFrame, s as validateAgentsDeleteParams, st as validateSessionsListParams, tt as validateNodeRenameParams, u as validateAgentsFilesSetParams, ut as validateSessionsResetParams, v as validateChatSendParams, vt as validateUpdateRunParams, w as validateConnectParams, wt as validateWizardStartParams, x as validateConfigPatchParams, xt as validateWebLoginWaitParams, y as validateConfigApplyParams, yt as validateWakeParams, z as validateExecApprovalsGetParams } from "./client-6xKrRC-1.js";
-import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-Bek1xlgk.js";
-import "./login-qr-wM8BnKJh.js";
-import "./pairing-store-c-QQ2u8p.js";
-import { t as formatDocsLink } from "./links-C591fM9M.js";
-import { n as runCommandWithRuntime } from "./cli-utils-R-ECs5cY.js";
-import { n as withProgress } from "./progress-DIQJt9Va.js";
-import { a as resolveSubagentToolPolicy, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy, t as filterToolsByPolicy } from "./pi-tools.policy-akYsGFiA.js";
-import "./prompt-style-CjQRlDx4.js";
-import "./pairing-labels-Ciu3Zoxj.js";
-import { i as loadSessionUsageTimeSeries, l as deriveSessionTotalTokens, n as loadCostUsageSummary, r as loadSessionCostSummary, t as discoverAllSessions, u as hasNonzeroUsage } from "./session-cost-usage-PvyVZz-g.js";
-import { n as formatTokenCount, r as formatUsd } from "./usage-format-hd37en6b.js";
-import { c as normalizeExecApprovals, g as saveExecApprovals, l as readExecApprovalsSnapshot, m as resolveExecApprovalsSocketPath, r as ensureExecApprovals } from "./exec-approvals-DGPTjO0N.js";
-import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-Db_1V-KY.js";
-import { t as parseAbsoluteTimeMs } from "./parse-DqAvJRIf.js";
-import { n as resolveMessageChannelSelection } from "./channel-selection-B9b7Kuit.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-DFQdAWQc.js";
-import { i as enableTailscaleServe, n as disableTailscaleServe, o as getTailnetHostname, r as enableTailscaleFunnel, t as disableTailscaleFunnel } from "./tailscale-Cu-2HNvU.js";
-import { t as ensureOpenClawCliOnPath } from "./path-env-BgLvMbz_.js";
-import "./daemon-runtime-UsK-tOty.js";
-import { c as loadAgentIdentity, d as loadAgentIdentityFromWorkspace, i as applyAgentConfig, l as pruneAgentConfig, o as findAgentEntryIndex, p as forceFreePortAndWait, r as getStatusSummary, s as listAgentEntries, t as runOnboardingWizard } from "./onboarding-Du_7qEng.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-C89IG08W.js";
-import "./logging-MMRGFxGI.js";
-import "./note-5WqioBRA.js";
-import { t as WizardCancelledError } from "./prompts--d-6l5Ln.js";
-import { i as discoverGatewayBeacons, n as installSkill } from "./onboard-skills-DQwOQ6Ry.js";
-import "./github-copilot-auth-Omqrto0J.js";
-import "./onboard-channels-CXhnVy4E.js";
-import { r as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-AOSOJ-v1.js";
-import "./archive-CXhvR9nU.js";
-import "./skill-scanner-DrVEHfC6.js";
-import "./installs-CRSjQxbR.js";
-import { a as resolveControlUiRootOverrideSync, c as getHealthSnapshot, d as runHeartbeatOnce, f as setHeartbeatsEnabled, n as ensureControlUiAssetsBuilt, o as resolveControlUiRootSync, p as startHeartbeatRunner, s as formatHealthChannelLines } from "./health-format-Dy1caGsq.js";
-import { S as normalizeUpdateChannel, _ as resolveNpmChannelTag, h as compareSemverStrings, m as checkUpdateStatus, t as runGatewayUpdate, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner-CmE6cHdn.js";
-import { i as resolveGatewayAuth, n as authorizeGatewayConnect, r as isLocalDirectRequest, t as assertGatewayAuthConfigured } from "./auth-BvIPpm7G.js";
-import { i as probeGateway } from "./audit-C4wLaF0D.js";
-import "./table-DEnmtvl5.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-BosMnzIs.js";
-import "./service-Cd4BxKuo.js";
-import "./systemd-D6wTPnHi.js";
-import "./service-audit-CCFxuvKs.js";
-import "./node-service-CM5vkdIo.js";
-import "./channels-status-issues-DQkRaZts.js";
-import "./completion-cli-DOec3E2Z.js";
-import { a as createOutboundSendDeps$1, i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-Bz1r5O8q.js";
-import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-2ah0bkAj.js";
-import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-DNQJSa4B.js";
-import "./tui-Bc7XUQGP.js";
-import { t as buildChannelAccountSnapshot } from "./status-Cv36yYdi.js";
-import "./shared-gOyV38rM.js";
-import { a as runDaemonStop, i as runDaemonStart, n as runDaemonStatus, o as runDaemonUninstall, r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-q7nkEF5-.js";
-import { a as toOptionString, i as parsePort$1, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-ILguacOr.js";
-import { i as setGatewayWsLogStyle, n as logWs, r as summarizeAgentEventForWsLog, t as formatForLog } from "./ws-log-D7MkvKhg.js";
-import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-BXQKsLtI.js";
+import { n as logAcceptedEnvOption, t as isTruthyEnvValue } from "./env-ONzUVAG2.js";
+import { A as resolveAgentMaxConcurrent, E as applyLegacyMigrations, M as VERSION, a as parseConfigJson5, c as writeConfigFile, g as parseDurationMs, i as loadConfig, j as resolveSubagentMaxConcurrent, l as validateConfigObjectWithPlugins, n as migrateLegacyConfig, o as readConfigFileSnapshot, r as createConfigIO, s as resolveConfigSnapshotHash, u as OpenClawSchema } from "./config-aFQssWKX.js";
+import { c as isTestDefaultMemorySlotDisabled } from "./manifest-registry-CQhdnDBZ.js";
+import { n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-X7d_tfTE.js";
+import { B as snapshotSessionOrigin, F as resolveAgentMainSessionKey, I as resolveExplicitAgentSessionKey, L as resolveMainSessionKey, R as resolveMainSessionKeyFromConfig, S as mergeDeliveryContext, at as normalizeToolName, b as deliveryContextFromSession, d as loadSessionStore, g as updateSessionStore, nt as collectExplicitAllowlist, ot as resolveToolProfilePolicy, rt as expandPolicyWithPluginGroups, st as stripPluginOnlyAllowlist, tt as buildPluginToolGroups, w as normalizeSessionDeliveryFields } from "./sandbox-Bhjnh1Xg.js";
+import { f as registerUnhandledRejectionHandler, s as loadModelCatalog } from "./runner-D_dujMod.js";
+import "./image-C4Nn2p3e.js";
+import "./pi-model-discovery-EwKVHlZB.js";
+import { d as inspectPortUsage, l as ensurePortAvailable, p as formatPortDiagnostics } from "./chrome-Cvr-57lg.js";
+import { i as loadWorkspaceSkillEntries, m as hasBinary, r as buildWorkspaceSkillSnapshot } from "./skills-DprQj9X2.js";
+import { c as saveMediaBuffer, l as detectMime } from "./routes-CmOI1hIH.js";
+import { a as isErrno, n as formatErrorMessage } from "./errors-Bv81hF2P.js";
+import { n as movePathToTrash } from "./server-context-Cl0U0vE3.js";
+import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-DATIFSsY.js";
+import { c as resolveGatewayBindHost, i as isTrustedProxyAddress, l as resolveGatewayClientIp, n as isLoopbackAddress, r as isLoopbackHost, t as rawDataToString, u as resolveGatewayListenHosts } from "./ws-CHCQHs0F.js";
+import { f as GATEWAY_CLIENT_CAPS, g as hasGatewayClientCap, h as GATEWAY_CLIENT_NAMES, i as isGatewayMessageChannel, l as normalizeMessageChannel, m as GATEWAY_CLIENT_MODES, n as isDeliverableMessageChannel, p as GATEWAY_CLIENT_IDS, r as isGatewayCliClient, s as isWebchatClient, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-BLi2a6Yw.js";
+import "./logging-fywhKCmE.js";
+import "./accounts-DeqIQjo1.js";
