create-walle 0.9.25 → 0.9.26

package/template/wall-e/agent.js

@@ -56,6 +56,7 @@ const adapterRegistry = require('./adapters/registry');
 const channelRegistry = require('./channels/registry');
 const { chat: walleChat } = require('./chat');
 const telemetry = require('./telemetry');
+const runtimeHealth = require('./lib/runtime-health');
 const fs = require('fs');
 const path = require('path');
 
@@ -140,6 +141,12 @@ function clampInterval(value, fallback) {
   return Math.max(MIN_INTERVAL_MS, Math.min(MAX_INTERVAL_MS, n));
 }
 
+function clampTimeoutMs(value, fallback) {
+  const n = Number(value);
+  const ms = Number.isFinite(n) && n > 0 ? n : fallback;
+  return Math.max(1000, Math.min(15 * 60 * 1000, Math.trunc(ms)));
+}
+
 function bootstrapSkills() {
   const existing = brain.listSkills({});
   if (existing.length > 0) return; // Already bootstrapped
@@ -302,11 +309,11 @@ async function checkForUpdates() {
 async function main() {
   console.log('[wall-e] Starting WALL-E agent daemon...');
 
-  // Boot profiler — per-phase wall-clock timing so we can SEE where startup time goes
-  // (logged below + surfaced at GET /api/wall-e/boot-profile). brain.initDb() records
-  // its own initDb.* sub-phases into the same profile.
+  // Boot profiler is opt-in developer diagnostics. It is disabled for normal
+  // npx/create-walle users unless WALL_E_RUNTIME_DIAGNOSTICS=1 is set.
   const _bootp = require('./lib/boot-profile');
   const { performance: _perf } = require('perf_hooks');
+  const { eventLoopMonitorEnabled, bootProfileEnabled, flagSnapshot } = require('./lib/diagnostics-flags');
   _bootp.reset();
   let _phaseLast = _perf.now();
   const _phase = (label) => { const n = _perf.now(); _bootp.mark(label, n - _phaseLast); _phaseLast = n; };
@@ -317,10 +324,40 @@ async function main() {
   const config = loadOrCreateConfig();
   _phase('loadConfig');
 
-  // Start the event-loop delay monitor early so a synchronous DB query that wedges the
-  // loop is surfaced in the logs (and on the health endpoint) instead of silently making
-  // the daemon look alive while every HTTP request times out.
-  try { require('./lib/event-loop-monitor').start(); } catch (e) { console.warn('[wall-e] event-loop monitor unavailable:', e.message); }
+  // Wire the shell-permission CTM bridge ONCE at boot so the coding agent (not just
+  // chat) routes run_shell through CTM's unified approver — the user's Permission
+  // tab. Without this the coding path's permission-checker had no _ctmBaseUrl, fell
+  // to its stricter local DEFAULT_RULES, and parked on commands the tab allows
+  // (e.g. `cp`, which the tab allows but local rules default to `ask`). The
+  // permission-checker is a process singleton, so one configure() covers every
+  // entry point; chat.js still re-configures per turn (idempotent + token refresh).
+  // When CTM is unreachable the bridge fails closed to the local rules (no hang).
+  try {
+    const { configure: configurePermissions } = require('./tools/permission-checker');
+    const ctmPort = process.env.CTM_PORT || '3456';
+    configurePermissions({ ctmUrl: `http://localhost:${ctmPort}`, ctmToken: process.env.CTM_TOKEN });
+  } catch (e) { console.warn('[wall-e] permission bridge configure failed:', e.message); }
+
+  if (eventLoopMonitorEnabled()) {
+    // Developer-only monitor: surfaces synchronous DB/I/O stalls without adding
+    // timers/noise to packaged npx installs.
+    try {
+      require('./lib/event-loop-monitor').start({
+        getContext: () => {
+          let scheduler = null;
+          try { scheduler = Scheduler.getInstance()?.getActiveSnapshot?.() || null; } catch {}
+          let runtime = null;
+          try { runtime = runtimeHealth.snapshot({ recentLimit: 5, topLimit: 5 }); } catch {}
+          let workerPool = null;
+          try { workerPool = require('./lib/runtime-worker-pool').getRuntimeWorkerPoolStatus(); } catch {}
+          return { scheduler, runtime_active: runtime?.active || [], worker_pool: workerPool };
+        },
+      });
+    } catch (e) { console.warn('[wall-e] event-loop monitor unavailable:', e.message); }
+  }
+  if (flagSnapshot().runtime_diagnostics) {
+    console.log('[wall-e] Runtime diagnostics enabled:', JSON.stringify(flagSnapshot()));
+  }
 
