direxio-deployer 0.1.1 → 0.1.3

package/AGENTS.md

@@ -42,7 +42,7 @@ If a change writes a path into `state.json`, `credentials.json`, `env`, `cc-conn
 ## Direxio Connect Wiring
 
 - S5/S6 must fail closed when `agent_room_id` is missing or uses a legacy pseudo id such as `!agent:<domain>`.
-- S6 must create a Matrix session through `agent.matrix_session.create` and require `@agent:<server>` for the bridge. Returning `@owner:<server>` is a server-side compatibility failure.
+- S6 must create a Matrix session through `agent.matrix_session.create` using `agent_token`, not owner `access_token`, and require `@agent:<server>` for the bridge. Returning `@owner:<server>` is a server-side compatibility failure.
 - The generated cc-connect config must contain one Matrix platform and must restrict sync/replies to the real `agent_room_id`.
 - The generated agent config must preserve the selected connect agent type and optional agent-specific TOML. Some providers require more than `cmd`; for example `reasonix` needs `serve_url`, `tmux` needs `session`, and generic `acp` may need command/args.
 - `DIREXIO_AGENT_INSTALL=auto` may install/start `direxio-connect`; `recommend` must only write files and print commands.

package/README.md

@@ -23,6 +23,14 @@ Install the deployer skill from npm, then place it into the current agent runtim
 
 The GitHub repository keeps tests for maintainers and CI, but the published npm package and installed skill copy exclude `tests/` to keep user installs small.
 
+If you want Codex to install and deploy in one instruction, do not say "install skills <GitHub URL>". That triggers GitHub skill installation and can place the skill in the global `~/.codex` directory. Use a short instruction that tells the agent to read this README's npm/project-local install rule:
+
+```text
+Follow the direxio-deployer README npm/project-local install rule, then deploy Direxio with domain __DOMAIN__.
+```
+
+After reading this instruction, the agent should run the npm install commands below; it should not switch to a GitHub skill installer.
+
 POSIX shells:
 
 ```bash
@@ -53,7 +61,7 @@ direxio-deployer skill install --agent codex --scope global
 The installer writes `.direxio-skill-install.json` into the target directory and refuses to overwrite unmanaged existing content unless `--force` is provided. To pin a version, install that package version first:
 
 ```bash
-npm install -g direxio-deployer@0.1.1
+npm install -g direxio-deployer@0.1.3
 direxio-deployer skill update --agent codex --scope project --project .
 ```
 
@@ -120,7 +128,7 @@ bash scripts/orchestrate.sh
 ```
 
 Supported install modes: `recommended` and `cc-connect`.
-If `DIREXIO_AGENT_PLATFORM=auto` cannot identify a single supported runtime, set `DIREXIO_CC_CONNECT_AGENT` explicitly. For OpenClaw or Hermes defaults, force the host runtime with `DIREXIO_AGENT_PLATFORM=openclaw` or `DIREXIO_AGENT_PLATFORM=hermes`; setting only `DIREXIO_CC_CONNECT_AGENT=acp` selects generic ACP and requires manual options. For OpenClaw Gateway ACP, set `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION` from the current OpenClaw runtime after pairing. Use `DIREXIO_OPENCLAW_ACP_ARGS_TOML` only when you need to provide the complete OpenClaw ACP args array yourself. Use `DIREXIO_HERMES_ACP_ARGS_TOML` for the child Hermes args; S6 prefixes the `hermes-acp-adapter -- <hermes-command>` wrapper automatically.
+If `DIREXIO_AGENT_PLATFORM=auto` cannot identify a single supported runtime, set `DIREXIO_CC_CONNECT_AGENT` explicitly. For OpenClaw or Hermes defaults, force the host runtime with `DIREXIO_AGENT_PLATFORM=openclaw` or `DIREXIO_AGENT_PLATFORM=hermes`; setting only `DIREXIO_CC_CONNECT_AGENT=acp` selects generic ACP and requires manual options. OpenClaw Gateway ACP defaults to `["acp", "--session", "agent:main:main"]` and lets `openclaw acp` auto-detect the Gateway from `~/.openclaw/openclaw.json`. To force explicit Gateway settings, set all of `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION` from the current OpenClaw runtime after pairing. Use `DIREXIO_OPENCLAW_ACP_ARGS_TOML` only when you need to provide the complete OpenClaw ACP args array yourself. Use `DIREXIO_HERMES_ACP_ARGS_TOML` for the child Hermes args; S6 prefixes the `hermes-acp-adapter -- <hermes-command>` wrapper automatically.
 
 Check status:
 

package/README_zh.md

@@ -21,6 +21,14 @@
 
 GitHub 仓库保留测试用于维护和 CI，但发布到 npm 的包以及安装到智能体 skill 目录的副本不包含 `tests/`，以减小用户安装体积。
 
+如果你想让 Codex 一句话安装并开始部署，不要说“安装 skills <GitHub 链接>”。那会触发 GitHub skill 安装器，容易安装到全局 `~/.codex`。推荐只说短句，让 agent 先读本 README 中的 npm/project-local 安装规则：
+
+```text
+请按 direxio-deployer README 的 npm/project-local 规则安装 skill，然后部署 Direxio，域名 __DOMAIN__。
+```
+
+Agent 读到这句后应执行下方 npm 安装命令；不要改用 GitHub skill installer。
+
 POSIX shell：
 
 ```bash
@@ -51,7 +59,7 @@ direxio-deployer skill install --agent codex --scope global
 安装器会在目标目录写入 `.direxio-skill-install.json`，并拒绝覆盖没有该 manifest 的既有目录，除非显式传入 `--force`。如需固定版本，先安装指定 npm 版本：
 
 ```bash
-npm install -g direxio-deployer@0.1.1
+npm install -g direxio-deployer@0.1.3
 direxio-deployer skill update --agent codex --scope project --project .
 ```
 
@@ -117,7 +125,7 @@ bash scripts/orchestrate.sh
 ```
 
 可选安装模式：`recommended`、`cc-connect`。
-如果 `DIREXIO_AGENT_PLATFORM=auto` 无法唯一识别当前运行时，显式设置 `DIREXIO_CC_CONNECT_AGENT`。需要触发 OpenClaw 或 Hermes 默认配置时，设置 `DIREXIO_AGENT_PLATFORM=openclaw` 或 `DIREXIO_AGENT_PLATFORM=hermes`；只设置 `DIREXIO_CC_CONNECT_AGENT=acp` 会进入通用 ACP，需要手动提供 options。OpenClaw Gateway ACP 必须在完成 pairing 后，从当前 OpenClaw runtime 填写 `DIREXIO_OPENCLAW_ACP_URL`、`DIREXIO_OPENCLAW_ACP_TOKEN_FILE` 和 `DIREXIO_OPENCLAW_ACP_SESSION`。只有需要完整覆盖 OpenClaw ACP args 数组时才使用 `DIREXIO_OPENCLAW_ACP_ARGS_TOML`；Hermes 自定义参数用 `DIREXIO_HERMES_ACP_ARGS_TOML`，S6 会自动在前面加上 `hermes-acp-adapter -- <hermes-command>`。
+如果 `DIREXIO_AGENT_PLATFORM=auto` 无法唯一识别当前运行时，显式设置 `DIREXIO_CC_CONNECT_AGENT`。需要触发 OpenClaw 或 Hermes 默认配置时，设置 `DIREXIO_AGENT_PLATFORM=openclaw` 或 `DIREXIO_AGENT_PLATFORM=hermes`；只设置 `DIREXIO_CC_CONNECT_AGENT=acp` 会进入通用 ACP，需要手动提供 options。OpenClaw Gateway ACP 默认写入 `["acp", "--session", "agent:main:main"]`，让 `openclaw acp` 从 `~/.openclaw/openclaw.json` 自动发现 Gateway。需要强制指定 Gateway 时，完成 pairing 后从当前 OpenClaw runtime 同时填写 `DIREXIO_OPENCLAW_ACP_URL`、`DIREXIO_OPENCLAW_ACP_TOKEN_FILE` 和 `DIREXIO_OPENCLAW_ACP_SESSION`。只有需要完整覆盖 OpenClaw ACP args 数组时才使用 `DIREXIO_OPENCLAW_ACP_ARGS_TOML`；Hermes 自定义参数用 `DIREXIO_HERMES_ACP_ARGS_TOML`，S6 会自动在前面加上 `hermes-acp-adapter -- <hermes-command>`。
 