+import { n as resolveSessionFilePath, o as resolveSessionTranscriptsDirForAgent, r as resolveSessionTranscriptPath, s as resolveStorePath } from "./paths-B49s6UZQ.js";
+import "./redact-BRsnXqwD.js";
+import "./tool-display-CZRIDMRm.js";
+import "./fetch-DmiOpALK.js";
+import { G as getGlobalHookRunner, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-LsxKETro.js";
+import { i as getMachineDisplayName, t as createBrowserRouteDispatcher } from "./dispatcher-DY51b-Zc.js";
+import "./manager-DkqF1GiK.js";
+import "./sqlite-D4w5TejA.js";
+import "./tui-formatters-CNySEfJN.js";
+import { $ as validateNodePairRequestParams, A as validateCronStatusParams, At as parseSessionLabel, B as validateExecApprovalsNodeGetParams, C as validateConfigSetParams, Ct as validateWizardNextParams, D as validateCronRemoveParams, Dt as ErrorCodes, E as validateCronListParams, Et as PROTOCOL_VERSION, F as validateDeviceTokenRevokeParams, G as validateNodeDescribeParams, H as validateExecApprovalsSetParams, I as validateDeviceTokenRotateParams, It as deriveDeviceIdFromPublicKey, J as validateNodeInvokeResultParams, K as validateNodeEventParams, L as validateExecApprovalRequestParams, M as validateDevicePairApproveParams, N as validateDevicePairListParams, Nt as normalizeInputProvenance, O as validateCronRunParams, Ot as errorShape, P as validateDevicePairRejectParams, Pt as buildDeviceAuthPayload, Q as validateNodePairRejectParams, R as validateExecApprovalResolveParams, Rt as normalizeDevicePublicKeyBase64Url, S as validateConfigSchemaParams, St as validateWizardCancelParams, T as validateCronAddParams, Tt as validateWizardStatusParams, U as validateLogsTailParams, V as validateExecApprovalsNodeSetParams, W as validateModelsListParams, X as validateNodePairApproveParams, Y as validateNodeListParams, Z as validateNodePairListParams, _ as validateChatInjectParams, _t as validateTalkModeParams, a as validateAgentWaitParams, at as validateSessionsCompactParams, b as validateConfigGetParams, bt as validateWebLoginStartParams, c as validateAgentsFilesGetParams, ct as validateSessionsPatchParams, d as validateAgentsListParams, dt as validateSessionsResolveParams, et as validateNodePairVerifyParams, f as validateAgentsUpdateParams, ft as validateSessionsUsageParams, g as validateChatHistoryParams, gt as validateSkillsUpdateParams, h as validateChatAbortParams, ht as validateSkillsStatusParams, i as validateAgentParams, it as validateSendParams, j as validateCronUpdateParams, k as validateCronRunsParams, l as validateAgentsFilesListParams, lt as validateSessionsPreviewParams, m as validateChannelsStatusParams, mt as validateSkillsInstallParams, n as formatValidationErrors, nt as validatePollParams, o as validateAgentsCreateParams, ot as validateSessionsDeleteParams, p as validateChannelsLogoutParams, pt as validateSkillsBinsParams, q as validateNodeInvokeParams, r as validateAgentIdentityParams, rt as validateRequestFrame, s as validateAgentsDeleteParams, st as validateSessionsListParams, tt as validateNodeRenameParams, u as validateAgentsFilesSetParams, ut as validateSessionsResetParams, v as validateChatSendParams, vt as validateUpdateRunParams, w as validateConnectParams, wt as validateWizardStartParams, x as validateConfigPatchParams, xt as validateWebLoginWaitParams, y as validateConfigApplyParams, yt as validateWakeParams, z as validateExecApprovalsGetParams, zt as verifyDeviceSignature } from "./client-BrYfyoDK.js";
+import { n as callGateway, o as loadGatewayTlsRuntime$1 } from "./call-SolyGS1r.js";
+import "./login-qr-B6ZgAuIf.js";
+import "./pairing-store-CmlRVqOz.js";
+import { t as formatDocsLink } from "./links-Eax1UO3w.js";
+import { n as runCommandWithRuntime } from "./cli-utils-CRhVAaLV.js";
+import { n as withProgress } from "./progress-C9kngsTD.js";
+import { a as resolveSubagentToolPolicy, i as resolveGroupToolPolicy, r as resolveEffectiveToolPolicy, t as filterToolsByPolicy } from "./pi-tools.policy-BpsROZbz.js";
+import "./prompt-style-CIbmaxSa.js";
+import "./pairing-labels-B6CN0SNH.js";
+import { i as loadSessionUsageTimeSeries, l as deriveSessionTotalTokens, n as loadCostUsageSummary, r as loadSessionCostSummary, t as discoverAllSessions, u as hasNonzeroUsage } from "./session-cost-usage-D7HuoSSD.js";
+import { n as formatTokenCount, r as formatUsd } from "./usage-format-CpORtVCG.js";
+import { c as normalizeExecApprovals, g as saveExecApprovals, l as readExecApprovalsSnapshot, m as resolveExecApprovalsSocketPath, r as ensureExecApprovals } from "./exec-approvals-Cb4ZLukq.js";
+import { a as safeEqualSecret, c as enableTailscaleFunnel, d as getTailnetHostname, i as resolveGatewayAuth, l as enableTailscaleServe, n as authorizeGatewayConnect, o as disableTailscaleFunnel, r as isLocalDirectRequest, s as disableTailscaleServe, t as assertGatewayAuthConfigured } from "./auth-CQNl_IaI.js";
+import "./control-auth-DBCu3qyv.js";
+import { n as createBrowserControlContext, r as startBrowserControlServiceFromConfig } from "./control-service-B5KnPqGP.js";
+import { t as parseAbsoluteTimeMs } from "./parse-Bw0oH-rT.js";
+import { n as resolveMessageChannelSelection } from "./channel-selection-MZAHm4U8.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-lAAA2zYI.js";
+import { t as ensureOpenClawCliOnPath } from "./path-env-CaYUVIML.js";
+import "./daemon-runtime-Bsjeut6m.js";
+import { c as loadAgentIdentity, d as loadAgentIdentityFromWorkspace, i as applyAgentConfig, l as pruneAgentConfig, o as findAgentEntryIndex, p as forceFreePortAndWait, r as getStatusSummary, s as listAgentEntries, t as runOnboardingWizard } from "./onboarding-CN-EDLjd.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-HyeZXsnu.js";
+import "./logging-BAyPwvdH.js";
+import "./note-BhRSeNeu.js";
+import { t as WizardCancelledError } from "./prompts-Bg96reub.js";
+import { i as discoverGatewayBeacons, n as installSkill } from "./onboard-skills-rlBHcu3Q.js";
+import "./github-copilot-auth-D7ewvpMd.js";
+import "./onboard-channels-Dxzroasd.js";
+import { r as buildChannelUiCatalog, t as applyPluginAutoEnable } from "./plugin-auto-enable-PW76g_PJ.js";
+import "./archive-beaSfAzA.js";
+import "./skill-scanner-CucvxYhu.js";
+import "./installs-DscWb9b9.js";
+import { a as resolveControlUiRootOverrideSync, c as getHealthSnapshot, d as runHeartbeatOnce, f as setHeartbeatsEnabled, n as ensureControlUiAssetsBuilt, o as resolveControlUiRootSync, p as startHeartbeatRunner, s as formatHealthChannelLines } from "./health-format-KGPokKJH.js";
+import { S as normalizeUpdateChannel, _ as resolveNpmChannelTag, h as compareSemverStrings, m as checkUpdateStatus, t as runGatewayUpdate, y as DEFAULT_PACKAGE_CHANNEL } from "./update-runner-7Qa1T9y6.js";
+import { i as probeGateway } from "./audit-Dmww_503.js";
+import "./table-B8dx3v4v.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-5U3P3YfJ.js";
+import "./service--nPk7DvT.js";
+import "./systemd-DrmBtJ5T.js";
+import "./service-audit-DnLmRGQt.js";
+import "./node-service-C8DTHTMg.js";
+import "./channels-status-issues-DDAWeT-6.js";
+import "./completion-cli-DnjpxAag.js";
+import { a as createOutboundSendDeps$1, i as resolveAgentOutboundTarget, r as resolveAgentDeliveryPlan, t as agentCommand } from "./agent-BvNJF5QL.js";
+import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-DzuRdwk5.js";
+import { i as shouldIncludeHook, n as loadWorkspaceHookEntries, r as resolveHookConfig } from "./hooks-status-D9MhwHRp.js";
+import "./tui-CVTQn-dC.js";
+import { t as buildChannelAccountSnapshot } from "./status-BRZfQbJ2.js";
+import "./shared-DRohONn_.js";