   // Init database (auto-creates data directory if needed)
   brain.initDb();
@@ -382,8 +419,15 @@ async function main() {
     console.warn('[wall-e] Auth profile setup failed (non-fatal):', err.message);
   }
 
-  // Version check (async, non-blocking) — alert if a newer version is on npm
-  checkForUpdates().catch(() => {});
+  // Version check (async, non-blocking) — alert if a newer version is on npm.
+  // Track it so source/dev restarts can show whether npm/network checks are
+  // competing with the first scheduler ticks.
+  {
+    const op = runtimeHealth.beginOperation('agent.checkForUpdates');
+    checkForUpdates()
+      .then(() => op.end({ ok: true }))
+      .catch((err) => op.end({ ok: false, error: err }));
+  }
 
   // Skill-reference sync (Learn+Reference system) does per-skill filesystem reads + a
   // skill_reference scan of the memories table — hundreds of ms to seconds on a large
@@ -484,6 +528,7 @@ async function main() {
   // Always start HTTP server — WALL-E API should be independently reachable
   const { startServer } = require('./server');
   let httpServer;
+  const startServerOp = runtimeHealth.beginOperation('agent.startServer');
   try {
     const _serverT0 = _perf.now();
     httpServer = startServer();
@@ -491,42 +536,86 @@ async function main() {
     _bootp.mark('startServer(portBind)', _perf.now() - _serverT0);
     _phaseLast = _perf.now();
     _bootp.done();
-    console.log(_bootp.summary());
+    if (bootProfileEnabled()) console.log(_bootp.summary());
+    startServerOp.end({ ok: true });
   } catch (e) {
+    startServerOp.end({ ok: false, error: e });
     console.error('[wall-e] HTTP server failed to start:', e.message);
     process.exit(e && e.code === 'EADDRINUSE' ? 98 : 1);
   }
 