 查看状态：
 

package/SKILL.md

@@ -207,6 +207,18 @@ Step-by-step onboarding flow:
    - Give a short billing warning before the first mutating AWS command:
      "This will create paid AWS resources for the server. They keep billing
      until destroyed."
+   - When AWS CLI is available after credentials are verified, make a best
+     effort Free Tier account-plan check:
+     ```bash
+     aws freetier get-account-plan-state --output json
+     ```
+     If it returns `accountPlanRemainingCredits`, mention the remaining credit
+     amount and expiration without treating it as a guarantee. If the command
+     is unavailable or fails, use the fixed wording: "AWS currently advertises
+     100 USD initial credits for new customer accounts, plus possible
+     additional credits after completing Free Tier activities. These credits
+     may cover a small trial deployment, but coverage is account-specific and
+     must be verified in AWS Billing Console."
    - **Provide an upfront monthly cost estimate** based on the selected
      region and instance type, so the user can decide whether to proceed.
      `scripts/orchestrate.sh` records `cost_estimate` in state before the
@@ -252,10 +264,15 @@ Step-by-step onboarding flow:
    - If the user asks what is billed, mention EC2/server, fixed public IPv4 or
      Elastic IP, storage, DNS, network traffic, and call relay traffic.
 
-Required first-time deployment confirmation:
+Required first-time deployment confirmation. Fill in the concrete domain,
+profile, and region, and include the Free Tier sentence immediately before the
+confirmation line:
 
 ```text
-I confirm that I have an active AWS account, a real long-lived domain, and an AWS access key CSV or AWS profile for this deployment. I understand this can create billable AWS resources and that they keep billing until destroyed.
+Please confirm before I deploy. AWS new customer accounts may have Free Tier credits, currently advertised as 100 USD initial credits plus possible additional credits; these credits may cover a small trial deployment, but actual coverage must be verified in AWS Billing Console.
+
+Reply with this exact sentence:
+I confirm that I have an active AWS account, the long-lived domain <domain>, and authorize the current <profile-or-identity> AWS profile in <region> to create the Direxio service. I understand this can create billable AWS resources, credits are not guaranteed to cover all usage, and resources keep billing until destroyed.
 ```
 
 If any prerequisite is missing, stop deployment and guide the user through that
@@ -280,6 +297,13 @@ Lightsail is a future deployment mode, not a current automatic option. Lightsail
 
 When the user asks to install or update this skill itself, or asks to wire Direxio into a local agent runtime, read `references/agent-targets.md` first. It is the source of truth for connent/connect agent targets, legacy host-runtime aliases, generic targets, and unknown targets.
 
+If the user says "install skills" and includes the GitHub repository URL
+`YingSuiAI/direxio-deployer`, do not use a generic GitHub skill installer for
+normal deployment use. First install the npm package and then run
+`direxio-deployer skill install --agent <runtime> --scope project --project
+<project-root>`. Use a Git clone only when the user explicitly asks for
+deployer development or local patching.
+
 For this skill repository itself, first determine whether the current working directory belongs to a project or workspace. Treat an explicit workspace root, project files, or an existing agent-specific directory such as `.codex/`, `.claude/`, `.gemini/`, `.cursor/`, `.github/copilot/`, `.devin/`, `.opencode/`, `.qoder/`, `.pi/`, `.openclaw/`, or `.hermes/` as a project target.
 
 If a project target exists, install or update this skill with the versioned npm CLI at the runtime-specific project-local path from `references/agent-targets.md`:
@@ -316,9 +340,9 @@ Post-deploy agent wiring is controlled by:
 ```bash
 DIREXIO_AGENT_PLATFORM=auto
 DIREXIO_CC_CONNECT_AGENT=<optional connect agent>
-DIREXIO_OPENCLAW_ACP_URL=<required for OpenClaw gateway URL>
-DIREXIO_OPENCLAW_ACP_TOKEN_FILE=<required for OpenClaw gateway token file>
-DIREXIO_OPENCLAW_ACP_SESSION=<required for OpenClaw ACP session>
+DIREXIO_OPENCLAW_ACP_URL=<optional explicit OpenClaw gateway URL>
+DIREXIO_OPENCLAW_ACP_TOKEN_FILE=<optional explicit OpenClaw gateway token file>
+DIREXIO_OPENCLAW_ACP_SESSION=<optional OpenClaw ACP session; defaults to agent:main:main>
 DIREXIO_AGENT_INSTALL=recommend
 DIREXIO_AGENT_INSTALL_MODE=recommended
 ```
@@ -327,11 +351,11 @@ The only supported local conversation bridge is `direxio-connect`, installed fro
 
 The local MCP tool surface is `direxio-mcp`, installed from `direxio-mcp@latest` by default. S6 writes `mcp/codex.toml`, `mcp/openclaw.md`, `mcp/openclaw-server.json`, `mcp/hermes.mcp.json`, `mcp/mcp-servers.json`, and `mcp/env`; these artifacts point to `credentials.json` by `DIREXIO_CREDENTIALS_FILE`. OpenClaw must be configured through the generated `openclaw mcp set` command in `mcp/openclaw.md`; do not paste MCP JSON into `~/.openclaw/openclaw.json`. Keep this separate from cc-connect: cc-connect must use its direct Matrix config and must not use `DIREXIO_CREDENTIALS_FILE`.
 