+import { a as runDaemonStop, i as runDaemonStart, n as runDaemonStatus, o as runDaemonUninstall, r as runDaemonRestart, s as runDaemonInstall } from "./daemon-cli-BDkU2ocb.js";
+import { a as toOptionString, i as parsePort$1, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-Bs4vduG4.js";
+import { i as setGatewayWsLogStyle, n as logWs, r as summarizeAgentEventForWsLog, t as formatForLog } from "./ws-log-DcQFZByi.js";
+import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-Cfns8TQx.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import * as fsSync from "node:fs";
 import fs, { constants } from "node:fs";
@@ -1205,6 +1207,10 @@ const BASE_RELOAD_RULES = [
 	}
 ];
 const BASE_RELOAD_RULES_TAIL = [
+	{
+		prefix: "meta",
+		kind: "none"
+	},
 	{
 		prefix: "identity",
 		kind: "none"
@@ -2548,6 +2554,8 @@ function resolveCronSession(params) {
 			thinkingLevel: entry?.thinkingLevel,
 			verboseLevel: entry?.verboseLevel,
 			model: entry?.model,
+			modelOverride: entry?.modelOverride,
+			providerOverride: entry?.providerOverride,
 			contextTokens: entry?.contextTokens,
 			sendPolicy: entry?.sendPolicy,
 			lastChannel: entry?.lastChannel,
@@ -2581,9 +2589,8 @@ async function runCronIsolatedAgentTurn(params) {
 	const defaultAgentId = resolveDefaultAgentId(params.cfg);
 	const requestedAgentId = typeof params.agentId === "string" && params.agentId.trim() ? params.agentId : typeof params.job.agentId === "string" && params.job.agentId.trim() ? params.job.agentId : void 0;
 	const normalizedRequested = requestedAgentId ? normalizeAgentId(requestedAgentId) : void 0;
-	const agentConfigOverride = normalizedRequested ? resolveAgentConfig(params.cfg, normalizedRequested) : void 0;
-	const { model: overrideModel, ...agentOverrideRest } = agentConfigOverride ?? {};
-	const agentId = agentConfigOverride ? normalizedRequested ?? defaultAgentId : defaultAgentId;
+	const { model: overrideModel, ...agentOverrideRest } = (normalizedRequested ? resolveAgentConfig(params.cfg, normalizedRequested) : void 0) ?? {};
+	const agentId = normalizedRequested ?? defaultAgentId;
 	const agentCfg = Object.assign({}, params.cfg.agents?.defaults, agentOverrideRest);
 	if (typeof overrideModel === "string") agentCfg.model = { primary: overrideModel };
 	else if (overrideModel) agentCfg.model = overrideModel;
@@ -2615,6 +2622,7 @@ async function runCronIsolatedAgentTurn(params) {
 		return catalog;
 	};
 	const isGmailHook = baseSessionKey.startsWith("hook:gmail:");
+	let hooksGmailModelApplied = false;
 	const hooksGmailModelRef = isGmailHook ? resolveHooksGmailModel({
 		cfg: params.cfg,
 		defaultProvider: DEFAULT_PROVIDER
@@ -2629,6 +2637,7 @@ async function runCronIsolatedAgentTurn(params) {
 		}).allowed) {
 			provider = hooksGmailModelRef.provider;
 			model = hooksGmailModelRef.model;
+			hooksGmailModelApplied = true;
 		}
 	}
 	const modelOverrideRaw = params.job.payload.kind === "agentTurn" ? params.job.payload.model : void 0;
@@ -2674,6 +2683,23 @@ async function runCronIsolatedAgentTurn(params) {
 		const labelSuffix = typeof params.job.name === "string" && params.job.name.trim() ? params.job.name.trim() : params.job.id;
 		cronSession.sessionEntry.label = `Cron: ${labelSuffix}`;
 	}
+	if (!modelOverride && !hooksGmailModelApplied) {
+		const sessionModelOverride = cronSession.sessionEntry.modelOverride?.trim();
+		if (sessionModelOverride) {
+			const sessionProviderOverride = cronSession.sessionEntry.providerOverride?.trim() || resolvedDefault.provider;
+			const resolvedSessionOverride = resolveAllowedModelRef({
+				cfg: cfgWithAgentDefaults,
+				catalog: await loadCatalog(),
+				raw: `${sessionProviderOverride}/${sessionModelOverride}`,
+				defaultProvider: resolvedDefault.provider,
+				defaultModel: resolvedDefault.model
+			});
+			if (!("error" in resolvedSessionOverride)) {
+				provider = resolvedSessionOverride.ref.provider;
+				model = resolvedSessionOverride.ref.model;
+			}
+		}
+	}
 	const hooksGmailThinking = isGmailHook ? normalizeThinkLevel(params.cfg.hooks?.gmail?.thinking) : void 0;
 	const thinkOverride = normalizeThinkLevel(agentCfg?.thinkingDefault);
 	let thinkLevel = normalizeThinkLevel((params.job.payload.kind === "agentTurn" ? params.job.payload.thinking : void 0) ?? void 0) ?? hooksGmailThinking ?? thinkOverride;
@@ -2811,6 +2837,7 @@ async function runCronIsolatedAgentTurn(params) {
 	const payloads = runResult.payloads ?? [];
 	{
 		const usage = runResult.meta.agentMeta?.usage;
+		const promptTokens = runResult.meta.agentMeta?.promptTokens;
 		const modelUsed = runResult.meta.agentMeta?.model ?? fallbackModel ?? model;
 		const providerUsed = runResult.meta.agentMeta?.provider ?? fallbackProvider ?? provider;
 		const contextTokens = agentCfg?.contextTokens ?? lookupContextTokens(modelUsed) ?? DEFAULT_CONTEXT_TOKENS;
@@ -2828,7 +2855,8 @@ async function runCronIsolatedAgentTurn(params) {
 			cronSession.sessionEntry.outputTokens = output;
 			cronSession.sessionEntry.totalTokens = deriveSessionTotalTokens({
 				usage,
-				contextTokens
+				contextTokens,
+				promptTokens
 			}) ?? input;
 		}
 		await persistSessionEntry();
@@ -3046,10 +3074,10 @@ function computeNextRunAtMs(schedule, nowMs) {
 		catch: false
 	});
 	const nowSecondMs = Math.floor(nowMs / 1e3) * 1e3;
-	const next = cron.nextRun(/* @__PURE__ */ new Date(nowSecondMs - 1));
+	const next = cron.nextRun(new Date(nowSecondMs));
 	if (!next) return;
 	const nextMs = next.getTime();
-	return Number.isFinite(nextMs) && nextMs >= nowSecondMs ? nextMs : void 0;
+	return Number.isFinite(nextMs) && nextMs > nowSecondMs ? nextMs : void 0;
 }
 
 //#endregion
@@ -3092,6 +3120,8 @@ function computeJobNextRunAtMs(job, nowMs) {
 	}
 	return computeNextRunAtMs(job.schedule, nowMs);
 }
+/** Maximum consecutive schedule errors before auto-disabling a job. */
+const MAX_SCHEDULE_ERRORS = 3;
 function recomputeNextRuns(state) {
 	if (!state.store) return false;
 	let changed = false;
@@ -3122,12 +3152,82 @@ function recomputeNextRuns(state) {
 			changed = true;
 		}
 		const nextRun = job.state.nextRunAtMs;
-		if (nextRun === void 0 || now >= nextRun) {
+		if (nextRun === void 0 || now >= nextRun) try {
 			const newNext = computeJobNextRunAtMs(job, now);
 			if (job.state.nextRunAtMs !== newNext) {
 				job.state.nextRunAtMs = newNext;
 				changed = true;
 			}
+			if (job.state.scheduleErrorCount) {
+				job.state.scheduleErrorCount = void 0;
+				changed = true;
+			}
+		} catch (err) {
+			const errorCount = (job.state.scheduleErrorCount ?? 0) + 1;
+			job.state.scheduleErrorCount = errorCount;
+			job.state.nextRunAtMs = void 0;
+			job.state.lastError = `schedule error: ${String(err)}`;
+			changed = true;
+			if (errorCount >= MAX_SCHEDULE_ERRORS) {
+				job.enabled = false;
+				state.deps.log.error({
+					jobId: job.id,
+					name: job.name,
+					errorCount,
+					err: String(err)
+				}, "cron: auto-disabled job after repeated schedule errors");
+			} else state.deps.log.warn({
+				jobId: job.id,
+				name: job.name,
+				errorCount,
+				err: String(err)
+			}, "cron: failed to compute next run for job (skipping)");
+		}
+	}
+	return changed;
+}
+/**
+* Maintenance-only version of recomputeNextRuns that handles disabled jobs
+* and stuck markers, but does NOT recompute nextRunAtMs for enabled jobs
+* with existing values. Used during timer ticks when no due jobs were found
+* to prevent silently advancing past-due nextRunAtMs values without execution
+* (see #13992).