+  const { getRuntimeWorkerPool } = require('./lib/runtime-worker-pool');
+  const { supportedSchedulerWorkerJobs } = require('./lib/scheduler-worker-jobs');
+  const runtimeWorkerPool = getRuntimeWorkerPool();
+  const runRuntimeJob = async (jobName, fallback, options = {}) => {
+    if (runtimeWorkerPool) {
+      try {
+        return await runtimeWorkerPool.request('scheduler.runJob', {
+          jobName,
+          trigger: options.trigger || 'agent',
+          modelOverride: options.modelOverride || null,
+        }, {
+          timeoutMs: options.timeoutMs || 0,
+          heavy: options.heavy !== false,
+          terminateOnTimeout: (options.timeoutMs || 0) > 0,
+        });
+      } catch (err) {
+        console.warn(`[wall-e] Runtime worker job "${jobName}" failed; falling back locally: ${err.message}`);
+      }
+    }
+    return await fallback();
+  };
+
   // Deferred, off the readiness path: heavy/optional init that must not delay port bind +
   // MCP readiness. Runs a few seconds after the server is up (the readiness probe completes
   // first). unref'd so it never holds the process. Sub-phase timings are still captured in
   // the boot profile (the marks append after startServer), so /api/wall-e/boot-profile shows
   // exactly which embeddings sub-step is slow on the live brain.
   setTimeout(() => {
+    (async () => {
     // 1) Embedding subsystem (optional; degrades gracefully — inserts queue for the backfill job)
+    const embeddingsOp = runtimeHealth.beginOperation('agent.deferred.embeddingsInit');
     try {
-      require('./embeddings').init();
+      await runRuntimeJob('deferred:embeddings-init', async () => {
+        require('./embeddings').init();
+        return { ok: true };
+      }, { trigger: 'deferred-init', timeoutMs: 120000 });
+      embeddingsOp.end({ ok: true });
     } catch (e) {
+      embeddingsOp.end({ ok: false, error: e });
       console.log('[wall-e] Embeddings not available:', e.message);
     }
     // 2) One-time temporal-validity backfill (no-op on an already-migrated brain)
+    const temporalOp = runtimeHealth.beginOperation('agent.deferred.temporalBackfill');
     try {
-      const n = brain.backfillTemporalValidity();
+      const temporalResult = await runRuntimeJob('deferred:temporal-backfill', async () => ({
+        rows: brain.backfillTemporalValidity() || 0,
+      }), { trigger: 'deferred-init', timeoutMs: 120000 });
+      const n = temporalResult?.rows || 0;
       if (n > 0) console.log(`[wall-e] Temporal-validity backfill completed (${n} rows, deferred off boot)`);
+      temporalOp.end({ ok: true, meta: { rows: n || 0 } });
     } catch (err) {
+      temporalOp.end({ ok: false, error: err });
       console.warn('[wall-e] Deferred temporal-validity backfill failed (non-fatal):', err.message);
     }
     // 3) Skill-reference sync — deferred off the readiness path (was on the boot path,
     //    where its filesystem reads + skill_reference scan delayed HTTP port bind).
+    const skillRefOp = runtimeHealth.beginOperation('agent.deferred.skillReferenceSync');
     try {
-      const { syncSkillReferences, checkImportedSkillUpdates } = require('./skills/claude-code-reader');
-      const refResult = syncSkillReferences();
+      const refResult = await runRuntimeJob('deferred:skill-reference-sync', async () => {
+        const { syncSkillReferences, checkImportedSkillUpdates } = require('./skills/claude-code-reader');
+        const syncResult = syncSkillReferences();
+        const updates = checkImportedSkillUpdates();
+        return { synced: syncResult.synced || 0, updates: updates.length || 0, updateNames: updates.map(u => u.name + '(' + u.action + ')') };
+      }, { trigger: 'deferred-init', timeoutMs: 120000 });
       if (refResult.synced > 0) console.log(`[wall-e] Synced ${refResult.synced} skill references to brain (deferred off boot)`);
-      const updates = checkImportedSkillUpdates();
-      if (updates.length > 0) console.log(`[wall-e] Imported skill updates: ${updates.map(u => u.name + '(' + u.action + ')').join(', ')}`);
+      if (refResult.updates > 0 && Array.isArray(refResult.updateNames)) console.log(`[wall-e] Imported skill updates: ${refResult.updateNames.join(', ')}`);
+      skillRefOp.end({ ok: true, meta: { synced: refResult.synced || 0, updates: refResult.updates || 0 } });
     } catch (e) {
+      skillRefOp.end({ ok: false, error: e });
       console.warn('[wall-e] Skill reference sync error:', e.message);
     }
+    })().catch((e) => console.warn('[wall-e] Deferred runtime init failed:', e.message));
   }, 2000).unref?.();
 
   // Slack Socket Mode is optional and event-driven. It only starts when an
@@ -556,33 +645,59 @@ async function main() {
 
   // Initial ingest (wrapped — must not crash the daemon)
   let ingestResult = { memoriesIngested: 0 };
+  const initialIngestOp = runtimeHealth.beginOperation('agent.initialIngest');
   try {
     console.log('[wall-e] Running initial ingest...');
-    ingestResult = await ingest.runOnce(adapters);
+    ingestResult = await runRuntimeJob('ingest', () => ingest.runOnce(adapters), {
+      trigger: 'initial-ingest',
+      timeoutMs: 120000,
+    });
     console.log(`[wall-e] Initial ingest: ${ingestResult.memoriesIngested} memories`);
     if (ingestResult.memoriesIngested > 0) {
       telemetry.track('ingest', { memories: ingestResult.memoriesIngested, initial: true });
       telemetry.trackFunnelStep('first_ingest');
     }
+    initialIngestOp.end({ ok: true, meta: { memoriesIngested: ingestResult.memoriesIngested || 0 } });
   } catch (e) {
+    initialIngestOp.end({ ok: false, error: e });
     console.error('[wall-e] Initial ingest failed (non-fatal):', e.message);
   }
 