-`DIREXIO_CC_CONNECT_AGENT` is the preferred explicit selector. Supported values match connent/connect: `acp`, `antigravity`, `claudecode`, `codex`, `copilot`, `cursor`, `devin`, `gemini`, `iflow`, `kimi`, `opencode`, `pi`, `qoder`, `reasonix`, and `tmux`. Detected OpenClaw and Hermes runtimes map to `cc_connect_agent=acp`; they are not native connect agent types. OpenClaw uses `cmd = "openclaw"` but S6 requires the current agent/operator to supply the real `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION`; do not guess these values or reuse old chat output. Hermes uses `cmd = "direxio-connect"` with `args = ["hermes-acp-adapter", "--", "hermes", "acp"]` so the Direxio compatibility layer can suppress Hermes reasoning text before it reaches the Matrix room. Use `DIREXIO_CC_CONNECT_AGENT_CMD`, `DIREXIO_<AGENT>_COMMAND`, and when needed `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` for agent-specific launch details. OpenClaw and Hermes also accept `DIREXIO_OPENCLAW_COMMAND`, `DIREXIO_HERMES_COMMAND`, `DIREXIO_HERMES_ACP_ADAPTER_COMMAND`, `DIREXIO_OPENCLAW_ACP_ARGS_TOML`, and `DIREXIO_HERMES_ACP_ARGS_TOML`; Hermes custom args are child Hermes args and S6 prefixes the adapter wrapper automatically.
+`DIREXIO_CC_CONNECT_AGENT` is the preferred explicit selector. Supported values match connent/connect: `acp`, `antigravity`, `claudecode`, `codex`, `copilot`, `cursor`, `devin`, `gemini`, `iflow`, `kimi`, `opencode`, `pi`, `qoder`, `reasonix`, and `tmux`. Detected OpenClaw and Hermes runtimes map to `cc_connect_agent=acp`; they are not native connect agent types. OpenClaw uses `cmd = "openclaw"` with args `["acp", "--session", "agent:main:main"]` by default, letting `openclaw acp` auto-discover the Gateway from `~/.openclaw/openclaw.json`. If the operator needs to force explicit Gateway settings, S6 requires all three real values from the current OpenClaw runtime after pairing: `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION`; do not guess these values or reuse old chat output. Hermes uses `cmd = "direxio-connect"` with `args = ["hermes-acp-adapter", "--", "hermes", "acp"]` so the Direxio compatibility layer can suppress Hermes reasoning text before it reaches the Matrix room. Use `DIREXIO_CC_CONNECT_AGENT_CMD`, `DIREXIO_<AGENT>_COMMAND`, and when needed `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` for agent-specific launch details. OpenClaw and Hermes also accept `DIREXIO_OPENCLAW_COMMAND`, `DIREXIO_HERMES_COMMAND`, `DIREXIO_HERMES_ACP_ADAPTER_COMMAND`, `DIREXIO_OPENCLAW_ACP_ARGS_TOML`, and `DIREXIO_HERMES_ACP_ARGS_TOML`; Hermes custom args are child Hermes args and S6 prefixes the adapter wrapper automatically.
 
 `DIREXIO_AGENT_PLATFORM` describes the host runtime following the skill, while `DIREXIO_CC_CONNECT_AGENT` describes the local agent backend that `direxio-connect` should launch. Host runtimes such as Hermes or OpenClaw are not native cc-connect backend types; S6 maps them to the generic ACP backend by default and records `cc_connect_agent=acp`. Override `DIREXIO_CC_CONNECT_AGENT` only when the operator intentionally wants a different local backend.
 
-`DIREXIO_AGENT_INSTALL` may be `skip`, `recommend`, or `auto`. Only `auto` attempts to run `npm install -g direxio-connent@latest` and `direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force`; the default `recommend` records and prints the command without mutating local daemon state. An automatic install is reported as installed only when `direxio-connect daemon status --service-name <service_id>` returns `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`.
+`DIREXIO_AGENT_INSTALL` may be `skip`, `recommend`, or `auto`. Only `auto` attempts to run `npm install -g direxio-connent@latest` and `direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force`; the default `recommend` records and prints the command without mutating local daemon state. An automatic install is reported as installed only when `direxio-connect daemon status --service-name <service_id>` returns `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`. S6 calls `agent.matrix_session.create` with `agent_token` and retries transient HTTP 000/5xx responses before failing, because the Matrix action can become reachable a few seconds after `/healthz`.
 
 Voice input is supported through `direxio-connect` speech-to-text. When `DIREXIO_SPEECH_API_KEY` or a provider-specific key such as `DIREXIO_SPEECH_QWEN_API_KEY`, `OPENAI_API_KEY`, `GROQ_API_KEY`, `DASHSCOPE_API_KEY`, `GEMINI_API_KEY`, or `GOOGLE_API_KEY` is present, S6 writes `[speech] enabled = true` into the generated config. Without an STT key, do not claim voice input is enabled.
 
@@ -374,9 +398,12 @@ DOMAIN=<DOMAIN> bash scripts/orchestrate.sh verify mcp_tools
 DOMAIN=<DOMAIN> bash scripts/orchestrate.sh verify mcp_smoke
 ```
 
-Use `verify runtime` as the normal aggregate check. It runs the service-scoped
-connect daemon check plus MCP doctor, MCP `tools/list`, and read-only backend
-smoke, then writes `runtime_checks.summary`. The individual commands are useful
+Use `verify runtime` as the normal aggregate check. It runs MCP doctor, MCP
+`tools/list`, and read-only backend smoke. It also runs the service-scoped
+connect daemon check when the daemon was expected to be installed; when S6
+recorded `agent_install_status=recommend` or `skip`, the aggregate marks
+`runtime_checks.connect_daemon.status=manual_pending` and does not fail the
+summary for that explicit operator action. The individual commands are useful
 when diagnosing one layer. These commands write `runtime_checks.connect_daemon`,
 `runtime_checks.mcp_doctor`, `runtime_checks.mcp_tools`, and
 `runtime_checks.mcp_smoke` into `state.json` and the operation report.
@@ -479,7 +506,8 @@ NS nameservers before authoritative DNS can resolve. Never use temporary
    **Credential freshness:** The synced `password` and owner `access_token`
    are one-time/volatile values. User login or token exchange can reset them
    on the server. Before reporting the eight-digit app initialization code or using an owner
-   `access_token` for API calls, rerun the credential sync path or pull the
+   `access_token` for owner API calls, or using `agent_token` for
+   `agent.matrix_session.create`, rerun the credential sync path or pull the
    latest `/opt/p2p/bootstrap.json` from the server; do not reuse values from
    old chat output, old `state.json`, or stale local `credentials.json`.
    **Runtime detection note:** S6 checks active-process signals before stale

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "direxio-deployer",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Versioned Direxio deployer agent skill and portable deployment orchestration tools.",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
     "scripts/"
   ],
   "scripts": {
-    "test": "bash tests/npm_skill_distribution_test.sh && bash tests/skill_structure_test.sh && bash tests/s6_wire_local_test.sh && bash tests/render_userdata_remote_nodes_test.sh"
+    "test": "bash tests/npm_skill_distribution_test.sh && bash tests/skill_structure_test.sh && bash tests/private_file_permissions_test.sh && bash tests/s6_wire_local_test.sh && bash tests/render_userdata_remote_nodes_test.sh"
   },
   "engines": {
     "node": ">=18"

package/references/agent-targets.md

@@ -6,6 +6,12 @@ Use this file when installing or updating this skill and when reviewing S6 local
 
 Prefer a project-local npm-managed install when a project or workspace exists. Install the versioned package, then let the CLI copy the skill bundle into the runtime-specific target:
 
+Do not use a generic "install skills <GitHub URL>" instruction for normal users. That can invoke a host's GitHub skill installer and place this repository under the global runtime directory before the npm-managed installer runs. A short user prompt should point the agent back to this npm/project-local rule:
+
+```text
+Follow the direxio-deployer README npm/project-local install rule, then deploy Direxio with domain __DOMAIN__.
+```
+
 POSIX shells:
 