+*/
+function recomputeNextRunsForMaintenance(state) {
+	if (!state.store) return false;
+	let changed = false;
+	const now = state.deps.nowMs();
+	for (const job of state.store.jobs) {
+		if (!job.state) {
+			job.state = {};
+			changed = true;
+		}
+		if (!job.enabled) {
+			if (job.state.nextRunAtMs !== void 0) {
+				job.state.nextRunAtMs = void 0;
+				changed = true;
+			}
+			if (job.state.runningAtMs !== void 0) {
+				job.state.runningAtMs = void 0;
+				changed = true;
+			}
+			continue;
+		}
+		const runningAt = job.state.runningAtMs;
+		if (typeof runningAt === "number" && now - runningAt > STUCK_RUN_MS) {
+			state.deps.log.warn({
+				jobId: job.id,
+				runningAtMs: runningAt
+			}, "cron: clearing stuck running marker");
+			job.state.runningAtMs = void 0;
+			changed = true;
+		}
+		if (job.state.nextRunAtMs === void 0) {
+			const newNext = computeJobNextRunAtMs(job, now);
+			if (newNext !== void 0) {
+				job.state.nextRunAtMs = newNext;
+				changed = true;
+			}
 		}
 	}
 	return changed;
@@ -3787,7 +3887,7 @@ function applyJobResult(state, job, result) {
 	job.updatedAtMs = result.endedAt;
 	if (result.status === "error") job.state.consecutiveErrors = (job.state.consecutiveErrors ?? 0) + 1;
 	else job.state.consecutiveErrors = 0;
-	const shouldDelete = job.schedule.kind === "at" && result.status === "ok" && job.deleteAfterRun === true;
+	const shouldDelete = job.schedule.kind === "at" && job.deleteAfterRun === true && result.status === "ok";
 	if (!shouldDelete) if (job.schedule.kind === "at") {
 		job.enabled = false;
 		job.state.nextRunAtMs = void 0;
@@ -3848,7 +3948,17 @@ function armTimer(state) {
 	}, "cron: timer armed");
 }
 async function onTimer(state) {
-	if (state.running) return;
+	if (state.running) {
+		if (state.timer) clearTimeout(state.timer);
+		state.timer = setTimeout(async () => {
+			try {
+				await onTimer(state);
+			} catch (err) {
+				state.deps.log.error({ err: String(err) }, "cron: timer tick failed");
+			}
+		}, MAX_TIMER_DELAY_MS);
+		return;
+	}
 	state.running = true;
 	try {
 		const dueJobs = await locked(state, async () => {
@@ -3858,7 +3968,7 @@ async function onTimer(state) {
 			});
 			const due = findDueJobs(state);
 			if (due.length === 0) {
-				if (recomputeNextRuns(state)) await persist(state);
+				if (recomputeNextRunsForMaintenance(state)) await persist(state);
 				return [];
 			}
 			const now = state.deps.nowMs();
@@ -3994,7 +4104,7 @@ async function runMissedJobs(state) {
 		if (!j.enabled) return false;
 		if (typeof j.state.runningAtMs === "number") return false;
 		const next = j.state.nextRunAtMs;
-		if (j.schedule.kind === "at" && j.state.lastStatus === "ok") return false;
+		if (j.schedule.kind === "at" && j.state.lastStatus) return false;
 		return typeof next === "number" && now >= next;
 	});
 	if (missed.length > 0) {
@@ -4020,7 +4130,10 @@ async function executeJobCore(state, job) {
 			const waitStartedAt = state.deps.nowMs();
 			let heartbeatResult;
 			for (;;) {
-				heartbeatResult = await state.deps.runHeartbeatOnce({ reason });
+				heartbeatResult = await state.deps.runHeartbeatOnce({
+					reason,
+					agentId: job.agentId
+				});
 				if (heartbeatResult.status !== "skipped" || heartbeatResult.reason !== "requests-in-flight") break;
 				if (state.deps.nowMs() - waitStartedAt > maxWaitMs) {
 					state.deps.requestHeartbeatNow({ reason });
@@ -4399,9 +4512,12 @@ function buildGatewayCronService(params) {
 			},
 			requestHeartbeatNow,
 			runHeartbeatOnce: async (opts) => {
+				const runtimeConfig = loadConfig();
+				const agentId = opts?.agentId ? resolveCronAgent(opts.agentId).agentId : void 0;
 				return await runHeartbeatOnce({
-					cfg: loadConfig(),
+					cfg: runtimeConfig,
 					reason: opts?.reason,
+					agentId,
 					deps: {
 						...params.deps,
 						runtime: defaultRuntime
@@ -4782,8 +4898,8 @@ function abortChatRunsForSessionKey(ops, params) {
 
 //#endregion
 //#region src/gateway/server-constants.ts
-const MAX_PAYLOAD_BYTES = 512 * 1024;
-const MAX_BUFFERED_BYTES = 1.5 * 1024 * 1024;
+const MAX_PAYLOAD_BYTES = 8 * 1024 * 1024;
+const MAX_BUFFERED_BYTES = 16 * 1024 * 1024;
 const DEFAULT_MAX_CHAT_HISTORY_MESSAGES_BYTES = 6 * 1024 * 1024;
 let maxChatHistoryMessagesBytes = DEFAULT_MAX_CHAT_HISTORY_MESSAGES_BYTES;
 const getMaxChatHistoryMessagesBytes = () => maxChatHistoryMessagesBytes;
@@ -5496,7 +5612,7 @@ function ensureAgentRunListener() {
 		agentRunStarts.delete(evt.runId);
 		recordAgentRunSnapshot({
 			runId: evt.runId,
-			status: phase === "error" ? "error" : "ok",
+			status: phase === "error" ? "error" : evt.data?.aborted ? "timeout" : "ok",
 			startedAt,
 			endedAt,
 			error,
@@ -5538,7 +5654,7 @@ async function waitForAgentJob(params) {
 			const error = typeof evt.data?.error === "string" ? evt.data.error : void 0;
 			const snapshot = {
 				runId: evt.runId,
-				status: phase === "error" ? "error" : "ok",
+				status: phase === "error" ? "error" : evt.data?.aborted ? "timeout" : "ok",
 				startedAt,
 				endedAt,
 				error,
@@ -5623,6 +5739,7 @@ const agentHandlers = {
 		let resolvedGroupChannel = groupChannelRaw || void 0;
 		let resolvedGroupSpace = groupSpaceRaw || void 0;
 		let spawnedByValue = typeof request.spawnedBy === "string" ? request.spawnedBy.trim() : void 0;
+		const inputProvenance = normalizeInputProvenance(request.inputProvenance);
 		const cached = context.dedupe.get(`agent:${idem}`);
 		if (cached) {
 			respond(cached.ok, cached.payload, cached.error, { cached: true });
@@ -5829,7 +5946,8 @@ const agentHandlers = {
 			messageChannel: resolvedChannel,
 			runId,
 			lane: request.lane,
-			extraSystemPrompt: request.extraSystemPrompt
+			extraSystemPrompt: request.extraSystemPrompt,
+			inputProvenance
 		}, defaultRuntime, context.deps).then((result) => {
 			const payload = {
 				runId,
@@ -6750,9 +6868,13 @@ const channelsHandlers = {
 //#region src/gateway/server-methods/chat.ts
 function resolveTranscriptPath(params) {
 	const { sessionId, storePath, sessionFile } = params;
-	if (sessionFile) return sessionFile;
-	if (!storePath) return null;
-	return path.join(path.dirname(storePath), `${sessionId}.jsonl`);
+	if (!storePath && !sessionFile) return null;
+	try {
+		const sessionsDir = storePath ? path.dirname(storePath) : void 0;