   // Initial think (wrapped — must not crash the daemon)
   if (ingestResult.memoriesIngested > 0) {
+    const initialThinkOp = runtimeHealth.beginOperation('agent.initialThink');
     try {
       console.log('[wall-e] Running initial think...');
-      const thinkResult = await think.runOnce();
+      const thinkResult = await runRuntimeJob('think', () => think.runOnce(), {
+        trigger: 'initial-think',
+        timeoutMs: 120000,
+      });
       console.log(`[wall-e] Initial think: ${thinkResult.memoriesProcessed} processed, ${thinkResult.knowledgeExtracted} knowledge`);
+      initialThinkOp.end({
+        ok: true,
+        meta: {
+          memoriesProcessed: thinkResult.memoriesProcessed || 0,
+          knowledgeExtracted: thinkResult.knowledgeExtracted || 0,
+        },
+      });
     } catch (e) {
+      initialThinkOp.end({ ok: false, error: e });
       console.error('[wall-e] Initial think failed (non-fatal):', e.message);
     }
   }
 
   // --- Central Scheduler ---
+  const schedulerDefaultWorkerTimeoutMs = clampTimeoutMs(
+    process.env.WALL_E_SCHEDULER_WORKER_TIMEOUT_MS ?? process.env.WALLE_SCHEDULER_WORKER_TIMEOUT_MS,
+    180000
+  );
   const scheduler = new Scheduler({
     tickMs: 5000,
     pools: { llm: 2, ollama: 1, embedding: 1, io: 3 },
+    workerPool: runtimeWorkerPool,
+    workerJobs: supportedSchedulerWorkerJobs(),
+    defaultWorkerJobTimeoutMs: schedulerDefaultWorkerTimeoutMs,
+    closeWorkerPoolOnShutdown: true,
     shutdownTimeoutMs: 5000,
     // Failure-alert: after 2 consecutive errors on a single job (with 1h
     // cooldown), write a Service Alert that the CTM Wall-E tab surfaces.
@@ -1087,6 +1202,7 @@ async function main() {
   // its instructions. Best-effort; never crashes the daemon. Borrowed from
   // OpenClaw's gateway/boot.ts. Runs BEFORE scheduler.start() so the user's
   // contract is honored before the recurring loops fire.
+  const bootCheckOp = runtimeHealth.beginOperation('agent.bootCheck');
   try {
     const { runBootCheck } = require('./loops/boot');
     const bootResult = await runBootCheck();
@@ -1103,7 +1219,9 @@ async function main() {
       console.warn(`[wall-e] BOOT.md run failed: ${bootResult.reason}${bootResult.error ? ' — ' + bootResult.error : ''}`);
       telemetry.track('boot_check', { status: 'failed', reason: bootResult.reason });
     }
+    bootCheckOp.end({ ok: bootResult.status !== 'failed', meta: { status: bootResult.status || 'unknown' } });
   } catch (e) {
+    bootCheckOp.end({ ok: false, error: e });
     console.error('[wall-e] BOOT.md run threw (non-fatal):', e.message);
     telemetry.trackError('boot_check', e);
   }
@@ -1112,6 +1230,7 @@ async function main() {
   // while the daemon was down. Cap of 5 immediate runs (5s stagger);
   // anything beyond that is deferred to the periodic tick. Borrowed
   // from OpenClaw's runMissedJobs (src/cron/service/timer.ts:962-1040).
+  const restartCatchupOp = runtimeHealth.beginOperation('agent.restartCatchup');
   try {
     const catchup = await scheduler.runMissedJobs();
     if (catchup.ran > 0 || catchup.deferred > 0) {
@@ -1123,7 +1242,9 @@ async function main() {
         deferred: catchup.deferred,
       });
     }
+    restartCatchupOp.end({ ok: true, meta: { ran: catchup.ran || 0, deferred: catchup.deferred || 0 } });
   } catch (e) {
+    restartCatchupOp.end({ ok: false, error: e });
     console.warn('[wall-e] runMissedJobs threw (non-fatal):', e.message);
   }
 

package/template/wall-e/api-walle.js

@@ -382,6 +382,14 @@ function parseTelemetryOffset(value) {
   return Math.max(parseInt(value, 10) || 0, 0);
 }
 