 ```bash
@@ -125,4 +131,4 @@ Use `mcp/codex.toml` for Codex and `mcp/hermes.mcp.json` for Hermes. For OpenCla
 
 Prefer `DIREXIO_CC_CONNECT_AGENT=<agent>` to choose the local agent that `direxio-connect` should run. Keep `DIREXIO_AGENT_PLATFORM=<runtime>` for auto-detection overrides and legacy host-runtime naming. Use `DIREXIO_AGENT_INSTALL_MODE=cc-connect` only when overriding the default `recommended` mapping explicitly.
 Use `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` for agent-specific options that cannot be represented by `work_dir` or `cmd`; for example `reasonix` requires `serve_url`, `tmux` requires `session`, and generic `acp` requires a command when `DIREXIO_CC_CONNECT_AGENT_CMD` is not enough.
-For OpenClaw Gateway ACP, complete OpenClaw pairing first, then set `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION` from the current OpenClaw runtime. S6 writes `["acp", "--url", <url>, "--token-file", <local path>, "--session", <session>]` and converts the token-file with `DIREXIO_LOCAL_PATH_STYLE`. `DIREXIO_OPENCLAW_ACP_ARGS_TOML` replaces the OpenClaw ACP args array only when the runtime needs a fully custom argument list. `DIREXIO_HERMES_ACP_ARGS_TOML` supplies the child Hermes args and keeps the Direxio adapter prefix.
+For OpenClaw Gateway ACP, S6 defaults to `["acp", "--session", "agent:main:main"]` and lets `openclaw acp` auto-discover the Gateway from `~/.openclaw/openclaw.json`. To force an explicit Gateway, complete OpenClaw pairing first, then set all of `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION` from the current OpenClaw runtime. S6 writes `["acp", "--url", <url>, "--token-file", <local path>, "--session", <session>]` and converts the token-file with `DIREXIO_LOCAL_PATH_STYLE`. `DIREXIO_OPENCLAW_ACP_ARGS_TOML` replaces the OpenClaw ACP args array only when the runtime needs a fully custom argument list. `DIREXIO_HERMES_ACP_ARGS_TOML` supplies the child Hermes args and keeps the Direxio adapter prefix.

package/references/deployment-workflow.md

@@ -55,9 +55,13 @@ bash scripts/pricing-estimate.sh --state ~/.direxio/nodes/<service_id>/state.jso
 selection and refreshes it in S3 after the final EC2 instance type is known.
 The estimate includes EC2, gp3 storage, public IPv4, and Route53 hosted-zone
 cost when applicable. It excludes data transfer, TURN relay traffic, domain
-registration, taxes, and AWS credits. Credit coverage is not guaranteed; verify
-credits and actual charges in AWS Billing Console, and set an AWS Budget or
-billing alert before leaving the node running.
+registration, taxes, and AWS credits. When available, check the Free Tier
+account plan with `aws freetier get-account-plan-state --output json`;
+otherwise tell the user that AWS currently advertises 100 USD initial credits
+for new customer accounts plus possible additional credits after Free Tier
+activities. Credit coverage is not guaranteed; verify credits and actual
+charges in AWS Billing Console, and set an AWS Budget or billing alert before
+leaving the node running.
 
 ## Destroy
 
@@ -141,7 +145,10 @@ When the user or runtime evidence confirms a manual product gate, write it back
 to state before regenerating the report. Connect daemon status is a
 service-scoped local bridge check, MCP doctor is a non-polluting runtime check,
 MCP tools is stdio `tools/list` discovery, and MCP smoke is a read-only backend
-call. They are not the full runtime product gate:
+call. In the default `DIREXIO_AGENT_INSTALL=recommend` path, `verify runtime`
+records `connect_daemon=manual_pending` instead of failing the aggregate,
+because daemon installation is an explicit operator action. These checks are
+not the full runtime product gate:
 
 ```bash
 DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh verify runtime

package/references/runtime-wiring.md

@@ -74,7 +74,7 @@ DIREXIO_CREDENTIALS_FILE=~/.direxio/nodes/<service_id>/credentials.json direxio-
 
 ## cc-connect Matrix Bridge
 
-S6 calls `agent.matrix_session.create` with the owner token. Current message-server builds must return a Matrix session for `@agent:<server>`, not for `@owner:<server>`. The resulting session is stored at:
+S6 calls `agent.matrix_session.create` with the backend `agent_token`, not the owner `access_token`. Current message-server builds must return a Matrix session for `@agent:<server>`, not for `@owner:<server>`. S6 retries transient HTTP 000/5xx responses before failing, because the Matrix action can become reachable shortly after `/healthz`. The resulting session is stored at:
 
 ```text
 ~/.direxio/nodes/<service_id>/cc-connect/matrix-session.json
@@ -112,9 +112,9 @@ DIREXIO_<AGENT>_COMMAND=<optional agent-specific executable path>
 DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML=<optional extra TOML under projects.agent.options>
 DIREXIO_OPENCLAW_COMMAND=<optional OpenClaw executable path>
 DIREXIO_HERMES_COMMAND=<optional Hermes executable path>
-DIREXIO_OPENCLAW_ACP_URL=<required OpenClaw gateway URL>
-DIREXIO_OPENCLAW_ACP_TOKEN_FILE=<required OpenClaw ACP token file>
-DIREXIO_OPENCLAW_ACP_SESSION=<required OpenClaw ACP session>
+DIREXIO_OPENCLAW_ACP_URL=<optional explicit OpenClaw gateway URL>
+DIREXIO_OPENCLAW_ACP_TOKEN_FILE=<optional explicit OpenClaw ACP token file>
+DIREXIO_OPENCLAW_ACP_SESSION=<optional OpenClaw ACP session; defaults to agent:main:main>
 DIREXIO_OPENCLAW_ACP_ARGS_TOML=<optional OpenClaw ACP TOML array>
 DIREXIO_HERMES_ACP_ARGS_TOML=<optional Hermes ACP TOML array>
 DIREXIO_CC_CONNECT_NPM_PACKAGE=direxio-connent@latest
@@ -131,13 +131,13 @@ DIREXIO_SPEECH_LANGUAGE=zh
 Defaults:
 