+		return resolveSessionFilePath(sessionId, sessionFile ? { sessionFile } : void 0, sessionsDir ? { sessionsDir } : void 0);
+	} catch {
+		return null;
+	}
 }
 function ensureTranscriptFile(params) {
 	if (fs.existsSync(params.transcriptPath)) return { ok: true };
@@ -7281,16 +7403,32 @@ function applyMergePatch(base, patch) {
 */
 const REDACTED_SENTINEL = "__OPENCLAW_REDACTED__";
 /**
+* Non-sensitive field names that happen to match sensitive patterns.
+* These are explicitly excluded from redaction.
+*/
+const SENSITIVE_KEY_WHITELIST = new Set([
+	"maxtokens",
+	"maxoutputtokens",
+	"maxinputtokens",
+	"maxcompletiontokens",
+	"contexttokens",
+	"totaltokens",
+	"tokencount",
+	"tokenlimit",
+	"tokenbudget"
+]);
+/**
 * Patterns that identify sensitive config field names.
 * Aligned with the UI-hint logic in schema.ts.
 */
 const SENSITIVE_KEY_PATTERNS = [
-	/token/i,
+	/token$/i,
 	/password/i,
 	/secret/i,
 	/api.?key/i
 ];
 function isSensitiveKey(key) {
+	if (SENSITIVE_KEY_WHITELIST.has(key.toLowerCase())) return false;
 	return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
 }
 /**
@@ -8000,7 +8138,7 @@ const FIELD_PLACEHOLDERS = {
 	"agents.list[].identity.avatar": "avatars/openclaw.png"
 };
 const SENSITIVE_PATTERNS = [
-	/token/i,
+	/token$/i,
 	/password/i,
 	/secret/i,
 	/api.?key/i
@@ -8932,7 +9070,7 @@ async function verifyDeviceToken(params) {
 			ok: false,
 			reason: "token-revoked"
 		};
-		if (entry.token !== params.token) return {
+		if (!safeEqualSecret(params.token, entry.token)) return {
 			ok: false,
 			reason: "token-mismatch"
 		};
@@ -9784,7 +9922,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-CHWXfb_T.js");
+			const { handleNodeEvent } = await import("./server-node-events-CBfTbiTA.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -9852,8 +9990,13 @@ const sendHandlers = {
 			return;
 		}
 		const to = request.to.trim();
-		const message = request.message.trim();
-		const mediaUrls = Array.isArray(request.mediaUrls) ? request.mediaUrls : void 0;
+		const message = typeof request.message === "string" ? request.message.trim() : "";
+		const mediaUrl = typeof request.mediaUrl === "string" && request.mediaUrl.trim().length > 0 ? request.mediaUrl.trim() : void 0;
+		const mediaUrls = Array.isArray(request.mediaUrls) ? request.mediaUrls.map((entry) => typeof entry === "string" ? entry.trim() : "").filter((entry) => entry.length > 0) : void 0;
+		if (!message && !mediaUrl && (mediaUrls?.length ?? 0) === 0) {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "invalid send params: text or media is required"));
+			return;
+		}
 		const channelInput = typeof request.channel === "string" ? request.channel : void 0;
 		const normalizedChannel = channelInput ? normalizeChannelId(channelInput) : null;
 		if (channelInput && !normalizedChannel) {
@@ -9885,7 +10028,7 @@ const sendHandlers = {
 				const outboundDeps = context.deps ? createOutboundSendDeps(context.deps) : void 0;
 				const mirrorPayloads = normalizeReplyPayloadsForDelivery([{
 					text: message,
-					mediaUrl: request.mediaUrl,
+					mediaUrl,
 					mediaUrls
 				}]);
 				const mirrorText = mirrorPayloads.map((payload) => payload.text).filter(Boolean).join("\n");
@@ -9913,7 +10056,7 @@ const sendHandlers = {
 					accountId,
 					payloads: [{
 						text: message,
-						mediaUrl: request.mediaUrl,
+						mediaUrl,
 						mediaUrls
 					}],
 					gifPlayback: request.gifPlayback,
@@ -11284,7 +11427,7 @@ const usageHandlers = {
 		const limit = typeof p.limit === "number" && Number.isFinite(p.limit) ? p.limit : 50;
 		const includeContextWeight = p.includeContextWeight ?? false;
 		const specificKey = typeof p.key === "string" ? p.key.trim() : null;
-		const { store } = loadCombinedSessionStoreForGateway(config);
+		const { storePath, store } = loadCombinedSessionStoreForGateway(config);
 		const now = Date.now();
 		const mergedEntries = [];
 		if (specificKey) {
@@ -11304,7 +11447,13 @@ const usageHandlers = {
 			const resolvedStoreKey = storeMatch?.key ?? storeByIdMatch?.key ?? specificKey;
 			const storeEntry = storeMatch?.entry ?? storeByIdMatch?.entry;
 			const sessionId = storeEntry?.sessionId ?? keyRest;
-			const sessionFile = resolveSessionFilePath(sessionId, storeEntry, { agentId: agentIdFromKey });
+			let sessionFile;
+			try {
+				sessionFile = resolveSessionFilePath(sessionId, storeEntry, storePath && storePath !== "(multiple)" ? { sessionsDir: path.dirname(storePath) } : { agentId: agentIdFromKey });
+			} catch {
+				respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session reference: ${specificKey}`));
+				return;
+			}
 			try {
 				const stats = fs.statSync(sessionFile);
 				if (stats.isFile()) mergedEntries.push({
@@ -11630,14 +11779,22 @@ const usageHandlers = {
 			return;
 		}
 		const config = loadConfig();
-		const { entry } = loadSessionEntry(key);
+		const { entry, storePath } = loadSessionEntry(key);
 		const parsed = parseAgentSessionKey(key);
 		const agentId = parsed?.agentId;
 		const rawSessionId = parsed?.rest ?? key;
+		const sessionId = entry?.sessionId ?? rawSessionId;
+		let sessionFile;
+		try {
+			sessionFile = resolveSessionFilePath(sessionId, entry, storePath ? { sessionsDir: path.dirname(storePath) } : { agentId });
+		} catch {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session key: ${key}`));
+			return;
+		}
 		const timeseries = await loadSessionUsageTimeSeries({
-			sessionId: entry?.sessionId ?? rawSessionId,
+			sessionId,
 			sessionEntry: entry,
-			sessionFile: entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId }),
+			sessionFile,
 			config,
 			maxPoints: 200
 		});
@@ -11655,13 +11812,19 @@ const usageHandlers = {
 		}
 		const limit = typeof params?.limit === "number" && Number.isFinite(params.limit) ? Math.min(params.limit, 1e3) : 200;
 		const config = loadConfig();
-		const { entry } = loadSessionEntry(key);
+		const { entry, storePath } = loadSessionEntry(key);
 		const parsed = parseAgentSessionKey(key);
 		const agentId = parsed?.agentId;
 		const rawSessionId = parsed?.rest ?? key;
 		const sessionId = entry?.sessionId ?? rawSessionId;
-		const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId });
-		const { loadSessionLogs } = await import("./session-cost-usage-PvyVZz-g.js").then((n) => n.a);
+		let sessionFile;
+		try {
+			sessionFile = resolveSessionFilePath(sessionId, entry, storePath ? { sessionsDir: path.dirname(storePath) } : { agentId });