+function telemetryParamEnabled(params, names) {
+  for (const name of names) {
+    const raw = String(params.get(name) || '').trim().toLowerCase();
+    if (raw === '1' || raw === 'true' || raw === 'yes' || raw === 'full') return true;
+  }
+  return false;
+}
+
 function telemetryAdminAuth(params) {
   const secret = process.env.WALLE_TELEMETRY_SECRET;
   if (!secret) return { ok: false, status: 503, error: 'Telemetry admin secret not configured' };
@@ -591,6 +599,56 @@ function telemetryEventsByTypeSince(tdb, since) {
   `).all(since, String(since || '').slice(0, 10));
 }
 
+function telemetrySanitizeDiagnosticText(value, max = 220) {
+  return String(value || 'unknown')
+    .replace(/https?:\/\/\S+/g, '[url]')
+    .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/ig, '[email]')
+    .replace(/\/Users\/[^\s:"']+/g, '<path>')
+    .replace(/\/private\/tmp\/[^\s:"']+/g, '<tmp>')
+    .replace(/\bpid=\d+/g, 'pid=<pid>')
+    .replace(/[0-9a-f]{8}-[0-9a-f-]{27,}/ig, '<id>')
+    .slice(0, max);
+}
+
+function telemetryErrorGroupsSince(tdb, since, limit = 20) {
+  const rows = tdb.prepare(`
+    SELECT version, meta
+    FROM telemetry_events
+    WHERE event = 'error' AND received_at >= ?
+    ORDER BY received_at DESC
+    LIMIT 500
+  `).all(since);
+  const groups = new Map();
+  for (const row of rows) {
+    let meta = {};
+    try { meta = row.meta ? JSON.parse(row.meta) : {}; } catch { meta = { message: row.meta }; }
+    const message = telemetrySanitizeDiagnosticText(meta.message || meta.error || meta.type || 'unknown');
+    const source = telemetrySanitizeDiagnosticText(meta.source || 'unknown', 80);
+    const key = `${message}\n${source}`;
+    const current = groups.get(key) || {
+      message,
+      source,
+      count: 0,
+      versions: new Set(),
+      skills: new Set(),
+    };
+    current.count += 1;
+    if (row.version) current.versions.add(String(row.version).slice(0, 80));
+    if (meta.skill) current.skills.add(telemetrySanitizeDiagnosticText(meta.skill, 80));
+    groups.set(key, current);
+  }
+  return Array.from(groups.values())
+    .sort((a, b) => b.count - a.count || a.message.localeCompare(b.message))
+    .slice(0, limit)
+    .map((row) => ({
+      message: row.message,
+      source: row.source,
+      count: row.count,
+      versions: Array.from(row.versions).sort(),
+      skills: Array.from(row.skills).sort(),
+    }));
+}
+
 function telemetrySetIntersectionSize(left, right) {
   let count = 0;
   for (const value of left || []) {
@@ -1539,7 +1597,34 @@ function handleWalleApi(req, res, url) {
   if (p === '/api/wall-e/health' && m === 'GET') {
     let eventLoop = { enabled: false };
     try { eventLoop = require('./lib/event-loop-monitor').stats(); } catch {}
-    return jsonResponse(res, { status: 'ok', uptime: process.uptime(), version: '0.1.0', event_loop: eventLoop }), true;
+    let runtime = null;
+    try { runtime = require('./lib/runtime-health').snapshot({ recentLimit: 5, topLimit: 10 }); } catch {}
+    let diagnostics = null;
+    try { diagnostics = require('./lib/diagnostics-flags').flagSnapshot(); } catch {}
+    let scheduler = null;
+    try {
+      const { Scheduler } = require('./lib/scheduler');
+      const sched = Scheduler.getInstance();
+      scheduler = sched ? sched.getMetrics({ jobLimit: 10 }) : { enabled: false, running: false };
+    } catch {}
+    let brainWriter = null;
+    try { brainWriter = brain?.getOwnerWriteQueueStatus?.() || null; } catch {}
+    let readiness = null;
+    try {
+      const { getServiceReadiness } = require('./lib/service-readiness');
+      readiness = getServiceReadiness({ eventLoop, runtime, brainWriter });
+    } catch {}
+    return jsonResponse(res, {
+      status: 'ok',
+      uptime: process.uptime(),
+      version: '0.1.0',
+      diagnostics,
+      event_loop: eventLoop,
+      runtime,
+      scheduler,
+      brain_writer: brainWriter,
+      readiness,
+    }), true;
   }
 