 - `DIREXIO_CC_CONNECT_AGENT` is the preferred explicit selector. It accepts every connent/connect agent: `acp`, `antigravity`, `claudecode`, `codex`, `copilot`, `cursor`, `devin`, `gemini`, `iflow`, `kimi`, `opencode`, `pi`, `qoder`, `reasonix`, and `tmux`.
-- `DIREXIO_AGENT_PLATFORM=auto` detects the local agent runtime and maps it to a `direxio-connect` agent type only when it can identify one unambiguously. OpenClaw and Hermes map to the generic `acp` connect agent. OpenClaw requires explicit real ACP Gateway settings from the current runtime; Hermes uses the `direxio-connect hermes-acp-adapter -- hermes acp` compatibility wrapper by default.
+- `DIREXIO_AGENT_PLATFORM=auto` detects the local agent runtime and maps it to a `direxio-connect` agent type only when it can identify one unambiguously. OpenClaw and Hermes map to the generic `acp` connect agent. OpenClaw uses `openclaw acp --session agent:main:main` by default and lets OpenClaw discover its Gateway config; Hermes uses the `direxio-connect hermes-acp-adapter -- hermes acp` compatibility wrapper by default.
 - `DIREXIO_LOCAL_PATH_STYLE=windows` writes Windows-compatible `data_dir`, `work_dir`, config paths, and install commands. `scripts/orchestrate.ps1` sets this automatically. Linux, macOS, and WSL Bash runs should leave the default `posix` style. Windows Git Bash/MSYS2 users who run `scripts/orchestrate.sh` directly must set `DIREXIO_LOCAL_PATH_STYLE=windows` when the local bridge is a Windows process.
 - `DIREXIO_CC_CONNECT_AGENT_CMD` writes `cmd = "<path>"` into `[projects.agent.options]`. Agent-specific forms such as `DIREXIO_CODEX_COMMAND`, `DIREXIO_CLAUDE_CODE_COMMAND`, `DIREXIO_GEMINI_COMMAND`, `DIREXIO_OPENCODE_COMMAND`, `DIREXIO_QODERCLI_COMMAND`, and `DIREXIO_OPENCLAW_COMMAND` are also accepted. For Hermes, `DIREXIO_HERMES_COMMAND` selects the child Hermes executable behind the adapter, while `DIREXIO_HERMES_ACP_ADAPTER_COMMAND` overrides the adapter command itself.
 - `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` appends agent-specific options under `[projects.agent.options]`; use it for agents with required non-command options such as `reasonix` (`serve_url`) or `tmux` (`session`).
-- OpenClaw Gateway ACP uses `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION` to write `--url`, `--token-file`, and `--session`. Complete OpenClaw pairing first and use the real session that should receive Direxio messages; do not guess a default session or reuse old chat output.
+- OpenClaw Gateway ACP auto-detects the Gateway from `~/.openclaw/openclaw.json` when `DIREXIO_OPENCLAW_ACP_URL` and `DIREXIO_OPENCLAW_ACP_TOKEN_FILE` are unset. It uses `DIREXIO_OPENCLAW_ACP_SESSION` when provided, otherwise `agent:main:main`. To force explicit Gateway settings, complete OpenClaw pairing first and set all three real values: `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION`.
 - `DIREXIO_OPENCLAW_ACP_ARGS_TOML` replaces the generated OpenClaw ACP args array, for example `["acp", "--url", "wss://gateway.example.test:18789", "--token-file", "$HOME/.openclaw/gateway.token", "--session", "agent:main:main"]`. `DIREXIO_HERMES_ACP_ARGS_TOML` supplies the child Hermes args; S6 prefixes `["hermes-acp-adapter", "--", "<hermes-command>"]` automatically.
-- `DIREXIO_AGENT_INSTALL=recommend` prints and records the command only.
+- `DIREXIO_AGENT_INSTALL=recommend` prints and records the command only. `verify runtime` records the daemon check as `manual_pending` in this mode and still verifies MCP doctor/tools/smoke.
 - `DIREXIO_AGENT_INSTALL=auto` runs `npm install -g direxio-connent@latest` and then installs the `direxio-connect` daemon with the generated config and `--service-name <service_id>`. It is recorded as installed only when `direxio-connect daemon status --service-name <service_id>` reports `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`.
 - `DIREXIO_AGENT_INSTALL_MODE=recommended` maps every supported local runtime to `cc-connect`.
 - Speech defaults to `DIREXIO_SPEECH_PROVIDER=openai` and `DIREXIO_SPEECH_LANGUAGE=zh`. Provider-specific keys are also accepted: `DIREXIO_SPEECH_OPENAI_API_KEY` or `OPENAI_API_KEY`, `DIREXIO_SPEECH_GROQ_API_KEY` or `GROQ_API_KEY`, `DIREXIO_SPEECH_QWEN_API_KEY` or `DASHSCOPE_API_KEY`, and `DIREXIO_SPEECH_GEMINI_API_KEY`, `GEMINI_API_KEY`, or `GOOGLE_API_KEY`. Set `DIREXIO_SPEECH_ENABLED=false` to suppress speech config generation even when a key exists.

package/references/state-machine.md

@@ -9,8 +9,8 @@
 - **S2_DOMAIN**: 确认正式长期域名和 Matrix `server_name` 不可逆绑定。
 - **S3_PROVISION**: 创建 EC2、密钥对、安全组、Elastic IP，按 DNS 模式处理 Route53 hosted zone/A 记录或等待外部 DNS，渲染 cloud-init。默认镜像 `MESSAGE_SERVER_IMAGE=direxio/message-server:latest`。
 - **S4_BOOTSTRAP_STACK**: 等 cloud-init 安装 Docker 并启动 `postgres:18 + message-server + caddy + coturn`，轮询 `https://<domain>/healthz`。
-- **S5_INIT_TOKENS**: SSH 读取云端 `init-tokens.sh` 生成的 `/opt/p2p/bootstrap.json`，归一化 `password`、`access_token`、`agent_token`、真实 `agent_room_id`。云端脚本会先调用 `portal.bootstrap`，并在服务端未返回房间时用 Matrix Client API 创建和回写真实 agent room。`password` 和 owner `access_token` 按一次性/易失凭据处理；需要登录或用 token 调接口前，必须重新从服务器拉取最新 `/opt/p2p/bootstrap.json`，不要复用旧输出。
-- **S6_WIRE_LOCAL**: 写本地凭据、创建 `@agent:<server>` Matrix session、写 `cc-connect/config.toml`，写 MCP 配置片段，并按策略安装或推荐 `direxio-connect`。
+- **S5_INIT_TOKENS**: SSH 读取云端 `init-tokens.sh` 生成的 `/opt/p2p/bootstrap.json`，归一化 `password`、`access_token`、`agent_token`、真实 `agent_room_id`。云端脚本会先调用 `portal.bootstrap`，用 `agent_token` 创建 `@agent:<server>` Matrix session，再用 owner Matrix token 创建房间并邀请/加入 agent，最后回写真正的 agent room。`password`、owner `access_token` 和 `agent_token` 按一次性/易失凭据处理；需要登录或用 token 调接口前，必须重新从服务器拉取最新 `/opt/p2p/bootstrap.json`，不要复用旧输出。
+- **S6_WIRE_LOCAL**: 写本地凭据、用 `agent_token` 创建 `@agent:<server>` Matrix session、写 `cc-connect/config.toml`，写 MCP 配置片段，并按策略安装或推荐 `direxio-connect`。
 - **S7_VERIFY_E2E**: 验证 `/_p2p`、Matrix versions、well-known、owner.json+CORS、TURN。
 
 ## 云端 compose

package/references/token-refresh.md

@@ -2,7 +2,7 @@
 
 每次重部署或清空数据卷后，`password`、owner `access_token`、`agent_token` 和 cc-connect Matrix session 都会变化。状态机 S6 会自动回填；手动恢复时按这里检查。
 