+		} catch {
+			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session key: ${key}`));
+			return;
+		}
+		const { loadSessionLogs } = await import("./session-cost-usage-D7HuoSSD.js").then((n) => n.a);
 		respond(true, { logs: await loadSessionLogs({
 			sessionId,
 			sessionEntry: entry,
@@ -12667,6 +12830,12 @@ function resolveHooksConfig(cfg) {
 	const maxBodyBytes = cfg.hooks?.maxBodyBytes && cfg.hooks.maxBodyBytes > 0 ? cfg.hooks.maxBodyBytes : DEFAULT_HOOKS_MAX_BODY_BYTES;
 	const mappings = resolveHookMappings(cfg.hooks);
 	const defaultAgentId = resolveDefaultAgentId(cfg);
+	const knownAgentIds = resolveKnownAgentIds(cfg, defaultAgentId);
+	const allowedAgentIds = resolveAllowedAgentIds(cfg.hooks?.allowedAgentIds);
+	const defaultSessionKey = resolveSessionKey$1(cfg.hooks?.defaultSessionKey);
+	const allowedSessionKeyPrefixes = resolveAllowedSessionKeyPrefixes(cfg.hooks?.allowedSessionKeyPrefixes);
+	if (defaultSessionKey && allowedSessionKeyPrefixes && !isSessionKeyAllowedByPrefix(defaultSessionKey, allowedSessionKeyPrefixes)) throw new Error("hooks.defaultSessionKey must match hooks.allowedSessionKeyPrefixes");
+	if (!defaultSessionKey && allowedSessionKeyPrefixes && !isSessionKeyAllowedByPrefix("hook:example", allowedSessionKeyPrefixes)) throw new Error("hooks.allowedSessionKeyPrefixes must include 'hook:' when hooks.defaultSessionKey is unset");
 	return {
 		basePath: trimmed,
 		token,
@@ -12674,8 +12843,13 @@ function resolveHooksConfig(cfg) {
 		mappings,
 		agentPolicy: {
 			defaultAgentId,
-			knownAgentIds: resolveKnownAgentIds(cfg, defaultAgentId),
-			allowedAgentIds: resolveAllowedAgentIds(cfg.hooks?.allowedAgentIds)
+			knownAgentIds,
+			allowedAgentIds
+		},
+		sessionPolicy: {
+			defaultSessionKey,
+			allowRequestSessionKey: cfg.hooks?.allowRequestSessionKey === true,
+			allowedSessionKeyPrefixes
 		}
 	};
 }
@@ -12700,6 +12874,29 @@ function resolveAllowedAgentIds(raw) {
 	if (hasWildcard) return;
 	return allowed;
 }
+function resolveSessionKey$1(raw) {
+	const value = raw?.trim();
+	return value ? value : void 0;
+}
+function normalizeSessionKeyPrefix(raw) {
+	const value = raw.trim().toLowerCase();
+	return value ? value : void 0;
+}
+function resolveAllowedSessionKeyPrefixes(raw) {
+	if (!Array.isArray(raw)) return;
+	const set = /* @__PURE__ */ new Set();
+	for (const prefix of raw) {
+		const normalized = normalizeSessionKeyPrefix(prefix);
+		if (!normalized) continue;
+		set.add(normalized);
+	}
+	return set.size > 0 ? Array.from(set) : void 0;
+}
+function isSessionKeyAllowedByPrefix(sessionKey, prefixes) {
+	const normalized = sessionKey.trim().toLowerCase();
+	if (!normalized) return false;
+	return prefixes.some((prefix) => normalized.startsWith(prefix));
+}
 function extractHookToken(req) {
 	const auth = typeof req.headers.authorization === "string" ? req.headers.authorization.trim() : "";
 	if (auth.toLowerCase().startsWith("bearer ")) {
@@ -12810,7 +13007,42 @@ function isHookAgentAllowed(hooksConfig, agentId) {
 	return resolved ? allowed.has(resolved) : false;
 }
 const getHookAgentPolicyError = () => "agentId is not allowed by hooks.allowedAgentIds";
-function normalizeAgentPayload(payload, opts) {
+const getHookSessionKeyRequestPolicyError = () => "sessionKey is disabled for external /hooks/agent payloads; set hooks.allowRequestSessionKey=true to enable";
+const getHookSessionKeyPrefixError = (prefixes) => `sessionKey must start with one of: ${prefixes.join(", ")}`;
+function resolveHookSessionKey(params) {
+	const requested = resolveSessionKey$1(params.sessionKey);
+	if (requested) {
+		if (params.source === "request" && !params.hooksConfig.sessionPolicy.allowRequestSessionKey) return {
+			ok: false,
+			error: getHookSessionKeyRequestPolicyError()
+		};
+		const allowedPrefixes = params.hooksConfig.sessionPolicy.allowedSessionKeyPrefixes;
+		if (allowedPrefixes && !isSessionKeyAllowedByPrefix(requested, allowedPrefixes)) return {
+			ok: false,
+			error: getHookSessionKeyPrefixError(allowedPrefixes)
+		};
+		return {
+			ok: true,
+			value: requested
+		};
+	}
+	const defaultSessionKey = params.hooksConfig.sessionPolicy.defaultSessionKey;
+	if (defaultSessionKey) return {
+		ok: true,
+		value: defaultSessionKey
+	};
+	const generated = `hook:${(params.idFactory ?? randomUUID)()}`;
+	const allowedPrefixes = params.hooksConfig.sessionPolicy.allowedSessionKeyPrefixes;
+	if (allowedPrefixes && !isSessionKeyAllowedByPrefix(generated, allowedPrefixes)) return {
+		ok: false,
+		error: getHookSessionKeyPrefixError(allowedPrefixes)
+	};
+	return {
+		ok: true,
+		value: generated
+	};
+}
+function normalizeAgentPayload(payload) {
 	const message = typeof payload.message === "string" ? payload.message.trim() : "";
 	if (!message) return {
 		ok: false,
@@ -12822,8 +13054,7 @@ function normalizeAgentPayload(payload, opts) {
 	const agentId = typeof agentIdRaw === "string" && agentIdRaw.trim() ? agentIdRaw.trim() : void 0;
 	const wakeMode = payload.wakeMode === "next-heartbeat" ? "next-heartbeat" : "now";
 	const sessionKeyRaw = payload.sessionKey;
-	const idFactory = opts?.idFactory ?? randomUUID;
-	const sessionKey = typeof sessionKeyRaw === "string" && sessionKeyRaw.trim() ? sessionKeyRaw.trim() : `hook:${idFactory()}`;
+	const sessionKey = typeof sessionKeyRaw === "string" && sessionKeyRaw.trim() ? sessionKeyRaw.trim() : void 0;
 	const channel = resolveHookChannel(payload.channel);
 	if (!channel) return {
 		ok: false,
@@ -12864,7 +13095,7 @@ function normalizeAgentPayload(payload, opts) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.OPENCLAW_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.OPENCLAW_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./control-service-Db_1V-KY.js").then((n) => n.t);
+	const mod = override ? await import(override) : await import("./control-service-B5KnPqGP.js").then((n) => n.t);
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -14515,6 +14746,7 @@ const OutputTextDoneEventSchema = z.object({
 //#endregion
 //#region src/gateway/openresponses-http.ts
 const DEFAULT_BODY_BYTES$1 = 20 * 1024 * 1024;
+const DEFAULT_MAX_URL_PARTS = 8;
 function writeSseEvent(res, event) {
 	res.write(`event: ${event.type}\n`);
 	res.write(`data: ${JSON.stringify(event)}\n\n`);