   // GET /api/wall-e/alerts — service alerts (auth failures, skill disabled, update available)
@@ -1548,6 +1633,7 @@ function handleWalleApi(req, res, url) {
       res.setHeader('Cache-Control', 'no-store, max-age=0');
       const { getServiceAlerts } = require('./skills/skill-planner');
       const { buildServiceHealth } = require('./lib/service-health');
+      const { getProviderHealthStatus } = require('./llm/provider-health-state');
       const alerts = getServiceAlerts({ includeVersionUpdate: true });
       let activeProvider = process.env.WALLE_PROVIDER || '';
       let activeModel = process.env.WALLE_MODEL || '';
@@ -1558,6 +1644,7 @@ function handleWalleApi(req, res, url) {
       const summary = buildServiceHealth(alerts, {
         activeProvider,
         activeModel,
+        providerStatus: getProviderHealthStatus(activeProvider, activeModel),
       });
       return jsonResponse(res, { alerts, summary }), true;
     } catch (e) {
@@ -1761,7 +1848,11 @@ function handleWalleApi(req, res, url) {
   if (p.startsWith('/api/wall-e/alerts/') && m === 'DELETE') {
     try {
       const alertId = decodeURIComponent(p.split('/api/wall-e/alerts/')[1]);
-      if (alertId === 'version_update') {
+      if (alertId.startsWith('provider_status:')) {
+        const { clearProviderHealthStatus, parseProviderStatusIssueId } = require('./llm/provider-health-state');
+        const target = parseProviderStatusIssueId(alertId);
+        if (target) clearProviderHealthStatus(target);
+      } else if (alertId === 'version_update') {
         try {
           const telemetry = require('./telemetry');
           const updateRaw = brain.getKv('update_available');
@@ -1802,6 +1893,7 @@ function handleWalleApi(req, res, url) {
       tickMs: sched._tickMs,
       jobs: sched.getState(),
       pools: sched.getPoolState(),
+      metrics: sched.getMetrics(),
     }), true;
   }
 
@@ -2507,10 +2599,12 @@ function handleWalleApi(req, res, url) {
     try {
       const { getServiceAlerts } = require('./skills/skill-planner');
       const { buildServiceHealth } = require('./lib/service-health');
+      const { getProviderHealthStatus } = require('./llm/provider-health-state');
       serviceAlerts = getServiceAlerts({ includeVersionUpdate: true });
       serviceAlertSummary = buildServiceHealth(serviceAlerts, {
         activeProvider: walleProvider,
         activeModel: walleModel,
+        providerStatus: getProviderHealthStatus(walleProvider, walleModel),
       });
     } catch {}
 
@@ -2520,6 +2614,23 @@ function handleWalleApi(req, res, url) {
       slackSocketMode = getSlackSocketModeStatus();
     } catch {}
 