-从服务端同步过来的 `password` 和 owner `access_token` 必须按一次性/易失凭据处理。`password` 是后端字段名，对用户展示时必须叫八位 App 初始化码。用户完成初始化或 token exchange 后，服务端可能立刻重置这些值；任何需要再次获取初始化码，或需要用 `access_token` 调 `/_p2p/command`、Matrix Client API 等接口的操作，都必须先重新从服务器拉取最新 `/opt/p2p/bootstrap.json`，再更新本地 `credentials.json`。不要复用聊天记录、旧 `state.json`、旧 `credentials.json` 或历史部署输出里的 password/access token。
+从服务端同步过来的 `password` 和 owner `access_token` 必须按一次性/易失凭据处理。`password` 是后端字段名，对用户展示时必须叫八位 App 初始化码。用户完成初始化或 token exchange 后，服务端可能立刻重置这些值；任何需要再次获取初始化码，或需要用 `access_token` 调 owner 身份 API/Matrix Client API，或需要用 `agent_token` 调 `agent.matrix_session.create` 的操作，都必须先重新从服务器拉取最新 `/opt/p2p/bootstrap.json`，再更新本地 `credentials.json`。不要复用聊天记录、旧 `state.json`、旧 `credentials.json` 或历史部署输出里的 password/access token。
 
 现有节点执行 `scripts/update.sh` 或 `scripts/reset-app-data.sh` 后，本地旧证据也必须作废。脚本会清掉旧 `password`、`access_token`、`agent_token`、`agent_room_id`、`user_confirmations` 和 `runtime_checks`，把 `agent_install_status` 标成 `refresh_pending`，并只在 `WorkDir` 匹配当前 service 时停止对应的本地 bridge（stops only the matching service-scoped direxio-connect daemon），再把 S4-S7 标回 pending。这样旧的用户确认、MCP discovery、Agent runtime probe 或旧 bridge 安装状态不会被误用到更新/重置后的节点。`status` 会显示 `Local refresh:`，提醒 update/reset 已经清掉旧 credentials、user confirmations、runtime checks 和 bridge install proof；下一步必须 rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, and runtime checks。后续必须续跑 `scripts/orchestrate.sh`，让 S5/S6/S7 和 `verify runtime` 重新写入当前证据。
 

package/references/windows-deployment-notes.md

@@ -109,7 +109,7 @@ Use the Git Bash `$HOME` path for files generated by the deployer. If running `d
 
 ## EC2 SSH Key Paths
 
-SSH key files are written with Windows-compatible paths such as `C:/Users/.../.direxio/deploy/p2p-*.pem`. The SSH command printed in the delivery summary works in Git Bash. If using PowerShell or cmd, convert forward slashes to backslashes.
+SSH key files are written with Windows-compatible paths such as `C:/Users/.../.direxio/deploy/p2p-*.pem`. The deployer removes inherited Windows ACLs where possible so OpenSSH does not reject the private key as too open. The SSH command printed in the delivery summary works in Git Bash. If using PowerShell or cmd, convert forward slashes to backslashes.
 
 ## Verifying Deployment
 

package/scripts/cloud-init/init-tokens.sh

@@ -149,7 +149,7 @@ PY
 }
 
 ensure_agent_room() {
-  local owner_token agent_user session room_resp join_resp agent_token room_id room_path
+  local owner_token agent_auth_token agent_user session room_resp join_resp matrix_agent_token room_id room_path
   if copy_bootstrap_file && bootstrap_has_real_agent_room "$BOOTSTRAP_FILE"; then
     log "agent_room_id is already present."
     return 0
@@ -160,15 +160,20 @@ ensure_agent_room() {
     log "FATAL: access_token is missing; cannot create agent room"
     return 1
   fi
+  agent_auth_token=$(json_string agent_token "$BOOTSTRAP_FILE")
+  if [ -z "$agent_auth_token" ]; then
+    log "FATAL: agent_token is missing; cannot create agent Matrix session"
+    return 1
+  fi
   agent_user="@agent:${DOMAIN}"
   session=$(mktemp)
-  if ! container_post_json "/_p2p/command" '{"action":"agent.matrix_session.create","params":{"device_id":"DIREXIO_DEPLOY_BOOTSTRAP"}}' "$owner_token" > "$session" 2>/dev/null; then
+  if ! container_post_json "/_p2p/command" '{"action":"agent.matrix_session.create","params":{"device_id":"DIREXIO_DEPLOY_BOOTSTRAP"}}' "$agent_auth_token" > "$session" 2>/dev/null; then
     log "FATAL: agent.matrix_session.create failed: $(head -c 160 "$session" 2>/dev/null)"
     rm -f "$session"
     return 1
   fi
-  agent_token=$(json_string access_token "$session")
-  if [ -z "$agent_token" ]; then
+  matrix_agent_token=$(json_string access_token "$session")
+  if [ -z "$matrix_agent_token" ]; then
     log "FATAL: agent.matrix_session.create did not return access_token: $(head -c 160 "$session" 2>/dev/null)"
     rm -f "$session"
     return 1
@@ -190,7 +195,7 @@ ensure_agent_room() {
 
   room_path=$(matrix_room_path "$room_id")
   join_resp=$(mktemp)
-  if ! container_post_json "/_matrix/client/v3/rooms/${room_path}/join" '{}' "$agent_token" > "$join_resp" 2>/dev/null; then
+  if ! container_post_json "/_matrix/client/v3/rooms/${room_path}/join" '{}' "$matrix_agent_token" > "$join_resp" 2>/dev/null; then
     log "FATAL: agent join failed for ${room_id}: $(head -c 160 "$join_resp" 2>/dev/null)"
     rm -f "$join_resp"
     return 1

package/scripts/lib/state.sh

@@ -46,6 +46,28 @@ is_yes() {
   esac
 }
 
+restrict_private_file() {
+  local file=$1 uname_s win_file user user_domain
+  chmod 600 "$file" 2>/dev/null || true
+  uname_s=$(uname -s 2>/dev/null || printf unknown)
+  case "$uname_s" in
+    MINGW*|MSYS*|CYGWIN*)
+      command -v icacls >/dev/null 2>&1 || return 0
+      win_file=$file
+      if command -v cygpath >/dev/null 2>&1; then
+        win_file=$(cygpath -w "$file")
+      fi
+      user=$(cmd.exe /c whoami 2>/dev/null | tr -d '\r' | tail -n 1 || true)
+      user_domain=${USERDOMAIN:-}
+      icacls "$win_file" /inheritance:r >/dev/null 2>&1 || true
+      icacls "$win_file" /remove:g \
+        "Users" "Authenticated Users" "Everyone" "CodexSandboxUsers" \
+        "${user_domain}\\CodexSandboxUsers" >/dev/null 2>&1 || true
+      [ -n "$user" ] && icacls "$win_file" /grant:r "$user:R" >/dev/null 2>&1 || true
+      ;;
+  esac
+}
+
 # Initialize state.json for a new deployment.
 state_init() {
   mkdir -p "$P2P_WORKDIR"