@@ -14527,13 +14759,20 @@ function extractTextContent(content) {
 		return "";
 	}).filter(Boolean).join("\n");
 }
+function normalizeHostnameAllowlist(values) {
+	if (!values || values.length === 0) return;
+	const normalized = values.map((value) => value.trim()).filter((value) => value.length > 0);
+	return normalized.length > 0 ? normalized : void 0;
+}
 function resolveResponsesLimits(config) {
 	const files = config?.files;
 	const images = config?.images;
 	return {
 		maxBodyBytes: config?.maxBodyBytes ?? DEFAULT_BODY_BYTES$1,
+		maxUrlParts: typeof config?.maxUrlParts === "number" ? Math.max(0, Math.floor(config.maxUrlParts)) : DEFAULT_MAX_URL_PARTS,
 		files: {
 			allowUrl: files?.allowUrl ?? true,
+			urlAllowlist: normalizeHostnameAllowlist(files?.urlAllowlist),
 			allowedMimes: normalizeMimeList(files?.allowedMimes, DEFAULT_INPUT_FILE_MIMES),
 			maxBytes: files?.maxBytes ?? DEFAULT_INPUT_FILE_MAX_BYTES,
 			maxChars: files?.maxChars ?? DEFAULT_INPUT_FILE_MAX_CHARS,
@@ -14547,6 +14786,7 @@ function resolveResponsesLimits(config) {
 		},
 		images: {
 			allowUrl: images?.allowUrl ?? true,
+			urlAllowlist: normalizeHostnameAllowlist(images?.urlAllowlist),
 			allowedMimes: normalizeMimeList(images?.allowedMimes, DEFAULT_INPUT_IMAGE_MIMES),
 			maxBytes: images?.maxBytes ?? DEFAULT_INPUT_IMAGE_MAX_BYTES,
 			maxRedirects: images?.maxRedirects ?? DEFAULT_INPUT_MAX_REDIRECTS,
@@ -14728,6 +14968,11 @@ async function handleOpenResponsesHttpRequest(req, res, opts) {
 	const user = payload.user;
 	let images = [];
 	let fileContexts = [];
+	let urlParts = 0;
+	const markUrlPart = () => {
+		urlParts += 1;
+		if (urlParts > limits.maxUrlParts) throw new Error(`Too many URL-based input sources: ${urlParts} (limit: ${limits.maxUrlParts})`);
+	};
 	try {
 		if (Array.isArray(payload.input)) {
 			for (const item of payload.input) if (item.type === "message" && typeof item.content !== "string") for (const part of item.content) {
@@ -14735,6 +14980,7 @@ async function handleOpenResponsesHttpRequest(req, res, opts) {
 					const source = part.source;
 					const sourceType = source.type === "base64" || source.type === "url" ? source.type : void 0;
 					if (!sourceType) throw new Error("input_image must have 'source.url' or 'source.data'");
+					if (sourceType === "url") markUrlPart();
 					const image = await extractImageContentFromSource({
 						type: sourceType,
 						url: source.url,
@@ -14748,6 +14994,7 @@ async function handleOpenResponsesHttpRequest(req, res, opts) {
 					const source = part.source;
 					const sourceType = source.type === "base64" || source.type === "url" ? source.type : void 0;
 					if (!sourceType) throw new Error("input_file must have 'source.url' or 'source.data'");
+					if (sourceType === "url") markUrlPart();
 					const file = await extractFileContentFromSource({
 						source: {
 							type: sourceType,
@@ -15311,6 +15558,9 @@ async function handleToolsInvokeHttpRequest(req, res, opts) {
 
 //#endregion
 //#region src/gateway/server-http.ts
+const HOOK_AUTH_FAILURE_LIMIT = 20;
+const HOOK_AUTH_FAILURE_WINDOW_MS = 6e4;
+const HOOK_AUTH_FAILURE_TRACK_MAX = 2048;
 function sendJson(res, status, body) {
 	res.statusCode = status;
 	res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -15352,6 +15602,31 @@ async function authorizeCanvasRequest(params) {
 }
 function createHooksRequestHandler(opts) {
 	const { getHooksConfig, bindHost, port, logHooks, dispatchAgentHook, dispatchWakeHook } = opts;
+	const hookAuthFailures = /* @__PURE__ */ new Map();
+	const resolveHookClientKey = (req) => {
+		return req.socket?.remoteAddress?.trim() || "unknown";
+	};
+	const recordHookAuthFailure = (clientKey, nowMs) => {
+		if (!hookAuthFailures.has(clientKey) && hookAuthFailures.size >= HOOK_AUTH_FAILURE_TRACK_MAX) hookAuthFailures.clear();
+		const current = hookAuthFailures.get(clientKey);
+		const next = !current || nowMs - current.windowStartedAtMs >= HOOK_AUTH_FAILURE_WINDOW_MS ? {
+			count: 1,
+			windowStartedAtMs: nowMs
+		} : {
+			count: current.count + 1,
+			windowStartedAtMs: current.windowStartedAtMs
+		};
+		hookAuthFailures.set(clientKey, next);
+		if (next.count <= HOOK_AUTH_FAILURE_LIMIT) return { throttled: false };
+		const retryAfterMs = Math.max(1, next.windowStartedAtMs + HOOK_AUTH_FAILURE_WINDOW_MS - nowMs);
+		return {
+			throttled: true,
+			retryAfterSeconds: Math.ceil(retryAfterMs / 1e3)
+		};
+	};
+	const clearHookAuthFailure = (clientKey) => {
+		hookAuthFailures.delete(clientKey);
+	};
 	return async (req, res) => {
 		const hooksConfig = getHooksConfig();
 		if (!hooksConfig) return false;
@@ -15365,12 +15640,24 @@ function createHooksRequestHandler(opts) {
 			return true;
 		}
 		const token = extractHookToken(req);
-		if (!token || token !== hooksConfig.token) {
+		const clientKey = resolveHookClientKey(req);
+		if (!safeEqualSecret(token, hooksConfig.token)) {
+			const throttle = recordHookAuthFailure(clientKey, Date.now());
+			if (throttle.throttled) {
+				const retryAfter = throttle.retryAfterSeconds ?? 1;
+				res.statusCode = 429;
+				res.setHeader("Retry-After", String(retryAfter));
+				res.setHeader("Content-Type", "text/plain; charset=utf-8");
+				res.end("Too Many Requests");
+				logHooks.warn(`hook auth throttled for ${clientKey}; retry-after=${retryAfter}s`);
+				return true;
+			}
 			res.statusCode = 401;
 			res.setHeader("Content-Type", "text/plain; charset=utf-8");
 			res.end("Unauthorized");
 			return true;
 		}
+		clearHookAuthFailure(clientKey);
 		if (req.method !== "POST") {
 			res.statusCode = 405;
 			res.setHeader("Allow", "POST");
@@ -15427,10 +15714,23 @@ function createHooksRequestHandler(opts) {
 				});
 				return true;
 			}
+			const sessionKey = resolveHookSessionKey({
+				hooksConfig,
+				source: "request",
+				sessionKey: normalized.value.sessionKey
+			});
+			if (!sessionKey.ok) {
+				sendJson(res, 400, {
+					ok: false,
+					error: sessionKey.error
+				});
+				return true;
+			}
 			sendJson(res, 202, {
 				ok: true,
 				runId: dispatchAgentHook({
 					...normalized.value,
+					sessionKey: sessionKey.value,
 					agentId: resolveHookTargetAgentId(hooksConfig, normalized.value.agentId)
 				})
 			});
@@ -15482,6 +15782,18 @@ function createHooksRequestHandler(opts) {
 					});
 					return true;
 				}
+				const sessionKey = resolveHookSessionKey({
+					hooksConfig,