+    let eventLoop = { enabled: false };
+    try { eventLoop = require('./lib/event-loop-monitor').stats(); } catch {}
+    let runtime = null;
+    try { runtime = require('./lib/runtime-health').snapshot({ recentLimit: 10, topLimit: 20 }); } catch {}
+    let brainWriter = null;
+    try { brainWriter = brain?.getOwnerWriteQueueStatus?.() || null; } catch {}
+    let readiness = null;
+    try {
+      const { getServiceReadiness } = require('./lib/service-readiness');
+      readiness = getServiceReadiness({
+        eventLoop,
+        runtime,
+        brainWriter,
+        serviceHealth: serviceAlertSummary,
+      });
+    } catch {}
+
     return jsonResponse(res, {
       data: {
         ...result,
@@ -2538,6 +2649,10 @@ function handleWalleApi(req, res, url) {
         service_alerts: serviceAlerts,
         service_alert_summary: serviceAlertSummary,
         slack_socket_mode: slackSocketMode,
+        event_loop: eventLoop,
+        runtime,
+        brain_writer: brainWriter,
+        readiness,
       }
     }), true;
   }
@@ -5909,6 +6024,7 @@ function handleWalleApi(req, res, url) {
     }
     const days = parseTelemetryDays(params.get('days'), 30);
     const since = telemetrySinceDateTime(days);
+    const includeIdentifiers = telemetryParamEnabled(params, ['full', 'include_identifiers', 'identifiers', 'debug']);
     const dailyActivityDays = Math.min(days, 7);
     const dailyActivitySince = telemetrySinceDateTime(dailyActivityDays);
     const stableIdentitySql = "CASE WHEN machine_bucket IS NOT NULL AND machine_bucket != '' THEN 'm:' || machine_bucket ELSE 'i:' || install_id END";
@@ -5939,15 +6055,10 @@ function handleWalleApi(req, res, url) {
       unique_ips: tdb.prepare(
         "SELECT count(DISTINCT ip) as cnt FROM telemetry_installs WHERE ip IS NOT NULL AND ip != ''"
       ).get().cnt,
-      ip_breakdown: tdb.prepare(
-        "SELECT ip, count(*) as installs, group_concat(install_id) as install_ids FROM telemetry_installs WHERE ip IS NOT NULL AND ip != '' GROUP BY ip ORDER BY installs DESC"
-      ).all(),
-      owner_hash_breakdown: tdb.prepare(
-        "SELECT owner_name_hash, count(*) as installs, max(last_seen) as last_seen FROM telemetry_installs WHERE owner_name_hash IS NOT NULL AND owner_name_hash != '' GROUP BY owner_name_hash ORDER BY installs DESC LIMIT 100"
-      ).all(),
-      recent_errors: tdb.prepare(
-        "SELECT install_id, version, meta, received_at FROM telemetry_events WHERE event = 'error' AND received_at >= ? ORDER BY received_at DESC LIMIT 50"
-      ).all(since),
+      unique_owner_hashes: tdb.prepare(
+        "SELECT count(DISTINCT owner_name_hash) as cnt FROM telemetry_installs WHERE owner_name_hash IS NOT NULL AND owner_name_hash != ''"
+      ).get().cnt,
+      error_groups: telemetryErrorGroupsSince(tdb, since),
       daily_activity: tdb.prepare(
         `SELECT date(te.received_at) as day, count(DISTINCT ${eventStableIdentitySql}) as users, count(*) as events
          FROM telemetry_events te
@@ -5955,7 +6066,22 @@ function handleWalleApi(req, res, url) {
          WHERE te.received_at >= ?
          GROUP BY day ORDER BY day DESC LIMIT ?`
       ).all(dailyActivitySince, dailyActivityDays),
+      privacy: {
+        identifiers: includeIdentifiers ? 'included' : 'omitted',
+        full: includeIdentifiers,
+      },
     };
+    if (includeIdentifiers) {
+      summary.ip_breakdown = tdb.prepare(
+        "SELECT ip, count(*) as installs, group_concat(install_id) as install_ids FROM telemetry_installs WHERE ip IS NOT NULL AND ip != '' GROUP BY ip ORDER BY installs DESC LIMIT 100"
+      ).all();
+      summary.owner_hash_breakdown = tdb.prepare(
+        "SELECT owner_name_hash, count(*) as installs, max(last_seen) as last_seen FROM telemetry_installs WHERE owner_name_hash IS NOT NULL AND owner_name_hash != '' GROUP BY owner_name_hash ORDER BY installs DESC LIMIT 100"
+      ).all();
+      summary.recent_errors = tdb.prepare(
+        "SELECT install_id, version, meta, received_at FROM telemetry_events WHERE event = 'error' AND received_at >= ? ORDER BY received_at DESC LIMIT 50"
+      ).all(since);
+    }
     summary.install_machine_ratio = summary.unique_machines > 0
       ? Math.round(summary.total_install_ids / summary.unique_machines * 100) / 100
       : null;
@@ -5968,18 +6094,23 @@ function handleWalleApi(req, res, url) {
       summary.feedback_by_status = tdb.prepare(
         'SELECT status, count(*) as cnt FROM feedback_reports WHERE received_at >= ? GROUP BY status ORDER BY cnt DESC'
       ).all(since);
-      summary.recent_feedback = tdb.prepare(`
-        SELECT feedback_id, type, status, severity, title, consent_level, version, received_at
-        FROM feedback_reports
-        WHERE received_at >= ?
-        ORDER BY received_at DESC
-        LIMIT 20
-      `).all(since);
+      if (includeIdentifiers) {
+        summary.recent_feedback = tdb.prepare(`
+          SELECT feedback_id, type, status, severity, title, consent_level, version, received_at
+          FROM feedback_reports
+          WHERE received_at >= ?
+          ORDER BY received_at DESC
+          LIMIT 20
+        `).all(since);
+      } else {
+        summary.recent_feedback_omitted = true;
+      }
     } catch {
       summary.feedback_count = 0;
       summary.feedback_by_type = [];
       summary.feedback_by_status = [];
-      summary.recent_feedback = [];
+      if (includeIdentifiers) summary.recent_feedback = [];
+      else summary.recent_feedback_omitted = true;
     }
 