package/scripts/mcp-tools-list.mjs

@@ -26,6 +26,7 @@ child.stderr.on("data", (chunk) => {
 child.stdout.on("data", (chunk) => {
   stdout = Buffer.concat([stdout, chunk]);
   readFrames();
+  if (completed) return;
   if (responses.has(2)) {
     const response = responses.get(2);
     const tools = Array.isArray(response?.result?.tools) ? response.result.tools : [];
@@ -60,35 +61,78 @@ send({ jsonrpc: "2.0", method: "notifications/initialized", params: {} });
 send({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
 
 function send(message) {
-  child.stdin.write(`${JSON.stringify(message)}\n`);
+  const body = JSON.stringify(message);
+  child.stdin.write(`Content-Length: ${Buffer.byteLength(body, "utf8")}\r\n\r\n${body}`);
 }
 
 function readFrames() {
   while (true) {
-    const headerEnd = stdout.indexOf("\r\n\r\n");
-    if (headerEnd >= 0) {
-      const header = stdout.subarray(0, headerEnd).toString("utf8");
-      const match = /^Content-Length:\s*(\d+)/im.exec(header);
-      if (match) {
-        const length = Number.parseInt(match[1], 10);
-        const bodyStart = headerEnd + 4;
-        if (stdout.length < bodyStart + length) return;
-        const body = stdout.subarray(bodyStart, bodyStart + length).toString("utf8");
-        stdout = stdout.subarray(bodyStart + length);
-        recordMessage(JSON.parse(body));
-        continue;
+    if (stdout.length === 0) return;
+    if (stdout[0] === 10 || stdout[0] === 13) {
+      stdout = stdout.subarray(1);
+      continue;
+    }
+    if (startsWithHeader(stdout, "Content-Length:")) {
+      const header = readHeader(stdout);
+      if (!header) return;
+      const contentLength = parseContentLength(header.text);
+      if (!Number.isSafeInteger(contentLength) || contentLength < 0) {
+        finishWithError("MCP response frame is missing a valid Content-Length header");
+        return;
       }
+      const messageEnd = header.bodyStart + contentLength;
+      if (stdout.length < messageEnd) return;
+      const body = stdout.subarray(header.bodyStart, messageEnd).toString("utf8");
+      stdout = stdout.subarray(messageEnd);
+      handleMessage(body);
+      if (completed) return;
+      continue;
     }
+
     const lineEnd = stdout.indexOf("\n");
     if (lineEnd < 0) return;
     const line = stdout.subarray(0, lineEnd).toString("utf8").replace(/\r$/, "");
     stdout = stdout.subarray(lineEnd + 1);
     if (line.length === 0) continue;
-    recordMessage(JSON.parse(line));
+    handleMessage(line);
+    if (completed) return;
+  }
+}
+
+function startsWithHeader(buffer, header) {
+  return buffer.subarray(0, header.length).toString("utf8").toLowerCase() === header.toLowerCase();
+}
+
+function readHeader(buffer) {
+  let marker = "\r\n\r\n";
+  let headerEnd = buffer.indexOf(marker);
+  if (headerEnd < 0) {
+    marker = "\n\n";
+    headerEnd = buffer.indexOf(marker);
+  }
+  if (headerEnd < 0) return null;
+  return {
+    text: buffer.subarray(0, headerEnd).toString("utf8"),
+    bodyStart: headerEnd + marker.length
+  };
+}
+
+function parseContentLength(headerText) {
+  for (const line of headerText.split(/\r?\n/)) {
+    const match = /^content-length:\s*(\d+)\s*$/i.exec(line);
+    if (match) return Number.parseInt(match[1], 10);
   }
+  return NaN;
 }
 
-function recordMessage(message) {
+function handleMessage(raw) {
+  let message;
+  try {
+    message = JSON.parse(raw);
+  } catch (error) {
+    finishWithError(`invalid MCP JSON response: ${error.message}`);
+    return;
+  }
   if (typeof message.id !== "undefined") {
     responses.set(message.id, message);
   }

package/scripts/orchestrate.sh

@@ -395,6 +395,25 @@ ensure_cost_estimate() {
   else
     warn "Could not write AWS cost estimate. Continue only after giving the user a manual billing estimate."
   fi
+  ensure_free_tier_credit_notice
+}
+
+ensure_free_tier_credit_notice() {
+  local output plan_status plan_type amount unit expires
+  if output=$(aws freetier get-account-plan-state --output json 2>/dev/null); then
+    plan_type=$(printf '%s\n' "$output" | json_stdin_get accountPlanType "unknown" 2>/dev/null)
+    plan_status=$(printf '%s\n' "$output" | json_stdin_get accountPlanStatus "unknown" 2>/dev/null)
+    amount=$(printf '%s\n' "$output" | json_stdin_get accountPlanRemainingCredits.amount "" 2>/dev/null)
+    unit=$(printf '%s\n' "$output" | json_stdin_get accountPlanRemainingCredits.unit "USD" 2>/dev/null)
+    expires=$(printf '%s\n' "$output" | json_stdin_get accountPlanExpirationDate "" 2>/dev/null)
+    if [ -n "$amount" ]; then
+      log "AWS Free Tier plan: type=${plan_type:-unknown}, status=${plan_status:-unknown}, remaining_credits=${amount} ${unit:-USD}${expires:+, expires=$expires}."
+      warn "Credits can reduce actual charges, but AWS resources still accrue charges until destroyed; verify credit coverage in AWS Billing Console."
+      return 0
+    fi
+  fi
+  warn "AWS new customer accounts may include Free Tier credits, currently advertised as 100 USD initial credits plus possible additional credits."
+  warn "Credits may cover a small trial deployment, but coverage is account-specific; verify credits in AWS Billing Console and destroy the node when finished."
 }
 
 precheck_new_deploy_domain_env() {
@@ -947,15 +966,35 @@ runtime_check_status() {
   json_get "$STATE_JSON" "runtime_checks.$check.status" "not_run"
 }
 
+runtime_status_counts_as_failure() {
+  local status=$1
+  case "$status" in
+    passed|manual_pending|skipped) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
 cmd_verify_runtime() {
   [ -f "$STATE_JSON" ] || {
     warn "state.json not found: $STATE_JSON"
     return 1
   }
 
-  local rc=0 failed_count=0 connect_status doctor_status tools_status smoke_status status
+  local rc=0 failed_count=0 connect_status doctor_status tools_status smoke_status status install_status install_policy service_name
 