+					source: "mapping",
+					sessionKey: mapped.action.sessionKey
+				});
+				if (!sessionKey.ok) {
+					sendJson(res, 400, {
+						ok: false,
+						error: sessionKey.error
+					});
+					return true;
+				}
 				sendJson(res, 202, {
 					ok: true,
 					runId: dispatchAgentHook({
@@ -15489,7 +15801,7 @@ function createHooksRequestHandler(opts) {
 						name: mapped.action.name ?? "Hook",
 						agentId: resolveHookTargetAgentId(hooksConfig, mapped.action.agentId),
 						wakeMode: mapped.action.wakeMode,
-						sessionKey: mapped.action.sessionKey ?? "",
+						sessionKey: sessionKey.value,
 						deliver: resolveHookDeliver(mapped.action.deliver),
 						channel,
 						to: mapped.action.to,
@@ -15527,13 +15839,31 @@ function createGatewayHttpServer(opts) {
 		try {
 			const configSnapshot = loadConfig();
 			const trustedProxies = configSnapshot.gateway?.trustedProxies ?? [];
+			const requestPath = new URL(req.url ?? "/", "http://localhost").pathname;
 			if (await handleHooksRequest(req, res)) return;
 			if (await handleToolsInvokeHttpRequest(req, res, {
 				auth: resolvedAuth,
 				trustedProxies
 			})) return;
 			if (await handleSlackHttpRequest(req, res)) return;
-			if (handlePluginRequest && await handlePluginRequest(req, res)) return;
+			if (handlePluginRequest) {
+				if (requestPath.startsWith("/api/channels/")) {
+					const token = getBearerToken(req);
+					if (!(await authorizeGatewayConnect({
+						auth: resolvedAuth,
+						connectAuth: token ? {
+							token,
+							password: token
+						} : null,
+						req,
+						trustedProxies
+					})).ok) {
+						sendUnauthorized(res);
+						return;
+					}
+				}
+				if (await handlePluginRequest(req, res)) return;
+			}
 			if (openResponsesEnabled) {
 				if (await handleOpenResponsesHttpRequest(req, res, {
 					auth: resolvedAuth,
@@ -15548,7 +15878,7 @@ function createGatewayHttpServer(opts) {
 				})) return;
 			}
 			if (canvasHost) {
-				if (isCanvasPath(new URL(req.url ?? "/", "http://localhost").pathname)) {
+				if (isCanvasPath(requestPath)) {
 					if (!await authorizeCanvasRequest({
 						req,
 						auth: resolvedAuth,
@@ -15622,7 +15952,7 @@ function createGatewayHooksRequestHandler(params) {
 		if (value.mode === "now") requestHeartbeatNow({ reason: "hook:wake" });
 	};
 	const dispatchAgentHook = (value) => {
-		const sessionKey = value.sessionKey.trim() ? value.sessionKey.trim() : `hook:${randomUUID()}`;
+		const sessionKey = value.sessionKey.trim();
 		const mainSessionKey = resolveMainSessionKeyFromConfig();
 		const jobId = randomUUID();
 		const now = Date.now();
@@ -16614,8 +16944,7 @@ function attachGatewayWsMessageHandler(params) {
 					close(1008, "invalid role");
 					return;
 				}
-				const requestedScopes = Array.isArray(connectParams.scopes) ? connectParams.scopes : [];
-				const scopes = requestedScopes.length > 0 ? requestedScopes : role === "operator" ? ["operator.admin"] : [];
+				const scopes = Array.isArray(connectParams.scopes) ? connectParams.scopes : [];
 				connectParams.role = role;
 				connectParams.scopes = scopes;
 				const isControlUi = connectParams.client.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
@@ -16819,7 +17148,7 @@ function attachGatewayWsMessageHandler(params) {
 						clientId: connectParams.client.id,
 						clientMode: connectParams.client.mode,
 						role,
-						scopes: requestedScopes,
+						scopes,
 						signedAtMs: signedAt,
 						token: connectParams.auth?.token ?? null,
 						nonce: providedNonce || void 0,
@@ -16832,7 +17161,7 @@ function attachGatewayWsMessageHandler(params) {
 							clientId: connectParams.client.id,
 							clientMode: connectParams.client.mode,
 							role,
-							scopes: requestedScopes,
+							scopes,
 							signedAtMs: signedAt,
 							token: connectParams.auth?.token ?? null,
 							version: "v1"
@@ -17681,6 +18010,12 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		logChannels,
 		logBrowser
 	}));
+	{
+		const hookRunner = getGlobalHookRunner();
+		if (hookRunner?.hasHooks("gateway_start")) hookRunner.runGatewayStart({ port }, { port }).catch((err) => {
+			log.warn(`gateway_start hook failed: ${String(err)}`);
+		});
+	}
 	const { applyHotReload, requestGatewayRestart } = createGatewayReloadHandlers({
 		deps,
 		broadcast,
@@ -17743,6 +18078,14 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		httpServers
 	});
 	return { close: async (opts) => {
+		{
+			const hookRunner = getGlobalHookRunner();
+			if (hookRunner?.hasHooks("gateway_stop")) try {
+				await hookRunner.runGatewayStop({ reason: opts?.reason ?? "gateway stopping" }, { port });
+			} catch (err) {
+				log.warn(`gateway_stop hook failed: ${String(err)}`);
+			}
+		}
 		if (diagnosticsEnabled) stopDiagnosticHeartbeat();
 		if (skillsRefreshTimer) {
 			clearTimeout(skillsRefreshTimer);
@@ -17848,6 +18191,8 @@ async function runGatewayLoop(params) {
 		process.removeListener("SIGINT", onSigint);
 		process.removeListener("SIGUSR1", onSigusr1);
 	};
+	const DRAIN_TIMEOUT_MS = 3e4;
+	const SHUTDOWN_TIMEOUT_MS = 5e3;
 	const request = (action, signal) => {
 		if (shuttingDown) {
 			gatewayLog$1.info(`received ${signal} during shutdown; ignoring`);
@@ -17856,13 +18201,23 @@ async function runGatewayLoop(params) {
 		shuttingDown = true;
 		const isRestart = action === "restart";
 		gatewayLog$1.info(`received ${signal}; ${isRestart ? "restarting" : "shutting down"}`);
+		const forceExitMs = isRestart ? DRAIN_TIMEOUT_MS + SHUTDOWN_TIMEOUT_MS : SHUTDOWN_TIMEOUT_MS;
 		const forceExitTimer = setTimeout(() => {
 			gatewayLog$1.error("shutdown timed out; exiting without full cleanup");
 			cleanupSignals();
 			params.runtime.exit(0);
-		}, 5e3);
+		}, forceExitMs);
 		(async () => {
 			try {
+				if (isRestart) {
+					const activeTasks = getActiveTaskCount();
+					if (activeTasks > 0) {
+						gatewayLog$1.info(`draining ${activeTasks} active task(s) before restart (timeout ${DRAIN_TIMEOUT_MS}ms)`);
+						const { drained } = await waitForActiveTasks(DRAIN_TIMEOUT_MS);
+						if (drained) gatewayLog$1.info("all active tasks drained");
+						else gatewayLog$1.warn("drain timeout reached; proceeding with restart");
+					}
+				}
 				await server?.close({
 					reason: isRestart ? "gateway restarting" : "gateway stopping",
 					restartExpectedMs: isRestart ? 1500 : null