     try {
@@ -6655,10 +6786,24 @@ function handleWalleApi(req, res, url) {
     }
   }
 
+  // POST /api/wall-e/permissions/reevaluate — re-check parked requests against the
+  // current rules and auto-resolve any now-allowed. CTM calls this after adding an
+  // allow rule (Pending-tab whitelist) so a matching park self-heals without a
+  // poller. Must precede the /:id/reply matcher (which would otherwise swallow it).
+  if (p === '/api/wall-e/permissions/reevaluate' && m === 'POST') {
+    readBody(req).then(body => {
+      const sessionId = body.session_id || body.sessionId || '';
+      Promise.resolve(_permissionRegistry.reEvaluatePending({ sessionId }))
+        .then(() => jsonResponse(res, { ok: true }))
+        .catch(e => jsonResponse(res, { error: e.message }, 500));
+    }).catch(e => jsonResponse(res, { error: e.message }, 500));
+    return true;
+  }
+
   // POST /api/wall-e/permissions/:id/reply — reply once/always/reject
   const permissionReplyMatch = p.match(/^\/api\/wall-e\/permissions\/([^/]+)\/reply$/);
   if (permissionReplyMatch && m === 'POST') {
-    readBody(req).then(body => {
+    readBody(req).then(async body => {
       const reply = body.reply || body.decision;
       if (!['once', 'always', 'reject'].includes(reply)) {
         return jsonResponse(res, { error: 'reply must be once, always, or reject' }, 400);
@@ -6668,8 +6813,42 @@ function handleWalleApi(req, res, url) {
         reply,
         message: body.message || '',
       });
-      if (!ok) return jsonResponse(res, { error: 'Permission request not found' }, 404);
-      jsonResponse(res, { ok: true });
+      // A live parked turn accepted the reply -> it resumes immediately.
+      if (ok) return jsonResponse(res, { ok: true, resumed: true });
+
+      // ORPHANED: the parked request is gone (Wall-E restart, the turn already
+      // ended, or a card rehydrated from history). The original turn cannot be
+      // resumed here. If the user chose "always", persist a durable rule derived
+      // from the command so a FRESH continuation turn (started by CTM) won't
+      // re-park on the same command. (CTM starts that turn; this just makes it
+      // clean.) The rule store is brain-KV backed -> shared with the orchestrator's
+      // permission checker and survives restart.
+      let ruleAdded = false;
+      if (reply === 'always' && body.command) {
+        try {
+          const { buildToolPermissionRequests } = require('./coding/permission-service');
+          const requests = await buildToolPermissionRequests(
+            body.tool || 'run_shell',
+            { command: body.command },
+            { cwd: body.projectRoot || '', projectRoot: body.projectRoot || '' },
+          );
+          for (const r of requests) {
+            _permissionRegistry.rulesStore.addAlways({
+              projectRoot: r.projectRoot,
+              permission: r.permission,
+              pattern: r.pattern,
+              tool: r.tool,
+              fingerprint: r.fingerprint,
+            });
+            ruleAdded = true;
+          }
+          // The new rule may also cover OTHER still-parked requests.
+          if (ruleAdded) await _permissionRegistry.reEvaluatePending({});
+        } catch (e) {
+          console.error('[walle-permission] orphan rule-add failed:', e.message);
+        }
+      }
+      return jsonResponse(res, { ok: false, resumed: false, orphaned: true, ruleAdded }, ruleAdded ? 200 : 404);
     }).catch(e => jsonResponse(res, { error: e.message }, 500));
     return true;
   }