-  cmd_verify_connect_daemon >/dev/null || rc=1
+  install_status=$(json_get "$STATE_JSON" agent_install_status)
+  install_policy=$(json_get "$STATE_JSON" agent_install_policy)
+  service_name=$(json_get "$STATE_JSON" agent_service_id)
+  [ -n "$service_name" ] || service_name=$(json_get "$STATE_JSON" domain)
+  if [ "$install_status" = "recommend" ] || { [ "$install_status" = "skip" ] && [ "${install_policy:-skip}" = "skip" ]; }; then
+    state_set_object runtime_checks.connect_daemon \
+      status=manual_pending \
+      "ts=$(_now)" \
+      "evidence=direxio-connect daemon install is an explicit operator action for policy=$install_status" \
+      "service_name=${service_name:-cc-connect}"
+  else
+    cmd_verify_connect_daemon >/dev/null || rc=1
+  fi
   cmd_verify_mcp_doctor >/dev/null || rc=1
   cmd_verify_mcp_tools >/dev/null || rc=1
   cmd_verify_mcp_smoke >/dev/null || rc=1
@@ -966,7 +1005,7 @@ cmd_verify_runtime() {
   smoke_status=$(runtime_check_status mcp_smoke)
 
   for status in "$connect_status" "$doctor_status" "$tools_status" "$smoke_status"; do
-    [ "$status" = "passed" ] || failed_count=$((failed_count + 1))
+    runtime_status_counts_as_failure "$status" && failed_count=$((failed_count + 1))
   done
 
   if [ "$failed_count" -eq 0 ]; then

package/scripts/phases/s3_provision.sh

@@ -57,7 +57,7 @@ run_phase() {
   if [ -z "$(res_get key_name)" ]; then
     log "Creating key pair $name ..."
     aws ec2 create-key-pair --key-name "$name" --query KeyMaterial --output text > "$keyfile"
-    chmod 600 "$keyfile"
+    restrict_private_file "$keyfile"
     res_set key_name "$name"; res_set key_file "$keyfile"
   else
     log "Key pair already exists; skipping."; keyfile=$(res_get key_file)

package/scripts/phases/s6_wire_local.sh

@@ -572,15 +572,21 @@ _openclaw_acp_args_toml() {
   url=${DIREXIO_OPENCLAW_ACP_URL:-}
   token_file=${DIREXIO_OPENCLAW_ACP_TOKEN_FILE:-}
   session=${DIREXIO_OPENCLAW_ACP_SESSION:-}
-  [ -n "$url" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_URL"
-  [ -n "$token_file" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_TOKEN_FILE"
-  [ -n "$session" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_SESSION"
-  if [ -n "$missing" ]; then
-    fail "OpenClaw ACP requires real Gateway settings:${missing}. Set them from the current OpenClaw runtime, or provide DIREXIO_OPENCLAW_ACP_ARGS_TOML with the complete args array."
+  if [ -n "$url" ] && [ -n "$token_file" ] && [ -n "$session" ]; then
+    token_file=$(_local_connect_path "$token_file")
+    _toml_array acp --url "$url" --token-file "$token_file" --session "$session"
+    return 0
+  fi
+  if [ -n "$url" ] || [ -n "$token_file" ]; then
+    [ -n "$url" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_URL"
+    [ -n "$token_file" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_TOKEN_FILE"
+    [ -n "$session" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_SESSION"
+    fail "OpenClaw ACP explicit Gateway settings are incomplete:${missing}. Set all of DIREXIO_OPENCLAW_ACP_URL, DIREXIO_OPENCLAW_ACP_TOKEN_FILE, and DIREXIO_OPENCLAW_ACP_SESSION; otherwise leave URL/token-file unset so openclaw acp can auto-detect from its config."
     return 1
   fi
-  token_file=$(_local_connect_path "$token_file")
-  _toml_array acp --url "$url" --token-file "$token_file" --session "$session"
+  # Fallback: OpenClaw acp auto-discovers gateway from ~/.openclaw/openclaw.json.
+  warn "OpenClaw ACP: Gateway URL/token-file not set; using session '${session:-agent:main:main}' and letting openclaw acp auto-detect the Gateway from its config."
+  _toml_array acp --session "${session:-agent:main:main}"
 }
 
 _hermes_acp_args_toml() {
@@ -879,25 +885,51 @@ EOF
 }
 
 _create_cc_connect_matrix_session() {
-  local asurl=$1 access_token=$2 device_id=$3 out=$4 body code http_body
+  local asurl=$1 agent_auth_token=$2 device_id=$3 out=$4 body code http_body
+  local max_attempts interval attempt preview
   body=$(json_build matrix-session-create "$device_id")
-  http_body=$(mktemp)
-  code=$(curl -sk -o "$http_body" -w '%{http_code}' -X POST "$asurl/_p2p/command" \
-    -H 'Content-Type: application/json' \
-    -H "Authorization: Bearer $access_token" \
-    -d "$body" 2>/dev/null || true)
-  if [ "$code" != "200" ]; then
-    warn "agent.matrix_session.create returned HTTP ${code:-000}: $(head -c 200 "$http_body" 2>/dev/null)"
-    rm -f "$http_body"
-    return 1
-  fi
-  if ! json_assert "$http_body" matrix-session >/dev/null; then
-    warn "agent.matrix_session.create response is missing Matrix session fields: $(head -c 200 "$http_body" 2>/dev/null)"
+  max_attempts=${DIREXIO_MATRIX_SESSION_CREATE_MAX:-4}
+  interval=${DIREXIO_MATRIX_SESSION_RETRY_INTERVAL:-2}
+  attempt=1
+  while [ "$attempt" -le "$max_attempts" ]; do
+    http_body=$(mktemp)
+    code=$(curl -sk \
+      --connect-timeout "${DIREXIO_MATRIX_SESSION_CURL_CONNECT_TIMEOUT:-10}" \
+      --max-time "${DIREXIO_MATRIX_SESSION_CURL_MAX_TIME:-20}" \
+      -o "$http_body" -w '%{http_code}' -X POST "$asurl/_p2p/command" \
+      -H 'Content-Type: application/json' \
+      -H "Authorization: Bearer $agent_auth_token" \
+      -d "$body" 2>/dev/null || true)
+    if [ "$code" = "200" ]; then
+      if ! json_assert "$http_body" matrix-session >/dev/null; then
+        warn "agent.matrix_session.create response is missing Matrix session fields: $(head -c 200 "$http_body" 2>/dev/null)"
+        rm -f "$http_body"
+        return 1
+      fi
+      mv "$http_body" "$out"
+      chmod 600 "$out" 2>/dev/null || true
+      return 0
+    fi
+    preview=$(head -c 200 "$http_body" 2>/dev/null || true)
     rm -f "$http_body"
+    case "${code:-000}" in
+      000|5*)
+        if [ "$attempt" -lt "$max_attempts" ]; then
+          warn "agent.matrix_session.create returned HTTP ${code:-000} on attempt $attempt/$max_attempts; retrying."
+          sleep "$interval"
+          attempt=$((attempt + 1))
+          continue
+        fi
+        ;;
+      401)
+        warn "agent.matrix_session.create rejected agent_token. Refresh bootstrap credentials or deploy a message-server build that allows agent_token for this action."
+        ;;
+      *) ;;
+    esac
+    warn "agent.matrix_session.create returned HTTP ${code:-000}: $preview"
     return 1
-  fi
-  mv "$http_body" "$out"
-  chmod 600 "$out" 2>/dev/null || true
+  done
+  return 1
 }
 
 _write_cc_connect_config() {
@@ -1328,7 +1360,7 @@ run_phase() {
 
   mkdir -p "$workspace"
   mkdir -p "$cc_runtime_dir"
-  if ! _create_cc_connect_matrix_session "$asurl" "$access_token" "DIREXIO_CC_CONNECT_${node_id}" "$cc_session"; then
+  if ! _create_cc_connect_matrix_session "$asurl" "$token" "DIREXIO_CC_CONNECT_${node_id}" "$cc_session"; then
     phase_set S6_WIRE_LOCAL failed "agent Matrix session creation failed"
     fail "failed to create cc-connect Matrix session via agent.matrix_session.create."
   fi